Function at 0x410d30
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4138e3
push eax
mov dword fs:[0], esp
sub esp, 0x5b0
xor eax, eax
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x5d0]
cmp eax, 1
jne 0x410db7
mov edi, str.WINWORD.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.WINWORD
jmp 0x411075
cmp eax, 2
jne 0x410df0
mov edi, str.EXCEL.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.EXCEL
jmp 0x411075
cmp eax, 3
jne 0x410e29
mov edi, str.POWERPNT.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.POWERPOINT
jmp 0x411075
cmp eax, 4
jne 0x410e8b
mov edi, str.HWPW.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x84]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HWP.EXE
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41a334
jmp 0x411075
cmp eax, 5
jne 0x410ec4
mov edi, str.HUN2K.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HUN2K
jmp 0x411075
cmp eax, 6
jne 0x410f26
mov edi, str.ACROBAT.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x84]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ACRORD32.EXE
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ACROBAT
jmp 0x411075
cmp eax, 7
jne 0x410f5f
mov edi, str.NOTEPAD.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.NOTEPAD
jmp 0x411075
cmp eax, 8
jne 0x410f98
mov edi, str.TARO13.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TARO13
jmp 0x411075
cmp eax, 9
jne 0x410fd1
mov edi, str.MSPAINT.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.MSPAINT
jmp 0x411075
cmp eax, 0xa
jne 0x411007
mov edi, str.WINPROJ.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.WINPROJ
jmp 0x411075
cmp eax, 0xb
jne 0x41103d
mov edi, str.HH.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41a24c
jmp 0x411075
cmp eax, 0xc
jne 0x4111cd
mov edi, str.WMPLAYER.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Window_MediaPlayer
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
call fcn.004085b0
push ecx
xor esi, esi
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41f244
mov dword [esp + 0x5d0], esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xa8]
call fcn.00405db0
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c8], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x64]
mov byte [esp + 0x5c8], 2
call fcn.00408750
lea ecx, [esp + 0x64]
call fcn.00408900
mov ebp, eax
cmp ebp, esi
jle 0x411194
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x3b0]
push ecx
push esi
lea ecx, [esp + 0x6c]
call fcn.00408910
push ecx
lea edx, [esp + 0x3bc]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xa8]
call fcn.00405e50
lea eax, [esp + 0x18]
lea ecx, [esp + 0xa4]
push eax
call fcn.00405ea0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5cc], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c8], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call edi
add esp, 8
test eax, eax
je 0x4111ed
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x84]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x4111ed
inc esi
cmp esi, ebp
jl 0x4110fc
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c8], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xa4]
mov byte [esp + 0x5c8], 0
call fcn.00405e40
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c8], 0xffffffff
call fcn.00408600
mov eax, 1
mov ecx, dword [esp + 0x5c0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5bc
ret 4
mov esi, dword [esp + 0x3b0]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5c8], 4
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x5c8], 5
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x14]
push str.SOMER029
push edx
mov ecx, 0x41f248
mov byte [esp + 0x5d0], 6
call fcn.00402910
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x5cc], 7
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x5c8], 6
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
push str.SOMER030
push eax
mov ecx, 0x41f248
call fcn.00402910
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x5cc], 8
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x5c8], 6
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
lea ecx, [esp + 0x24]
push str._s__s_n_n_s
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea edx, [esp + 0x14]
mov ecx, 0x41f248
push str.SOMWT001
push edx
call fcn.00402910
mov eax, dword [eax]
test ebx, ebx
jne 0x4112d4
xor ecx, ecx
jmp 0x4112d7
mov ecx, dword [ebx + 0x20]
push 0x31
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
lea ecx, [esp + 0x14]
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x411355
push esi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x411355
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov byte [esp + 0x5c8], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5c8], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c8], 2
call sub.MFC42.DLL_CString::CString
jmp 0x411194
lea ecx, [esp + 0x20]
mov byte [esp + 0x5c8], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5c8], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c8], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c8], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xa4]
mov byte [esp + 0x5c8], 0
call fcn.00405e40
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c8], 0xffffffff
call fcn.00408600
xor eax, eax
jmp 0x4111d2