Function at 0x437965
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Manipulate boot configuration
Reference google public dns server
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14a8
call fcn.004ee940
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 2
call esi
or eax, 2
push eax
call esi
push 0x43792d
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x437940
call fcn.004edb6c
pop ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
xor ebx, ebx
inc ecx
mov dword [esp + 0xd8], ebx
test eax, eax
je 0x4379f8
push ecx
push 0x40
push 2
push str.CONOUT_
lea ecx, [esp + 0x608]
call fcn.0043a5f6
mov eax, dword [0x5e0cf0]
push ebx
push ebx
mov ecx, dword [eax + 4]
lea eax, [esp + 0x604]
add ecx, 0x5e0cf0
mov dword [ecx + 0x38], eax
call fcn.00435309
lea ecx, [esp + 0x5f8]
call fcn.00439dbe
mov byte [0x5f1ef4], bl
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [0x5f1ef0], eax
call fcn.004ca6cd
push ebx
mov eax, 0x54de54
mov edi, 0x5de924
push eax
mov ecx, edi
call fcn.0043c2de
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
push 4
pop esi
test ebx, ebx
je 0x43819d
xor eax, eax
inc eax
cmp dword [esp + 0x14], eax
jle 0x43819d
mov edx, dword [ebx + 4]
cmp word [edx], 0x2d
je 0x437a81
mov ecx, edx
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x437a63
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x5de924
call fcn.0043c2de
push 4
pop esi
lea ecx, [esp + 0x124]
call fcn.0043a5a2
lea ecx, [esp + 0xb4]
call fcn.0043a495
mov edi, str.8.8.8.8
lea ecx, [esp + 0x124]
push edi
push dword [esp + 0x18]
mov edx, 0x54e2bc
push ebx
call fcn.0043742d
add esp, 0xc
test al, al
je 0x437ad8
call fcn.004ca6cd
lea ecx, [esp + 0x124]
push ecx
push esi
lea ecx, [eax + 0x320]
push ecx
mov ecx, eax
call fcn.0043dd3d
push dword [esp + 0x14]
mov edx, 0x54e2c8
lea ecx, [esp + 0x24]
push ebx
call fcn.0043725a
pop ecx
pop ecx
test al, al
je 0x437b0a
call fcn.004ca6cd
lea ecx, [esp + 0x20]
push ecx
push esi
lea ecx, [eax + 0x328]
push ecx
mov ecx, eax
call fcn.0043dd6b
push edi
push dword [esp + 0x18]
mov edx, 0x54e2d8
lea ecx, [esp + 0x12c]
push ebx
call fcn.0043742d
add esp, 0xc
test al, al
je 0x437b44
call fcn.004ca6cd
lea ecx, [esp + 0x124]
push ecx
push esi
lea ecx, [eax + 0x300]
push ecx
mov ecx, eax
call fcn.0043dd3d
push dword [esp + 0x14]
mov edx, 0x54e2ec
lea ecx, [esp + 0x24]
push ebx
call fcn.0043725a
pop ecx
pop ecx
test al, al
je 0x437b76
call fcn.004ca6cd
lea ecx, [esp + 0x20]
push ecx
push esi
lea ecx, [eax + 0x318]
push ecx
mov ecx, eax
call fcn.0043dd6b
push str.user
push dword [esp + 0x18]
mov edx, 0x54e310
lea ecx, [esp + 0x12c]
push ebx
call fcn.0043742d
add esp, 0xc
test al, al
je 0x437bb4
call fcn.004ca6cd
lea ecx, [esp + 0x124]
push ecx
push esi
lea ecx, [eax + 0x308]
push ecx
mov ecx, eax
call fcn.0043dd3d
push 0x54e328
push dword [esp + 0x18]
mov edx, 0x54e33c
lea ecx, [esp + 0x12c]
push ebx
call fcn.0043742d
add esp, 0xc
test al, al
je 0x437bf2
call fcn.004ca6cd
lea ecx, [esp + 0x124]
push ecx
push esi
lea ecx, [eax + 0x310]
push ecx
mov ecx, eax
call fcn.0043dd3d
push dword [esp + 0x14]
mov edx, str.terminal
mov ecx, 0x5fea1a
push ebx
call fcn.004374b8
push dword [esp + 0x1c]
mov edx, 0x54e368
mov ecx, 0x5f1f0f
push ebx
call fcn.004374b8
push dword [esp + 0x24]
mov edx, 0x54e370
lea ecx, [esp + 0x27]
push ebx
call fcn.004374b8
add esp, 0x18
test al, al
je 0x437c4d
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x340]
push ecx
mov ecx, eax
call fcn.0043dc45
push dword [esp + 0x14]
mov edx, 0x54e380
lea ecx, [esp + 0x17]
push ebx
call fcn.004374b8
pop ecx
pop ecx
test al, al
je 0x437c7f
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x398]
push ecx
mov ecx, eax
call fcn.0043dc45
push dword [esp + 0x14]
mov edx, 0x54e394
lea ecx, [esp + 0x17]
push ebx
call fcn.004374b8
pop ecx
pop ecx
test al, al
je 0x437cb1
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x3a0]
push ecx
mov ecx, eax
call fcn.0043dc45
push dword [esp + 0x14]
mov edx, 0x54e3a8
lea ecx, [esp + 0x24]
push ebx
call fcn.0043725a
pop ecx
pop ecx
test al, al
je 0x437ce3
call fcn.004ca6cd
lea ecx, [esp + 0x20]
push ecx
push esi
lea ecx, [eax + 0x338]
push ecx
mov ecx, eax
call fcn.0043dd6b
push dword [esp + 0x14]
mov edx, 0x54e3bc
lea ecx, [esp + 0x24]
push ebx
call fcn.0043725a
pop ecx
pop ecx
test al, al
je 0x437d15
call fcn.004ca6cd
lea ecx, [esp + 0x20]
push ecx
push esi
lea ecx, [eax + 0x330]
push ecx
mov ecx, eax
call fcn.0043dd6b
push dword [esp + 0x14]
mov edx, 0x54e3d0
lea ecx, [esp + 0x17]
push ebx
call fcn.004374b8
pop ecx
pop ecx
test al, al
je 0x437d47
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x348]
push ecx
mov ecx, eax
call fcn.0043dc45
push dword [esp + 0x14]
mov edx, 0x54e3e4
lea ecx, [esp + 0x17]
push ebx
call fcn.004374b8
pop ecx
pop ecx
test al, al
je 0x437d79
