Function at 0x404d58
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xeb1]
mov esi, 0x42d57f
push ebx
sub esp, 0xedc
mov eax, dword [0x4294b8]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xcf5]
mov esi, 0x42d58a
mov dword [esp], eax
call fcn.004131b4
imul eax, dword [0x4294b8], 0x695f35d2
mov dword [0x429314], eax
and eax, 0xb7651a49
mov dword [0x4294b8], eax
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov eax, dword [0x4294b8]
mov ecx, 0x21
rep movsb byte es:[edi], byte [esi]
mov ecx, str.The_ALPC_message_has_been_canceled.
or eax, 0xbc6a38f8
mov dword [0x429314], eax
mov dl, byte [ecx]
test dl, dl
je 0x404df3
sub edx, 0x30
cmp dl, 9
jbe 0x404df0
sub eax, 0x288c16df
mov dword [0x429314], eax
jmp 0x404df3
inc ecx
jmp 0x404dd6
add dword [0x429314], 0x1583dc8c
call fcn.00412174
call fcn.00412d2c
mov edx, str.CLR_version_string_null_or_too_long
mov ecx, 0x20c
movzx eax, byte [edx]
inc edx
test al, al
je 0x404e37
add ecx, eax
cmp ecx, 0x41b
jbe 0x404e11
mov eax, dword [0x4294b8]
and eax, 0xfeddb51e
sub eax, 0x3bb82c45
mov dword [0x4294b8], eax
imul eax, dword [0x4294b8], 0x1d7610c1
mov dword [0x4294b8], eax
sub eax, 0x110abe82
mov dword [0x429314], eax
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
xor eax, eax
imul edx, dword [0x4294b8], 0xeff05679
mov byte [ebp + eax - 0xb18], al
inc eax
cmp eax, 0x100
jne 0x404e70
mov eax, edx
xor esi, esi
xor ebx, ebx
xor eax, 0xebe215a4
mov dword [0x4294b8], eax
mov eax, ebx
movzx ecx, byte [ebp + ebx - 0xb18]
and eax, 0x1f
movzx eax, byte [ebp + eax - 0xcf5]
mov byte [ebp - 0xecc], cl
add eax, ecx
add eax, esi
movzx esi, al
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov al, byte [ebp + esi - 0xb18]
mov ecx, dword [0x4294b8]
mov dl, byte [ebp - 0xecc]
mov byte [ebp + ebx - 0xb18], al
lea edi, [ecx - 0xee06f6b]
inc ebx
mov dword [0x429314], edi
mov byte [ebp + esi - 0xb18], dl
cmp ebx, 0x100
jne 0x404e8f
and ecx, 0x2a89edb0
or edi, 0xca3e3d6e
xor esi, esi
xor ebx, ebx
mov dword [0x429314], edi
xor edi, edi
mov dword [0x4294b8], ecx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.00410758
xor eax, eax
cmp byte [eax + str.The_ALPC_message_has_been_canceled.], 0
je 0x404f6b
inc eax
cmp eax, 0xe34
jne 0x404f27
mov dword [esp + 4], str.RegLoadAppKey_failed___d_
mov dword [esp], str.heap_failure_unknown
call fcn.00410758
mov eax, dword [0x4294b8]
mov edx, eax
or edx, 0x52285048
mov dword [0x429314], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
jmp 0x404f87
cmp eax, 0x43f
jg 0x404f87
mov eax, dword [0x429314]
and eax, 0xf8630cd0
mov dword [0x4294b8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, dword [0x4294b8], 0x6abda6dd
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0xb18]
xor edx, 0xf668a9e0
lea ecx, [eax + esi]
mov dword [0x429314], edx
movzx esi, cl
mov cl, byte [ebp + esi - 0xb18]
mov byte [ebp + ebx - 0xb18], cl
lea ecx, [edx + 0x479b9784]
mov byte [ebp + esi - 0xb18], al
add al, byte [ebp + ebx - 0xb18]
movzx eax, al
cmp byte [str.Insufficient_Resources_on_Remote_Computer], 0
mov dword [0x4294b8], ecx
mov al, byte [ebp + eax - 0xb18]
mov byte [ebp - 0xecc], al
je 0x405001
mov dword [esp], edx
call fcn.004131b4
xor dword [0x429314], 0x55ea0936
mov eax, dword [0x429314]
add eax, 0x23859087
mov dword [0x4294b8], eax
call fcn.0041479c
mov al, byte [ebp - 0xecc]
xor al, byte [ebp + edi - 0xeb1]
movzx eax, al
mov word [ebp + edi*2 - 0xdde], ax
inc edi
cmp edi, 0xb
jne 0x404f25
lea edi, [ebp - 0xec5]
mov esi, 0x42d5ab
mov ecx, 0xa
mov word [ebp - 0xdc8], 0
rep movsb byte es:[edi], byte [esi]
mov edx, str.The_ALPC_message_has_been_canceled.
mov ecx, 0x774
movzx eax, byte [edx]
inc edx
test al, al
je 0x405089
add ecx, eax
cmp ecx, 0x17f1
jbe 0x40505c
mov dword [esp], str.heap_failure_unknown
call fcn.00414b84
mov eax, dword [0x429314]
and eax, 0x9bbb0379
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
lea edi, [ebp - 0xb86]
mov esi, str.The_journal_entry_has_been_deleted_from_the_journal.
mov edx, eax
imul eax, eax, 0x109c79ff
or edx, 0xffc6ebb0
mov dword [0x429314], edx
mov dword [0x4294b8], eax
call fcn.0041479c
mov ecx, 0x35
mov edx, str.The_ALPC_message_has_been_canceled.
