Function at 0x427720
Capabilities:
Accept command line arguments
Check mutex on windows
Contain obfuscated stackstrings
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get comspec environment variable
Get file system object information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.0040b270
mov eax, dword [0x43b2c4]
xor eax, ebp
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x914], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x910], 0
mov dword [ebp - 0x904], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x908], 0
xor eax, eax
mov word [ebp - 0x498], ax
push 0x45e
push 0
lea ecx, [ebp - 0x496]
push ecx
call fcn.00401e30
add esp, 0xc
xor edx, edx
mov word [ebp - 0x8f8], dx
push 0x45e
push 0
lea eax, [ebp - 0x8f6]
push eax
call fcn.00401e30
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xb1e]
call fcn.004019d0
lea ecx, [ebp - 0xb1d]
call fcn.004019d0
mov dword [ebp - 0x14], str.ErrorInfo.log
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0xb1c], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040f1b0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0xb1e]
push eax
call fcn.00429910
mov byte [ebp - 0xb2c], 0x4d
mov byte [ebp - 0xb2b], 0x69
mov byte [ebp - 0xb2a], 0x63
mov byte [ebp - 0xb29], 0x72
mov ecx, dword [ebp - 0xb2c]
mov dword [0x43bf6c], ecx
mov byte [ebp - 0xb2c], 0x6f
mov byte [ebp - 0xb2b], 0x73
mov byte [ebp - 0xb2a], 0x6f
mov byte [ebp - 0xb29], 0x66
mov edx, dword [ebp - 0xb2c]
mov dword [0x43bf70], edx
mov byte [ebp - 0xb2c], 0x74
mov byte [ebp - 0xb2b], 0x2e
mov byte [ebp - 0xb2a], 0x4e
mov byte [ebp - 0xb29], 0x45
mov eax, dword [ebp - 0xb2c]
mov dword [0x43bf74], eax
lea ecx, [ebp - 0xb2d]
call fcn.004019d0
lea ecx, [ebp - 0xb2d]
push ecx
call fcn.0042bf90
lea ecx, [ebp - 0xb2d]
call fcn.004019e0
mov edx, dword [ebp + 8]
mov dword [0x455310], edx
push 0x118
push 0x455aa0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xb24], eax
cmp dword [ebp - 0x904], 2
jle 0x427a7f
mov dword [ebp - 0xb34], 0xffffffff
lea ecx, [ebp - 0x498]
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb38], 0
lea ecx, [ebp - 0xb3d]
call fcn.004019d0
mov dword [ebp - 0x914], 0x270f
mov dword [ebp - 0x8fc], 0
jmp 0x42792c
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x455aa0]
test ecx, ecx
je 0x427979
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x455aa0]
cmp eax, 0x5c
je 0x427964
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x455aa0]
cmp edx, 0x2f
jne 0x427977
mov eax, dword [ebp - 0x8fc]
lea ecx, [eax*2 + 0x455aa0]
mov dword [ebp - 0xb38], ecx
jmp 0x42791d
cmp dword [ebp - 0xb38], 0
je 0x42799c
xor edx, edx
mov eax, dword [ebp - 0xb38]
mov word [eax], dx
mov ecx, dword [ebp - 0xb38]
add ecx, 2
mov dword [0x43bf68], ecx
mov edx, dword [ebp - 0xb24]
mov eax, dword [edx + 4]
push eax
call fcn.00403eb7
add esp, 4
mov dword [ebp - 0xb34], eax
mov ecx, dword [ebp - 0xb3c]
push ecx
mov edx, dword [ebp - 0xb34]
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.0042b450
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb34]
push ecx
mov edx, dword [ebp - 0xb3c]
push edx
lea eax, [ebp - 0xb3d]
push eax
call fcn.0042a330
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xb34]
push edx
push str._____d___d__r_n
mov eax, dword [ebp - 0xb3c]
add eax, 0x27
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x4376a8
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x455aa0
push 0x4376d0
lea edx, [ebp - 0x8f8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb3c]
push eax
mov ecx, dword [ebp - 0xb3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x8f8]
push edx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb3d]
call fcn.004019e0
jmp 0x428bae
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x454a70], eax
cmp dword [0x454a70], 0
jne 0x427ab7
mov dword [ebp - 0x914], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
jmp 0x428bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0xb7
jne 0x427ae8
mov dword [ebp - 0x914], 0x270d
mov dword [ebp - 0x910], 0
jmp 0x428bae
lea ecx, [ebp - 0xb25]
call fcn.004019d0
lea ecx, [ebp - 0xb26]
call fcn.004019d0
lea eax, [ebp - 0xb25]
push eax
call fcn.00429b30
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb26]
push ecx
call fcn.0042d740
lea edx, [ebp - 0xb1e]
push edx
call fcn.004298e0
lea ecx, [ebp - 0xd60]
call fcn.004295e0
push 1
lea ecx, [ebp - 0xd60]
call fcn.00429300
test eax, eax
je 0x427b5f
lea eax, [ebp - 0xd60]
push eax
call fcn.00413b80