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x350]
push ecx
mov ecx, eax
call fcn.0043dc45
push dword [esp + 0x14]
mov edx, 0x54e404
lea ecx, [esp + 0x78]
push ebx
call fcn.00437315
pop ecx
pop ecx
test al, al
je 0x437dab
call fcn.004ca6cd
lea ecx, [esp + 0x74]
push ecx
push esi
lea ecx, [eax + 0x358]
push ecx
mov ecx, eax
call fcn.0043dd96
push 0x54e41c
push dword [esp + 0x18]
mov edx, 0x54e424
lea ecx, [esp + 0x12c]
push ebx
call fcn.0043742d
add esp, 0xc
test al, al
je 0x437de9
call fcn.004ca6cd
lea ecx, [esp + 0x124]
push ecx
push esi
lea ecx, [eax + 0x3b8]
push ecx
mov ecx, eax
call fcn.0043dd3d
push dword [esp + 0x14]
mov edx, 0x54e438
lea ecx, [esp + 0x78]
push ebx
call fcn.00437315
pop ecx
pop ecx
test al, al
je 0x437e3a
call fcn.004ca6cd
lea ecx, [esp + 0x74]
push ecx
push esi
lea ecx, [eax + 0x368]
push ecx
mov ecx, eax
call fcn.0043dd96
xor eax, eax
mov byte [esp + 0x1c], al
call fcn.004ca6cd
lea ecx, [esp + 0x1c]
push ecx
push esi
lea ecx, [eax + 0x360]
push ecx
mov ecx, eax
call fcn.0043dc45
mov edi, str.valid_path
lea ecx, [esp + 0xb4]
push edi
push dword [esp + 0x18]
mov edx, 0x54e46c
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437e79
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x390]
push ecx
mov ecx, eax
call fcn.0043ddc1
push edi
push dword [esp + 0x18]
mov edx, str.user
lea ecx, [esp + 0xbc]
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437eb3
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3b0]
push ecx
mov ecx, eax
call fcn.0043ddc1
push dword [esp + 0x14]
mov edx, 0x54e47c
lea ecx, [esp + 0x17]
push ebx
call fcn.004374b8
pop ecx
pop ecx
test al, al
je 0x437ee5
call fcn.004ca6cd
lea ecx, [esp + 0x13]
push ecx
push esi
lea ecx, [eax + 0x3c0]
push ecx
mov ecx, eax
call fcn.0043dc45
mov edi, str.example_email.com
lea ecx, [esp + 0xb4]
push edi
push dword [esp + 0x18]
mov edx, 0x54e4ac
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437f24
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3c8]
push ecx
mov ecx, eax
call fcn.0043ddc1
push edi
push dword [esp + 0x18]
mov edx, 0x54e4d0
lea ecx, [esp + 0xbc]
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437f5e
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3d0]
push ecx
mov ecx, eax
call fcn.0043ddc1
mov edi, str._any_text_in_quotes_
lea ecx, [esp + 0xb4]
push edi
push dword [esp + 0x18]
mov edx, 0x54e520
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437f9d
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3d8]
push ecx
mov ecx, eax
call fcn.0043ddc1
push str._any_path_in_quotes_
push dword [esp + 0x18]
mov edx, 0x54e560
lea ecx, [esp + 0xbc]
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x437fdb
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3e0]
push ecx
mov ecx, eax
call fcn.0043ddc1
push edi
push dword [esp + 0x18]
mov edx, 0x54e580
lea ecx, [esp + 0xbc]
push ebx
call fcn.00437131
add esp, 0xc
test al, al
je 0x438015
call fcn.004ca6cd
lea ecx, [esp + 0xb4]
push ecx
push esi
lea ecx, [eax + 0x3e8]
push ecx
mov ecx, eax
call fcn.0043ddc1
push dword [esp + 0x14]
mov eax, dword [0x5f1ef0]
lea ecx, [esp + 0xa0]
push ebx
mov edx, 0x54e59c
mov dword [esp + 0xa4], eax
call fcn.004373c9
push dword [esp + 0x1c]
mov eax, dword [esp + 0xa8]
mov edx, str.service
push ebx
mov ecx, 0x5f1f18
mov dword [0x5f1ef0], eax
call fcn.004374b8
push dword [esp + 0x24]
mov edx, str.install_service
mov ecx, 0x5f1f19
push ebx
call fcn.004374b8
add esp, 0x18
lea ecx, [esp + 0x210]
call fcn.0043a495
xor eax, eax
lea ecx, [esp + 0x210]
push eax
push dword [esp + 0x18]
mov edx, str.update
push ebx
call fcn.00437131
add esp, 0xc
cmp dword [esp + 0x220], 0
je 0x438174
push 0x104
lea eax, [esp + 0x774]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x770]
push 0x5c
push eax
call fcn.00504a54
pop ecx
pop ecx
xor ecx, ecx
mov word [eax + 2], cx
lea ecx, [esp + 0x210]
call fcn.0043a3b1
mov edx, eax
xor ecx, ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x4380ea
lea edi, [esp + 0x770]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x438101
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov esi, eax
mov edi, 0x3e8
lea eax, [esp + 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43813f
push 0xa
call ebp
inc esi
cmp esi, edi
jl 0x438124
mov ecx, 0x5e0cf0
mov edx, str.Updater_deleted:
cmp esi, edi
jne 0x438152
mov edx, str.Cant_delete_updater:
call fcn.0043e07c
lea edx, [esp + 0x770]
mov ecx, eax
call fcn.0043e07c
push eax
call fcn.0043e241
xor eax, eax
inc eax
pop ecx
mov byte [0x5f1ef4], al
lea ecx, [esp + 0x210]
call fcn.0043c274
lea ecx, [esp + 0xb4]
call fcn.0043c274
lea ecx, [esp + 0x124]
call fcn.0043c446
mov edi, 0x5de924
call fcn.004ca6cd
mov ecx, eax
call fcn.004c8a33
call fcn.004ca6cd
mov ecx, eax
call fcn.004cacda
xor eax, eax
mov ecx, 0x5de90c
inc eax
