Function at 0x407540
Capabilities:
Check mutex on windows
Create pipe
Create process on windows
Create process suspended
Get common file path
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x394
mov dword [ebp - 0x368], ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0x36c], edx
add eax, 0x18
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebp - 0x374], eax
call eax
push ecx
mov ebx, dword [esi + 0x68]
test ebx, ebx
je 0x4075af
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
push edx
push edx
je 0x407ea8
mov dword [esi + 0x68], 0
mov eax, dword [ebx + 0x10]
dec eax
mov dword [ebx + 0x10], eax
mov dword [esp], ebx
call fcn.00406f40
mov dword [esi + 0x70], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
lea eax, [eax + eax]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x358], eax
call eax
mov dword [ebp - 0x364], eax
test eax, eax
je 0x407cbb
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call edi
mov eax, dword [esi + 0x78]
sub esp, 0xc
test eax, eax
mov eax, dword [esi + 0x34]
jne 0x407960
lea ecx, [ebp - 0x214]
mov edi, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x360], edi
dec eax
cmp eax, 1
jbe 0x407ac0
lea eax, [ebp - 0x348]
mov dword [ebp - 0x340], 0xffffffff
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x340]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0xc], eax
mov eax, dword [0x4200e0]
mov dword [ebp - 0x348], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x4076a1
cmp dword [ebp - 0x214], 4
je 0x407ce3
mov eax, dword [0x4200e0]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x420090
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [0x420090]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipe_netNtControlPipe_u
mov dword [esp + 4], 0x27
mov dword [esp], 0x420040
call fcn.00405a60
mov eax, dword [0x420090]
inc eax
mov dword [esp + 4], 0x28
mov dword [esp], 1
mov dword [0x420090], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
test eax, eax
je 0x40864e
mov dword [eax + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateMutexW]
sub esp, 0xc
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x407e08
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov dword [ebx + 0x24], eax
test eax, eax
je 0x407e80
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x2710
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], 0x420040
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
sub esp, 0x20
mov dword [ebx + 0x20], eax
inc eax
je 0x407fba
lea edx, [ebp - 0x210]
xor eax, eax
mov ecx, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
test byte [esi + 0x35], 1
mov dword [ebp - 0x214], 0x44
jne 0x40780b
mov dword [ebp - 0x20c], str.__wineservice_winstationDefault
mov eax, dword [0x4200e4]
test eax, eax
je 0x407fe7
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
push eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
lea edx, [eax + 8]
mov dword [ebx], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 4], edx
mov dword [edx], ebx
mov dword [eax + 0xc], ebx
lock inc dword [ebx + 0xc]
mov eax, dword [ebp - 0x368]
mov dword [esi + 0x68], ebx
mov edx, dword [ebx + 0x10]
mov dword [eax], 0
inc edx
mov eax, dword [esi + 8]
mov dword [ebx + 0x10], edx
add eax, 0x18
mov dword [esi + 0x6c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x340]
mov esi, dword [ebp - 0x364]
push ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0x20], eax
mov eax, dword [0x4200e4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x408
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
mov edi, eax
mov eax, dword [ebp - 0x360]
mov dword [esp], esi
call eax
test edi, edi
je 0x407d02
mov eax, dword [ebp - 0x340]
mov dword [esp + 4], eax
mov eax, dword [0x4200dc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_AssignProcessToJobObject]
test eax, eax
push esi
push esi
jne 0x407919
test byte [0x418090], 2
jne 0x408134
mov eax, dword [ebp - 0x338]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x340]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x33c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x358], 0
push ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x358]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
and edi, 3
jne 0x40761b
lea ebx, [ebp - 0x214]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
mov dword [ebp - 0x35c], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x214], 0
push eax
push eax
je 0x408443
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4079a0
mov ecx, dword [ebp - 0x35c]
sub eax, ecx
mov dword [ebp - 0x360], eax
sar eax, 1
mov dword [esp + 8], eax
mov ebx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x364]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
test eax, eax
jne 0x407ec8
mov dword [esp], ebx
mov dword [esp + 4], 0x104
mov dword [ebp - 0x35c], ebx
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
mov ebx, dword [sym.imp.ucrtbase.dll_wcslen]
push eax
push eax
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x35c]
mov dword [esp], ecx
mov dword [ebp - 0x370], eax
call ebx
mov edx, dword [ebp - 0x370]
add eax, edx
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0x358]
call eax
mov ebx, eax
test eax, eax
je 0x407cac
xor eax, eax
mov ecx, dword [ebp - 0x35c]
mov dx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x407a40
mov eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x360]
add ecx, eax
mov eax, ebx
cmp word [ebx], 0
je 0x407a78
nop
add eax, 2
cmp word [eax], 0
jne 0x407a68
lea esi, [esi]
mov dx, word [ecx + edi]
mov word [eax + edi], dx
add edi, 2
test dx, dx
jne 0x407a78
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x360], eax
call eax
test byte [0x418090], 8
jne 0x408072
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x364], ebx
jmp 0x407633
mov ebx, dword [ebp - 0x35c]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x364]
push edi
push edi
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0x20]
mov dword [esp], eax
mov eax, dword [ebp - 0x358]
call eax
mov ecx, eax
mov dword [ebp - 0x370], eax
test eax, eax
je 0x407cbb
xor eax, eax
lea esi, [esi]
mov dx, word [ebx + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x407b18
mov edx, dword [ebp - 0x370]
cmp word [edx], 0
je 0x4083f5
add edx, 2
cmp word [edx], 0
jne 0x407b38
xor eax, eax
mov ecx, 0x5c
jmp 0x407b57
mov cx, word [eax + str.winedevice.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x407b50
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x44]
mov dword [ebp - 0x364], ecx
test edx, edx
lea eax, [ecx + 0x10]
mov dword [ebp - 0x378], eax
je 0x407d49
mov edi, dword [ecx + 0x10]
cmp eax, edi
je 0x407d49
mov ebx, dword [sym.imp.kernel32.dll_lstrcmpW]
lea esi, [esi]
mov eax, dword [edi + 0x18]
sub eax, 2
and eax, 0xfffffffd
jne 0x407d30
mov eax, dword [edi + 0x68]
test eax, eax
je 0x407d30
mov eax, dword [edi + 0x78]
test eax, eax
jne 0x407d30
mov eax, dword [edi + 0x40]
test eax, eax
je 0x407d30
mov ecx, dword [ebp - 0x370]
mov dword [esp], eax
mov dword [esp + 4], ecx
call ebx
test eax, eax
push edx
push edx
jne 0x407d28
mov eax, dword [edi + 0x44]
test eax, eax
je 0x407d28
mov edx, dword [esi + 0x44]
mov dword [esp], eax
mov dword [esp + 4], edx
call ebx
test eax, eax
push ecx
push ecx
jne 0x407d28
mov ebx, dword [edi + 0x68]
test ebx, ebx
je 0x407fa3
lea eax, [ebx + 0xc]
mov dword [ebp - 0x358], eax
lock inc dword [ebx + 0xc]
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov edi, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
push eax
mov eax, dword [ebp - 0x358]
lock inc dword [eax]
mov eax, dword [ebp - 0x368]
mov dword [esi + 0x68], ebx
mov dword [eax], 1
mov dword [esi + 0x6c], 1
mov eax, dword [ebx + 0x10]
inc eax
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call edi
push eax
mov dword [esp + 4], 0x7530
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x358], eax
test eax, eax
push edx
push edx
jne 0x4081ab
mov eax, dword [ebp - 0x36c]
mov dword [eax], ebx
jmp 0x407cd5
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebp - 0x358], 0x46a
push ecx
mov eax, dword [ebp - 0x358]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x340]
mov edx, dword [0x420090]
inc eax
cmp eax, edx
jb 0x407fe0
mov dword [0x420090], eax
jmp 0x4076a1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], ebx
mov dword [ebp - 0x358], eax
call fcn.004074b0
mov dword [esp], ebx
call fcn.00406f40
jmp 0x407cd5
mov ecx, dword [esi + 8]
lea esi, [esi]
nop
mov edi, dword [edi]
lea eax, [ecx + 0x10]
cmp edi, eax
jne 0x407b98
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x378], eax
mov edi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov ebx, dword [ebp - 0x378]
mov dword [ebp - 0x358], esi
lea esi, [esi]
nop
mov eax, dword [0x4200d0]
mov dword [esp + 8], str.Winedevice_u
inc eax
mov dword [esp + 4], 0x17
mov dword [esp + 0xc], eax
mov dword [esp], 0x4200a0
mov dword [0x4200d0], eax
call fcn.00405a60
mov eax, dword [ebp - 0x364]
mov esi, dword [eax + 0x10]
cmp esi, ebx
je 0x407db2
mov eax, dword [esi + 0x10]
mov dword [esp], 0x4200a0
mov dword [esp + 4], eax
call edi
test eax, eax
je 0x407d60
mov esi, dword [esi]
cmp esi, ebx
jne 0x407d98
lea eax, [ebp - 0x340]
mov dword [esp], 0x4200a0
mov dword [esp + 4], eax
mov esi, dword [ebp - 0x358]
call fcn.00406600
mov dword [ebp - 0x358], eax
test eax, eax
je 0x4081c8
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push eax
jmp 0x407cd5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x358], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x407e28
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
mov dword [esp], ebx
mov eax, dword [ebp - 0x360]
call eax
mov ecx, dword [ebp - 0x358]
test ecx, ecx
je 0x4077e0
test byte [0x418090], 2
jne 0x407edc
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push eax
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov eax, dword [ebp - 0x358]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x358], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x407e28
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
jmp 0x407e17
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebp - 0x358], 0x420
push eax
jmp 0x407cd5
mov edi, dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x360], edi
jmp 0x407633
mov edi, dword [esi + 0x10]
test edi, edi
je 0x40845e
mov eax, edi
shr eax, 0x10
je 0x40815d
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
test eax, eax
push edx
push edx
jne 0x408454
cmp word [edi], 0
je 0x4084ec
nop
mov ecx, eax
lea eax, [eax + 1]
cmp word [edi + ecx*2 + 2], 0
jne 0x407f18
mov word [ebp - 0x214], 0x224c
lea edx, [ebp - 0x212]
jmp 0x407f73
cmp ax, 9
je 0x4083e8
cmp ax, 0xa
jne 0x408382
mov word [edx], 0x6e5c
add edx, 2
lea esi, [esi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x408400
lea ecx, [ebp - 0xf2]
cmp edx, ecx
ja 0x408400
mov ecx, eax
mov ax, word [edi]
add edi, 2
cmp ax, 0xd
je 0x408368
jbe 0x407f38
cmp ax, 0x22
je 0x4083d8
cmp ax, 0x5c
jne 0x408375
mov word [edx], 0x5c5c
add edx, 2
jmp 0x407f58
mov eax, dword [esi + 8]
mov dword [ebp - 0x364], eax
add eax, 0x10
mov dword [ebp - 0x378], eax
jmp 0x407d49
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x358], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x407e96
jmp 0x407e17
mov eax, edx
jmp 0x407cf8
lea eax, [ebp - 0x354]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.advapi32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x407818
mov eax, dword [ebp - 0x354]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x4200e4
call dword [sym.imp.userenv.dll_CreateEnvironmentBlock]
lea eax, [ebp - 0x340]
sub esp, 0xc
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], str.WINEBOOTSTRAPMODE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x4085ce
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
jmp 0x407818
mov eax, ebx
shr eax, 0x10
je 0x40856a
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
test eax, eax
push edx
push edx
mov edx, eax
jne 0x40858b
mov eax, dword [ebx]
test ax, ax
je 0x408592
mov ecx, edx
lea edx, [edx + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x4080a5
lea edx, [ebp - 0x33e]
mov edi, ebx
mov dword [ebp - 0x364], ebx
mov word [ebp - 0x340], 0x224c
mov ebx, edx
jmp 0x408107
cmp ax, 9
je 0x4084df
cmp ax, 0xa
jne 0x408475
mov word [ebx], 0x6e5c
add ebx, 2
lea edx, [ecx - 1]
test ecx, ecx
jle 0x40850a
lea eax, [ebp - 0x21e]
cmp ebx, eax
ja 0x40850a
mov ax, word [edi]
mov ecx, edx
add edi, 2
cmp ax, 0xd
je 0x4084d2
jbe 0x4080cd
cmp ax, 0x22
je 0x4084c5
cmp ax, 0x5c
jne 0x408468
mov word [ebx], 0x5c5c
add ebx, 2
jmp 0x4080e9
mov dword [esp + 0xc], str.Could_not_add_object_to_job._n
mov dword [esp + 8], str.service_start_process
mov dword [esp + 4], 0x418090
mov dword [esp], 1
call fcn.00405e80
jmp 0x407919
mov eax, edi
mov dword [esp], 0x41ac20
and eax, 0xffff
mov dword [esp + 4], eax
call fcn.00405d50
mov edi, dword [ebp - 0x358]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], str.failed_to_create_process_object_for__s__error___lu_n
mov dword [esp + 8], str.service_start_process
mov dword [esp + 4], 0x418090
mov dword [esp], 1
call fcn.00405e80
jmp 0x407e4e
mov dword [esp], ebx
call fcn.00406f40
mov dword [ebp - 0x358], 0x41d
jmp 0x407cd5
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0x370]
mov ebx, dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x358], edx
mov dword [edx + 0x78], 0
mov dword [edx + 0x34], 0x10
mov dword [edx + 0x38], 3
mov dword [edx + 0x14], 0x10
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x358]
test eax, eax
mov dword [edx + 0x40], eax
je 0x408626
mov dword [esp], str.LocalSystem
call ebx
mov edx, dword [ebp - 0x358]
test eax, eax
mov dword [edx + 0x50], eax
je 0x408626
mov dword [esp], 0x4200a0
call ebx
mov edx, dword [ebp - 0x358]
test eax, eax
mov dword [edx + 0x54], eax
je 0x408626
mov eax, dword [esi + 0x44]
test eax, eax
je 0x408269
mov dword [esp], eax
mov dword [ebp - 0x358], edx
call ebx
mov edx, dword [ebp - 0x358]
test eax, eax
mov dword [edx + 0x44], eax
je 0x408626
mov edi, dword [ebp - 0x364]
mov eax, dword [ebp - 0x378]
mov dword [edx + 8], edi
mov dword [edx], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x358], edx
mov dword [edx + 4], eax
mov dword [eax], edx
mov eax, dword [ebp - 0x370]
mov dword [edi + 0x14], edx
mov dword [edx + 0x74], 1
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov edx, dword [ebp - 0x358]
mov eax, dword [edx + 0x44]
mov dword [esp], eax
call ebx
mov edi, dword [esi + 8]
mov dword [ebp - 0x214], eax
lea eax, [edi + 0x18]
mov dword [esp], eax
mov edi, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call edi
mov edx, dword [ebp - 0x35c]
push eax
xor eax, eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x214]
test edx, edx
mov edx, dword [ebp - 0x358]
setne al
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x35c], edx
call fcn.00408660
mov ebx, eax
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x360]
mov dword [esp], eax
call ecx
test ebx, ebx
mov edx, dword [ebp - 0x35c]
jne 0x40842e
mov eax, dword [esi + 8]
mov dword [ebp - 0x358], edx
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov edx, dword [ebp - 0x358]
