Function at 0x423e20
Capabilities:
Accept command line arguments
Check mutex on windows
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get file system object information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.00409cc0
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xb10], 0
xor eax, eax
mov word [ebp - 0x698], ax
push 0x45e
push 0
lea ecx, [ebp - 0x696]
push ecx
call fcn.00401b10
add esp, 0xc
xor edx, edx
mov word [ebp - 0xb00], dx
push 0x45e
push 0
lea eax, [ebp - 0xafe]
push eax
call fcn.00401b10
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xd20], cx
push 0x1fe
push 0
lea edx, [ebp - 0xd1e]
push edx
call fcn.00401b10
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00401b10
add esp, 0xc
xor edx, edx
mov word [ebp - 0xf30], dx
push 0x1fe
push 0
lea eax, [ebp - 0xf2e]
push eax
call fcn.00401b10
add esp, 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0xd25]
call fcn.00401ac0
mov dword [ebp - 0x220], str.ErrorInfo.log
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0xd24], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
push edx
call fcn.0040c860
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp - 0xf31]
call fcn.00401ac0
lea eax, [ebp - 0xf31]
push eax
call fcn.00428530
lea ecx, [ebp - 0xf31]
call fcn.00401ad0
mov ecx, dword [ebp + 8]
mov dword [0x456ee8], ecx
push 0x118
push 0x457150
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 5]
call fcn.00401ac0
lea ecx, [ebp - 0x699]
call fcn.00401ac0
lea edx, [ebp - 5]
push edx
call fcn.00426270
mov dword [ebp - 4], eax
lea eax, [ebp - 0x699]
push eax
call fcn.00429d00
lea ecx, [ebp - 0xb0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xb0c], 2
jle 0x42417e
mov dword [ebp - 0xf38], 0xffffffff
lea edx, [ebp - 0x698]
mov dword [ebp - 0xf40], edx
mov dword [ebp - 0xf3c], 0
lea ecx, [ebp - 0xf41]
call fcn.00401ac0
mov dword [ebp - 0xb1c], 0x270f
mov dword [ebp - 0xb04], 0
jmp 0x42402b
mov eax, dword [ebp - 0xb04]
add eax, 1
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457150]
test edx, edx
je 0x424078
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457150]
cmp ecx, 0x5c
je 0x424063
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457150]
cmp eax, 0x2f
jne 0x424076
mov ecx, dword [ebp - 0xb04]
lea edx, [ecx*2 + 0x457150]
mov dword [ebp - 0xf3c], edx
jmp 0x42401c
cmp dword [ebp - 0xf3c], 0
je 0x42409b
xor eax, eax
mov ecx, dword [ebp - 0xf3c]
mov word [ecx], ax
mov edx, dword [ebp - 0xf3c]
add edx, 2
mov dword [0x43dccc], edx
mov eax, dword [ebp - 0xd2c]
mov ecx, dword [eax + 4]
push ecx
call fcn.004039e2
add esp, 4
mov dword [ebp - 0xf38], eax
mov edx, dword [ebp - 0xf40]
push edx
mov eax, dword [ebp - 0xf38]
push eax
lea ecx, [ebp - 0xf41]
push ecx
call fcn.00427bb0
mov dword [ebp - 4], eax
lea edx, [ebp - 0xf38]
push edx
mov eax, dword [ebp - 0xf40]
push eax
lea ecx, [ebp - 0xf41]
push ecx
call fcn.00426a90
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xf38]
push eax
push str._____d___d__r_n
mov ecx, dword [ebp - 0xf40]
add ecx, 0x27
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push 0x438184
mov edx, dword [ebp - 0xf40]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.wiatrcvw.txt
push 0x457150
push 0x4381ac
lea eax, [ebp - 0xb00]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0xf40]
push ecx
mov edx, dword [ebp - 0xf40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xb00]
push eax
call fcn.00401360
add esp, 0xc
lea ecx, [ebp - 0xf41]
call fcn.00401ad0
jmp 0x425343
push str.GlobalFileEventMultexSW
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x456648], eax
cmp dword [0x456648], 0
jne 0x4241b6
mov dword [ebp - 0xb1c], 0x270e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
jmp 0x425343
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
cmp dword [ebp - 0xb18], 0xb7
jne 0x4241e7
mov dword [ebp - 0xb1c], 0x270d
mov dword [ebp - 0xb18], 0
jmp 0x425343
push 1
push str.HTTP_Parser_Log.txt
call fcn.00425ad0
push 0x438214
call fcn.00425950
add esp, 4
push 0x457150
push 0x438218
call fcn.00425950
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
push str.__tWinMain__________________CodePage_______________________d_
call fcn.00425950
add esp, 8