push eax
push 0x54dfa8
call fcn.0043c2de
mov ecx, dword [ebx]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4381cf
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebx]
mov ebx, 0x5de90c
mov ecx, ebx
call fcn.0043d30e
push 2
push 0x54e638
mov ecx, ebx
call fcn.0043d30e
push dword [0x5de904]
mov esi, 0x5de8f4
mov ecx, esi
call fcn.0043a3b1
push eax
mov ecx, ebx
call fcn.0043d30e
cmp byte [0x5f1f19], 0
je 0x4382da
push esi
push 0x54e1b4
lea ecx, [esp + 0x508]
call fcn.0043a44d
mov edx, eax
lea ecx, [esp + 0x4ec]
call fcn.0043deb9
pop ecx
mov ecx, eax
call fcn.004755b1
lea ecx, [esp + 0x4e8]
mov bl, al
call fcn.0043c274
lea ecx, [esp + 0x500]
call fcn.0043c274
test bl, bl
je 0x4382da
call fcn.00475a62
test al, al
je 0x4382da
push 0x58
call fcn.004ed632
pop ecx
mov ecx, 0x5de90c
mov esi, eax
call fcn.0043a3b1
push eax
mov ecx, esi
call fcn.004421c1
xor ebx, ebx
mov dword [0x5f1f14], eax
mov esi, ebx
mov ecx, eax
call fcn.00442445
test al, al
jne 0x4382b2
push 0x64
call ebp
inc esi
cmp esi, 0xa
jge 0x4382b2
mov eax, dword [0x5f1f14]
jmp 0x438296
mov esi, dword [0x5f1f14]
test esi, esi
je 0x4382cd
mov ecx, esi
call fcn.00442227
push 0x58
push esi
call fcn.004ed601
pop ecx
pop ecx
mov dword [0x5f1f14], ebx
mov esi, 0x5de8f4
jmp 0x4382dc
xor ebx, ebx
push 0x54e640
mov ecx, edi
call fcn.0043ef27
test al, al
je 0x4386ce
call fcn.00437049
test al, al
jne 0x439db2
push 0x58
call fcn.004ed632
pop ecx
mov ecx, 0x5de90c
mov esi, eax
call fcn.0043a3b1
push eax
mov ecx, esi
call fcn.004421c1
push 8
mov dword [0x5f1f14], eax
call fcn.004ed632
pop ecx
mov edx, 0x5ffcd8
lea ecx, [esp + 0xcc]
mov esi, eax
call fcn.0043f540
mov edx, eax
mov ecx, esi
call fcn.0043f551
lea ecx, [esp + 0xcc]
call fcn.0043ec42
mov dword [0x5f1f10], esi
call fcn.0044562d
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x43841a
push 0x54e66c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov ebp, eax
call esi
mov ebx, eax
test ebp, ebp
je 0x43841a
test ebx, ebx
je 0x43841a
lea eax, [esp + 0xd0]
push eax
call ebp
push 0x3c
pop ebp
mov esi, eax
xor eax, eax
push ebp
push eax
lea eax, [esp + 0x324]
push eax
call fcn.005055e0
xor eax, eax
mov dword [esp + 0x328], ebp
mov dword [esp + 0x330], eax
add esp, 0xc
inc eax
mov dword [esp + 0x32c], str.bcdedit.exe
mov dword [esp + 0x338], eax
lea eax, [esp + 0x31c]
mov dword [esp + 0x330], str._deletevalue_safeboot
push eax
mov dword [esp + 0x324], 0x8500
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test esi, esi
je 0x438413
push dword [esp + 0xd0]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 2
mov dword [0x5f1f00], eax
mov dword [esp + 0x1b0], 0x30
mov dword [esp + 0x1b4], 3
mov dword [esp + 0x1b8], 0x436d47
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c0], ebx
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x1cc], eax
mov edi, str.AeroAdminTrayWnd
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1d0], ebx
push eax
mov dword [esp + 0x1d8], edi
mov dword [esp + 0x1dc], ebx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push ebx
push dword [0x5f1f00]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push accept
push edi
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x5f1f1c], eax
lea eax, [esp + 0x518]
push eax
call fcn.004ca6cd
mov ecx, eax
call fcn.004357f4
mov ecx, eax
call fcn.0043a4ec
push eax
call fcn.004db835
mov ecx, eax
call fcn.004dba24
lea ecx, [esp + 0x518]
call fcn.0043c446
call fcn.00435829
mov ecx, eax
call fcn.004d6f7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00517aab
pop ecx
cmp byte [0x5f1f0d], bl
je 0x438554
push 0x54e70c
lea ecx, [esp + 0x3c4]
call fcn.0043a44d
lea eax, [esp + 0x3c0]
push eax
push str.menu_service
call fcn.00435829
mov ecx, eax
call fcn.004d6e47
lea ecx, [esp + 0x3c0]
call fcn.0043c274
push 0x3bc
lea eax, [esp + 0x97c]
push ebx
push eax
call fcn.005055e0
mov eax, dword [0x5f1f1c]
add esp, 0xc
mov dword [esp + 0x97c], eax
xor eax, eax
inc eax
mov dword [esp + 0x978], 0x3bc
mov dword [esp + 0xc98], 4
mov dword [esp + 0x980], eax
mov dword [esp + 0x984], 0x87
mov dword [esp + 0x988], 0x8000
call fcn.004db835
mov ecx, eax
call fcn.0043a4ec
mov esi, eax
call fcn.00435829
push str.tray_tip
push esi
mov ecx, eax
call fcn.004d6fe7
lea edx, [esp + 0x990]
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4385d5
push ebx
push 0x10
push 0x10
xor eax, eax
inc eax
push eax
push 0x7b
push dword [0x5f1f00]
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esp + 0x98c], eax
lea eax, [esp + 0x978]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
lea eax, [esp + 0x978]
push eax
push 4
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
call fcn.004ca6cd
push ebx
lea ecx, [eax + 0x398]
push ecx
lea ecx, [esp + 0x398]
push ecx
mov ecx, eax
call fcn.0043db94
mov al, byte [eax + 4]
test al, al
