Function at 0x401000
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create process suspended
Download url
Get file attributes
Query environment variable
Receive data
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x84bc
mov dword [esp + 0x64b0], 0
lea edi, [esp + 0x64b4]
mov eax, 0
mov ecx, 0x7ff
rep stosd dword es:[edi], eax
mov dword [esp + 0x62a8], 0
lea edi, [esp + 0x62ac]
mov ecx, 0x81
rep stosd dword es:[edi], eax
mov dword [esp + 0x60a0], 0
lea edi, [esp + 0x60a4]
mov ecx, 0x81
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6058]
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [esp + 0x6048], 0
mov dword [esp + 0x604c], 0
mov dword [esp + 0x6050], 0
mov dword [esp + 0x6054], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
sub esp, 8
lea edx, [esp + 0x604c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x10], eax
sub esp, 0xc
push 0x105
lea ebx, [esp + 0x62c0]
push ebx
push str._ProgramW6432_Powershell7pwsh.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
cmp eax, 0xffffffff
je 0x401103
mov edx, dword [esp + 8]
lea edi, [edx + 4]
mov eax, dword [edx + 4]
test eax, eax
je 0x4016a6
mov esi, 1
mov ebp, dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov ebx, edi
mov edi, edx
jmp 0x4014f2
sub esp, 4
push 0x105
lea esi, [esp + 0x60a8]
push esi
push str._TMP_PowerShell_7.4.1_win_x64.msi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 8
push 2
mov ebx, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
call ebx
add esp, 8
push eax
push str.e_1_33mDownloading_Powershell_Core
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call ebx
add esp, 8
push eax
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call ebx
add esp, 8
push eax
push str.e_0m_n
call sub.ucrtbase.dll_fputws
mov dword [esp], 0
push 0
push esi
push str.https:__github.com_PowerShell_PowerShell_releases_download_v7.4.1_PowerShell_7.4.1_win_x64.msi
push 0
call sub.urlmon.dll_URLDownloadToFileW
add esp, 0xc
test eax, eax
je 0x4011ac
sub esp, 0xc
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 8
push eax
push str.download_failed
call sub.ucrtbase.dll_fputs
mov dword [esp], 1
call sub.ucrtbase.dll_exit
sub esp, 4
push 0x44
push 0
lea edi, [esp + 0x6064]
push edi
call sub.ucrtbase.dll_memset
mov dword [esp + 0x6068], 0x44
add esp, 0xc
push 0x10
push 0
lea ebp, [esp + 0x6054]
push ebp
call sub.ucrtbase.dll_memset
add esp, 0xc
push 0x105
lea ebx, [esp + 0x60a8]
push ebx
push str._winsysdir_msiexec.exe__i__TMP_PowerShell_7.4.1_win_x64.msi_ENABLE_PSREMOTING1_REGISTER_MANIFEST1___q
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
sub esp, 4
push ebp
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x6054]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 4
push dword [esp + 0x6054]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x6058]
call edi
sub esp, 8
push 0x105
push ebx
push str._TMP_ConEmuPack.230724.7z
call esi
add esp, 8
push 2
mov esi, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
call esi
add esp, 8
push eax
push str.e_1_33mDownloading_ConEmu
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call esi
add esp, 8
push eax
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call esi
add esp, 8
push eax
push str.e_0m_n
call sub.ucrtbase.dll_fputws
mov dword [esp], 0
push 0
push ebx
push str.https:__github.com_Maximus5_ConEmu_releases_download_v23.07.24_ConEmuPack.230724.7z
push 0
call sub.urlmon.dll_URLDownloadToFileW
add esp, 0xc
test eax, eax
je 0x4012de
sub esp, 0xc
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 8
push eax
push str.download_failed
call sub.ucrtbase.dll_fputs
mov dword [esp], 1
call sub.ucrtbase.dll_exit
sub esp, 4
push 0x105
lea esi, [esp + 0x60a8]
push esi
push str._TMP_7zr.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 8
push 2
mov ebx, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
call ebx
add esp, 8
push eax
push str.e_1_33mDownloading_7zr
