Function at 0x40bc50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x442897
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x45878c]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
mov eax, dword [0x45878c]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
call fcn.004041f0
xor esi, esi
mov dword [esp + 0x140], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x140], 1
call fcn.0041068e
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x40bcc9
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov bl, 2
push str.C:WINDOWSexplorer.exe
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], bl
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 3
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bd2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_regedit.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 4
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bd78
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_alg.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 5
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bdc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_autochk.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 6
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40be0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32logonui.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 7
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40be59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_nvsvc32.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 8
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bea4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_rundll32.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 9
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40beef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_svchost.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xa
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bf3a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32winlogon.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xb
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bf85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32wuauclt.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xc
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bfd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_notepad.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xd
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c01b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_notepad.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xe
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c066
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_services.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xf
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c0b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_agentsvr.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x10
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c0fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32cscript.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x11
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c147
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32explorer.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x12
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c192
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_fltmc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x13
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c1dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32iedw.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x14
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c228
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32logagent.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x15
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c273
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32moviemk.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x16
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c2be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32mqbkup.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x17
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c309
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32mqsvc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x18
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c354
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32mqtgsvc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x19
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c39f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32mspaint.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1a
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c3ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_ntkrnlmp.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1b
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c435
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_ntkrnlpa.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1c
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c480
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_sc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1d
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c4cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_telnet.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1e
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c516
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_tlntsess.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x1f
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c561
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32w32tm.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x20
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c5ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32wmiprvse.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x21
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c5f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32wordpad.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x22
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c642
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32wscript.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x23
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c68d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_services.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x24
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c6d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_agentsvr.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x25
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c723
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachecscript.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x26
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c76e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcacheexplorer.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x27
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c7b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_fltmc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x28
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c804
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcacheiedw.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x29
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c84f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachelogagent.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2a
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c89a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachemoviemk.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2b
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c8e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachemqbkup.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2c
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c930
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachemqsvc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2d
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c97b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachemqtgsvc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2e
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c9c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachemspaint.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x2f
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ca11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_ntkrnlmp.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x30
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ca5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_ntkrnlpa.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x31
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40caa7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_ntkrpamp.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x32
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40caf2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_ntoskrnl.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x33
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cb3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_sc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x34
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cb88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_telnet.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x35
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cbd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcache_tlntsess.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x36
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cc1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachew32tm.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x37
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cc69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachewmiprvse.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x38
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ccb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachewordpad.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x39
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ccff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dllcachewscript.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3a
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cd4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32COMMAND.COM
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3b
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cd95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32ctfmon.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3c
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cde0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32mmc.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3d
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ce2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32dfrgntfs.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3e
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ce76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32SETUP.EXE
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x3f
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cec1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32MSIEXEC.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x40
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cf0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_scardsvr.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x41
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cf57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_runonce.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x42
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cfa2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32userinit.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x43
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40cfed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32winhlp32.exe
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x44
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d038
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32cdfview.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x45
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d083
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32wiaservc.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x46
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d0ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32ComRes.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x47
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32_rpcss.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x48
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d164
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32_batmeter.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x49
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d1af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32_rasadhlp.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4a
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d1fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32webcheck.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4b
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d245
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32webcheck.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4c
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d290
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32olepro32.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4d
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d2db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32hnetcfg.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4e
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d326
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32ddraw.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x4f
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d371
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32dsound.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x50
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d3bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32mobsync.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x51
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d407
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WindowsSystem32eventlog.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x52
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d452
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:WINDOWS_system32_avifile.dll
lea ecx, [esp + 0x10]
call fcn.00401920
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0x53
call fcn.00403a60
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x140], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d49d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x104
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0042d490
add esp, 0xc
push 0x104
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x30]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40d4c7
mov ecx, dword [str._bakfile.dat]
mov edx, dword [0x445974]
mov dword [eax], ecx
mov ecx, dword [0x445978]
mov dword [eax + 4], edx
mov dl, byte [0x44597c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00401920
sub esp, 0x10
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
mov byte [esp + 0x15c], 0x54
call fcn.00403120
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], bl
call fcn.00404270
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x140], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d55d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
cmp eax, esi
mov byte [esp + 0x140], 0
je 0x40d58f
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push ecx
push eax
call fcn.00402ce0
mov edx, dword [esp + 0x24]
push edx
call fcn.0040fe2e
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x140], 0xffffffff
call fcn.00404200
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0042d47b
add esp, 0x138
ret