jne 0x438686
push 0x118
call fcn.004ed632
mov dword [esp], 0x5de8c4
mov ecx, eax
push str.MainWindow
push ebx
push dword [0x5f1f00]
call fcn.0047f6c4
mov eax, dword [0x5f1f8c]
push 9
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f1f8c]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.004ca6cd
push ebx
lea ecx, [eax + 0x3c0]
push ecx
lea ecx, [esp + 0x3a0]
push ecx
mov ecx, eax
call fcn.0043db94
mov al, byte [eax + 4]
test al, al
je 0x4387a4
push 0xa8
call fcn.004ed632
pop ecx
mov ecx, dword [0x5f1f8c]
test ecx, ecx
je 0x438794
mov ecx, dword [ecx + 0x10]
jmp 0x438796
push 0x54e644
mov ecx, edi
call fcn.0043ef27
test al, al
je 0x4386f5
mov ecx, dword [0x5f1ef0]
mov edx, str.runer
push esi
call fcn.00475afd
pop ecx
jmp 0x439db2
push 0x54e650
mov ecx, edi
call fcn.0043ef27
test al, al
je 0x43870e
mov edx, str.watchdog
xor ecx, ecx
jmp 0x4386e9
push 0x54e660
mov ecx, edi
call fcn.0043ef27
test al, al
je 0x438725
mov edx, 0x54e664
jmp 0x43870a
push 0x54e668
mov ecx, edi
call fcn.0043ef27
test al, al
jne 0x4382fd
push 0x54e1ec
mov ecx, edi
call fcn.0043ef27
test al, al
jne 0x438756
call fcn.00437049
test al, al
jne 0x439db2
cmp byte [0x5f1f19], 0
jne 0x4382fd
call fcn.004ca6cd
push ebx
lea ecx, [eax + 0x3a0]
push ecx
lea ecx, [esp + 0x390]
push ecx
mov ecx, eax
call fcn.0043db94
mov al, byte [eax + 4]
test al, al
je 0x4382fd
call fcn.0043761b
jmp 0x4382f5
mov ecx, ebx
push ecx
push dword [0x5f1f00]
mov ecx, eax
call fcn.0048521f
mov dword [esp + 0x80], ebx
call fcn.00517b84
mov dword [0x5ffd08], eax
call fcn.00517b84
mov dword [0x5ffd04], eax
xor eax, eax
inc eax
mov dword [esp + 0x38], eax
call fcn.00517b84
fld qword [0x55d660]
mov esi, eax
fstp qword [esp + 0x88]
call fcn.00517b84
mov ebp, ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x78], ebp
cmp byte [0x5fea1a], bl
jne 0x4388e4
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
xor eax, eax
lea ecx, [esp + 0x548]
inc eax
push eax
push 3
call fcn.0043adb7
push dword [esp + 0xd4]
mov edx, str.AeroadminLocalIPB
push ecx
lea ecx, [esp + 0x560]
call fcn.0043e07c
pop ecx
mov ecx, eax
call fcn.0043b508
lea eax, [esp + 0x3d8]
push eax
lea ecx, [esp + 0x564]
call fcn.0043c8d5
lea ecx, [esp + 0x3d8]
call fcn.0043a3b1
xor ecx, ecx
inc ecx
push ecx
push ecx
push eax
lea ecx, [esp + 0x124]
call fcn.00447985
mov ebp, eax
lea ecx, [esp + 0x3d8]
mov dword [esp + 0x78], ebp
call fcn.0043c274
test ebp, ebp
jne 0x4388d8
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x564]
call fcn.0043c8d5
lea ecx, [esp + 0x3f0]
call fcn.0043a3b1
push 1
push ebx
push eax
lea ecx, [esp + 0x124]
call fcn.00447985
lea ecx, [esp + 0x3f0]
mov dword [esp + 0x78], eax
mov ebp, eax
call fcn.0043c274
lea ecx, [esp + 0x548]
call fcn.00436d2d
cmp byte [0x5f1f89], bl
jne 0x439d48
jmp 0x438917
cmp byte [0x5f1f89], 0
jne 0x438930
lea eax, [esp + 0x300]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x300]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
inc eax
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4388f2
call fcn.004e2186
test ebp, ebp
je 0x438946
cmp byte [ebp], 0x6d
jne 0x438946
xor eax, eax
inc eax
mov bh, al
jmp 0x43894b
xor eax, eax
mov bh, bl
inc eax
test ebp, ebp
je 0x43895b
cmp byte [ebp], 0x73
jne 0x43895b
mov bl, al
xor eax, eax
jmp 0x43895f
xor eax, eax
mov bl, al
test bh, bh
jne 0x438967
test bl, bl
je 0x438972
mov byte [ebp], al
test bh, bh
jne 0x43897f
test bl, bl
jne 0x43897f
cmp byte [0x5f1f1a], 0
je 0x438bbd
cmp byte [0x5f1f0d], 0
je 0x4389fe
call fcn.00435829
push str.menu_service
push 0x54e730
mov ecx, eax
call fcn.004d6fe7
mov edx, eax
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
cmp cx, word [esp + 0xd8]
jne 0x4389a3
sub edx, edi
mov ecx, 0x25aa
sar edx, 1
cmp word [eax + edx*2 - 2], cx
je 0x4389f9
push 0x54e70c
lea ecx, [esp + 0x40c]
call fcn.0043a44d
lea eax, [esp + 0x408]
push eax
push str.menu_service
call fcn.00435829
mov ecx, eax
call fcn.004d6e47
lea ecx, [esp + 0x408]
call fcn.0043c274
mov edi, str.AeroAdminTrayWnd
mov eax, dword [0x5f1f00]
xor ecx, ecx
push 2
mov dword [esp + 0x1e0], 0x30
mov dword [esp + 0x1e4], 3
mov dword [esp + 0x1e8], 0x436d47
mov dword [esp + 0x1ec], ecx
mov dword [esp + 0x1f0], ecx
mov dword [esp + 0x1f4], eax
mov dword [esp + 0x1f8], ecx
mov dword [esp + 0x1fc], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x1fc], eax
xor eax, eax
mov dword [esp + 0x200], eax
mov dword [esp + 0x208], eax
lea eax, [esp + 0x1dc]
push eax
mov dword [esp + 0x208], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
push eax
push dword [0x5f1f00]
push eax
push eax
push eax
push eax
push eax
push eax
push accept
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
xor eax, eax
push 0x3bc
push eax
lea eax, [esp + 0xd40]
mov dword [0x5f1f1c], edi
push eax
call fcn.005055e0
xor eax, eax
