Function at 0x40a7d0
Capabilities:
Check for time delay via gettickcount
Delete directory
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c248
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x438040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x43a84a
lea ecx, [ebp - 0x48]
call fcn.004031f0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00408af0
mov dword [ebp - 4], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [ebp - 0x48]
mov ecx, ebx
mov byte [ebp - 0xd], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40a83d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0xd]
test al, al
jne 0x40a85f
mov ecx, 0xe
call fcn.00408c40
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b296
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b2a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push 0x439844
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004031f0
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.00401d80
push 0x80000002
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push 0x439d96
call fcn.004031f0
lea ecx, [ebp - 0x84]
call fcn.00401f70
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.00402920
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
js 0x40a951
push esi
push 0x439c92
lea eax, [ebp - 0x44]
push str._s__d
push eax
call fcn.00407c20
add esp, 0x10
push 0
push ecx
mov ecx, esp
push 0x439d14
call fcn.004031f0
mov edx, esi
lea ecx, [ebp - 0x48]
call fcn.00408a10
add esp, 8
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.00403180
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a951
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
mov eax, dword [esi - 0xc]
test eax, eax
setg byte [ebp - 0xd]
test eax, eax
jle 0x40b20c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call edi
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b2aa
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00407c20
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp dword [eax - 0xc], 3
setg byte [ebp - 0xd]
jle 0x40b287
push 0x439c92
lea ecx, [ebp - 0x28]
call fcn.004031f0
mov byte [ebp - 4], 7
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b2b4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x68]
push dword [ebp - 0x2c]
push 0x80000002
call fcn.00404240
test eax, eax
jne 0x40ab64
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x400
or eax, ecx
mov dword [ebp - 0x48], 0x400
jge 0x40aa50
push 0x400
lea ecx, [ebp - 0x14]
call fcn.00401430
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push edi
push str.UninstallString
lea ecx, [ebp - 0x68]
call fcn.00404150
push dword [edi - 8]
push edi
call fcn.004146d4
add esp, 8
test eax, eax
js 0x40b2c8
cmp eax, dword [edi - 8]
jg 0x40b2c8
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
or ecx, 0xffffffff
xor esi, esi
nop dword [eax]
add ecx, 1
js 0x40ab64
cmp ecx, dword [edi - 0xc]
jge 0x40ab64
lea eax, [edi + ecx*2]
push 0x22
push eax
call fcn.0041115e
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40ab64
sub ecx, edi
sar ecx, 1
js 0x40ab64
inc esi
cmp esi, 3
jl 0x40aa90
mov eax, dword [edi - 0xc]
sub eax, ecx
lea ecx, [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004076e0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.00403180
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 1
jle 0x40ab64
lea eax, [edi + 2]
push 0x22
push eax
call fcn.0041115e
add esp, 8
test eax, eax
je 0x40ab64
sub eax, edi
sar eax, 1
js 0x40ab64
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.004075e0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.00403180
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab61
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40b2be
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
push 0x5c
push edi
mov byte [ebp - 4], 0xc
call fcn.00410f12
add esp, 8
test eax, eax
je 0x40abd2
sub eax, edi
sar eax, 1
js 0x40abd2
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.004075e0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xd
call fcn.00403180
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40abcf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
call fcn.004087c0
mov ecx, dword [ebp - 0x5c]
test al, al
je 0x40ad92
mov eax, dword [ebp - 0x58]
sub eax, ecx
mov dword [ebp - 0x48], 0
sar eax, 2
imul eax, eax, 0x451ab30b
mov dword [ebp - 0x3c], eax
test eax, eax
jle 0x40ad92
mov edi, dword [ebp - 0x24]
lea esi, [ecx + 0x82]
mov dword [ebp - 0x40], esi
mov ecx, eax
nop
cmp word [esi - 0x82], 0
lea eax, [esi - 0x82]
je 0x40ad74
push 0
push ecx
mov ecx, esp
push eax
call fcn.004031f0
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x38]
call fcn.00408a10
add esp, 8
push 0x439844
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004031f0
push 1
push 0x433f24
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
call fcn.00407b30
test esi, esi
jne 0x40ac89
xor ecx, ecx
jmp 0x40ac9f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ac90
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.00407b30
lea ecx, [edi - 0x10]
call fcn.00401350
add eax, 0x10
mov dword [ebp - 0x34], eax
push 1
push 0x433f24
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x11
call fcn.00407b30
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
push dword [eax - 0xc]
push eax
call fcn.00407b30
push 4
push 0x434100
lea ecx, [ebp - 0x34]
call fcn.00407b30