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x15c4
movzx eax, byte [edx]
inc edx
test al, al
je 0x4050e9
add ecx, eax
cmp ecx, 0x226f
jbe 0x4050c8
imul eax, dword [0x4294b8], 0x74c151e3
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
and eax, 0xe8881baa
mov dword [0x4294b8], eax
sub eax, 0x4fa8bc1d
mov dword [0x429314], eax
call fcn.0041479c
xor eax, eax
mov byte [ebp + eax - 0xa18], al
inc eax
cmp eax, 0x100
jne 0x405109
xor edi, edi
xor ecx, ecx
mov esi, 0x34
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0xa18]
div esi
movzx eax, byte [ebp + edx - 0xb86]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0xa18]
mov byte [ebp + ecx - 0xa18], al
inc ecx
mov byte [ebp + edi - 0xa18], bl
cmp ecx, 0x100
jne 0x405121
mov edx, str.The_ALPC_message_has_been_canceled.
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x40516f
inc edx
jmp 0x405163
mov eax, dword [0x429314]
mov edx, eax
or edx, 0x4de84096
cmp byte [str.CLR_version_string_null_or_too_long], 0
mov dword [0x4294b8], edx
je 0x4051ba
mov dword [esp + 0xc], str.RegLoadAppKey_failed___d_
mov dword [esp + 8], eax
mov dword [esp + 4], str.heap_failure_unknown
mov dword [esp], str.RegLoadAppKey_failed___d_
call fcn.00414cd0
mov eax, dword [0x429314]
add eax, 0xcb0eba5
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
xor edi, edi
xor esi, esi
xor ebx, ebx
sub eax, 0x220eefb3
mov dword [0x429314], eax
mov dword [esp + 4], str.RegLoadAppKey_failed___d_
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov ecx, str.Insufficient_Resources_on_Remote_Computer
mov al, byte [ecx]
test al, al
je 0x405204
sub eax, 0x30
cmp al, 9
jbe 0x405201
add dword [0x429314], 0x17ab592
jmp 0x405204
inc ecx
jmp 0x4051e8
mov ecx, dword [0x429314]
inc ebx
movzx ebx, bl
mov eax, ecx
or eax, 0x453d11e9
mov dword [0x429314], eax
mov al, byte [ebp + ebx - 0xa18]
lea edx, [eax + esi]
movzx esi, dl
mov dl, byte [ebp + esi - 0xa18]
mov byte [ebp + ebx - 0xa18], dl
mov byte [ebp + esi - 0xa18], al
add al, byte [ebp + ebx - 0xa18]
movzx eax, al
cmp byte [str.CLR_version_string_null_or_too_long], 0
mov al, byte [ebp + eax - 0xa18]
mov byte [ebp - 0xecc], al
je 0x405268
or ecx, 0xc53f3fed
mov dword [0x4294b8], ecx
imul eax, dword [0x4294b8], 0xdee2a367
and eax, 0x812d545f
mov dword [0x4294b8], eax
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov al, byte [ebp - 0xecc]
xor al, byte [ebp + edi - 0xec5]
movzx eax, al
mov word [ebp + edi*2 - 0xe06], ax
inc edi
cmp edi, 0xa
jne 0x4051e3
lea edi, [ebp - 0xe6a]
mov esi, 0x42d5ea
mov ecx, 4
mov word [ebp - 0xdf2], 0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4294b8]
or eax, 0xec39aa39
mov dword [0x429314], eax
xor eax, eax
cmp byte [eax + str.Insufficient_Resources_on_Remote_Computer], 0
je 0x405312
inc eax
cmp eax, 0x2104
jne 0x4052de
mov dword [esp + 4], str.CLR_version_string_null_or_too_long
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov eax, dword [0x429314]
or eax, 0xf4527abc
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
lea edi, [ebp - 0xc49]
mov esi, str.The_WMI_GUID_is_no_longer_available
xor ebx, ebx
xor eax, 0x2c76961c
lea edx, [eax - 0x6b4548e6]
imul eax, eax, 0x3dd3760e
mov dword [0x429314], edx
mov dword [0x4294b8], eax
mov dword [esp + 4], edx
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov edx, str.Insufficient_Resources_on_Remote_Computer
mov al, byte [edx]
test al, al
je 0x40537d
sub eax, 0x30
cmp al, 9
jbe 0x40537a
mov eax, dword [0x4294b8]
or eax, 0x222ef236
mov dword [0x429314], eax
jmp 0x40537d
inc edx
jmp 0x40535c
add dword [0x429314], 0x38bf3c15
mov dword [esp + 0xc], str.Insufficient_Resources_on_Remote_Computer
mov eax, dword [0x4294b8]
mov dword [esp + 4], str.heap_failure_unknown
mov dword [esp + 8], eax
mov dword [esp], str.RegLoadAppKey_failed___d_
call fcn.00414cd0
mov eax, dword [0x4294b8]
sub eax, 0x4cb6c820
mov dword [0x429314], eax
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
imul eax, dword [0x4294b8], 0xed17fdc4
and dword [0x429314], 0x6b54d00c
mov dword [0x4294b8], eax
mov dword [esp], eax
call fcn.004131b4
mov byte [ebp + ebx - 0x918], bl