mov dword [esp + 0xd44], 0x3bc
add esp, 0xc
mov dword [esp + 0x1058], 4
inc eax
mov dword [esp + 0xd3c], edi
mov dword [esp + 0xd40], eax
mov dword [esp + 0xd44], 0x87
mov dword [esp + 0xd48], 0x8000
call fcn.004db835
mov ecx, eax
call fcn.0043a4ec
mov edi, eax
call fcn.00435829
push str.tray_tip
push edi
mov ecx, eax
call fcn.004d6fe7
lea edx, [esp + 0xd50]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x438b20
xor eax, eax
push eax
push 0x10
push 0x10
inc eax
push eax
push 0x7b
push dword [0x5f1f00]
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [esp + 0xd4c], eax
lea eax, [esp + 0xd38]
push eax
xor eax, eax
push eax
call edi
lea eax, [esp + 0xd38]
push eax
push 4
call edi
xor eax, eax
mov byte [0x5f1f1b], al
cmp byte [0x5f1f1a], al
jne 0x438e5b
test bh, bh
jne 0x438e5b
test bl, bl
je 0x438bbd
cmp byte [0x5f1fa9], al
jne 0x438bbd
push 0xa8
call fcn.004ed632
pop ecx
mov ecx, dword [0x5f1f8c]
test ecx, ecx
je 0x438bad
mov ecx, dword [ecx + 0x10]
jmp 0x438baf
xor ecx, ecx
push ecx
push dword [0x5f1f00]
mov ecx, eax
call fcn.0048521f
xor ebx, ebx
mov eax, dword [0x5f1f04]
test eax, eax
jg 0x438bd3
cmp dword [0x5f1f08], 0
mov cl, bl
jle 0x438bd5
mov cl, 1
mov byte [0x5f1ef6], cl
test eax, eax
jle 0x438c74
mov cl, byte [0x5f1faa]
test cl, cl
jne 0x438c29
push 0x27c
call fcn.004ed632
push ecx
mov edi, eax
mov ecx, esp
lea eax, [esp + 0x8f]
push eax
push 0x5ffe40
call fcn.0043e329
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call fcn.00488095
mov eax, dword [0x5f1f04]
mov cl, byte [0x5f1faa]
test eax, eax
jle 0x438c74
test cl, cl
je 0x438c74
cmp byte [0x5f1faf], 0
je 0x438c74
cmp byte [0x5f1fae], 0
jne 0x438c74
push 0x150
call fcn.004ed632
push ecx
mov edi, eax
mov ecx, esp
lea eax, [esp + 0x9f]
push eax
push 0x5ffe40
call fcn.0043e329
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call fcn.00488e6c
cmp byte [0x5f1ef6], 0
jne 0x438d7d
cmp byte [0x5f1ef5], 0
je 0x438d08
call fcn.00517b84
sub eax, esi
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
fld qword [esp + 0x88]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x438cff
call fcn.004ca6cd
cmp byte [eax + 0x404], 0
jne 0x438cff
fld qword [0x55d660]
fstp qword [esp + 0x88]
call fcn.00517b84
sub esp, 0x18
mov esi, eax
mov ecx, esp
push str.https:__ulm.aeroadmin.com_
call fcn.0043a44d
xor cl, cl
call fcn.00435fc4
movzx ecx, byte [0x5f1f89]
add esp, 0x18
cmp eax, 4
push 1
pop eax
cmove ecx, eax
mov byte [0x5f1f89], cl
cmp byte [0x5f1ef6], 0
jne 0x438d7d
call fcn.00517b84
sub eax, esi
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
fld qword [esp + 0x88]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x438d7d
call fcn.004ca6cd
cmp byte [eax + 0x404], 0
jne 0x438d7d
fld qword [0x55d660]
fstp qword [esp + 0x88]
call fcn.00517b84
sub esp, 0x18
mov esi, eax
mov ecx, esp
push str.https:__ulm.aeroadmin.com_
call fcn.0043a44d
xor cl, cl
call fcn.00435fc4
movzx ecx, byte [0x5f1f89]
add esp, 0x18
cmp eax, 4
push 1
pop eax
cmove ecx, eax
mov byte [0x5f1f89], cl
call fcn.00517b84
sub eax, dword [0x5ffd08]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
fld qword [0x55d5a8]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x438dc6
cmp byte [0x5f1f88], 0
je 0x438dc6
mov ecx, dword [0x5f1f8c]
test ecx, ecx
je 0x438dbc
call fcn.00480993
call fcn.00517b84
mov dword [0x5ffd08], eax
cmp dword [0x5f1ef8], 0
jg 0x438f3f
mov eax, dword [0x56cb94]
cmp dword [eax], ebx
jg 0x438df0
call fcn.00517b84
mov dword [0x5ffd04], eax
xor ecx, ecx
mov eax, dword [0x56cb94]
inc ecx
mov dword [eax], ecx
call fcn.00517b84
sub eax, dword [0x5ffd04]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
fld qword [0x55d620]
fcompi st(1)
fstp st(0)
jb 0x438eb7
mov edx, dword [0x56cb94]
cmp dword [edx], 5
jle 0x438eb7
mov ebx, dword [esp + 0x38]
mov ecx, dword [0x5f1efc]
imul eax, ebx, 0xa
add ecx, eax
xor eax, eax
mov dword [0x5f1ef8], ecx
mov dword [0x5f1efc], ecx
mov dword [edx], eax
call fcn.00517b84
inc ebx
mov dword [0x5ffd04], eax
mov dword [esp + 0x38], ebx
jmp 0x438f6b
mov eax, dword [0x5f1f8c]
test eax, eax
jne 0x438e91
push 0x118
call fcn.004ed632
mov dword [esp], 0x5de8c4
xor ebx, ebx
push str.MainWindow
push ebx
push dword [0x5f1f00]
mov ecx, eax
call fcn.0047f6c4
mov eax, dword [0x5f1f8c]
jmp 0x438e93
xor ebx, ebx
push 9
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f1f8c]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x5f1f1a], bl
jmp 0x438bbf
call fcn.00517b84
sub eax, dword [0x5ffd04]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
fld qword [0x55d620]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x438ee7
cmp dword [0x5f1ef8], 0
jle 0x438f2c
call fcn.00517b84
sub eax, dword [0x5ffd04]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
imul eax, dword [esp + 0x38], 0x3c