mov esi, dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
push 0x433f20
push 0x16
call fcn.00406f40
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
push 0x17
call fcn.00406f40
add esp, 0x10
mov byte [ebp - 4], 0x10
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ad32
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ad50
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ad6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
add esi, 0x28c
inc eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], eax
cmp eax, ecx
jl 0x40ac30
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
cmp dword [ecx - 4], 1
jle 0x40ada9
push dword [ecx - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00401540
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.00409590
mov eax, dword [ebp - 0x48]
push ecx
add eax, eax
mov dword [ebp - 0x4c], esp
mov ecx, esp
mov dword [0x438aa0], eax
push 0x439d96
mov dword [0x439834], 0
mov byte [ebp - 0xd], 1
call fcn.004031f0
push ecx
mov byte [ebp - 4], 0x12
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x439844
call fcn.004031f0
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push 0x439a4e
call fcn.004031f0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0xe
call fcn.00409f10
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0x439844
call fcn.004031f0
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 4
jge 0x40ae3a
mov byte [ebp - 4], 0xe
lea edx, [eax - 0x10]
jmp 0x40aef4
mov ecx, 0x439844
call fcn.00409a20
cmp byte [0x439814], 0
mov byte [ebp - 0xd], al
jne 0x40aeea
push 0x439844
lea ecx, [ebp - 0x1c]
call fcn.004031f0
push 2
push 0x434224
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.00407b30
mov ecx, 0x43a7c8
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae80
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a7c8
lea ecx, [ebp - 0x1c]
call fcn.00407b30
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 4], 1
jle 0x40aeb4
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00401540
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0xd], 0
je 0x40aecc
push 0x439844
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0x14
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aeea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40af08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x439814], 0
je 0x40afe5
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x40af5c
mov eax, dword [ebp - 0x54]
sub eax, ecx
sar eax, 2
imul eax, eax, 0x451ab30b
imul edx, eax, 0x28c
mov eax, ecx
cmp edx, 0x1000
jb 0x40af52
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b2d2
push edx
push ecx
call fcn.0040fafb
add esp, 8
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40af77
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40af85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40afa0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40afbe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40afdc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 0xd], 1
jmp 0x40b20c
push 0x439d96
lea ecx, [ebp - 0x50]
call fcn.004031f0
push 0x439844
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x16
call fcn.004031f0
push 1
push 0x433f24
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call fcn.00407b30
mov ecx, 0x43a7c8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b020
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a7c8
lea ecx, [ebp - 0x20]
call fcn.00407b30
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push 0x433f20
push 0x16
call fcn.00406f40
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push 0x17
call fcn.00406f40
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x28]
call fcn.00406220
add esp, 8
cmp dword [edi - 0xc], 3
jle 0x40b080
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.00402ae0
mov byte [ebp - 0xd], al
test al, al
jne 0x40b0a0
mov ecx, 8
call fcn.00408c40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40b0b9
test edx, edx
jne 0x40b0d3
push 0x63
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
mov byte [ebp - 4], 0x16
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b0f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b10f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x40b156
mov eax, dword [ebp - 0x54]
sub eax, ecx
sar eax, 2
imul eax, eax, 0x451ab30b
imul edx, eax, 0x28c
mov eax, ecx
cmp edx, 0x1000
jb 0x40b14c
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b2d2
push edx
push ecx
call fcn.0040fafb
add esp, 8
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b171
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40b17f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40b19a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b1b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
cmp byte [ebp - 0xd], 0
je 0x40b1d2
push dword [ebp - 0x2c]
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call edi
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b20c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x84]
call fcn.00401eb0
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b235
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b253
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40b272
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 2
call fcn.00408c40
jmp 0x40b1be
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80070057
call fcn.004016f0
call fcn.00414ba0
int3