Function at 0x4001e0f3
Capabilities:
Check for time delay via gettickcount
Create thread
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x40097a38]
sub esp, 0x2fc
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
push 0xa
pop ecx
test bl, al
jne 0x4001e125
or eax, ebx
push ecx
mov dword [0x40097a38], eax
call fcn.4004eee0
mov byte [0x40097a34], al
jmp 0x4001e12a
mov al, byte [0x40097a34]
test al, al
jne 0x4001e15b
call fcn.4004fb50
mov ecx, 0x411
push ecx
push ecx
push 0
push ecx
push 0x10
cmp ax, cx
mov ecx, str.T0_R_un0
pop edx
je 0x4001e14f
mov ecx, str.Your_OS_is_outdated_and_now_unsupported
call fcn.40048740
xor eax, eax
jmp 0x4001ee3b
call fcn.4001d9ae
mov edi, dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push edi
push str._Preload
call esi
test eax, eax
je 0x4001e154
push 0
push str.TSleipnirSpeedLauncherWindow
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4001e1a2
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x8065
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x40097b7c]
test bl, al
jne 0x4001e1be
or eax, ebx
mov dword [0x40097b7c], eax
call fcn.40050e30
mov dword [0x40097b80], eax
jmp 0x4001e1c3
mov eax, dword [0x40097b80]
push ebx
call eax
sub esp, 0x18
lea ecx, [esp + 0x100]
mov eax, esp
sub esp, 0x18
mov dword [eax], 0x40081788
mov dword [eax + 0x10], eax
mov eax, esp
mov dword [eax], 0x40082840
mov dword [eax + 0x10], eax
call fcn.4000ad16
xor eax, eax
mov byte [esp + 0x28], al
mov byte [esp + 0x18], al
mov byte [esp + 0x23], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push str._ShowStartupTime
mov dword [esp + 0x64], eax
call esi
test eax, eax
jne 0x4001e218
mov byte [esp + 0x23], bl
jmp 0x4001e26e
push edi
push str._StartTimeCheckWriteFile
call esi
test eax, eax
jne 0x4001e22e
mov byte [esp + 0x28], bl
mov byte [esp + 0x18], bl
jmp 0x4001e26e
push edi
push str._StartTimeCheck
call esi
test eax, eax
jne 0x4001e244
mov byte [esp + 0x28], bl
mov byte [esp + 0x18], al
jmp 0x4001e26e
push edi
push str._StartTimeCheckWaitForDebugger
call esi
test eax, eax
jne 0x4001e26e
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [esp + 0x28], bl
mov byte [esp + 0x18], al
jmp 0x4001e268
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
test eax, eax
je 0x4001e260
mov eax, dword [0x40097298]
test eax, eax
jne 0x4001e2a4
push 0x48
call fcn.400549a4
pop ecx
test eax, eax
je 0x4001e299
push dword [esp + 0x18]
mov ecx, eax
push str.Start
push dword [esp + 0x30]
call fcn.400094c8
jmp 0x4001e29b
xor eax, eax
mov dword [0x40097298], eax
test eax, eax
je 0x4001e2f4
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.40009667
mov ecx, 0x4009761c
push dword [eax]
call fcn.40006a29
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.40004636
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e2f4
push str._STLOG_
push eax
call fcn.400096f5
mov eax, dword [0x40097298]
pop ecx
pop ecx
test eax, eax
je 0x4001e2f4
push str.P00_00
push eax
call fcn.400096f5
pop ecx
pop ecx
xor eax, eax
mov byte [esp + 0x24], al
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, esp
push edi
call fcn.400069d1
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x78]
call fcn.4001fb25
pop ecx
pop ecx
test al, al
je 0x4001e364
mov ecx, dword [0x40097298]
test ecx, ecx
je 0x4001e35d
push str.P00_00_99
push ecx
call fcn.400096f5
pop ecx
pop ecx
mov ecx, dword [0x40097298]
test ecx, ecx
je 0x4001e35d
mov byte [ecx + 9], 0
call fcn.400096a9
xor ebx, ebx
jmp 0x4001ecb6
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e37a
push str.P00_00_02
push eax
call fcn.400096f5
pop ecx
pop ecx
lea ecx, [esp + 0x9c]
call fcn.40020c82
lea ecx, [esp + 0x7c]
call fcn.40020c82
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x9c]
call fcn.4002056b
push ecx
mov ecx, esp
push str.mutex
call fcn.400069d1
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.4001ef11
push ecx
mov ecx, esp
push str.output
call fcn.400069d1
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.4001ef11
push eax
mov ecx, 0x400977fc
call fcn.400088ff
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e40a
push str.P00_00_03
push eax
call fcn.400096f5
pop ecx
pop ecx
mov ecx, dword [esp + 0x58]
lea ecx, [ecx - 0x10]
call fcn.400073ec
lea esi, [eax + 0x10]
cmp dword [esi - 0xc], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x18], esi
jne 0x4001e4c4
push 0x208
lea eax, [esp + 0x104]
push 0
push eax
call fcn.40054740
add esp, 0xc
lea eax, [esp + 0x100]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [esp + 0x1c]
call fcn.40006a29
push 0x40081a58
lea ecx, [esp + 0x1c]
call fcn.4000d585
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x4001e4c0
mov esi, dword [eax - 0xc]
lea ecx, [esp + 0x18]
push esi
call fcn.40006b63
lea ecx, [esi + 1]
push ecx
push eax
call fcn.40057780
pop ecx
pop ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.40007032
mov esi, dword [esp + 0x18]
mov dword [esp + 0x30], esi
jmp 0x4001e4c4
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.40021082
pop ecx
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x84]
call fcn.400210ad
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e507
push str.P00_01
push eax
call fcn.400096f5
pop ecx
pop ecx
lea eax, [esp + 0x18]
mov edx, str.MutexNameV5_StartupExists_
push eax
lea ecx, [esp + 0x30]
call fcn.40006aaf
pop ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
call fcn.400210f4
pop ecx
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x84]
call fcn.400210ad
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.40004636
push dword [esp + 0x2c]
and dword [esp + 0x68], 0
lea ecx, [esp + 0x6c]
mov dword [esp + 0x64], 0x4008283c
call fcn.400069d1
xor eax, eax
mov edi, 0x1388
mov word [esp + 0x6c], ax
mov byte [esp + 0x13], al
lea ecx, [esp + 0x60]
call fcn.4001dc5b
test al, al
jne 0x4001e735
mov cl, byte [esp + 0x6c]
test cl, cl
je 0x4001e735
mov ch, byte [esp + 0x6d]
test ch, ch
je 0x4001e735
cmp byte [esp + 0x13], al
jne 0x4001e63b
mov eax, edi
xor esi, esi
push 0xa
pop edi
cdq
idiv edi
mov edi, eax
test edi, edi
jle 0x4001e5f9
push 0
push str.MainWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4001e5d1
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4001e5f1
lea ecx, [esp + 0x60]
call fcn.4001dc5b
test al, al
jne 0x4001e735
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, edi
jl 0x4001e5b5
mov ch, byte [esp + 0x6d]
mov cl, byte [esp + 0x6c]
test cl, cl
je 0x4001e63b
test ch, ch
je 0x4001e63b
push 0
push str.MainWindow
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x4001e62a
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4001e62c
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x4001e62c
xor esi, esi
test esi, esi
je 0x4001e63b
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4001e667
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x13], 0
jne 0x4001e65d
lea ecx, [esp + 0x13]
call fcn.40020856
test eax, eax
js 0x4001e716
mov edi, 0x2710
jmp 0x4001e572
mov edi, dword [esp + 0x70]
jmp 0x4001e67c
mov edx, dword [edi]
push 0
push ecx
mov ecx, esi
call fcn.4001dcc3
add edi, 4
cmp edi, dword [esp + 0x74]
jne 0x4001e66d
mov edi, dword [esp + 0x44]
cmp edi, dword [esp + 0x48]
je 0x4001e702
push edi
mov edx, str.open:
lea ecx, [esp + 0x20]
call fcn.40006aaf
pop ecx
jmp 0x4001e6c9
push edi
mov edx, 0x4007f4d8
lea ecx, [esp + 0x18]
call fcn.40006aaf
pop ecx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.4000e154
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.40004636
add edi, 4
cmp edi, dword [esp + 0x48]
jne 0x4001e69e
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
and dword [esp + 0x24], 0
push eax
push ecx
mov ecx, esi
call fcn.4001dcc3
cmp dword [esp + 0x24], 2
jne 0x4001e6f6
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov eax, dword [0x40097298]
test eax, eax
je 0x4001ec18
push str.P00_01_10_99
jmp 0x4001e728
mov eax, dword [0x40097298]
test eax, eax
je 0x4001ec18
push str.P00_01_20_99
push eax
call fcn.400096f5
pop ecx
pop ecx
jmp 0x4001ec18
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e74b
push str.P00_02
push eax
call fcn.400096f5
pop ecx
pop ecx
mov eax, dword [0x40097ac4]
test bl, al
jne 0x4001e76b
or eax, ebx