push 1
lea ecx, [ebp - 0xd60]
call fcn.00429220
jmp 0x427c50
mov dword [ebp - 0x914], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x455aa0
push 0x437710
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
lea ecx, [ebp - 0xd60]
call fcn.00429510
push eax
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xd60]
call fcn.00429550
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
lea ecx, [ebp - 0xd60]
call fcn.00429550
push 0x118
lea edx, [ebp - 0x8f8]
push edx
push 0xffffffffffffffff
push 0x430ee0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0x18], 0x36387828
mov dword [ebp - 0x8fc], 0
jmp 0x427ca4
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
movzx edx, word [ecx*2 + 0x455aa0]
test edx, edx
je 0x427cf1
mov eax, dword [ebp - 0x8fc]
movzx ecx, word [eax*2 + 0x455aa0]
cmp ecx, 0x5c
je 0x427cdc
mov edx, dword [ebp - 0x8fc]
movzx eax, word [edx*2 + 0x455aa0]
cmp eax, 0x2f
jne 0x427cef
mov ecx, dword [ebp - 0x8fc]
lea edx, [ecx*2 + 0x455aa0]
mov dword [ebp - 0xd64], edx
jmp 0x427c95
cmp dword [ebp - 0xd64], 0
je 0x427d14
xor eax, eax
mov ecx, dword [ebp - 0xd64]
mov word [ecx], ax
mov edx, dword [ebp - 0xd64]
add edx, 2
mov dword [0x43bf68], edx
mov eax, dword [0x43bf68]
push eax
push 0x437780
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x427d4e
mov dword [ebp - 0x914], 0x3df
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
lea ecx, [ebp - 0x8f8]
push ecx
push 0x455aa0
push 0x43771c
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x498]
push ecx
call fcn.004010b0
add esp, 8
test eax, eax
jge 0x427dae
mov dword [ebp - 0x914], 0x3e0
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
lea edx, [ebp - 0x900]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0x41d0d0
push 0
push 0
call fcn.00403c1b
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427ebf
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x455aa0
push 0x4377a0
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.parserSearchThread_Call_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push 0x4377e8
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.parserchk.txt
push 0x455aa0
push 0x437850
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x427f5a
mov dword [0x455338], 1
push str.parsernot.txt
push 0x455aa0
push 0x437878
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x427f5a
mov dword [0x455338], 2
push 0x455aa0
push str._sHTTP_Parser.chm
push 0x455cd0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xd74], 0
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xd6c], 0
mov dword [ebp - 0xd70], 0
push str.BINTYPE
push 0x12d
mov eax, dword [0x455310]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0xd74], 0
je 0x428070
push 0x460
push 0
lea ecx, [ebp - 0x498]
push ecx
call fcn.00401e30
add esp, 0xc
cmp dword [ebp - 0xd74], 0
je 0x428004
mov edx, dword [ebp - 0xd74]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xd68], eax
cmp dword [ebp - 0xd74], 0
je 0x428024
mov ecx, dword [ebp - 0xd74]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd68], 0
je 0x428040
mov eax, dword [ebp - 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xd70], eax
lea ecx, [ebp - 0x498]
push ecx
push str.logo.gif
mov edx, dword [ebp - 0xd6c]
push edx
mov eax, dword [ebp - 0xd70]
push eax
call fcn.004197b0
lea ecx, [ebp - 0x498]
push ecx
call fcn.0040e4d0
mov dword [0x455314], eax
cmp dword [ebp - 0xd68], 0
je 0x428086
mov edx, dword [ebp - 0xd68]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x455aa0
push str._s_themes_b_good.bmp
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x455aa0
push str._s_themes_b_bad.bmp
lea ecx, [ebp - 0x8f8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x455aa0
push str._s_themes_b_desktop.bmp
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x498]
push eax
call fcn.0040e4d0
mov dword [0x455318], eax
lea ecx, [ebp - 0x8f8]
push ecx
call fcn.0040e4d0
mov dword [0x45531c], eax
lea edx, [ebp - 0xb18]
push edx
call fcn.0040e4d0
mov dword [0x455320], eax
mov dword [ebp - 0xd78], 0x900000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x454a7c], eax
cmp dword [0x454a7c], 0xffffffff
jne 0x428227
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
mov dword [0x454a7c], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x455aa0
push 0x43798c
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x910]
push eax
push str.Mail_Handle_Create_Error
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x4379d0