fmul qword [0x55d530]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fxch st(1)
fcompi st(1)
fstp st(0)
jb 0x438f6b
mov eax, dword [0x56cb94]
cmp dword [eax], 4
jg 0x438f6b
xor eax, eax
mov dword [0x5f1efc], ebx
inc eax
mov dword [esp + 0x38], eax
call fcn.00517b84
mov dword [0x5ffd04], eax
mov eax, dword [0x56cb94]
mov dword [eax], ebx
jmp 0x438f6b
call fcn.00517b84
sub eax, dword [0x5ffd04]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x55d530]
call fcn.004ee120
mov ecx, dword [0x5f1efc]
sub ecx, eax
mov dword [0x5f1ef8], ecx
mov al, byte [0x5f1ef6]
test al, al
je 0x43905c
push 0x5f1f0c
push 0x5f1f08
mov edx, 0x5f1f04
mov ecx, 0x5ffe40
call fcn.0044925e
pop ecx
pop ecx
test al, al
je 0x439057
lea ecx, [esp + 0x10c]
call fcn.00470ca8
xor ebx, ebx
mov byte [esp + 0x1d], 0x46
inc ebx
lea eax, [esp + 0x1d]
push ebx
push eax
lea ecx, [esp + 0x114]
call fcn.004c809e
push str.fromInterface
lea ecx, [esp + 0x424]
call fcn.0043a44d
mov edi, 0x54de54
lea ecx, [esp + 0x530]
push edi
call fcn.0043a44d
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x3e]
sub eax, dword [esp + 0x10c]
push eax
push dword [esp + 0x110]
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0xe8]
push eax
call fcn.004c6b74
mov ecx, eax
call fcn.004c6cb3
lea ecx, [esp + 0xdc]
call fcn.004c6c2a
lea ecx, [esp + 0x530]
call fcn.0043c274
lea ecx, [esp + 0x420]
call fcn.0043c274
dec dword [0x5f1f04]
lea ecx, [esp + 0x10c]
call fcn.0043c24c
mov al, byte [0x5f1ef6]
jmp 0x439064
mov al, byte [0x5f1ef6]
xor ebx, ebx
mov edi, 0x54de54
inc ebx
mov byte [0x5f1ef5], al
test al, al
jne 0x43908c
movzx eax, byte [0x5f1f0c]
xor ecx, ecx
cmp byte [0x5f1fb1], cl
push 0x32
cmove eax, ecx
mov byte [0x5f1f0c], al
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x80], 0
jne 0x4390ed
xor edx, edx
mov ecx, str.mw_statbar_connecting
call fcn.00480949
push 8
call fcn.004ed632
pop ecx
mov ebx, eax
mov dword [esp + 0xe0], 0x44a6cf
lea edx, [esp + 0xe0]
mov dword [esp + 0x80], ebx
lea ecx, [esp + 0xe4]
call fcn.0043f705
mov edx, eax
mov ecx, ebx
call fcn.0043f71e
lea ecx, [esp + 0xe4]
call fcn.0043ec31
push edi
lea ecx, [esp + 0x4d4]
call fcn.0043a44d
lea ecx, [esp + 0x4d0]
call fcn.0043c274
push str.toInterface
lea ecx, [esp + 0x43c]
call fcn.0043a44d
lea eax, [esp + 0x438]
push eax
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x47]
call fcn.004c6b74
lea ecx, [esp + 0x438]
call fcn.0043c274
lea eax, [esp + 0xa0]
xor ebx, ebx
push eax
lea ecx, [esp + 0x80]
mov dword [esp + 0xa4], ebx
call fcn.004c6d2d
test al, al
je 0x439cf7
mov ebp, 0x54de54
push dword [esp + 0xa4]
lea ecx, [esp + 0x28]
push dword [esp + 0xa4]
call fcn.004c80d0
xor eax, eax
lea ecx, [esp + 0x24]
inc eax
push eax
lea eax, [esp + 0x22]
push eax
call fcn.004c810e
movsx eax, byte [esp + 0x1e]
cmp eax, 0x63
jg 0x439967
je 0x439933
sub eax, 0x41
je 0x4398ce
sub eax, 4
je 0x439871
sub eax, 7
je 0x439848
sub eax, 6
je 0x4397b5
sub eax, 3
je 0x43933e
dec eax
sub eax, 1
je 0x439330
sub eax, 0xa
jne 0x439cbb
lea ecx, [esp + 0x228]
call fcn.0043a495
lea ecx, [esp + 0x488]
call fcn.004356ed
lea edx, [esp + 0x228]
lea ecx, [esp + 0x24]
call fcn.004c82c4
lea edx, [esp + 0x488]
mov ecx, eax
call fcn.004356aa
xor ecx, ecx
inc ecx
push ecx
lea ecx, [esp + 0x23]
push ecx
mov ecx, eax
call fcn.004c810e
lea eax, [esp + 0x228]
mov edi, 0x5ffe48
push eax
lea eax, [esp + 0xb0]
mov ecx, edi
push eax
call fcn.0043a17e
lea eax, [esp + 0x20c]
mov ecx, edi
push eax
call fcn.0043a1ea
push eax
lea ecx, [esp + 0xb0]
call fcn.0043bb6f
test al, al
jne 0x439318
mov eax, dword [esp + 0xac]
mov ebx, dword [eax + 0x28]
lea eax, [esp + 0x488]
push eax
lea edi, [ebx + 0x80]
mov ecx, edi
call fcn.00439dd8
cmp byte [esp + 0x1f], 0
lea ecx, [esp + 0x6a8]
mov eax, 0x54e8f8
cmove eax, ebp
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xe8]
push eax
lea eax, [ebx + 0x68]
push eax
push 0x54e8fc
push edi
call fcn.0043e2ae
lea ecx, [esp + 0x6a8]
call fcn.0043a320
push eax
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
inc dword [0x5f1f08]
mov edx, 0x5f1f04
push 0x5f1f0c
push 0x5f1f08
mov ecx, 0x5ffe40
call fcn.0044925e
dec dword [0x5f1f08]
pop ecx
pop ecx
test al, al
je 0x43930a
xor eax, eax
push eax
push eax
push 0x10
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x6a8]
call fcn.00439e2f
xor ebx, ebx
lea ecx, [esp + 0x488]
call fcn.0043a3e2
lea ecx, [esp + 0x228]
jmp 0x439c42
fld1
fstp qword [esp + 0x88]
jmp 0x439cbb
push 4
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
cmp dword [esp + 0xb0], 0
jle 0x439382
call fcn.00517a8a
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fimul dword [esp + 0xb0]
fmul qword [0x55d540]
fadd qword [0x55d5f8]
fstp qword [esp + 0x88]
push 4
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push 2
pop edi
push edi
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
push edi