inc ebx
cmp ebx, 0x100
jne 0x405357
xor edi, edi
xor ecx, ecx
mov esi, 0x23
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x918]
div esi
movzx eax, byte [ebp + edx - 0xc49]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x918]
mov byte [ebp + ecx - 0x918], al
inc ecx
mov byte [ebp + edi - 0x918], bl
cmp ecx, 0x100
jne 0x405409
mov eax, dword [0x4294b8]
xor edi, edi
xor esi, esi
mov dword [esp], eax
call fcn.004131b4
xor dword [0x4294b8], 0xb4da7e9c
call fcn.0040f4d4
xor edx, edx
lea eax, [esi + 1]
mov dword [ebp - 0xecc], edx
movzx esi, al
mov eax, dword [0x4294b8]
and eax, 0x5bb4db06
imul eax, eax, 0x9a6d89bc
mov dword [0x429314], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov bl, byte [ebp + esi - 0x918]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x918]
mov byte [ebp + esi - 0x918], al
mov eax, dword [0x4294b8]
mov ecx, eax
and ecx, 0xefb502c9
mov dword [0x429314], ecx
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
mov eax, dword [0x4294b8]
mov edx, dword [ebp - 0xecc]
mov byte [ebp + edi - 0x918], bl
add bl, byte [ebp + esi - 0x918]
mov ecx, eax
movzx ebx, bl
or eax, 0xd997839a
mov dword [0x4294b8], eax
mov al, byte [ebp + ebx - 0x918]
or ecx, 0x1735333e
xor al, byte [ebp + edx - 0xe6a]
mov dword [0x429314], ecx
movzx eax, al
mov word [ebp + edx*2 - 0xd56], ax
inc edx
cmp edx, 0x10
jne 0x405468
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], str.CompanyName
mov esi, 0x42d61e
call ebx
push edi
lea edi, [ebp - 0xe3a]
mov dword [esp], str.Windows.Xbox
call ebx
push eax
mov eax, dword [0x4294b8]
mov word [ebp - 0xd36], 0
sub eax, 0x4722013d
imul edx, eax, 0xd36faa96
or eax, 0x22166473
mov dword [0x429314], eax
mov dword [0x4294b8], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x11
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbdb]
mov esi, str.Maximum_Segment_Descriptors_Exceeded
mov ecx, 0x27
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x818], al
inc eax
cmp eax, 0x100
jne 0x405593
xor edi, edi
xor ebx, ebx
mov ecx, 0x26
mov eax, ebx
xor edx, edx
movzx esi, byte [ebp + ebx - 0x818]
div ecx
mov eax, esi
mov ecx, str.CLR_version_string_null_or_too_long
add al, byte [ebp + edx - 0xbdb]
add eax, edi
movzx edi, al
mov eax, dword [0x4294b8]
and eax, 0x57f62617
mov dword [0x429314], eax
mov dl, byte [ecx]
test dl, dl
je 0x4055f8
sub edx, 0x30
cmp dl, 9
jbe 0x4055f5
xor eax, 0xfa81268f
mov dword [0x429314], eax
jmp 0x4055f8
inc ecx
jmp 0x4055db
mov eax, dword [0x429314]
xor eax, 0x55f5cdfe
mov dword [0x4294b8], eax
call fcn.0041479c
mov eax, dword [0x429314]
mov ecx, esi
mov edx, eax
xor edx, 0xeded1cbf
mov dword [0x4294b8], edx
mov dl, byte [ebp + edi - 0x818]
mov byte [ebp + ebx - 0x818], dl
inc ebx
mov byte [ebp + edi - 0x818], cl
cmp ebx, 0x100
jne 0x4055a6
mov ecx, str.CLR_version_string_null_or_too_long
movzx edi, byte [ecx]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x405656
inc ecx
jmp 0x405648
sub eax, 0xd872b4b
xor edi, edi
xor esi, esi
mov dword [0x4294b8], eax
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
xor edx, edx
lea eax, [esi + 1]
mov ecx, str.The_ALPC_message_has_been_canceled.
movzx esi, al
mov bl, byte [ebp + esi - 0x818]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x818]
mov byte [ebp + esi - 0x818], al
mov byte [ebp + edi - 0x818], bl
mov al, byte [ecx]
sub eax, 0x30
cmp al, 9
ja 0x4056af
inc ecx
jmp 0x4056a3
mov eax, dword [0x4294b8]
mov dword [ebp - 0xecc], edx
add eax, 0x30dbeabe
mov dword [0x429314], eax
call fcn.00412174
mov eax, dword [0x4294b8]
xor eax, 0x678b41be
sub eax, 0x4dabba00
mov dword [0x4294b8], eax
mov eax, dword [0x429314]
mov dword [esp], str.heap_failure_unknown
mov dword [esp + 4], eax
call fcn.00412770
mov edx, dword [ebp - 0xecc]
add bl, byte [ebp + esi - 0x818]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x818]
xor al, byte [ebp + edx - 0xe3a]
movzx eax, al
mov word [ebp + edx*2 - 0xcd4], ax
inc edx
cmp edx, 0x11
jne 0x405676
lea edi, [ebp - 0xe8b]
mov esi, 0x42d656
mov ecx, 0xf
mov word [ebp - 0xcb2], 0
rep movsb byte es:[edi], byte [esi]
mov edx, str.The_ALPC_message_has_been_canceled.
lea edi, [ebp - 0xe99]
mov esi, str.VerifierFlags
mov ecx, 0xe
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x1b6
movzx eax, byte [edx]
inc edx
test al, al
je 0x40578d
add ecx, eax
cmp ecx, 0x1560
jbe 0x40575c
mov eax, dword [0x429314]
mov dword [esp], str.heap_failure_unknown
mov dword [esp + 4], eax
call fcn.00412770
and dword [0x429314], 0x65bef0e1
mov eax, dword [0x429314]
and eax, 0x638bb721
mov dword [0x4294b8], eax
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.00410758
imul eax, dword [0x4294b8], 0x231f5f6b
mov dword [0x4294b8], eax
xor eax, eax
mov byte [ebp + eax - 0x718], al
inc eax
cmp eax, 0x100
jne 0x4057c1
xor esi, esi
xor ebx, ebx
mov al, byte [ebp + ebx - 0x718]
mov ecx, 0xd
xor edx, edx
mov edi, dword [0x4294b8]
mov byte [ebp - 0xecc], al
mov eax, ebx
div ecx
mov al, byte [ebp - 0xecc]
mov ecx, 0x108
add al, byte [ebp + edx - 0xe99]
mov edx, str.CLR_version_string_null_or_too_long
add eax, esi
movzx esi, al
mov eax, edi
or eax, 0xb6bcb02a
mov dword [0x429314], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x405834
add ecx, eax
cmp ecx, 0x1121
jbe 0x40581a
mov dword [esp], edi
call fcn.004131b4
mov eax, dword [0x4294b8]
mov edx, eax
and eax, 0x1472cf12
or eax, 0x14408d00
or edx, 0x3fcdadc1
mov dword [0x429314], eax
mov dword [0x4294b8], edx
call fcn.00412174
mov al, byte [ebp + esi - 0x718]
mov byte [ebp + ebx - 0x718], al
mov al, byte [ebp - 0xecc]
inc ebx
mov byte [ebp + esi - 0x718], al
cmp ebx, 0x100
jne 0x4057d4
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x718]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x718]
mov byte [ebp + edx - 0x718], bl
mov byte [ebp + ecx - 0x718], al
add al, byte [ebp + edx - 0x718]
movzx eax, al
mov al, byte [ebp + eax - 0x718]
xor al, byte [esi + ebp - 0xe8b]
movzx eax, al
mov word [ebp + esi*2 - 0xd94], ax
inc esi
cmp esi, 0xf
jne 0x405889
mov eax, dword [0x4294b8]
lea edi, [ebp - 0xea6]
mov esi, 0x42d673
mov word [ebp - 0xd76], 0
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc01]
mov esi, 0x42d680
mov ecx, 0x26
rep movsb byte es:[edi], byte [esi]
or eax, 0xa8b80068
lea edx, [eax + 0x43bd943c]
xor eax, 0x53d39b5a
mov dword [0x429314], edx
mov dword [0x4294b8], eax
xor eax, eax
mov byte [ebp + eax - 0x618], al
inc eax
cmp eax, 0x100
jne 0x405926
xor esi, esi
xor ebx, ebx
xor edx, edx
mov edi, 0x25
mov eax, ebx
mov cl, byte [ebp + ebx - 0x618]
div edi
movzx eax, byte [ebp + edx - 0xc01]
movzx edx, cl
add eax, edx
add eax, esi
cmp byte [str.The_ALPC_message_has_been_canceled.], 0
movzx esi, al
mov eax, dword [0x4294b8]
mov dl, byte [ebp + esi - 0x618]
mov byte [ebp + ebx - 0x618], dl
je 0x405983
add eax, 0x15ae48d4
mov dword [0x429314], eax
imul eax, dword [0x429314], 0xfedbaa16
mov byte [ebp - 0xecc], cl
inc ebx
mov dword [0x4294b8], eax
and eax, 0x962316ba
mov dword [0x429314], eax
call fcn.00412174
mov cl, byte [ebp - 0xecc]
mov byte [ebp + esi - 0x618], cl
cmp ebx, 0x100
jne 0x405939
mov esi, dword [0x4294b8]
mov ecx, str.The_ALPC_message_has_been_canceled.
mov ebx, 0x8aa
lea eax, [esi - 0x6c2f7bae]
mov dword [0x429314], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x405a4b
add ebx, edx
cmp ebx, 0x130c
jbe 0x4059dc
mov dword [esp + 8], esi
mov dword [esp + 0xc], str.CLR_version_string_null_or_too_long
mov dword [esp + 4], str.heap_failure_unknown
mov dword [esp], str.CLR_version_string_null_or_too_long
call fcn.00414cd0
and dword [0x4294b8], 0xe74aad4d
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
imul eax, dword [0x4294b8], 0x2620f0df
mov dword [0x4294b8], eax
mov dword [esp], str.Process_initialization_raised_exception_0x_08lx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
jmp 0x405a56
imul eax, eax, 0x5ea86db
mov dword [0x429314], eax
mov eax, dword [0x429314]
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0xecc], ebx
xor eax, 0xc87a5a59
sub eax, 0x27ca9d17
mov dword [0x429314], eax
lea eax, [esi + 1]
mov edx, str.The_ALPC_message_has_been_canceled.