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xb1c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x498]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xb1c]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
push str.PARSER_SHARED_MAPMEMORY
mov ecx, dword [ebp - 0xd78]
push ecx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x454a80], eax
cmp dword [0x454a80], 0
jne 0x428339
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x14]
push eax
push 0x455aa0
push 0x437a4c
lea ecx, [ebp - 0xb18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0x910]
push edx
push 0x437a58
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x20]
push edx
movzx eax, word [ebp - 0x22]
push eax
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x28]
push edx
push 0x437a88
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xb1c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x498]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xb1c]
push eax
mov ecx, dword [ebp - 0xb1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xb18]
push edx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
mov eax, dword [ebp - 0xd78]
push eax
push 0
push 0
push 2
mov ecx, dword [0x454a80]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x454a88], eax
cmp dword [0x454a88], 0
jne 0x42844b
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x14]
push eax
push 0x455aa0
push 0x437ad4
lea ecx, [ebp - 0xb18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0x910]
push edx
push str.Map_Handle_Create_Error
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x20]
push edx
movzx eax, word [ebp - 0x22]
push eax
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x28]
push edx
push 0x437b10
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov ecx, dword [ebp - 0xb1c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x498]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xb1c]
push eax
mov ecx, dword [ebp - 0xb1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xb18]
push edx
call fcn.00401540
add esp, 0xc
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
jmp 0x428bae
mov eax, dword [0x454a88]
add eax, 0x100000
mov dword [0x4561b8], eax
mov dword [ebp - 0xd80], 8
mov dword [ebp - 0xd7c], 0x3ff
lea ecx, [ebp - 0xd80]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [ebp - 0xb26]
call fcn.004019e0
lea ecx, [ebp - 0xb25]
call fcn.004019e0
push 0x100
push 0x455670
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x4284ba
push str.cmd.exe
push 0x455670
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5460
push 0
push 0x44d968
call fcn.00401e30
add esp, 0xc
push 0x437b7c
push 0x455aa0
push 0x437b98
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x498]
push ecx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x428520
push 0x44d968
push 0x5460
lea edx, [ebp - 0x498]
push edx
call fcn.004012f0
add esp, 0xc
push 0x43bf6c
push 0x430ee0
call fcn.0040e510
mov dword [0x455324], 1
lea eax, [ebp - 0x900]
push eax
push 0
push 0
push 0x419880
push 0
push 0
call fcn.00403c1b
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x428632
mov dword [ebp - 0x914], 0x3e1
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x14]
push edx
push 0x455aa0
push 0x437ba4
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x910]
push ecx
push str.sessionSearchThread_Call_Error
movzx edx, word [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x26]
push eax
movzx ecx, word [ebp - 0x28]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xb1c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xb1c]
push edx
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xb18]
push ecx
call fcn.00401540
add esp, 0xc
jmp 0x428bae
call fcn.0040ed30
push str._test.html
call fcn.0040e550
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x428851
mov dword [ebp - 0x8fc], 0
jmp 0x428669
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x42869e
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x42869c
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x10], edx
jmp 0x42865a
cmp dword [ebp - 0x10], 0
jne 0x4286ab
mov dword [ebp - 0x10], 0x437c54
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x455328], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x4286e0
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
movzx eax, word [edx + 0x44d468]
test eax, eax
je 0x42872a
mov ecx, dword [ebp - 0x90c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
add eax, 0x44d468