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call ebx
add esp, 8
push eax
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call ebx
add esp, 8
push eax
push str.e_0m_n
call sub.ucrtbase.dll_fputws
mov dword [esp], 0
push 0
push esi
push str.https:__www.7_zip.org_a_7zr.exe
push 0
call sub.urlmon.dll_URLDownloadToFileW
add esp, 0xc
test eax, eax
je 0x401387
sub esp, 0xc
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 8
push eax
push str.download_failed
call sub.ucrtbase.dll_fputs
mov dword [esp], 1
call sub.ucrtbase.dll_exit
sub esp, 4
push 0x44
push 0
lea esi, [esp + 0x6064]
push esi
call sub.ucrtbase.dll_memset
mov dword [esp + 0x6068], 0x44
add esp, 0xc
push 0x10
push 0
lea edi, [esp + 0x6054]
push edi
call sub.ucrtbase.dll_memset
add esp, 0xc
push 0x105
lea ebx, [esp + 0x60a8]
push ebx
push str._TMP_7zr.exe_x__TMP_ConEmuPack.230724.7z__o__SystemDrive_ConEmu_
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call ebp
sub esp, 4
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x6054]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 4
push dword [esp + 0x6054]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x6058]
call esi
push 2
mov esi, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
call esi
add esp, 8
push eax
push str.e_1_33mDownloading_profile.ps1
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call esi
add esp, 8
push eax
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_fputws
mov dword [esp], 2
call esi
add esp, 8
push eax
push str.e_0m_n
call sub.ucrtbase.dll_fputws
add esp, 0xc
push 0x105
push ebx
push str._ProgramW6432_Powershell7profile.ps1
call ebp
sub esp, 8
push 0
push 0
push ebx
push str.https:__raw.githubusercontent.com_PietJankbal_powershell_wrapper_for_wine_master_profile.ps1
push 0
call sub.urlmon.dll_URLDownloadToFileW
add esp, 0xc
test eax, eax
je 0x4010dd
sub esp, 0xc
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 8
push eax
push str.download_failed
call sub.ucrtbase.dll_fputs
mov dword [esp], 1
call sub.ucrtbase.dll_exit
sub esp, 4
push 2
push 0x402614
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x401544
lea eax, [esi*4]
cmp dword [edi + esi*4], 0
je 0x401d01
add esi, 1
lea ebx, [edi + eax + 4]
mov eax, dword [ebx]
test eax, eax
je 0x4015d0
sub esp, 4
push 1
push 0x402620
push eax
call sub.ucrtbase.dll_wcsncmp
mov dword [esp + 0x14], eax
add esp, 0x10
test eax, eax
jne 0x4015d0
mov ebx, dword [ebx]
sub esp, 4
push 2
push 0x4025fe
push ebx
call ebp
add esp, 0x10
test eax, eax
jne 0x4014b8
sub esp, 4
push 7
push 0x402604
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x4014d0
jmp 0x4014b8
sub esp, 4
push 2
push 0x40261a
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4014d0
sub esp, 8
push 0x402620
push ebx
call sub.ucrtbase.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x4014d0
sub esp, 4
push 4
push 0x402624
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4014d0
sub esp, 4
push 2
push 0x40262e
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4014d0
sub esp, 4
push 2
push 0x402634
push ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
cmp eax, 1
sbb esi, 0xffffffff
jmp 0x4014d0
cmp esi, 1
jle 0x4017fd
mov edi, 1
mov ebx, 0
jmp 0x401651
sub esp, 4
push 3
push 0x402654
push dword [ebp]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x401604
add edi, 1
jmp 0x40164a
sub esp, 4
push 4
push str._nop
push dword [ebp]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x40164a
mov ebp, dword [ebp]
sub esp, 8
push 0x402666
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscat
add esp, 8
push ebp
push eax
call sub.ucrtbase.dll_wcscat
add esp, 0x10
jmp 0x40164a
mov ebx, 1
add edi, 1
cmp edi, esi
jge 0x4016b0
mov eax, dword [esp + 8]
lea ebp, [eax + edi*4]
sub esp, 8
push dword [ebp]
push 0x402620
call sub.ucrtbase.dll_wcscmp
add esp, 0x10
test eax, eax
jne 0x4015e5
mov eax, dword [esp + 0x6044]
sub eax, 1
cmp eax, edi