movzx esi, al
mov bl, byte [ebp + esi - 0x618]
lea eax, [ebx + edi]
movzx edi, al
mov eax, dword [0x429314]
lea ecx, [eax + 0x45b9300e]
mov dword [0x4294b8], ecx
mov cl, byte [ebp + edi - 0x618]
mov byte [ebp + esi - 0x618], cl
mov byte [ebp + edi - 0x618], bl
mov cl, byte [edx]
test cl, cl
je 0x405ad3
sub ecx, 0x30
cmp cl, 9
jbe 0x405ad0
lea ecx, [eax - 0x1e407b0d]
mov dword [0x4294b8], ecx
jmp 0x405ad3
inc edx
jmp 0x405ab4
and eax, 0x9f4896de
mov dword [0x429314], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x15edfc91
mov dword [0x4294b8], eax
call fcn.0040f4d4
mov eax, dword [0x429314]
add bl, byte [ebp + esi - 0x618]
movzx ebx, bl
and eax, 0x2aaa4c03
mov dword [0x4294b8], eax
add eax, 0x1c46d847
mov dword [0x429314], eax
mov al, byte [ebp + ebx - 0x618]
mov ebx, dword [ebp - 0xecc]
inc dword [ebp - 0xecc]
xor al, byte [ebp + ebx - 0xea6]
cmp dword [ebp - 0xecc], 0xd
movzx eax, al
mov word [ebp + ebx*2 - 0xdae], ax
jne 0x405a76
mov word [ebp - 0xd94], 0
lea edi, [ebp - 0xebb]
mov esi, 0x42d6a6
xor eax, eax
mov ecx, 0xa
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xdc7]
mov esi, 0x42d6b0
mov ecx, 0x19
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x405b76
xor esi, esi
xor ebx, ebx
xor eax, eax
cmp byte [eax + str.The_ALPC_message_has_been_canceled.], 0
je 0x405bab
inc eax
cmp eax, 0x88f
jne 0x405b8b
mov eax, dword [0x4294b8]
add eax, 0x2123969d
mov dword [0x429314], eax
mov eax, dword [0x429314]
mov edi, 0x18
lea edx, [eax - 0x429b15f9]
add eax, 0x66319d3e
mov dword [0x429314], edx
mov dword [0x4294b8], eax
mov dword [esp], eax
call fcn.004131b4
mov eax, dword [0x429314]
xor edx, edx
mov cl, byte [ebp + ebx - 0x518]
and eax, 0xe5d0cc16
mov dword [0x429314], eax
add eax, 0x36e06469
mov dword [0x4294b8], eax
mov eax, ebx
div edi
mov al, byte [ebp + edx - 0xdc7]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x518]
mov byte [ebp + ebx - 0x518], al
inc ebx
mov byte [ebp + esi - 0x518], cl
cmp ebx, 0x100
jne 0x405b89
mov dword [esp], 0xe35
xor esi, esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor edx, edx
push ecx
xor ecx, ecx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x518]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x518]
mov byte [ebp + edx - 0x518], bl
mov byte [ebp + ecx - 0x518], al
add al, byte [ebp + edx - 0x518]
movzx eax, al
mov al, byte [ebp + eax - 0x518]
xor al, byte [esi + ebp - 0xebb]
movzx eax, al
mov word [ebp + esi*2 - 0xdf2], ax
inc esi
cmp esi, 0xa
jne 0x405c3d
mov word [ebp - 0xdde], 0
lea edi, [ebp - 0xe29]
mov esi, 0x42d6c9
xor eax, eax
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb51]
mov esi, 0x42d6da
mov ecx, 0x39
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x418], al
inc eax
cmp eax, 0x100
jne 0x405cba
xor esi, esi
xor ebx, ebx
mov ecx, 0x38
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x418]
div ecx
mov eax, edi
add al, byte [ebp + edx - 0xb51]
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ebx - 0x418], al
xor eax, eax
cmp byte [eax + str.The_ALPC_message_has_been_canceled.], 0
je 0x405d32
inc eax
cmp eax, 0x74f
jne 0x405cfe
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov eax, dword [0x429314]
or eax, 0xd8e20d9d
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
xor eax, 0x41fa2c70
add eax, 0x1aaeaf6a
mov dword [0x429314], eax
call fcn.00412174
mov edx, str.Insufficient_Resources_on_Remote_Computer
mov ecx, 0xaaf
movzx eax, byte [edx]
inc edx
test al, al
je 0x405d67
add ecx, eax
cmp ecx, 0x1303
jbe 0x405d55
mov eax, dword [0x4294b8]
inc ebx
or eax, 0x48da24df
mov dword [0x429314], eax
imul eax, eax, 0xe08f8d74
mov dword [0x4294b8], eax
mov dword [esp], 0x184e
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edx
mov eax, dword [0x4294b8]
mov edx, eax
sub eax, 0x74342304
or edx, 0x7fd072ec
mov dword [0x4294b8], eax
mov dword [0x429314], edx
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
mov eax, edi
mov byte [ebp + esi - 0x418], al
cmp ebx, 0x100
jne 0x405ccd
xor eax, eax
cmp byte [eax + str.RegLoadAppKey_failed___d_], 0
je 0x405df4
inc eax
cmp eax, 0x682
jne 0x405dd4
imul eax, dword [0x429314], 0x91c3420d