push fcn.4000c0b8
mov dword [0x40097ac4], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x40097ac0], eax
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x400972d0], eax
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e794
push str.P00_02_01
push eax
call fcn.400096f5
pop ecx
pop ecx
push str.supplement.fx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x4001e80e
push str.SetDefaultExceptionFilter
push esi
call edi
test eax, eax
je 0x4001e7c2
push fcn.4000c0b8
call eax
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e7d8
push str.P00_02_02
push eax
call fcn.400096f5
pop ecx
pop ecx
push str.HookIDropTargetInAllProcess
push esi
call edi
mov esi, eax
test esi, esi
je 0x4001e80e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.4000492d
push dword [esp + 0x1c]
push 0x4001dd5b
call esi
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e824
push str.P00_03
push eax
call fcn.400096f5
pop ecx
pop ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 8
push eax
mov dword [esp + 0xc4], 0xffff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e86e
push str.P00_05
push eax
call fcn.400096f5
pop ecx
pop ecx
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0x48]
je 0x4001e926
mov ecx, str.GlobalStorageService_fenrir.co.jp
call fcn.400047fe
push eax
lea ecx, [esp + 0x18]
call fcn.40007d71
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4001e926
mov eax, dword [edi]
lea ecx, [esp + 0x14]
and dword [esp + 0x14], 0
push ecx
push edi
call dword [eax + 0xc]
test eax, eax
jns 0x4001e8b4
xor eax, eax
jmp 0x4001e8bd
mov ecx, dword [esp + 0x14]
call fcn.40007b6e
push eax
lea ecx, [esp + 0x20]
call fcn.40006c2d
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4001e920
lea ecx, [esp + 0x44]
call fcn.4004b0f0
push 8
mov dword [esp + 0x20], eax
call fcn.400549a4
pop ecx
test eax, eax
je 0x4001e8f3
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], ebx
jmp 0x4001e8f5
xor eax, eax
push eax
lea ecx, [esp + 0x54]
call fcn.40006c2d
mov ecx, dword [esi]
push dword [eax]
push str.client.startup.params
push esi
call dword [ecx + 0x10]
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4001e91a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e93c
push str.P00_06
push eax
call fcn.400096f5
pop ecx
pop ecx
and dword [esp + 0x18], 0
and dword [esp + 0x1c], 0
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e95c
push str.P00_07
push eax
call fcn.400096f5
pop ecx
pop ecx
mov al, byte [0x40097310]
lea edx, [esp + 0x1c]
mov byte [esp + 0x13], al
lea ecx, [esp + 0x18]
lea eax, [esp + 0x7c]
mov byte [0x40097310], bl
push eax
push dword [esp + 0x28]
call fcn.4001f0a5
pop ecx
pop ecx
test al, al
jne 0x4001e9b5
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e99d
push str.P99_01
push eax
call fcn.400096f5
pop ecx
pop ecx
push 0x40097ac0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x1c]
call fcn.4001f75c
pop ecx
jmp 0x4001ea66
mov al, byte [esp + 0x13]
mov byte [0x40097310], al
mov eax, dword [0x40097298]
test eax, eax
je 0x4001e9d9
push str.P00_08
push eax
call fcn.400096f5
mov eax, dword [0x40097298]
pop ecx
pop ecx
cmp byte [esp + 0x24], 0
je 0x4001ea6d
test eax, eax
je 0x4001ea09
push str.P00_08_99
push eax
call fcn.400096f5
mov eax, dword [0x40097298]
pop ecx
pop ecx
test eax, eax
je 0x4001ea09
mov ecx, eax
mov byte [eax + 9], 0
call fcn.400096a9
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
mov eax, dword [0x40097ac0]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x34]
push eax
push 0
push 0x4002052d
call fcn.40057ed9
add esp, 0xc
mov dword [esp + 0x34], eax
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x34], 0
je 0x4001ea66
push 6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x4001ec18
test eax, eax
je 0x4001ea7e
push str.P00_09
push eax
call fcn.400096f5
pop ecx
pop ecx
mov ecx, str.GlobalStorageService_fenrir.co.jp
call fcn.400047fe
push eax
lea ecx, [esp + 0x54]
call fcn.40007d71
mov edi, dword [esp + 0x50]
test edi, edi
je 0x4001eae4
mov eax, dword [edi]
lea ecx, [esp + 0x14]
and dword [esp + 0x14], 0
push ecx
push edi
call dword [eax + 0xc]