push eax
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x428728
mov ecx, dword [ebp - 0x8fc]
mov dword [0x455328], ecx
jmp 0x42872a
jmp 0x4286d1
cmp dword [0x455328], 0xffffffff
jne 0x4287bd
mov dword [ebp - 0x10], str.msedge.exe
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x455328], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x428773
mov eax, dword [ebp - 0x8fc]
add eax, 1
mov dword [ebp - 0x8fc], eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
movzx edx, word [ecx + 0x44d468]
test edx, edx
je 0x4287bd
mov eax, dword [ebp - 0x90c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x8fc]
shl edx, 7
add edx, 0x44d468
push edx
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x4287bb
mov eax, dword [ebp - 0x8fc]
mov dword [0x455328], eax
jmp 0x4287bd
jmp 0x428764
cmp dword [0x455328], 0xffffffff
jne 0x428851
mov dword [ebp - 0x10], str.iexplore.exe
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x90c], eax
mov dword [0x455328], 0xffffffff
mov dword [ebp - 0x8fc], 0
jmp 0x428806
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x8fc]
shl eax, 7
movzx ecx, word [eax + 0x44d468]
test ecx, ecx
je 0x428851
mov edx, dword [ebp - 0x90c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x8fc]
shl ecx, 7
add ecx, 0x44d468
push ecx
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x42884f
mov edx, dword [ebp - 0x8fc]
mov dword [0x455328], edx
jmp 0x428851
jmp 0x4287f7
push str.parsercommon.data
push 0x455aa0
push 0x437cc4
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x910]
push ecx
lea edx, [ebp - 0x498]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x4288d2
push 0x452dc8
push 0x310
lea eax, [ebp - 0x498]
push eax
call fcn.004012f0
add esp, 0xc
test eax, eax
jl 0x4288cb
mov ecx, dword [0x452dd0]
mov dword [0x455328], ecx
mov edx, dword [0x452dd4]
mov dword [0x43bf40], edx
mov eax, dword [0x452dcc]
mov dword [0x45532c], eax
jmp 0x4288d2
mov byte [0x452dc8], 0
movzx ecx, byte [0x452dc8]
test ecx, ecx
jne 0x428952
mov byte [0x452dc8], 9
mov byte [0x452dc9], 9
mov byte [0x452dca], 3
mov byte [0x452dcb], 3
mov edx, dword [0x45532c]
mov dword [0x452dcc], edx
mov eax, dword [0x455328]
mov dword [0x452dd0], eax
mov ecx, dword [0x43bf40]
mov dword [0x452dd4], ecx
mov byte [0x452dd8], 0
mov byte [0x452dd9], 0
mov byte [0x452dda], 0
mov byte [0x452ddc], 0
push 0
push 0x452dc8
push 0x310
lea edx, [ebp - 0x498]
push edx
call fcn.00401400
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x456154], eax
cmp dword [0x456154], 0
je 0x4289d2
mov dword [ebp - 0x1040], 0x99
jmp 0x42898b
mov eax, dword [ebp - 0x1040]
add eax, 1
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0xb5
jg 0x4289d2
push 0
push 0x10
push 0x10
push 1
movzx ecx, word [ebp - 0x1040]
push ecx
mov edx, dword [0x455310]
push edx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x103c]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x456154]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x42897c
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov edx, dword [0x455310]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x456150], eax
push 0x4000
push 0x2b4
lea eax, [ebp - 0x1038]
push eax
push 0
push 0x437cd0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x456148], eax
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x1038]
push ecx
push 0
push 0x437cd8
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x45614c], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x428a75
push str.HtmlHelpW
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4561c0], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x428a9d
push str.ImmAssociateContext
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4561bc], eax
mov dword [ebp - 0x1048], 8
mov dword [ebp - 0x1044], 0x3ff
lea ecx, [ebp - 0x1048]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x8d
mov edx, dword [0x455310]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x454a6c], eax
push 0
push 0x423830
push 0
push 0x259
mov eax, dword [0x455310]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x455308], 0
mov dword [0x455324], 0
push 0x455aa0
push str._slist.txt
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x454a84], 0
je 0x428b6a
push 0x1388
mov edx, dword [0x454a84]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x454a84]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00414140
push str.sitelink.txt
push 0x455aa0
push str._s_s
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x44d968