mov dword [0x429314], eax
mov eax, dword [0x429314]
xor edi, edi
xor esi, esi
imul edx, eax, 0xef802091
mov dword [0x4294b8], edx
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
xor edx, edx
lea eax, [esi + 1]
mov dword [ebp - 0xecc], edx
or dword [0x4294b8], 0x3828a8d3
movzx esi, al
mov bl, byte [ebp + esi - 0x418]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x418]
mov byte [ebp + esi - 0x418], al
mov eax, dword [0x429314]
and eax, 0x4444d704
xor eax, 0x9cfbdf45
mov dword [0x429314], eax
call fcn.00412174
mov edx, dword [ebp - 0xecc]
mov byte [ebp + edi - 0x418], bl
add bl, byte [ebp + esi - 0x418]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x418]
xor al, byte [ebp + edx - 0xe29]
movzx eax, al
mov word [ebp + edx*2 - 0xcb2], ax
inc edx
cmp edx, 0x11
jne 0x405e1b
mov word [ebp - 0xc90], 0
mov edx, dword [0x429314]
lea edi, [ebp - 0xe5a]
xor eax, eax
mov esi, 0x42d713
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xd75]
mov esi, str.The_metadata_read_was_corrupt.
mov ecx, 0x1f
rep movsb byte es:[edi], byte [esi]
xor edx, 0x400e5f06
mov dword [0x4294b8], edx
cmp byte [eax + str.CLR_version_string_null_or_too_long], 0
je 0x405ef5
inc eax
cmp eax, 0x221a
jne 0x405edc
mov dword [esp], edx
call fcn.004131b4
mov edx, dword [0x4294b8]
lea eax, [edx + 0x6d4b793f]
and eax, 0xa3efb063
mov dword [0x429314], eax
mov dword [esp], edx
call fcn.004131b4
mov edx, str.CLR_version_string_null_or_too_long
mov al, byte [edx]
test al, al
je 0x405f34
sub eax, 0x30
cmp al, 9
jbe 0x405f31
add dword [0x429314], 0x9ad8a34
jmp 0x405f34
inc edx
jmp 0x405f18
mov eax, dword [0x429314]
xor edx, edx
and eax, 0xffb96fbb
mov dword [0x429314], eax
cmp byte [edx + str.Insufficient_Resources_on_Remote_Computer], 0
je 0x405f68
inc edx
cmp edx, 0x11a4
jne 0x405f45
imul eax, eax, 0x6c58b374
mov dword [0x4294b8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [0x429314]
mov edx, eax
xor edx, 0x2197b276
mov dword [0x4294b8], edx
mov dword [esp], eax
call fcn.004131b4
xor eax, eax
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x405f85
xor edi, edi
xor ecx, ecx
mov esi, 0x1e
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x318]
div esi
movzx eax, byte [ebp + edx - 0xd75]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov byte [ebp + edi - 0x318], bl
cmp ecx, 0x100
jne 0x405f9d
xor edi, edi
xor esi, esi
xor ebx, ebx
add dword [0x429314], 0x5839602d
inc ebx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
movzx ebx, bl
mov ecx, dword [0x4294b8]
mov al, byte [ebp + ebx - 0x318]
lea edx, [eax + esi]
movzx esi, dl
lea edx, [ecx - 0xe1b6d5b]
mov cl, byte [ebp + esi - 0x318]
mov dword [0x429314], edx
xor edx, 0x4b3535a
mov dword [0x4294b8], edx
mov byte [ebp + ebx - 0x318], cl
mov byte [ebp + esi - 0x318], al
add al, byte [ebp + ebx - 0x318]
movzx eax, al
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + edi - 0xe5a]
movzx eax, al
mov word [ebp + edi*2 - 0xd36], ax
inc edi
cmp edi, 0x10
jne 0x405fe0
cmp byte [str.Insufficient_Resources_on_Remote_Computer], 0
je 0x406072
sub edx, 0x28ab9166
mov dword [0x4294b8], edx
mov eax, dword [0x4294b8]
and eax, 0xdddd02e7
mov edx, eax
mov dword [0x429314], eax
or edx, 0x3d6fe01
mov dword [0x4294b8], edx
mov dword [esp + 0xc], str.RegLoadAppKey_failed___d_
mov dword [esp + 8], eax
mov dword [esp + 4], str.heap_failure_unknown
mov dword [esp], str.The_ALPC_message_has_been_canceled.
call fcn.00414cd0
mov eax, dword [0x4294b8]
sub eax, 0x1e8d81a4
mov dword [0x429314], eax
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
xor eax, eax
cmp word [eax + str.heap_failure_unknown], 0
je 0x406104
add eax, 2
cmp eax, 0x3ae
jne 0x4060dc
call fcn.00412d2c
mov eax, dword [0x4294b8]
sub eax, 0x2adf115
mov dword [0x429314], eax
mov eax, dword [0x429314]
lea edi, [ebp - 0xe4a]
mov esi, 0x42d742
xor eax, 0xda9b340c
mov dword [0x4294b8], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00414b84
mov ecx, 4
mov edx, str.heap_failure_unknown
mov word [ebp - 0xd16], 0
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc25]
mov esi, str.The_specified_group_does_not_exist.