test eax, eax
jns 0x4001eab2
xor eax, eax
jmp 0x4001eabb
mov ecx, dword [esp + 0x14]
call fcn.40007b6e
push eax
lea ecx, [esp + 0x54]
call fcn.40006c2d
mov esi, dword [esp + 0x50]
test esi, esi
je 0x4001eade
mov eax, dword [esi]
push str.DebugLog
push esi
call dword [eax + 0x18]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [0x40097298]
test eax, eax
je 0x4001eafa
push str.P00_09
push eax
call fcn.400096f5
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [esp + 0x5c]
cmp byte [esp + 0x23], 0
je 0x4001eb45
call fcn.40001ce1
push eax
lea ecx, [esp + 0x18]
call fcn.40006f05
push edi
lea eax, [esp + 0x18]
push str.Startup_Time___d
push eax
call fcn.40007b5a
mov esi, dword [esp + 0x20]
mov edx, ebx
pop ecx
push 0
push ecx
mov ecx, esi
call fcn.40048740
lea ecx, [esi - 0x10]
call fcn.40004636
call fcn.40001ce1
push eax
lea ecx, [esp + 0x18]
call fcn.40006f05
push edi
lea eax, [esp + 0x18]
push str.Startup_Time:___d
push eax
call fcn.4000a08c
mov ecx, dword [0x40097298]
add esp, 0xc
mov esi, dword [esp + 0x14]
test ecx, ecx
je 0x4001eb8c
push esi
push ecx
call fcn.400096f5
pop ecx
pop ecx
mov ecx, dword [0x40097298]
test ecx, ecx
je 0x4001eb8c
mov byte [ecx + 9], 0
cmp byte [esp + 0x28], 0
jne 0x4001eb9c
test ecx, ecx
je 0x4001eb9c
call fcn.400096a9
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea ecx, [esp + 0xc4]
call fcn.40008520
push 4
call fcn.400549a4
mov edi, eax
pop ecx
test edi, edi
je 0x4001ebe1
lea eax, [esp + 0xc4]
mov ecx, edi
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], eax
call fcn.40009209
mov ecx, edi
call fcn.4000849e
jmp 0x4001ebe3
xor edi, edi
push edi
lea ecx, [esp + 0xc8]
call fcn.400089cd
lea ecx, [esp + 0x18]
call fcn.4001f3b2
lea ecx, [esp + 0xc4]
test al, al
jne 0x4001ece4
push 2
pop ebx
call fcn.40008679
lea ecx, [esi - 0x10]
call fcn.40004636
lea ecx, [esp + 0x60]
call fcn.4001dc41
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, dword [esp + 0x58]
lea ecx, [ecx - 0x10]
call fcn.40004636
cmp dword [esp + 0x84], 0
je 0x4001ec73
push dword [esp + 0x84]
call fcn.40053016
xor eax, eax
pop ecx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
lea ecx, [esp + 0x7c]
call fcn.40020d33
cmp dword [esp + 0xa4], 0
je 0x4001ecaa
push dword [esp + 0xa4]
call fcn.40053016
xor eax, eax
pop ecx
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
lea ecx, [esp + 0x9c]
call fcn.40020d33
lea ecx, [esp + 0x44]
call fcn.400071fa
lea ecx, [esp + 0x70]
call fcn.400071fa
mov ecx, dword [0x40097298]
test ecx, ecx
je 0x4001ecd8
push ecx
call fcn.40009c6b
and dword [0x40097298], 0
jmp 0x4001ee2d
call fcn.40008818
push 0
lea ecx, [esp + 0xc8]
call fcn.400089cd
lea ecx, [esp + 0xc4]
call fcn.40008679
cmp dword [0x4009729c], 0
jne 0x4001ed30
push 0x48
call fcn.400549a4
pop ecx
test eax, eax
je 0x4001ed29
push ebx
push str.Shutdown
push 0
mov ecx, eax
call fcn.400094c8
jmp 0x4001ed2b
xor eax, eax
mov dword [0x4009729c], eax
push 0x40097ac0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x1c]
call fcn.4001f75c
pop ecx
lea ecx, [esi - 0x10]
call fcn.40004636
lea ecx, [esp + 0x60]
call fcn.4001dc41
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, dword [esp + 0x58]
lea ecx, [ecx - 0x10]
call fcn.40004636
cmp dword [esp + 0x84], 0
je 0x4001eda8
push dword [esp + 0x84]
call fcn.40053016
xor ebx, ebx
pop ecx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
jmp 0x4001edaa
xor ebx, ebx
lea ecx, [esp + 0x7c]
call fcn.40020d33
cmp dword [esp + 0xa4], 0
je 0x4001eddf
push dword [esp + 0xa4]
call fcn.40053016
pop ecx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
lea ecx, [esp + 0x9c]
call fcn.40020d33
lea ecx, [esp + 0x44]
call fcn.400071fa
lea ecx, [esp + 0x70]
call fcn.400071fa
mov ecx, dword [0x40097298]
test ecx, ecx
je 0x4001ee0d
push ecx
call fcn.40009c6b
mov eax, dword [esp + 0x34]
mov dword [0x40097298], ebx
test eax, eax
je 0x4001ee2d
push str.UnHookIDropTargetInAllProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4001ee2d
call eax
lea ecx, [esp + 0xe8]
call fcn.4000ad6f
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10