mov edx, dword [ebp - 0xb0c]
push edx
push str.__tWinMain__________________Arg_Count______________________d_
call fcn.00425950
add esp, 8
mov eax, dword [ebp - 4]
push eax
push str.__tWinMain__________________ActUserNameInformation_________d_
call fcn.00425950
add esp, 8
lea ecx, [ebp - 5]
push ecx
call fcn.004263c0
push eax
push str.__tWinMain__________________Logon_UserCount________________d_
call fcn.00425950
add esp, 8
lea edx, [ebp - 5]
push edx
call fcn.004263d0
push eax
push str.__tWinMain__________________ActiveUserName_________________s_
call fcn.00425950
add esp, 8
push str.__tWinMain__________________Start________
call fcn.00425950
add esp, 4
lea ecx, [ebp - 0x1168]
call fcn.00426220
push 1
lea ecx, [ebp - 0x1168]
call fcn.00425f40
test eax, eax
je 0x4242c0
lea eax, [ebp - 0x1168]
push eax
call fcn.0040fa60
push 1
lea ecx, [ebp - 0x1168]
call fcn.00425e60
jmp 0x4243b3
mov dword [ebp - 0xb1c], 0x3e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x220]
push edx
push 0x457150
push 0x438598
lea eax, [ebp - 0xd20]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0xb18]
push ecx
lea ecx, [ebp - 0x1168]
call fcn.00426150
push eax
movzx edx, word [ebp - 0x224]
push edx
movzx eax, word [ebp - 0x226]
push eax
movzx ecx, word [ebp - 0x228]
push ecx
movzx edx, word [ebp - 0x22a]
push edx
movzx eax, word [ebp - 0x22e]
push eax
movzx ecx, word [ebp - 0x230]
push ecx
push str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xd24]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x698]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xd24]
push edx
mov eax, dword [ebp - 0xd24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xd20]
push ecx
call fcn.00401360
add esp, 0xc
lea ecx, [ebp - 0x1168]
call fcn.00426190
jmp 0x425343
lea ecx, [ebp - 0x1168]
call fcn.00426190
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0xb04], 0
jmp 0x4243e3
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
movzx ecx, word [eax*2 + 0x457150]
test ecx, ecx
je 0x424430
mov edx, dword [ebp - 0xb04]
movzx eax, word [edx*2 + 0x457150]
cmp eax, 0x5c
je 0x42441b
mov ecx, dword [ebp - 0xb04]
movzx edx, word [ecx*2 + 0x457150]
cmp edx, 0x2f
jne 0x42442e
mov eax, dword [ebp - 0xb04]
lea ecx, [eax*2 + 0x457150]
mov dword [ebp - 0x116c], ecx
jmp 0x4243d4
cmp dword [ebp - 0x116c], 0
je 0x424453
xor edx, edx
mov eax, dword [ebp - 0x116c]
mov word [eax], dx
mov ecx, dword [ebp - 0x116c]
add ecx, 2
mov dword [0x43dccc], ecx
mov edx, dword [0x43dccc]
push edx
push 0x438608
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x424478
mov dword [ebp - 0xb1c], 0x3df
jmp 0x425343
push str.parser_manifest.xml
push 0x457150
push 0x4385a4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str.regist.txt
push 0x457150
push 0x438668
lea ecx, [ebp - 0xf30]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xb18]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jge 0x4244df
mov dword [ebp - 0xb1c], 0x3e0
jmp 0x425343
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0xf30]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jge 0x42452a
push 0
push 9
lea eax, [ebp - 0xf30]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00416c50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x424528
mov dword [ebp - 0xb1c], 0x3e9
jmp 0x425343
jmp 0x424559
push 0
push 1
lea edx, [ebp - 0xf30]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00416c50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x424559
mov dword [ebp - 0xb1c], 0x3ea
jmp 0x425343
push str.parserchk.txt
push 0x457150
push 0x438690
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xb18]
push edx
lea eax, [ebp - 0x698]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x4245df
mov dword [0x456f0c], 1
push str.parsernot.txt
push 0x457150
push 0x4386b8
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xb18]
push edx
lea eax, [ebp - 0x698]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x4245df
mov dword [0x456f0c], 2
push 0x457150
push str._sHTTP_Parser.chm
push 0x457380
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x117c], 0
mov dword [ebp - 0x1170], 0
mov dword [ebp - 0x1174], 0
mov dword [ebp - 0x1178], 0
push str.BINTYPE
push 0x12d