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x162a
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40616b
add ecx, eax
cmp ecx, 0x2434
jbe 0x406156
mov eax, dword [0x429314]
or eax, 0xb85305aa
mov dword [0x429314], eax
xor eax, 0x40cb8083
mov dword [0x4294b8], eax
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.RegLoadAppKey_failed___d_
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
cmp byte [str.CLR_version_string_null_or_too_long], 0
je 0x4061c8
imul eax, dword [0x4294b8], 0xb22da761
mov dword [0x429314], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
sub eax, 0x42c41437
mov dword [0x4294b8], eax
imul eax, dword [0x429314], 0x6622eac8
or dword [0x4294b8], 0x99864b83
mov dword [0x429314], eax
xor eax, eax
cmp byte [eax + str.RegLoadAppKey_failed___d_], 0
je 0x406217
inc eax
cmp eax, 0x6a3
jne 0x4061e3
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov eax, dword [0x429314]
sub eax, 0x20f2546a
mov dword [0x4294b8], eax
add dword [0x4294b8], 0x69071bc5
add dword [0x429314], 0x236bfca9
mov dword [esp + 4], str.CLR_version_string_null_or_too_long
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x406241
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov edi, 0x23
xor edx, edx
mov cl, byte [ebp + ebx - 0x218]
div edi
mov byte [ebp - 0xecc], cl
movzx eax, byte [ebp + edx - 0xc25]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x4294b8]
sub eax, 0x78636abc
mov edx, eax
mov dword [0x4294b8], eax
and edx, 0x4583ebc
mov dword [0x429314], edx
mov dword [esp + 4], eax
mov dword [esp], str.heap_failure_unknown
call fcn.00412770
mov al, byte [ebp + esi - 0x218]
mov cl, byte [ebp - 0xecc]
mov byte [ebp + ebx - 0x218], al
inc ebx
mov byte [ebp + esi - 0x218], cl
cmp ebx, 0x100
jne 0x406254
call fcn.00412d2c
mov eax, dword [0x4294b8]
xor esi, esi
mov edx, eax
or eax, 0xfffefffd
or edx, 0x6cb805f4
mov dword [0x429314], eax
mov dword [0x4294b8], edx
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0xe4a]
movzx eax, al
mov word [ebp + esi*2 - 0xd16], ax
inc esi
cmp esi, 0x10
jne 0x406313
imul edx, dword [0x429314], 0xe576cfcd
xor eax, eax
mov dword [0x4294b8], edx
cmp byte [eax + str.The_ALPC_message_has_been_canceled.], 0
je 0x40639e
inc eax
cmp eax, 0x1f01
jne 0x406373
xor edx, 0x81de1bf7
mov dword [0x4294b8], edx
mov dword [esp], 0xd1e
call dword [sym.imp.USER32.dll_OpenIcon]
push eax
imul eax, dword [0x4294b8], 0xe9b7a201
mov ecx, str.CLR_version_string_null_or_too_long
and eax, 0xb9878160
mov dword [0x4294b8], eax
movzx edi, byte [ecx]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x4063c5
inc ecx
jmp 0x4063b7
sub eax, 0x57a58488
lea edi, [ebp - 0xe18]
mov esi, 0x42d776
mov dword [0x429314], eax
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.Insufficient_Resources_on_Remote_Computer
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
mov eax, dword [0x429314]
mov ecx, 0x12
mov word [ebp - 0xcf6], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc90]
mov esi, 0x42d788
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
mov ecx, str.The_ALPC_message_has_been_canceled.
movzx edi, byte [ecx]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x406430
inc ecx
jmp 0x406422
and eax, 0x262a3600
mov dword [0x4294b8], eax
xor eax, eax
cmp byte [eax + str.RegLoadAppKey_failed___d_], 0
je 0x406478
inc eax
cmp eax, 0x1dac
jne 0x40643c
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
imul eax, dword [0x429314], 0x1138ee94
mov dword [0x4294b8], eax
mov eax, dword [0x4294b8]
imul edx, eax, 0xc82cc72
add eax, 0x2db74e7c
mov dword [0x4294b8], eax
mov dword [0x429314], edx
call fcn.0041479c
mov ecx, dword [0x4294b8]
xor ecx, 0x26276094
lea eax, [ecx + 0x57db68bd]
mov dword [ebp - 0xecc], eax
mov dword [0x429314], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x4064b7
xor edi, edi
xor esi, esi
mov eax, esi
mov ecx, 0x21
xor edx, edx
mov bl, byte [ebp + esi - 0x118]
div ecx
movzx eax, byte [ebp + edx - 0xc90]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
inc esi
mov byte [ebp + edi - 0x118], bl
cmp esi, 0x100
jne 0x4064ca
mov ecx, dword [ebp - 0xecc]
xor eax, eax
or ecx, 0xfebc58cc
mov dword [0x4294b8], ecx
cmp word [eax + eax + str.heap_failure_unknown], 0
je 0x40655b
inc eax
cmp eax, 0x251c
jne 0x406520
mov dword [esp + 8], str.heap_failure_unknown
mov dword [esp + 4], str.The_ALPC_message_has_been_canceled.