je 0x401645
sub esp, 0xc
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 8
push eax
push str.e_1_35mInvalid_usagee_0m
call sub.ucrtbase.dll_fputs
mov dword [esp], 1
call sub.ucrtbase.dll_exit
mov esi, 1
mov ebx, 0
lea eax, [esi*4]
mov ecx, dword [esp + 8]
lea edi, [ecx + eax]
cmp dword [edi], 0
je 0x4016e5
lea ebp, [ecx + eax - 4]
sub esp, 4
push 2
push 0x4025fe
push dword [ebp]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x401807
mov edi, esi
cmp dword [esp + 0x6044], esi
jle 0x40172e
mov dword [esp + 4], ebx
mov ebp, dword [esp + 8]
mov ebx, dword [ebp + edi*4]
sub esp, 8
push 0x402666
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscat
add esp, 8
push ebx
push eax
call sub.ucrtbase.dll_wcscat
add edi, 1
add esp, 0x10
cmp dword [esp + 0x6044], edi
jg 0x4016f8
mov ebx, dword [esp + 4]
test ebx, ebx
jne 0x40187d
cmp dword [esp + 0x6044], esi
sete al
movzx eax, al
mov esi, eax
sub esp, 4
push 0x105
lea eax, [esp + 0x60a8]
push eax
push str.PSHACKS
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 4
test eax, eax
jne 0x4019ce
lea eax, [esp + 0x64b0]
test esi, esi
jne 0x401ccd
sub esp, 8
lea edx, [esp + 0x6050]
push edx
lea edx, [esp + 0x6064]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea eax, [esp + 0x62d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x6054]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x60a4]
push eax
push dword [esp + 0x6054]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 4
push dword [esp + 0x6054]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x6058]
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x60a8]
call sub.ucrtbase.dll_exit
mov ebx, 0
jmp 0x4016b0
sub esp, 4
push 4
push 0x402624
push dword [ebp]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4016e5
sub esp, 4
push 2
push 0x40261a
push dword [ebp]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4016e5
sub esp, 4
push 2
push 0x40266a
push dword [edi]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x4016e5
sub esp, 8
push 0x402670
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscat
add esp, 0x10
jmp 0x4016e5
mov dword [esp + 0x44], 0x20262220
mov dword [esp + 0x48], 0x7b20
lea edi, [esp + 0x4c]
mov ecx, 0x7fe
mov eax, 0
rep stosd dword es:[edi], eax
sub esp, 0xc
lea eax, [esp + 0x50]
push eax
call sub.ucrtbase.dll_strlen
mov ebx, eax
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
add esp, 0xc
cmp eax, 2
jne 0x4018fa
sub esp, 4
push 0x105
lea eax, [esp + 0x60a8]
push eax
push str.PSHACKS
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 4
test eax, eax
jne 0x4019c9
lea eax, [esp + 0x64b0]
jmp 0x40177a
sub esp, 8
push 0x402620
mov eax, dword [esp + 0x6050]
mov ecx, dword [esp + 0x14]
push dword [ecx + eax*4 - 4]
call sub.ucrtbase.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x401928
sub ebx, 1
mov esi, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
jmp 0x40196f
sub esp, 4
push 2
push 0x4025fe
mov eax, dword [esp + 0x6050]
mov ecx, dword [esp + 0x14]
push dword [ecx + eax*4 - 8]
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x40191d
sub esp, 8
push 0x402670
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscat
add esp, 0x10
jmp 0x40191d
add ebx, 1
mov byte [esp + ebx + 0x44], al
sub esp, 0xc
push 0
call esi
mov dword [esp], eax
call sub.ucrtbase.dll_fgetc
add esp, 0x10
cmp ax, 0xffff
jne 0x401968
mov byte [esp + ebx + 0x45], 0x7d
mov byte [esp + ebx + 0x46], 0x22
mov byte [esp + ebx + 0x47], 0
sub esp, 4
push 0x2000
lea eax, [esp + 0x4c]
push eax
lea ebx, [esp + 0x2050]
push ebx
call sub.ucrtbase.dll_mbstowcs
add esp, 8
push ebx
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscat
add esp, 0x10
jmp 0x4018c8
mov esi, 0
sub esp, 4
push 0x105
lea eax, [esp + 0x4c]
push eax
push str.PS_FROM
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 4
test eax, eax
je 0x40176b
sub esp, 4
push 0x105
lea eax, [esp + 0x204c]
push eax
push str.PS_TO