mov ecx, dword [0x456ee8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 0
je 0x4246eb
push 0x460
push 0
lea edx, [ebp - 0x698]
push edx
call fcn.00401b10
add esp, 0xc
cmp dword [ebp - 0x117c], 0
je 0x42467f
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x117c], 0
je 0x42469f
mov edx, dword [ebp - 0x117c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1170], 0
je 0x4246bb
mov ecx, dword [ebp - 0x1170]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1178], eax
lea edx, [ebp - 0x698]
push edx
push str.logo.gif
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, dword [ebp - 0x1178]
push ecx
call fcn.0040f990
lea edx, [ebp - 0x698]
push edx
call fcn.0040bf10
mov dword [0x456eec], eax
cmp dword [ebp - 0x1170], 0
je 0x424701
mov eax, dword [ebp - 0x1170]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x457150
push str._s_themes_b_good.bmp
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457150
push str._s_themes_b_bad.bmp
lea edx, [ebp - 0xb00]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x457150
push str._s_themes_b_desktop.bmp
lea eax, [ebp - 0xd20]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x698]
push ecx
call fcn.0040bf10
mov dword [0x456ef0], eax
lea edx, [ebp - 0xb00]
push edx
call fcn.0040bf10
mov dword [0x456ef4], eax
lea eax, [ebp - 0xd20]
push eax
call fcn.0040bf10
mov dword [0x456ef8], eax
mov dword [ebp - 0x1180], 0x900000
push 0
push 0
push 0x878
push str..mailslotparser_manage
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [0x456654], eax
cmp dword [0x456654], 0xffffffff
jne 0x4248a4
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
mov dword [0x456654], 0
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0x220]
push edx
push 0x457150
push 0x4387cc
lea eax, [ebp - 0xd20]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0xb18]
push ecx
push str.Mail_Handle_Create_Error
movzx edx, word [ebp - 0x224]
push edx
movzx eax, word [ebp - 0x226]
push eax
movzx ecx, word [ebp - 0x228]
push ecx
movzx edx, word [ebp - 0x22a]
push edx
movzx eax, word [ebp - 0x22e]
push eax
movzx ecx, word [ebp - 0x230]
push ecx
push 0x438810
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov eax, dword [ebp - 0xd24]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x698]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xd24]
push edx
mov eax, dword [ebp - 0xd24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0xd20]
push ecx
call fcn.00401360
add esp, 0xc
jmp 0x425343
push str.PARSER_SHARED_MAPMEMORY
mov edx, dword [ebp - 0x1180]
push edx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x456658], eax
cmp dword [0x456658], 0
jne 0x4249b8
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457150
push 0x43888c
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
push 0x438898
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push 0x4388c8
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.00401360
add esp, 0xc
jmp 0x425343
mov ecx, dword [ebp - 0x1180]
push ecx
push 0
push 0
push 2
mov edx, dword [0x456658]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x456660], eax
cmp dword [0x456660], 0
jne 0x424acc
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457150
push 0x438914
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
push str.Map_Handle_Create_Error
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push 0x438950
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.00401360
add esp, 0xc
jmp 0x425343
mov ecx, dword [0x456660]
add ecx, 0x100000
mov dword [0x457b14], ecx
mov edx, dword [0x456660]
push edx
push str.__tWinMain__________________SharedMemory___________________08X_
call fcn.00425950
add esp, 8
mov dword [ebp - 0x1188], 8
mov dword [ebp - 0x1184], 0x3ff
lea eax, [ebp - 0x1188]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x5460
push 0
push 0x44f6a8
call fcn.00401b10
add esp, 0xc
push 0x43899c
push 0x457150
push 0x438a3c
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xb18]
push edx
lea eax, [ebp - 0x698]
push eax
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x424b79
push 0x44f6a8
push 0x5460
lea ecx, [ebp - 0x698]
push ecx
call fcn.00401190
add esp, 0xc
mov dword [0x456efc], 1
lea edx, [ebp - 0xb08]