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
mov edi, 0x5ffe40
mov ecx, edi
call fcn.0043a2ff
mov eax, dword [esp + 0xec]
mov ecx, edi
mov dword [esp + 0x188], eax
lea eax, [esp + 0x184]
mov dword [esp + 0x184], str.minutesSpent
push eax
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x3ac]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x40]
mov ecx, edi
mov word [esp + 0x190], ax
lea eax, [esp + 0x18c]
push eax
mov dword [esp + 0x190], str.partnCount
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x3b4]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x44]
mov ecx, edi
mov word [esp + 0x198], ax
lea eax, [esp + 0x194]
push eax
mov dword [esp + 0x198], str.partnCountLimWarn
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x3bc]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x48]
mov ecx, edi
mov word [esp + 0x1a0], ax
lea eax, [esp + 0x19c]
push eax
mov dword [esp + 0x1a0], str.partnCountSuspWarn
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x3c4]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x4c]
mov ecx, edi
mov word [esp + 0x1a8], ax
lea eax, [esp + 0x1a4]
push eax
mov dword [esp + 0x1a8], str.partnCountLim
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x474]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x50]
mov ecx, edi
mov word [esp + 0x140], ax
lea eax, [esp + 0x13c]
push eax
mov dword [esp + 0x140], str.timeLimWarn
call fcn.0043fc21
push eax
add eax, 0x10
push eax
push ebx
lea eax, [esp + 0x47c]
push eax
mov ecx, edi
call fcn.0043fc8b
mov ax, word [esp + 0x54]
mov ecx, edi
mov word [esp + 0x148], ax
lea eax, [esp + 0x144]
push eax
mov dword [esp + 0x148], str.timeLimSuspWarn
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x484]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x58]
mov ecx, edi
mov word [esp + 0x150], ax
lea eax, [esp + 0x14c]
push eax
mov dword [esp + 0x150], str.timeLim
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x48c]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x5c]
mov ecx, edi
mov word [esp + 0x158], ax
lea eax, [esp + 0x154]
push eax
mov dword [esp + 0x158], str.prlSesLimOut
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x38c]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x60]
mov ecx, edi
mov word [esp + 0x160], ax
lea eax, [esp + 0x15c]
push eax
mov dword [esp + 0x160], str.prlSesLimIn
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x364]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x64]
mov ecx, edi
mov word [esp + 0x168], ax
lea eax, [esp + 0x164]
push eax
mov dword [esp + 0x168], str.fileTransfer
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x36c]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x68]
mov dword [esp + 0x16c], str.msg1Interval
mov word [esp + 0x170], ax
lea eax, [esp + 0x16c]
mov ecx, edi
push eax
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x374]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x6c]
mov ecx, edi
mov word [esp + 0x178], ax
lea eax, [esp + 0x174]
push eax
mov dword [esp + 0x178], str.showPPAfterSession
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x37c]
push eax
call fcn.0043fc8b
mov ax, word [esp + 0x70]
mov ecx, edi
mov word [esp + 0x180], ax
lea eax, [esp + 0x17c]
push eax
mov dword [esp + 0x180], str.autoUpdate
call fcn.0043fc21
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x384]
push eax
call fcn.0043fc8b
jmp 0x439cbb
lea ecx, [esp + 0x258]
call fcn.0043a495
lea ecx, [esp + 0x240]
call fcn.0043a5a2
lea edx, [esp + 0x258]
lea ecx, [esp + 0x24]
call fcn.004c82c4
lea edx, [esp + 0x240]
mov ecx, eax
call fcn.004c8282
lea eax, [esp + 0x258]
mov ecx, 0x5ffe48
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.0043a17e
mov eax, dword [esp + 0xf0]
cmp eax, dword [0x5ffe48]
je 0x43982b
mov edi, dword [eax + 0x28]
lea ecx, [esp + 0x240]
call fcn.0043a4ec
mov edx, dword [edi]
mov ecx, edi
push eax
call dword [edx + 0x48]
lea ecx, [esp + 0x240]
call fcn.0043c446
lea ecx, [esp + 0x258]
call fcn.0043c274
jmp 0x439cbb
mov edi, 0x5de8c4
lea ecx, [esp + 0x24]
mov edx, edi
call fcn.004c82c4
mov ecx, dword [0x5f1f8c]
test ecx, ecx
je 0x439cbb
push edi
call fcn.004808b9
jmp 0x439cbb
xor eax, eax
inc eax
cmp byte [0x5f1f0d], 0
mov byte [0x5f1f89], al
je 0x439cbb
push 0x5ffca8
lea ecx, [esp + 0xfc]
call fcn.0043a36b
mov ecx, dword [0x5f1f14]
lea eax, [esp + 0xf4]
push eax
mov dword [esp + 0xf8], 0x73
lea ecx, [ecx + 0x40]
call fcn.004424c7
lea ecx, [esp + 0xf8]
call fcn.0043a357
call fcn.00475982
jmp 0x439cbb
lea ecx, [esp + 0x270]
call fcn.0043a495
lea edx, [esp + 0x270]
lea ecx, [esp + 0x24]
call fcn.004c82c4
push 4
lea ecx, [esp + 0x100]
push ecx
mov ecx, eax
call fcn.004c810e
push 0xd8
call fcn.004ed632
pop ecx
push dword [esp + 0xfc]
mov edi, eax
lea eax, [esp + 0x274]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call fcn.0048c129