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 4
test eax, eax
je 0x40176b
mov dword [esp + 0x40], 0
sub esp, 4
lea eax, [esp + 0x40]
push eax
push 0x4026a6
lea eax, [esp + 0x50]
push eax
mov ebx, dword [sym.imp.ucrtbase.dll_wcstok_s]
call ebx
mov dword [esp + 0x24], eax
add esp, 0xc
lea eax, [esp + 0x44]
push eax
push 0x4026a6
lea eax, [esp + 0x2050]
push eax
call ebx
mov dword [esp + 0x28], eax
add esp, 0x10
mov dword [esp + 0x2c], esi
jmp 0x401c06
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub esp, 4
lea edx, [edi + edi]
push edx
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
je 0x401bae
test ebx, ebx
je 0x401a96
mov dword [esp + 0x10], edi
jmp 0x401c94
sub esp, 4
lea eax, [edi + edi]
push eax
lea eax, [esp + 0x64b8]
push eax
push dword [esp + 0x18]
call sub.ucrtbase.dll_memcpy
mov dword [esp + 0x1c], eax
add esp, 0x10
jmp 0x401bae
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub esp, 4
push dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 4
mov dword [esp + 0xc], esi
jmp 0x401bae
mov esi, dword [esp + 4]
sub esi, ebp
sub esp, 4
push esi
push ebp
push ebx
call sub.ucrtbase.dll_memcpy
add ebx, esi
add esp, 0xc
mov esi, dword [esp + 0x28]
push esi
push dword [esp + 0x20]
push ebx
call sub.ucrtbase.dll_memcpy
add ebx, esi
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
add ebp, eax
add esp, 0x10
sub esp, 8
push dword [esp + 0x1c]
push ebp
mov eax, dword [esp + 0x2c]
call eax
mov dword [esp + 0xc], eax
add esp, 8
test eax, eax
je 0x401b71
mov eax, dword [esp + 0x20]
add edi, eax
cmp dword [esp + 0x10], edi
jae 0x401ade
lea eax, [edi*4]
mov esi, eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x401aba
mov ecx, dword [esp + 0xc]
sub ebx, ecx
add ebx, eax
mov dword [esp + 0xc], eax
jmp 0x401ade
sub esp, 4
mov edx, ebx
mov esi, dword [esp + 0x10]
sub edx, esi
sar edx, 1
mov eax, edi
sub eax, edx
add eax, eax
push eax
push ebp
push ebx
call sub.ucrtbase.dll_memcpy
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
lea eax, [edi + edi]
push eax
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
add esp, 0x10
test eax, eax
cmove eax, esi
mov dword [esp + 0xc], eax
sub esp, 8
mov esi, dword [esp + 0x14]
push esi
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcscpy
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0xc
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [esp + 0x40]
push eax
push 0x4026a6
push 0
mov ebx, dword [sym.imp.ucrtbase.dll_wcstok_s]
call ebx
mov dword [esp + 0x24], eax
add esp, 0xc
lea eax, [esp + 0x44]
push eax
push 0x4026a6
push 0
call ebx
mov dword [esp + 0x28], eax
add esp, 0x10
cmp dword [esp + 0x14], 0
je 0x401cc4
cmp dword [esp + 0x18], 0
je 0x401cbb
sub esp, 0xc
push dword [esp + 0x20]
call sub.ucrtbase.dll_wcslen
mov ebx, eax
add esp, 4
push dword [esp + 0x24]
call sub.ucrtbase.dll_wcslen
mov esi, eax
add esp, 4
lea eax, [esp + 0x64bc]
push eax
call sub.ucrtbase.dll_wcslen
lea edi, [eax + 1]
add esp, 0x10
mov eax, esi
sub eax, ebx
mov dword [esp + 0x20], eax
je 0x401a64
test ebx, ebx
je 0x401a64
lea eax, [edi + edi]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub esp, 4
lea edx, [edi*4]
push edx
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
je 0x401bae
lea eax, [esi + esi]
mov dword [esp + 0x24], eax
lea eax, [ebx + ebx]
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0xc]
lea ebp, [esp + 0x64b0]
mov eax, dword [sym.imp.SHELL32.dll_StrStrIW]
mov dword [esp + 0x1c], eax
jmp 0x401b12
mov esi, dword [esp + 0x2c]
jmp 0x40176b
mov esi, dword [esp + 0x2c]
jmp 0x40176b
sub esp, 4
push 0x105
lea ebx, [esp + 0x60a8]
push ebx
push str.__c__SystemDrive_ConEmuConEmu64.exe__NoUpdate__LoadRegistry__run__ProgramW6432_Powershell7pwsh.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 4
lea eax, [esp + 0x64b8]
push eax
push ebx
call sub.ucrtbase.dll_wcscat
add esp, 0x10
jmp 0x40177a
mov ebx, dword [esp + 4]
cmp esi, 1
jg 0x4015d9
jmp 0x4016e5