push 0x5460
lea edx, [ebp - 0x498]
push edx
call fcn.00401400
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x10
cmp dword [0x456158], 0
je 0x428bca
mov eax, dword [0x456158]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x456150], 0
je 0x428be0
mov ecx, dword [0x456150]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x456154], 0
je 0x428bf6
mov edx, dword [0x456154]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x454a88], 0
je 0x428c0b
mov eax, dword [0x454a88]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x454a80], 0
je 0x428c21
mov ecx, dword [0x454a80]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x454a7c], 0
je 0x428c37
mov edx, dword [0x454a7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x454a70], 0
je 0x428c4c
mov eax, dword [0x454a70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x914]
mov dword [ebp - 0x1050], ecx
cmp dword [ebp - 0x1050], 0x3df
jg 0x428c86
cmp dword [ebp - 0x1050], 0x3df
je 0x428d32
cmp dword [ebp - 0x1050], 0
je 0x428d24
jmp case.default.0x428d18
cmp dword [ebp - 0x1050], 0x3e9
jg 0x428cd7
cmp dword [ebp - 0x1050], 0x3e9
je 0x428e34
cmp dword [ebp - 0x1050], 0x3e0
je 0x428d68
cmp dword [ebp - 0x1050], 0x3e1
je 0x428d9e
cmp dword [ebp - 0x1050], 0x3e2
je 0x428df7
jmp case.default.0x428d18
cmp dword [ebp - 0x1050], 0x270e
jg 0x428d1f
cmp dword [ebp - 0x1050], 0x270d
jge 0x428fbb
mov edx, dword [ebp - 0x1050]
sub edx, 0x3ea
mov dword [ebp - 0x1050], edx
cmp dword [ebp - 0x1050], 3
ja case.default.0x428d18
mov eax, dword [ebp - 0x1050]
jmp dword [eax*4 + 0x429074]
jmp case.default.0x428d18
xor ecx, ecx
mov word [ebp - 0x498], cx
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428d51
push 0x437d88
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x428d63
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428d87
push 0x437e88
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x428d99
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428dcb
mov eax, dword [ebp - 0x910]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x437f80
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x428deb
mov eax, dword [ebp - 0x910]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.OS_state_is_unstable___d_:__d_
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xc], 0x30
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428e16
push 0x438048
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x428e28
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0xc], 0x30
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428e63
lea edx, [ebp - 0xb1e]
push edx
call fcn.00429640
push eax
push 0x438128
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x428e85
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.00429640
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428eb9
lea eax, [ebp - 0xb1e]
push eax
call fcn.00429640
push eax
push 0x438328
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x428edb
lea edx, [ebp - 0xb1e]
push edx
call fcn.00429640
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428f0f
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.00429640
push eax
push 0x438528
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x428f31
lea eax, [ebp - 0xb1e]
push eax
call fcn.00429640
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428f5c
mov edx, dword [ebp - 4]
push edx
push 0x438728
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x428f75
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428fa0
mov eax, dword [ebp - 4]
push eax
push 0x438928
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x428fb9
mov edx, dword [ebp - 4]
push edx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429012
push 0
call fcn.0040f1b0
test eax, eax
je 0x428fe4
mov ecx, dword [ebp - 0x910]
push ecx
push 0x438b28
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x429000
mov eax, dword [ebp - 0x910]
push eax
push 0x438b58
lea ecx, [ebp - 0x498]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0xc], 0x30
jmp 0x429012
xor edx, edx
mov word [ebp - 0x498], dx
movzx eax, word [ebp - 0x498]
test eax, eax
je 0x42903a
mov ecx, dword [ebp - 0xc]
push ecx
push str._notification_BOX
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x104c], eax
lea ecx, [ebp - 0xb1d]
call fcn.004019e0
lea ecx, [ebp - 0xb1e]
call fcn.004019e0
mov eax, dword [ebp - 0x104c]
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.00401e17
mov esp, ebp
pop ebp
ret 0x10