push edx
push 0
push 0
push 0x419420
push 0
push 0
call fcn.00403821
add esp, 0x18
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x424c9a
mov dword [ebp - 0xb1c], 0x3e1
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb18], eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x457150
push 0x438a48
lea edx, [ebp - 0xd20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0xb18]
push eax
push str.sessionSearchThread_Call_Error
movzx ecx, word [ebp - 0x224]
push ecx
movzx edx, word [ebp - 0x226]
push edx
movzx eax, word [ebp - 0x228]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22e]
push edx
movzx eax, word [ebp - 0x230]
push eax
push str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
push 0
push 0x118
mov edx, dword [ebp - 0xd24]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x698]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0xd24]
push ecx
mov edx, dword [ebp - 0xd24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.00401360
add esp, 0xc
jmp 0x425343
call fcn.0040c3e0
mov dword [ebp - 0xb04], 0
jmp 0x424cba
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
movzx eax, word [edx + 0x44f428]
test eax, eax
je 0x424ced
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
add ecx, 0x44f428
push ecx
push str.__tWinMain__________________InstBrowser____________________s_
call fcn.00425950
add esp, 8
jmp 0x424cab
push str._test.html
call fcn.0040bf50
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x424f37
mov dword [ebp - 0xb04], 0
jmp 0x424d25
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x424d66
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x424d64
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x238]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x21c], edx
jmp 0x424d16
cmp dword [ebp - 0x21c], 0
jne 0x424d79
mov dword [ebp - 0x21c], 0x438b98
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456f00], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x424db1
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
movzx eax, word [edx + 0x44f1a8]
test eax, eax
je 0x424dfe
mov ecx, dword [ebp - 0xb14]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
add eax, 0x44f1a8
push eax
call fcn.00401460
add esp, 0xc
test eax, eax
jne 0x424dfc
mov ecx, dword [ebp - 0xb04]
mov dword [0x456f00], ecx
jmp 0x424dfe
jmp 0x424da2
cmp dword [0x456f00], 0xffffffff
jne 0x424e9a
mov dword [ebp - 0x21c], str.msedge.exe
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456f00], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x424e4d
mov eax, dword [ebp - 0xb04]
add eax, 1
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
movzx edx, word [ecx + 0x44f1a8]
test edx, edx
je 0x424e9a
mov eax, dword [ebp - 0xb14]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0xb04]
shl edx, 7
add edx, 0x44f1a8
push edx
call fcn.00401460
add esp, 0xc
test eax, eax
jne 0x424e98
mov eax, dword [ebp - 0xb04]
mov dword [0x456f00], eax
jmp 0x424e9a
jmp 0x424e3e
cmp dword [0x456f00], 0xffffffff
jne 0x424f37
mov dword [ebp - 0x21c], str.iexplore.exe
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb14], eax
mov dword [0x456f00], 0xffffffff
mov dword [ebp - 0xb04], 0
jmp 0x424ee9
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb04]
shl eax, 7
movzx ecx, word [eax + 0x44f1a8]
test ecx, ecx
je 0x424f37
mov edx, dword [ebp - 0xb14]
push edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0xb04]
shl ecx, 7
add ecx, 0x44f1a8
push ecx
call fcn.00401460
add esp, 0xc
test eax, eax
jne 0x424f35
mov edx, dword [ebp - 0xb04]
mov dword [0x456f00], edx
jmp 0x424f37
jmp 0x424eda
mov eax, dword [0x456f00]
shl eax, 7
add eax, 0x44f1a8
push eax
mov ecx, dword [0x456f00]
shl ecx, 7
add ecx, 0x44f428
push ecx
mov edx, dword [0x456f00]
push edx
push str.__tWinMain__________________DefaultBrowser_________________d___s_:__s_
call fcn.00425950
add esp, 0x10
push str.parsercommon.data
push 0x457150
push 0x438c7c
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xb18]
push ecx
lea edx, [ebp - 0x698]
push edx
call fcn.004010b0
add esp, 8
test eax, eax
jl 0x424fea
push 0x454b08
push 0x310
lea eax, [ebp - 0x698]
push eax
call fcn.00401190
add esp, 0xc
test eax, eax
jl 0x424fe3