mov dword [esp], str.heap_failure_unknown
call fcn.0040f8a8
add dword [0x4294b8], 0x172c59d8
jmp 0x406562
cmp eax, 0x20c4
jle 0x406587
mov dword [esp + 0xc], str.RegLoadAppKey_failed___d_
mov eax, dword [0x429314]
mov dword [esp + 4], str.heap_failure_unknown
mov dword [esp + 8], eax
mov dword [esp], str.The_ALPC_message_has_been_canceled.
call fcn.00414cd0
mov eax, dword [0x4294b8]
xor esi, esi
xor edi, edi
mov edx, eax
and eax, 0x23042b2a
or edx, 0xfce3b29a
or eax, 0x2000220a
mov dword [0x4294b8], edx
mov dword [0x429314], eax
call fcn.00412d2c
xor edx, edx
lea eax, [edi + 1]
mov ebx, str.The_ALPC_message_has_been_canceled.
movzx edi, al
mov cl, byte [ebp + edi - 0x118]
add edx, ecx
movzx edx, dl
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x4065d7
inc ebx
jmp 0x4065cb
mov eax, dword [0x429314]
mov dword [ebp - 0xed0], edx
lea ebx, [ebp - 0xc6e]
mov byte [ebp - 0xecc], cl
and eax, 0x993cbe88
mov dword [0x4294b8], eax
mov dword [esp + 4], str.CLR_version_string_null_or_too_long
mov dword [esp], str.heap_failure_unknown
call fcn.0040fbac
mov edx, dword [ebp - 0xed0]
mov cl, byte [ebp - 0xecc]
sub dword [0x429314], 0x5005bdef
mov al, byte [ebp + edx - 0x118]
mov byte [ebp + edi - 0x118], al
mov byte [ebp + edx - 0x118], cl
mov al, byte [ebp + edi - 0x118]
add eax, ecx
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + esi - 0xe18]
movzx eax, al
mov word [ebx + esi*2], ax
inc esi
cmp esi, 0x12
jne 0x4065b4
mov word [ebp - 0xc4a], 0
xor eax, eax
cmp word [eax + str.heap_failure_unknown], 0
je 0x406690
add eax, 2
cmp eax, 0x9d0
jne 0x40666d
call fcn.0041479c
and dword [0x4294b8], 0xdbb58c4c
mov eax, dword [0x4294b8]
xor esi, esi
imul edx, eax, 0xf26c5761
xor eax, 0xd684e047
mov dword [0x4294b8], eax
mov dword [0x429314], edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
call dword [sym.imp.USER32.dll_GetShellWindow]
mov eax, dword [0x4294b8]
and eax, 0x4114d7b0
mov dword [0x429314], eax
call fcn.0040f4d4
mov eax, dword [0x4294b8]
mov dword [ebp - 0xb8c], ebx
add eax, 0x122677d5
and eax, 0x31cc529d
add eax, 0xf6d86e4
xor eax, 0xf3065001
mov dword [0x429314], eax
lea eax, [ebp - 0xdde]
mov dword [ebp - 0xbb4], eax
lea eax, [ebp - 0xe06]
mov dword [ebp - 0xbb0], eax
lea eax, [ebp - 0xd56]
mov dword [ebp - 0xbac], eax
lea eax, [ebp - 0xcd4]
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0xd94]
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0xdae]
mov dword [ebp - 0xba0], eax
lea eax, [ebp - 0xdf2]
mov dword [ebp - 0xb9c], eax
lea eax, [ebp - 0xcb2]
mov dword [ebp - 0xb98], eax
lea eax, [ebp - 0xd36]
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0xd16]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp + esi*4 - 0xbb4]
mov dword [esp], eax
call fcn.004010e8
mov ebx, eax
test eax, eax
je 0x4067fc
lea edi, [ebp - 0xe7c]
mov esi, 0x416024
mov ecx, 4
mov ebx, 0x1e
rep movsd dword es:[edi], dword [esi]
xor esi, esi
add dword [0x4294b8], 0x45849375
mov ecx, str.Insufficient_Resources_on_Remote_Computer
mov eax, 0x1d99
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4067c8
add eax, edx
cmp eax, 0x1d48
jbe 0x4067ab
and dword [0x429314], 0xdc2e8e62
jmp 0x4067cf
cmp eax, 0x1d48
jbe 0x4067d4
call fcn.0041479c
mov eax, dword [0x429314]
add ebx, dword [ebp + esi*4 - 0xe7c]
inc esi
add eax, 0x7ae5a82f
mov dword [0x429314], eax
and eax, 0x72e8b9a3
mov dword [0x4294b8], eax
cmp esi, 4
jne 0x406797
jmp 0x406806
inc esi
cmp esi, 0xb
jne 0x406769
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret