Function at 0x4071c6
Capabilities:
Check http status code
Get session user name
Impersonate user
Initialize winhttp library
Prepare http request
Read file on windows
Read http header
Receive http response
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c44
call fcn.0041183e
mov eax, dword [0x42e068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
or dword [ebp - 0x3b58], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x28]
push esi
mov dword [ebp - 0x3b84], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x3b80], eax
lea edi, [ebp - 0x3c08]
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3b6c], eax
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3b68], eax
mov dword [ebp - 0x3bc4], eax
mov dword [ebp - 0x3b9c], eax
mov dword [ebp - 0x3b70], eax
mov dword [ebp - 0x3b98], eax
mov dword [ebp - 0x3b5c], eax
mov dword [ebp - 0x3b74], eax
mov dword [ebp - 0x3b78], eax
inc eax
movlpd qword [ebp - 0x3bbc], xmm0
mov dword [ebp - 0x3bcc], 0x100
mov dword [ebp - 0x3c08], 0x20
mov dword [ebp - 0x3c04], eax
call fcn.00405194
mov eax, dword [0x42e880]
lea edx, [ebp - 0x3b68]
push edx
push str.system:write
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
js 0x4072e0
mov esi, 0x25f8
lea eax, [ebp - 0x3b54]
push esi
push 0
push eax
call fcn.004122e7
mov edi, dword [ebp - 0x3b80]
lea ecx, [ebp - 0x3b54]
add esp, 0xc
mov dword [ebp - 0x3b54], esi
mov dword [ebp - 0x3b50], 0x4000000
mov eax, dword [edi]
push ecx
push ebx
push 0
push edi
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
js 0x4072e0
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
test eax, eax
je 0x407392
mov esi, 0x80004004
mov edi, dword [ebp - 0x3b5c]
mov ebx, dword [ebp - 0x3b58]
mov ecx, dword [ebp - 0x3b80]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x64]
mov eax, dword [ebp - 0x3b74]
test eax, eax
je 0x407310
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test edi, edi
je 0x40731b
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 0x3b98]
test eax, eax
je 0x40732c
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 0x3b70]
test eax, eax
je 0x40733d
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp ebx, 0xffffffff
je 0x407349
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3bc4], 0
je 0x407ee3
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x407ee3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
movzx esi, ax
push ebx
or esi, 0x80070000
test eax, eax
push ebx
cmovle esi, eax
push 0xc0000015
push esi
call fcn.00410c49
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x3b84]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ebx, eax
lea eax, [ebp - 0x3bcc]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x3bc8], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x3c00], eax
lea eax, [ebp - 0x3c08]
push eax
push dword [ebp - 0x3b84]
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
mov ecx, dword [ebp - 0x3b9c]
test eax, eax
push 1
pop eax
push dword [ebp - 0x3b84]
cmovne ecx, eax
push 0
mov dword [ebp - 0x3b9c], ecx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x40741b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3bc4], ecx
cmp ebx, 2
je 0x407acd
cmp ebx, 3
je 0x407acd
cmp ebx, 4
jne 0x407ac3
xor bl, bl
mov dword [ebp - 0x3b7c], 0x824
mov byte [ebp - 0x3b61], bl
lea eax, [ebp - 0x3c40]
push 0x38
xor ebx, ebx
push ebx
push eax
call fcn.004122e7
add esp, 0xc
mov dword [ebp - 0x3c44], 0x3c
lea eax, [ebp - 0x514]
mov edi, 0x80000000
mov dword [ebp - 0x3c34], eax
mov ecx, 0x104
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x3c30], ecx
mov dword [ebp - 0x3c18], eax
lea eax, [ebp - 0x3c44]
push eax
push edi
push ebx
lea eax, [ebp - 0x25a4]
mov dword [ebp - 0x3c14], ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x4074d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x407edc
lea eax, [ebp - 0x3b7c]
push eax
lea eax, [ebp - 0x155c]
push eax
push edi
lea eax, [ebp - 0x3c44]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x40750f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x407edc
push ebx
push ebx
push ebx
push ebx
push 0x4259ec
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ebx, eax
mov dword [ebp - 0x3b70], ebx
test ebx, ebx
jne 0x407546
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e0
xor eax, eax
mov dword [ebp - 0x3b60], eax
mov edi, eax
and dword [ebp - 0x3bc0], 0
and dword [ebp - 0x3b94], 0
mov dword [ebp - 0x3bd0], 4
test edi, edi
je 0x407573
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 0x3b98]
test eax, eax
je 0x407584
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push 0
push 0
lea eax, [ebp - 0x514]
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, eax
mov dword [ebp - 0x3b98], ebx
test ebx, ebx
jne 0x4075be
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x30c]
push eax
push 0x425cec
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
mov dword [ebp - 0x3b5c], edi
test edi, edi
jne 0x4075ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
xor ecx, ecx
mov ebx, ecx
xor edx, edx
mov dword [ebp - 0x3b90], ecx
inc edx
mov dword [ebp - 0x3b8c], ecx
mov eax, ebx
mov dword [ebp - 0x3b88], ecx
mov dword [ebp - 0x3be8], edx
xorps xmm0, xmm0
mov dword [ebp - 0x3be4], 3
mov edi, ecx
mov dword [ebp - 0x3be0], ecx
mov dword [ebp - 0x3bdc], ecx
mov dword [ebp - 0x3bd8], ecx
mov dword [ebp - 0x3bd4], edx
movups xmmword [ebp - 0x3bac], xmm0
sub eax, ecx
je 0x4076f4
sub eax, edx
je 0x40766f
sub eax, edx
jne 0x407788
mov dword [ebp - 0x3b90], edx
mov edi, edx
jmp 0x407755
lea eax, [ebp - 0x3bac]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x40776c
cmp dword [ebp - 0x3ba4], 0
je 0x40776c
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x208
push 0
mov dword [ebp - 0x3b8c], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x3b8c]
mov dword [ebp - 0x3b88], eax
test ecx, ecx
je 0x40776c
test eax, eax
je 0x40776c
push 0xffffffffffffffff
push dword [ebp - 0x3ba4]
mov dword [ebp - 0x3b90], 3
push 0x104
push ecx
call fcn.0041657c
add esp, 0x10
xor eax, eax
lea edi, [eax + 1]
jmp 0x407755
lea eax, [ebp - 0x3bac]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x40776c
cmp dword [ebp - 0x3bac], 0
je 0x40776c
mov eax, dword [ebp - 0x3ba8]
test eax, eax
je 0x407725
or dword [ebp - 0x3be8], 2
mov dword [ebp - 0x3be0], eax
xor eax, eax
inc eax
mov dword [ebp - 0x3bd4], eax
lea eax, [ebp - 0x3b90]
push eax
lea eax, [ebp - 0x3be8]
push eax
lea eax, [ebp - 0x155c]
push eax
push dword [ebp - 0x3b70]
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov edi, eax
test edi, edi
je 0x40776c
push 0xc
lea eax, [ebp - 0x3b90]
push eax
push 0x26
push dword [ebp - 0x3b70]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [ebp - 0x3ba8], 0
je 0x407788
push dword [ebp - 0x3ba8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebp - 0x3ba8], 0
cmp dword [ebp - 0x3ba4], 0
je 0x4077a4
push dword [ebp - 0x3ba4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebp - 0x3ba4], 0
cmp dword [ebp - 0x3ba0], 0
je 0x4077c0
push dword [ebp - 0x3ba0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebp - 0x3ba0], 0
mov ecx, dword [ebp - 0x3b8c]
test ecx, ecx
je 0x4077db
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor ecx, ecx
mov dword [ebp - 0x3b8c], ecx
jmp 0x4077dd
xor ecx, ecx
mov eax, dword [ebp - 0x3b88]
test eax, eax
je 0x4077f6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor ecx, ecx
mov dword [ebp - 0x3b88], ecx
test edi, edi
mov edi, dword [ebp - 0x3b5c]
je 0x407817
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x40798d
xor ecx, ecx
inc ebx
cmp ebx, 3
jb 0x407603
mov bl, byte [ebp - 0x3b61]
test bl, bl
jne 0x407833
test esi, esi
js 0x4072e6
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x407849
test esi, esi
js 0x4072e6
lea eax, [ebp - 0x3b94]
push eax
lea eax, [ebp - 0x3bd0]
push eax
lea eax, [ebp - 0x3bc0]
push eax
push ebx
push 0x20000013
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x40788b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
mov eax, dword [ebp - 0x3bc0]
cmp eax, 0x194
ja 0x4079a7
je 0x407a0a
cmp eax, 0xc8
je 0x40799d
cmp eax, 0x12c
jbe 0x407a00
cmp eax, 0x12f
ja 0x4079e8
lea eax, [ebp - 0x3b94]
mov dword [ebp - 0x3b7c], 0x824
push eax
lea eax, [ebp - 0x3b7c]
mov dword [ebp - 0x3b94], ebx
push eax
lea eax, [ebp - 0x155c]
push eax
push ebx
push 0x33
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x407912
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
lea eax, [ebp - 0x3c44]
push eax
push ebx
push ebx
lea eax, [ebp - 0x155c]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x407948
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
lea eax, [ebp - 0x3b7c]
push eax
lea eax, [ebp - 0x155c]
push eax
push 0x80000000
lea eax, [ebp - 0x3c44]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x407988
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e6
xor eax, eax
inc eax
jmp 0x40799f
xor eax, eax
lea ebx, [eax + 1]
mov byte [ebp - 0x3b61], bl
jmp 0x407827
mov eax, ebx
mov dword [ebp - 0x3b60], eax
jmp 0x4079d5
cmp eax, 0x198
je 0x4079ca
cmp eax, 0x1f4
je 0x407a0a
cmp eax, 0x1f5
jbe 0x407a00
cmp eax, 0x1f7
jbe 0x407a0a
cmp eax, 0x1f8
jne 0x407a00
mov eax, dword [ebp - 0x3b60]
mov esi, 0x80070102
test esi, esi
jne 0x407a14
test eax, eax
je 0x407a1a
mov ebx, dword [ebp - 0x3b70]
jmp 0x407550
cmp eax, 0x191
je 0x4079f6
cmp eax, 0x193
jne 0x407a00
mov esi, 0x80070005
jmp 0x4072e6
mov esi, 0x8000ffff
jmp 0x4072e6
mov esi, 0x80070002
jmp 0x4072e6
js 0x4072e6
lea eax, [ebp - 0x3bb4]
push eax
push edi
call fcn.004104f3
mov esi, eax
test esi, esi
js 0x4072e6
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x407a67
mov eax, dword [ebp - 0x3bb0]
cmp eax, dword [ecx + 4]
jb 0x407a89
jne 0x407a4f
mov eax, dword [ebp - 0x3bb4]
cmp eax, dword [ecx]
jbe 0x407a89
mov ecx, dword [ebp - 0x3b80]
push ebx
push ebx
push ebx
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x50]
xorps xmm0, xmm0
movlpd qword [ebp + 0x10], xmm0
lea eax, [ebp - 0x3bbc]
push eax
push edi
call fcn.00410586
mov esi, eax
test esi, esi
js 0x4072e6
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
jmp 0x407be0
mov edi, ebx
cmp dword [ebp + 0x24], ebx
jbe 0x407abc
mov eax, dword [ebp - 0x3b6c]
push ebx
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 3
push dword [eax + edi*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
inc edi
cmp edi, dword [ebp + 0x24]
jb 0x407a90
mov esi, ebx
jmp 0x4072e0
mov esi, 0x8007000f
jmp 0x4072e0
mov eax, 0x8000080
cmp ebx, 2
jne 0x407ae0
cmp dword [0x42e88c], 0
je 0x407aee
cmp ebx, 3
jne 0x407af3
cmp dword [0x42e894], 0
jne 0x407af3
mov eax, 0x28000080
push 0
push eax
push 3
push 0
push ecx
push 0x80000000
lea eax, [ebp - 0x25a4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x3b58], ebx
cmp ebx, 0xffffffff
jne 0x407b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x407ed1
lea eax, [ebp - 0x3bb4]
push eax
push ebx
call fcn.0040f418
mov esi, eax
test esi, esi
js 0x407ed1
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x407b87
mov eax, dword [ebp - 0x3bb0]
cmp eax, dword [ecx + 4]
jb 0x407cb1
jne 0x407b73
mov eax, dword [ebp - 0x3bb4]
cmp eax, dword [ecx]
jbe 0x407cb1
mov eax, dword [edi]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push edi
call dword [eax + 0x50]
xorps xmm0, xmm0
movlpd qword [ebp + 0x10], xmm0
lea eax, [ebp - 0x3bbc]
push eax
push ebx
call fcn.0040e262
mov esi, eax
test esi, esi
js 0x407ed1
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
test edx, edx
jl 0x407bde
jg 0x407bae
test edi, edi
je 0x407bde
push 0
push 0
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x407bdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x407ed1
mov edx, dword [ebp + 0x14]
xor ebx, ebx
mov eax, ebx
mov ebx, dword [ebp + 0x24]
mov dword [ebp - 0x3b60], eax
test ebx, ebx
je 0x407c31
mov ecx, dword [ebp - 0x3b6c]
lea esi, [ebp - 0x3bb4]
push esi
push edx
push edi
mov eax, dword [ecx + eax*4]
push dword [ebp - 0x3bb8]
push dword [ebp - 0x3bbc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
js 0x4072e0
mov eax, dword [ebp - 0x3b60]
mov edx, dword [ebp + 0x14]
inc eax
mov dword [ebp - 0x3b60], eax
cmp eax, ebx
jb 0x407bef
cmp dword [ebp - 0x3bbc], 0
jne 0x407cef
cmp dword [ebp - 0x3bb8], 0
jne 0x407cef
xor edi, edi
test ebx, ebx
je 0x407eca
push 0
push 0
push 0xffffffffffffffff
xor eax, eax
push 0xffffffffffffffff
inc eax
push eax
mov eax, dword [ebp - 0x3b6c]
push dword [eax + edi*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
mov eax, dword [ebp - 0x3b6c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 2
push dword [eax + edi*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
inc edi
cmp edi, ebx
jb 0x407c55
jmp 0x407eca
xor edi, edi
cmp dword [ebp + 0x24], edi
jbe 0x407ce6
mov eax, dword [ebp - 0x3b6c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 3
push dword [eax + edi*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x407ed1
inc edi
cmp edi, dword [ebp + 0x24]
jb 0x407cb8
xor esi, esi
mov edi, esi
jmp 0x4072ec
mov eax, dword [ebp - 0x3bc8]
dec eax
sub eax, 1
je 0x407d1c
sub eax, 1
je 0x407d14
sub eax, 1
je 0x407d0c
mov edi, 0x10000
jmp 0x407d32
mov edi, dword [0x42e8a0]
jmp 0x407d22
mov edi, dword [0x42e898]
jmp 0x407d22
mov edi, dword [0x42e890]
mov ecx, dword [0x42e884]
dec edi
add edi, ecx
lea eax, [ecx - 1]
not eax
and edi, eax
push 4
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x3b74], eax
test eax, eax
jne 0x407e8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e0
jmp 0x407e8d
mov ecx, dword [ebp - 0x3b80]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jne 0x407e97
mov eax, dword [ebp - 0x3bc8]
cmp eax, 2
je 0x407db1
cmp eax, 3
je 0x407db1
lea eax, [ebp - 0x3b78]
push eax
push edi
push dword [ebp - 0x3b74]
push dword [ebp - 0x3b5c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
jmp 0x407dcd
push 0
lea eax, [ebp - 0x3b78]
push eax
push edi
push dword [ebp - 0x3b74]
push dword [ebp - 0x3b58]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4072e0
mov ecx, dword [ebp - 0x3b78]
xor eax, eax
mov dword [ebp - 0x3b60], eax
test ecx, ecx
je 0x407e4b
test ebx, ebx
je 0x407e8d
push ecx
push dword [ebp - 0x3b74]
mov ecx, dword [ebp - 0x3b6c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push dword [ecx + eax*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
mov eax, dword [ebp - 0x3b60]
inc eax
mov dword [ebp - 0x3b60], eax
cmp eax, ebx
jae 0x407e8d
mov ecx, dword [ebp - 0x3b78]
jmp 0x407e07
test ebx, ebx
je 0x407e88
mov ecx, dword [ebp - 0x3b6c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 2
push dword [ecx + eax*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
mov eax, dword [ebp - 0x3b60]
inc eax
mov dword [ebp - 0x3b60], eax
cmp eax, ebx
jb 0x407e4f
xor eax, eax
lea esi, [eax + 1]
test esi, esi
je 0x407d71
jmp 0x407eca
xor edi, edi
test ebx, ebx
je 0x407eca
mov eax, dword [ebp - 0x3b6c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push dword [eax + edi*4]
push dword [ebp - 0x3b68]
call fcn.0040d846
mov esi, eax
test esi, esi
js 0x4072e0
inc edi
cmp edi, ebx
jb 0x407e9d
xor esi, esi
jmp 0x4072e0
mov edi, dword [ebp - 0x3b5c]
jmp 0x4072ec
mov edi, ebx
jmp 0x4072e6
cmp dword [ebp - 0x3b9c], 0
je 0x407efe
push dword [ebp - 0x3bec]
push dword [ebp - 0x3b84]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov ecx, dword [ebp - 0x3b68]
test ecx, ecx
je 0x407f0e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411738
mov esp, ebp
pop ebp
ret 0x24