Function at 0x416700
Capabilities:
Acquire debug privileges
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8848
mov eax, dword fs:[0]
push eax
sub esp, 0x868
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0xf4], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0xff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x80c]
call fcn.005a286b
call fcn.005303a0
push 0x638974
mov ecx, 0x673eac
call fcn.0040b520
push eax
call fcn.005be4ae
add esp, 8
test eax, eax
jne 0x416787
push 0x618326
mov ecx, 0x673eac
call fcn.0040b4d0
push 1
push 2
lea ecx, [ebp - 0x194]
call fcn.0040a750
mov dword [ebp - 4], 0
mov ecx, 0x673eac
call fcn.0040b520
push eax
push str._change:
push 0x638984
lea ecx, [ebp - 0x194]
push ecx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x6b0]
push edx
lea ecx, [ebp - 0x194]
call fcn.00408c00
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x814]
call fcn.0040b520
push eax
push 0x6389a0
push 0x74
push 0x6389bc
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6b0]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.004094e0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416925
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x6389cc
lea edx, [ebp - 0x214]
push edx
call fcn.005bd49b
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x294]
call fcn.0040a750
mov dword [ebp - 4], 2
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x294]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x6cc]
push edx
lea ecx, [ebp - 0x294]
call fcn.00408c00
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x81c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x81c]
call fcn.0040b520
push eax
push 0x6389e8
push 0x81
push 0x638a04
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6cc]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.004094e0
xor eax, eax
jmp 0x41707b
push 0
push 2
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416a13
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x638a14
lea edx, [ebp - 0x314]
push edx
call fcn.005bd49b
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x394]
call fcn.0040a750
mov dword [ebp - 4], 4
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x394]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x6e8]
push edx
lea ecx, [ebp - 0x394]
call fcn.00408c00
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x824], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x824]
call fcn.0040b520
push eax
push 0x638a38
push 0x8f
push 0x638a54
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6e8]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.004094e0
xor eax, eax
jmp 0x41707b
push 0
call fcn.005a4441
add esp, 4
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
push 1
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
call fcn.004040c0
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x704]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0040c3c0
mov dword [ebp - 0x828], eax
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x82c]
call fcn.0040b520
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x673dec], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call fcn.0040b640
cmp dword [0x673dec], 0
je 0x416ad9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416b7f
push 1
push 2
lea ecx, [ebp - 0x414]
call fcn.0040a750
mov dword [ebp - 4], 7
push 0x638a64
lea ecx, [ebp - 0x414]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x720]
push edx
lea ecx, [ebp - 0x414]
call fcn.00408c00
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x834]
call fcn.0040b520
push eax
push 0x638a74
push 0xb0
push 0x638a90
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x720]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.004094e0
xor eax, eax
jmp 0x41707b
push 1
lea ecx, [ebp - 0x73c]
push ecx
call fcn.00508a90
add esp, 8
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x838]
mov dword [ebp - 0x83c], edx
mov dword [ebp - 4], 9
push 0x638ab4
mov eax, dword [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x758]
push ecx
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0x840], eax
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x844], edx
mov byte [ebp - 4], 0xa
push 0x638aa8
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x774]
push ecx
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 0xb
push str..lck
mov eax, dword [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x774]
call fcn.0040b640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x758]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x73c]
call fcn.0040b640
push 0
push 0x4000080
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.0040b520
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x416d4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x416d4c
push 1
push 2
lea ecx, [ebp - 0x494]
call fcn.0040a750
mov byte [ebp - 4], 0x10
push 0x638ab8
lea edx, [ebp - 0x494]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x494]
call fcn.00408c00
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x854], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x854]
call fcn.0040b520
push eax
push 0x638ac8
push 0xbd
push 0x638ae4
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x790]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x494]
call fcn.004094e0
mov dword [ebp - 0x794], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040b640
mov eax, dword [ebp - 0x794]
jmp 0x41707b
push 1
push 0x638af4
call fcn.00507050
add esp, 8
test eax, eax
jne 0x416dfc
push 1
push 2
lea ecx, [ebp - 0x514]
call fcn.0040a750
mov byte [ebp - 4], 0x12
push str.SeDebugPrivilege
lea edx, [ebp - 0x514]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0x514]
call fcn.00408c00
mov dword [ebp - 0x858], eax
mov ecx, dword [ebp - 0x858]
mov dword [ebp - 0x85c], ecx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x85c]
call fcn.0040b520
push eax
push 0x638b1c
push 0xd0
push 0x638b38
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7b0]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x514]
call fcn.004094e0
push 1
push 0x638b48
call fcn.00507050
add esp, 8
test eax, eax
jne 0x416eac
push 1
push 2
lea ecx, [ebp - 0x594]
call fcn.0040a750
mov byte [ebp - 4], 0x14
push str.SeBackupPrivilege
lea edx, [ebp - 0x594]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x594]
call fcn.00408c00
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x864], ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x864]
call fcn.0040b520
push eax
push 0x638b70
push 0xd5
push 0x638b8c
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7cc]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x594]
call fcn.004094e0
push 1
push 0x638b9c
call fcn.00507050
add esp, 8
test eax, eax
jne 0x416f5c
push 1
push 2
lea ecx, [ebp - 0x614]
call fcn.0040a750
mov byte [ebp - 4], 0x16
push str.SeSecurityPrivilege
lea edx, [ebp - 0x614]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x614]
call fcn.00408c00
mov dword [ebp - 0x868], eax
mov ecx, dword [ebp - 0x868]
mov dword [ebp - 0x86c], ecx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x86c]
call fcn.0040b520
push eax
push 0x638bc4
push 0xda
push 0x638be0
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x7e8]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x614]
call fcn.004094e0
push 1
push 0x638bf0
call fcn.00507050
add esp, 8
test eax, eax
jne 0x41700c
push 1
push 2
lea ecx, [ebp - 0x694]
call fcn.0040a750
mov byte [ebp - 4], 0x18
push str.SeSystemtimePrivilege
lea edx, [ebp - 0x694]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x694]
call fcn.00408c00
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x870]
mov dword [ebp - 0x874], ecx
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x874]
call fcn.0040b520
push eax
push str.CEDSClientApp::InitInstance
push 0xdf
push str..EDSClient.cpp
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x804]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x694]
call fcn.004094e0
push 0x416270
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00512a50
push 0
lea ecx, [ebp - 0xec]
call fcn.004179e0
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x80c]
lea eax, [ebp - 0xec]
mov dword [edx + 0x20], eax
lea ecx, [ebp - 0xec]
call fcn.005a51e6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x808], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xec]
call fcn.004170a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040b640
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xf4]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret