Function at 0x40a7b0
Capabilities:
Check for time delay via gettickcount
Delete directory
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c208
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x438040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x43a84a
lea ecx, [ebp - 0x48]
call fcn.004031f0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00408ad0
mov dword [ebp - 4], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [ebp - 0x48]
mov ecx, ebx
mov byte [ebp - 0xd], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40a81d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0xd]
test al, al
jne 0x40a83f
mov ecx, 0xe
call fcn.00408c20
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b276
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b280
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push 0x439844
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004031f0
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.00401d80
push 0x80000002
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push 0x439d96
call fcn.004031f0
lea ecx, [ebp - 0x84]
call fcn.00401f70
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.00402920
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
js 0x40a931
push esi
push 0x439c92
lea eax, [ebp - 0x44]
push str._s__d
push eax
call fcn.00407c20
add esp, 0x10
push 0
push ecx
mov ecx, esp
push 0x439d14
call fcn.004031f0
mov edx, esi
lea ecx, [ebp - 0x48]
call fcn.004089f0
add esp, 8
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.00403180
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a931
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
mov eax, dword [esi - 0xc]
test eax, eax
setg byte [ebp - 0xd]
test eax, eax
jle 0x40b1ec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call edi
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b28a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00407c20
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp dword [eax - 0xc], 3
setg byte [ebp - 0xd]
jle 0x40b267
push 0x439c92
lea ecx, [ebp - 0x28]
call fcn.004031f0
mov byte [ebp - 4], 7
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b294
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x68]
push dword [ebp - 0x2c]
push 0x80000002
call fcn.00404240
test eax, eax
jne 0x40ab44
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x400
or eax, ecx
mov dword [ebp - 0x48], 0x400
jge 0x40aa30
push 0x400
lea ecx, [ebp - 0x14]
call fcn.00401430
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push edi
push str.UninstallString
lea ecx, [ebp - 0x68]
call fcn.00404150
push dword [edi - 8]
push edi
call fcn.00414692
add esp, 8
test eax, eax
js 0x40b2a8
cmp eax, dword [edi - 8]
jg 0x40b2a8
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
or ecx, 0xffffffff
xor esi, esi
nop dword [eax]
add ecx, 1
js 0x40ab44
cmp ecx, dword [edi - 0xc]
jge 0x40ab44
lea eax, [edi + ecx*2]
push 0x22
push eax
call fcn.0041111e
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40ab44
sub ecx, edi
sar ecx, 1
js 0x40ab44
inc esi
cmp esi, 3
jl 0x40aa70
mov eax, dword [edi - 0xc]
sub eax, ecx
lea ecx, [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004076e0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.00403180
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aae8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 1
jle 0x40ab44
lea eax, [edi + 2]
push 0x22
push eax
call fcn.0041111e
add esp, 8
test eax, eax
je 0x40ab44
sub eax, edi
sar eax, 1
js 0x40ab44
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.004075e0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.00403180
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab41
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b29e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
push 0x5c
push edi
mov byte [ebp - 4], 0xc
call fcn.00410ed2
add esp, 8
test eax, eax
je 0x40abb2
sub eax, edi
sar eax, 1
js 0x40abb2
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.004075e0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xd
call fcn.00403180
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40abaf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.004087a0
mov ecx, dword [ebp - 0x5c]
test al, al
je 0x40ad72
mov eax, dword [ebp - 0x58]
sub eax, ecx
mov dword [ebp - 0x48], 0
sar eax, 2
imul eax, eax, 0x451ab30b
mov dword [ebp - 0x3c], eax
test eax, eax
jle 0x40ad72
mov edi, dword [ebp - 0x24]
lea esi, [ecx + 0x82]
mov dword [ebp - 0x40], esi
mov ecx, eax
nop
cmp word [esi - 0x82], 0
lea eax, [esi - 0x82]
je 0x40ad54
push 0
push ecx
mov ecx, esp
push eax
call fcn.004031f0
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x38]
call fcn.004089f0
add esp, 8
push 0x439844
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004031f0
push 1
push 0x433f24
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
call fcn.00407b30
test esi, esi
jne 0x40ac69
xor ecx, ecx
jmp 0x40ac7f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ac70
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.00407b30
lea ecx, [edi - 0x10]
call fcn.00401350
add eax, 0x10
mov dword [ebp - 0x34], eax
push 1
push 0x433f24
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x11
call fcn.00407b30
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
push dword [eax - 0xc]
push eax
call fcn.00407b30
push 4
push 0x434100
lea ecx, [ebp - 0x34]