push eax
mov ebx, dword [edx + 0x68]
test ebx, ebx
je 0x4085ab
lea eax, [ebx + 0xc]
mov dword [ebp - 0x358], eax
lock inc dword [ebx + 0xc]
mov eax, dword [ebp - 0x340]
mov dword [esp], eax
call fcn.004072e0
jmp 0x407c31
mov word [edx], 0x725c
add edx, 2
jmp 0x407f58
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x40843b
mov ebx, eax
mov byte [edx], 0x5c
shr bx, 0xc
add edx, 5
and ebx, 0xffff
mov bl, byte [ebx + str.0123456789abcdefvalidate_service_config]
mov byte [edx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
mov bl, byte [ebx + str.0123456789abcdefvalidate_service_config]
mov byte [edx - 3], bl
mov ebx, eax
shr bx, 4
and eax, 0xf
and ebx, 0xf
mov al, byte [eax + str.0123456789abcdefvalidate_service_config]
mov bl, byte [ebx + str.0123456789abcdefvalidate_service_config]
mov byte [edx - 1], al
mov byte [edx - 2], bl
jmp 0x407f58
mov word [edx], 0x225c
add edx, 2
jmp 0x407f58
mov word [edx], 0x745c
add edx, 2
jmp 0x407f58
mov edx, dword [ebp - 0x370]
jmp 0x407b41
mov byte [edx], 0x22
test eax, eax
jle 0x408502
lea eax, [edx + 4]
mov word [edx + 1], 0x2e2e
mov byte [edx + 3], 0x2e
mov byte [eax], 0
mov eax, dword [ebp - 0x35c]
mov dword [esp], eax
call fcn.004164a0
jmp 0x408174
mov dword [esp], edx
call fcn.004072e0
jmp 0x407cd5
mov byte [edx], al
inc edx
jmp 0x407f58
xor eax, eax
mov dword [ebp - 0x360], 0
jmp 0x4079b9
mov eax, 0x41ac2d
jmp 0x408174
mov eax, 0x41ac26
jmp 0x408174
lea edx, [eax - 0x20]
cmp dx, 0x5e
jbe 0x408583
mov edx, eax
mov byte [ebx], 0x5c
shr dx, 0xc
add ebx, 5
and edx, 0xffff
mov dl, byte [edx + str.0123456789abcdefvalidate_service_config]
mov byte [ebx - 4], dl
mov edx, eax
shr dx, 8
and edx, 0xf
mov dl, byte [edx + str.0123456789abcdefvalidate_service_config]
mov byte [ebx - 3], dl
mov edx, eax
shr dx, 4
and eax, 0xf
and edx, 0xf
mov al, byte [eax + str.0123456789abcdefvalidate_service_config]
mov dl, byte [edx + str.0123456789abcdefvalidate_service_config]
mov byte [ebx - 1], al
mov byte [ebx - 2], dl
jmp 0x4080e9
mov word [ebx], 0x225c
add ebx, 2
jmp 0x4080e9
mov word [ebx], 0x725c
add ebx, 2
jmp 0x4080e9
mov word [ebx], 0x745c
add ebx, 2
jmp 0x4080e9
mov word [ebp - 0x214], 0x224c
mov byte [ebp - 0x212], 0x22
lea edx, [ebp - 0x212]
lea eax, [edx + 1]
jmp 0x408418
mov eax, ebx
test edx, edx
mov ebx, dword [ebp - 0x364]
mov byte [eax], 0x22
jle 0x4085a8
mov ecx, eax
lea eax, [eax + 4]
mov word [ecx + 1], 0x2e2e
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x340]
mov dword [esp], eax
call fcn.004164a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.redirected_to__s_n
mov dword [esp + 8], str.get_service_binary_path
mov dword [esp + 4], 0x418090
mov dword [esp], 3
call fcn.00405e80
jmp 0x407aab
mov eax, ebx
mov dword [esp], 0x41ac20
and eax, 0xffff
mov dword [esp + 4], eax
call fcn.00405d50
jmp 0x40853d
mov byte [ebx], al
inc ebx
jmp 0x4080e9
mov eax, 0x41ac2d
jmp 0x40853d
mov word [ebp - 0x340], 0x224c
mov byte [ebp - 0x33e], 0x22
lea eax, [ebp - 0x33e]
inc eax
jmp 0x40852c
mov dword [esp], edx
call fcn.004072e0
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call edi
mov dword [ebp - 0x358], 0x41d
push ebx
jmp 0x407cd5
lea eax, [ebp - 0x340]
mov dword [ebp - 0x350], 0x240022
mov dword [esp + 4], eax
lea eax, [ebp - 0x348]
mov dword [esp], eax
mov dword [ebp - 0x34c], str.WINEBOOTSTRAPMODE
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push eax
push eax
lea eax, [ebp - 0x348]
mov dword [esp + 8], eax
lea eax, [ebp - 0x350]
mov dword [esp + 4], eax
mov dword [esp], 0x4200e4
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
sub esp, 0xc
jmp 0x40805d
mov dword [esp], edx
call fcn.00406fd0
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov dword [ebp - 0x358], 0x46a
jmp 0x407ded
mov dword [ebp - 0x358], 0x46a
jmp 0x407e41