mov ecx, dword [0x454b10]
mov dword [0x456f00], ecx
mov edx, dword [0x454b14]
mov dword [0x43dcb0], edx
mov eax, dword [0x454b0c]
mov dword [0x456f04], eax
jmp 0x424fea
mov byte [0x454b08], 0
movzx ecx, byte [0x454b08]
test ecx, ecx
jne 0x42506a
mov byte [0x454b08], 9
mov byte [0x454b09], 9
mov byte [0x454b0a], 3
mov byte [0x454b0b], 3
mov edx, dword [0x456f04]
mov dword [0x454b0c], edx
mov eax, dword [0x456f00]
mov dword [0x454b10], eax
mov ecx, dword [0x43dcb0]
mov dword [0x454b14], ecx
mov byte [0x454b18], 0
mov byte [0x454b19], 0
mov byte [0x454b1a], 0
mov byte [0x454b1c], 0
push 0
push 0x454b08
push 0x310
lea edx, [ebp - 0x698]
push edx
call fcn.00401280
add esp, 0x10
push 0
push 0
push 0x21
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov dword [0x457ab4], eax
cmp dword [0x457ab4], 0
je 0x4250ea
mov dword [ebp - 0x1448], 0x99
jmp 0x4250a3
mov eax, dword [ebp - 0x1448]
add eax, 1
mov dword [ebp - 0x1448], eax
cmp dword [ebp - 0x1448], 0xb5
jg 0x4250ea
push 0
push 0x10
push 0x10
push 1
movzx ecx, word [ebp - 0x1448]
push ecx
mov edx, dword [0x456ee8]
push edx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x1444]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x457ab4]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
jmp 0x425094
push 0x1000
push 0
push 0xff000000
push 0
push 0xf
push 0x14c
mov edx, dword [0x456ee8]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov dword [0x457ab0], eax
push 0x4000
push 0x2b4
lea eax, [ebp - 0x1440]
push eax
push 0
push 0x438c88
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x457aa8], eax
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x1440]
push ecx
push 0
push 0x438c90
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x457aac], eax
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
push str.HHCTRL.OCX
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x425199
push str.HtmlHelpW
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x457b1c], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x4251ca
push str.ImmAssociateContext
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x457b18], eax
push 0x8d
mov ecx, dword [0x456ee8]
push ecx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x455b44], eax
push 0
push 0x41fe80
push 0
push 0x259
mov edx, dword [0x456ee8]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [0x456ee0], 0
mov dword [0x456efc], 0
mov eax, dword [0x43dcc4]
push eax
mov ecx, dword [0x43dcc0]
push ecx
mov edx, dword [0x43dcbc]
push edx
mov eax, dword [0x43dcc8]
push eax
mov ecx, dword [ebp - 0xb10]
push ecx
push str.__tWinMain______________End_____parserSearchThread__1______d___d:_d:_d:_d_
call fcn.00425950
add esp, 0x18
mov edx, dword [ebp - 0xb10]
push edx
push str.__tWinMain______________End_____parserSearchThread__2______d_
call fcn.00425950
add esp, 8
push 0x457150
push str._slist.txt
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45665c], 0
je 0x4252c0
push 0x1388
mov ecx, dword [0x45665c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x45665c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x43dcb4], 5
jne 0x4252e0
push 0
push 3
lea eax, [ebp - 0xf30]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00416c50
push 0
call fcn.00410030
push str.sitelink.txt
push 0x457150
push str._s_s
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x44f6a8
push 0x5460
lea eax, [ebp - 0x698]
push eax
call fcn.00401280
add esp, 0x10
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 4]
push edx
push str.__tWinMain__________________SITE_CHECKST_FILE______________d___d___s_
call fcn.00425950
add esp, 0x10
mov dword [ebp - 0x218], 0x10
cmp dword [0x457ab8], 0
je 0x425362
mov eax, dword [0x457ab8]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x457ab0], 0
je 0x425378
mov ecx, dword [0x457ab0]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x457ab4], 0
je 0x42538e
mov edx, dword [0x457ab4]
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp dword [0x456660], 0
je 0x4253a3
mov eax, dword [0x456660]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x456658], 0
je 0x4253b9
mov ecx, dword [0x456658]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456654], 0
je 0x4253cf