lea ecx, [esp + 0x270]
jmp 0x439c42
lea ecx, [esp + 0x2a0]
call fcn.0043a495
lea edx, [esp + 0x2a0]
lea ecx, [esp + 0x24]
call fcn.004c82c4
lea ecx, [esp + 0x2a0]
call fcn.0048bc1d
lea ecx, [esp + 0x2a0]
jmp 0x439c42
sub eax, 0x6d
je 0x439c49
sub eax, 1
je 0x439b94
push 2
pop edi
sub eax, edi
je 0x439b43
sub eax, edi
je 0x439a89
sub eax, 1
je 0x439a4c
sub eax, edi
jne 0x439cbb
mov eax, dword [0x5f1f8c]
test eax, eax
je 0x4399c1
push 9
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f1f8c]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4399e9
push 0x118
call fcn.004ed632
mov dword [esp], 0x5de8c4
mov edi, eax
push str.MainWindow
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call fcn.0047f6c4
push 4
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
cmp dword [esp + 0x100], 0
push 0x7c
jle 0x439a20
call fcn.004ed632
mov dword [esp], str.btn_cancel
push str.btn_ok
push str.update_request
jmp 0x439a31
call fcn.004ed632
pop ecx
push ebx
push str.btn_update_noneed_ok
push str.update_noneed
mov ecx, dword [0x5f1f8c]
push str.title_common
push ecx
push dword [ecx + 0x10]
mov ecx, eax
call fcn.0048afda
jmp 0x439cbb
lea ecx, [esp + 0x2b8]
call fcn.0043a5a2
lea edx, [esp + 0x2b8]
lea ecx, [esp + 0x24]
call fcn.004c8282
lea ecx, [esp + 0x2b8]
call fcn.0043a4ec
xor edx, edx
mov ecx, eax
call fcn.00480949
lea ecx, [esp + 0x2b8]
jmp 0x439cb6
lea ecx, [esp + 0x4ac]
call fcn.004356ed
lea ecx, [esp + 0x288]
call fcn.0043a495
lea ecx, [esp + 0x2d0]
call fcn.0043a495
lea edx, [esp + 0x288]
lea ecx, [esp + 0x24]
call fcn.004c82c4
lea edx, [esp + 0x2d0]
mov ecx, eax
call fcn.004c82c4
lea edx, [esp + 0x4ac]
mov ecx, eax
call fcn.004356aa
push 0xf4
call fcn.004ed632
pop ecx
mov ecx, dword [0x5f1f8c]
mov edi, eax
test ecx, ecx
je 0x439af5
mov ecx, dword [ecx + 0x10]
jmp 0x439af7
mov ecx, ebx
lea eax, [esp + 0x4ac]
push eax
lea eax, [esp + 0x2d4]
push eax
lea eax, [esp + 0x290]
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call fcn.0048b2bd
lea ecx, [esp + 0x2d0]
call fcn.0043a3e2
lea ecx, [esp + 0x288]
call fcn.0043a3e2
lea ecx, [esp + 0x4ac]
jmp 0x439c42
push 4
push 0x5f1f80
lea ecx, [esp + 0x2c]
call fcn.004c810e
push 4
push 0x5f1f84
lea ecx, [esp + 0x2c]
call fcn.004c810e
fld qword [0x55d660]
fld qword [esp + 0x88]
mov eax, dword [0x5f1f84]
fucompi st(1)
mov dword [0x5f1f04], eax
fstp st(0)
lahf
test ah, 0x44
jnp 0x439cbb
call fcn.00517b84
mov esi, eax
jmp 0x439cbb
push 4
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004c810e
cmp byte [0x5f1f0f], 0
mov eax, dword [esp + 0x98]
mov dword [0x5f1fa0], eax
je 0x439cbb
push 0x54e8cc
push str.id.txt
call fcn.0051872c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x439cbb
xor eax, eax
mov dword [esp + 0x104], 0xfeff
push edi
inc eax
push eax
lea eax, [esp + 0x10c]
push 2
push eax
call fcn.0051899d
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0x2f8]
add esp, 0x10
call fcn.0043547b
push edi
lea ecx, [esp + 0x2ec]
call fcn.0043a3ad
push eax
push 2
lea ecx, [esp + 0x2f4]
call fcn.0043a3b1
push eax
call fcn.0051899d
push edi
call fcn.00518a6b
add esp, 0x14
lea ecx, [esp + 0x2e8]
call fcn.0043a3e2
jmp 0x439cbb
lea ecx, [esp + 0x450]
call fcn.0043a5a2
lea edx, [esp + 0x450]
lea ecx, [esp + 0x24]
call fcn.004c8282
lea eax, [esp + 0x34]
mov edi, 0x5ffe48
push eax
mov ecx, edi
call fcn.0043a1f9
jmp 0x439c92
mov eax, dword [esp + 0x34]
push str.adminwind_noserver
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x48]
lea ecx, [esp + 0x34]
call fcn.0043a137
lea eax, [esp + 0x108]
mov ecx, edi
push eax
call fcn.0043a1ea
push eax
lea ecx, [esp + 0x38]
call fcn.0043bb6f
test al, al
je 0x439c78
lea ecx, [esp + 0x450]
call fcn.0043a53c
lea ecx, [esp + 0x28]
call fcn.0043c24c
lea ecx, [esp + 0xa0]
call fcn.004c6d71
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], ebx
push eax
lea ecx, [esp + 0x80]
call fcn.004c6d2d
test al, al
jne 0x439166
mov ebp, dword [esp + 0x78]
cmp dword [esp + 0xa0], 0
je 0x439d0e
push dword [esp + 0xa0]
call fcn.004ed662
pop ecx
lea ecx, [esp + 0x7c]
call fcn.004c6c2a
cmp byte [0x5f1f89], 0
mov edi, str.AeroAdminTrayWnd
je 0x438917
mov ebx, dword [esp + 0x80]
test ebx, ebx
je 0x439d46
mov ecx, ebx
call fcn.00435634
xor eax, eax
mov ecx, ebx
inc eax
push eax
call fcn.00435e65
xor ebx, ebx
cmp byte [0x5f1f1b], 0
jne 0x439d98
push 0x3bc
lea eax, [esp + 0x10fc]
push ebx
push eax
call fcn.005055e0
xor eax, eax
mov dword [esp + 0x1104], 0x3bc
inc eax
add esp, 0xc
mov dword [esp + 0x1100], eax
mov eax, dword [0x5f1f1c]
mov dword [esp + 0x10fc], eax
lea eax, [esp + 0x10f8]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp dword [0x5f1f14], 0
je 0x439da6
call fcn.00435e1e
lea ecx, [esp + 0x118]
call fcn.00447969
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10