call fcn.00407b30
mov esi, dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
push 0x433f20
push 0x16
call fcn.00406f40
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
push 0x17
call fcn.00406f40
add esp, 0x10
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ad12
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ad30
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ad4e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
add esi, 0x28c
inc eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], eax
cmp eax, ecx
jl 0x40ac10
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
cmp dword [ecx - 4], 1
jle 0x40ad89
push dword [ecx - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00401540
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.00409570
mov eax, dword [ebp - 0x48]
push ecx
add eax, eax
mov dword [ebp - 0x4c], esp
mov ecx, esp
mov dword [0x438aa0], eax
push 0x439d96
mov dword [0x439834], 0
mov byte [ebp - 0xd], 1
call fcn.004031f0
push ecx
mov byte [ebp - 4], 0x12
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x439844
call fcn.004031f0
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push 0x439a4e
call fcn.004031f0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0xe
call fcn.00409ef0
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0x439844
call fcn.004031f0
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 4
jge 0x40ae1a
mov byte [ebp - 4], 0xe
lea edx, [eax - 0x10]
jmp 0x40aed4
mov ecx, 0x439844
call fcn.00409a00
cmp byte [0x439814], 0
mov byte [ebp - 0xd], al
jne 0x40aeca
push 0x439844
lea ecx, [ebp - 0x1c]
call fcn.004031f0
push 2
push 0x434224
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.00407b30
mov ecx, 0x43a7c8
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae60
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a7c8
lea ecx, [ebp - 0x1c]
call fcn.00407b30
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 4], 1
jle 0x40ae94
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00401540
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0xd], 0
je 0x40aeac
push 0x439844
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0x14
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aeca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aee8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x439814], 0
je 0x40afc5
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x40af3c
mov eax, dword [ebp - 0x54]
sub eax, ecx
sar eax, 2
imul eax, eax, 0x451ab30b
imul edx, eax, 0x28c
mov eax, ecx
cmp edx, 0x1000
jb 0x40af32
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b2b2
push edx
push ecx
call fcn.0040fabb
add esp, 8
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40af57
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40af65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40af80
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40af9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40afbc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 0xd], 1
jmp 0x40b1ec
push 0x439d96
lea ecx, [ebp - 0x50]
call fcn.004031f0
push 0x439844
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x16
call fcn.004031f0
push 1
push 0x433f24
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call fcn.00407b30
mov ecx, 0x43a7c8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b000
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a7c8
lea ecx, [ebp - 0x20]
call fcn.00407b30
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push 0x433f20
push 0x16
call fcn.00406f40
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push 0x17
call fcn.00406f40
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x28]
call fcn.00406220
add esp, 8
cmp dword [edi - 0xc], 3
jle 0x40b060
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.00402ae0
mov byte [ebp - 0xd], al
test al, al
jne 0x40b080
mov ecx, 8
call fcn.00408c20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40b099
test edx, edx
jne 0x40b0b3
push 0x63
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
mov byte [ebp - 4], 0x16
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b0d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b0ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x40b136
mov eax, dword [ebp - 0x54]
sub eax, ecx
sar eax, 2
imul eax, eax, 0x451ab30b
imul edx, eax, 0x28c
mov eax, ecx
cmp edx, 0x1000
jb 0x40b12c
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b2b2
push edx
push ecx
call fcn.0040fabb
add esp, 8
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b151
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40b15f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40b17a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b198
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
cmp byte [ebp - 0xd], 0
je 0x40b1b2
push dword [ebp - 0x2c]
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call edi
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b1ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x84]
call fcn.00401eb0
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b215
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b233
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40b252
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 2
call fcn.00408c20
jmp 0x40b19e
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80070057
call fcn.004016f0
call fcn.00414b5e
int3