mov edx, dword [0x456654]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x456648], 0
je 0x4253e4
mov eax, dword [0x456648]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0x1450], ecx
cmp dword [ebp - 0x1450], 0x3df
jg 0x42541e
cmp dword [ebp - 0x1450], 0x3df
je 0x4254ca
cmp dword [ebp - 0x1450], 0
je 0x4254bc
jmp case.default.0x4254b0
cmp dword [ebp - 0x1450], 0x3e9
jg 0x42546f
cmp dword [ebp - 0x1450], 0x3e9
je 0x4255d2
cmp dword [ebp - 0x1450], 0x3e0
je 0x425500
cmp dword [ebp - 0x1450], 0x3e1
je 0x425536
cmp dword [ebp - 0x1450], 0x3e2
je 0x425592
jmp case.default.0x4254b0
cmp dword [ebp - 0x1450], 0x270e
jg 0x4254b7
cmp dword [ebp - 0x1450], 0x270d
jge 0x425723
mov edx, dword [ebp - 0x1450]
sub edx, 0x3ea
mov dword [ebp - 0x1450], edx
cmp dword [ebp - 0x1450], 3
ja case.default.0x4254b0
mov eax, dword [ebp - 0x1450]
jmp dword [eax*4 + 0x425828]
jmp case.default.0x4254b0
xor ecx, ecx
mov word [ebp - 0x698], cx
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x4254e9
push 0x438ee8
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4254fb
push str.There_is_a_problem_with_the_contents_of_the_module._n__1___I_cannot_run_the_program.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x42551f
push 0x438fe8
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x425531
push str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x425563
mov eax, dword [ebp - 0xb18]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x4390e0
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x425583
mov eax, dword [ebp - 0xb18]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.OS_state_is_unstable___d_:__d_
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x218], 0x30
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x4255b1
push 0x4391a8
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4255c3
push str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x218], 0x30
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x4255f8
mov edx, dword [ebp - 4]
push edx
push 0x439288
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x425611
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x42563c
mov eax, dword [ebp - 4]
push eax
push 0x439488
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x425655
mov edx, dword [ebp - 4]
push edx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x425680
mov ecx, dword [ebp - 4]
push ecx
push 0x439688
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x425699
mov eax, dword [ebp - 4]
push eax
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__3_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x4256c4
mov edx, dword [ebp - 4]
push edx
push 0x439888
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4256dd
mov ecx, dword [ebp - 4]
push ecx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x425708
mov eax, dword [ebp - 4]
push eax
push 0x439a88
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x425721
mov edx, dword [ebp - 4]
push edx
push str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x42577d
push 0
call fcn.0040c860
test eax, eax
je 0x42574c
mov ecx, dword [ebp - 0xb18]
push ecx
push 0x439c88
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x425768
mov eax, dword [ebp - 0xb18]
push eax
push 0x439cb8
lea ecx, [ebp - 0x698]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x218], 0x30
jmp 0x42577d
xor edx, edx
mov word [ebp - 0x698], dx
movzx eax, word [ebp - 0x698]
test eax, eax
je 0x4257a8
mov ecx, dword [ebp - 0x218]
push ecx
push str._notification_BOX
lea edx, [ebp - 0x698]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.__tWinMain__________________End__________
call fcn.00425950
add esp, 4
mov eax, dword [ebp - 0xb18]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
push str.__tWinMain__________________fcret__________________________d_:__d___d_
call fcn.00425950
add esp, 0x10
push 0x439cb4
call fcn.00425950
add esp, 4
call fcn.00425aa0
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x144c], eax
lea ecx, [ebp - 0x699]
call fcn.00401ad0
lea ecx, [ebp - 5]
call fcn.00401ad0
lea ecx, [ebp - 0xd25]
call fcn.00401ad0
mov eax, dword [ebp - 0x144c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401af7
mov esp, ebp
pop ebp
ret 0x10