Function at 0x4065bf
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x242c
call fcn.0040a510
mov eax, dword [0x40c080]
xor eax, esp
mov dword [esp + 0x2428], eax
push ebx
push esi
lea eax, [esp + 0x90]
mov dword [esp + 0x88], 1
push edi
mov dword [esp + 0x88], eax
mov edi, ecx
lea eax, [esp + 0x2b0]
mov dword [esp + 0x2b0], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x406650
push ebx
push 4
lea eax, [esp + 0x58]
mov byte [0x40cd92], bl
push eax
push 0x1a
mov byte [0x40caad], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x406650
cmp dword [esp + 0x50], ebx
je 0x406650
mov byte [0x40caad], 1
mov eax, dword [0x40b060]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x40b870]
mov word [eax], cx
lea eax, [esp + 0xa4]
mov dword [esp + 0x9c], 0x104
mov dword [esp + 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop edx
mov dword [esp + 0x18], esi
cmp word [esi], dx
jne 0x40669b
add esi, 2
mov dword [esp + 0x18], esi
jmp 0x40669d
mov edx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4066c7
cmp cx, dx
je 0x4066b7
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4066a5
mov dword [esp + 0x18], esi
cmp word [esi], bx
je 0x4066c7
add esi, 2
mov dword [esp + 0x18], esi
push 0xfffffffffffffff5
mov dword [0x40cda4], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40cab4], eax
cmp eax, 0xffffffff
je 0x4066eb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4066f1
mov dword [0x40cab4], ebx
mov edi, 0x800
mov dword [esp + 0x50], ebx
push edi
lea eax, [esp + 0xc34]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x1430]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x40c914], ebx
push 9
pop edx
push 0x20
mov dword [esp + 0x4c], edx
pop ecx
movzx eax, word [esi]
cmp ax, cx
je 0x40673b
cmp ax, dx
jne 0x406740
add esi, 2
jmp 0x40672e
movzx eax, word [esi]
push 0x2d
pop edx
push 0x2f
pop edi
mov dword [esp + 0x18], esi
cmp ax, di
je 0x40675b
cmp ax, dx
jne 0x406894
lea eax, [esi + 2]
test eax, eax
je 0x406894
mov ax, word [eax]
or ax, cx
cmp ax, 0x60
jne 0x406894
add esi, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
call fcn.004060c3
lea eax, [esp + 0xc30]
push 0x400
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004062e0
pop ecx
test al, al
je 0x40705f
mov eax, dword [esp + 0x9c]
mov edx, 0x401778
add eax, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
call fcn.00403082
add esp, 0xc
test eax, eax
jne 0x407cc0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x9c]
lea eax, [esp + 0x3c]
push eax
push ebx
lea eax, [esp + 0xc40]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x406850
mov eax, dword [esp + 0x38]
push ecx
shr eax, 1
lea ecx, [esp + 0x9c]
push eax
call fcn.00408731
test al, al
jne 0x40682a
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4068c3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x9c]
lea eax, [esp + 0x3c]
push eax
push ebx
lea eax, [esp + 0xc40]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407cc0
cmp dword [esp + 0x34], 1
jne 0x407cc0
mov esi, dword [esp + 0x98]
push 0x20
pop edx
movzx edi, word [esi]
mov dword [esp + 0x10], esi
cmp di, dx
je 0x40688f
push 9
pop eax
cmp di, ax
jne 0x406cbe
add esi, 2
jmp 0x406877
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
mov ecx, esi
call fcn.00402fae
test eax, eax
js 0x406c48
mov eax, dword [esp + 0x1c]
push ecx
inc eax
lea ecx, [esp + 0x9c]
push eax
call fcn.00408731
test al, al
jne 0x4068cb
push 0xe
pop ebx
jmp 0x407cc0
mov eax, dword [esp + 0x98]
lea edi, [esp + 0xab4]
xor ecx, ecx
mov dword [esp + 0xa28], 0x401800
mov esi, 0x401974
mov dword [esp + 0xa34], 0x401810
push 8
mov word [eax], cx
mov edx, 0x7fffffff
mov eax, dword [0x401964]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xaa8], eax
mov ax, word [0x401968]
mov word [esp + 0xaac], ax
mov eax, dword [0x40196c]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xab0], eax
mov ax, word [0x401970]
pop ecx
movsd dword es:[edi], dword [esi]
mov word [esp + 0xab0], ax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0xa44], 0x401824
movsw word es:[edi], word [esi]
mov esi, 0x401984
mov dword [esp + 0xa48], 0x401834
lea edi, [esp + 0xad8]
mov byte [esp + 0xa4c], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401824
mov dword [esp + 0xa50], 0x40183c
mov dword [esp + 0xa54], 0x401848
mov byte [esp + 0xa58], 1
mov dword [esp + 0xa5c], 0x401850
mov dword [esp + 0xa60], 0x40185c
mov byte [esp + 0xa64], 1
mov dword [esp + 0xa68], 0x401864
mov dword [esp + 0xa6c], 0x401874
mov byte [esp + 0xa70], 1
mov dword [esp + 0xa74], 0x4018a0
mov dword [esp + 0xa78], 0x4018b4
mov byte [esp + 0xa7c], 1
mov dword [esp + 0xa80], 0x4018e0
mov dword [esp + 0xa84], 0x4018fc
mov byte [esp + 0xa88], 1
mov dword [esp + 0xa8c], 0x401918
mov dword [esp + 0xa90], 0x401934
mov byte [esp + 0xa94], 1
mov dword [esp + 0xa98], 0x401954
mov dword [esp + 0xa9c], 0x40195c
mov byte [esp + 0xaa0], 1
mov dword [esp + 0x58], ebx
call fcn.00402fe3
test eax, eax
js 0x406c48
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
jmp 0x406ada
movzx eax, word [edi]
test ax, ax
je 0x406af1
push 0x2d
pop ecx
cmp ax, cx
je 0x406a7d
push 0x2f
pop ecx
cmp ax, cx
jne 0x406ada
mov eax, dword [esp + 0x10]
lea ecx, [eax - 1]
mov dword [esp + 0x2c], ecx
cmp ecx, 1
jne 0x406ab3
push 0xffffffffffffffff
push 0x4019a4
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406b2a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x54], ecx
jne 0x406ada
push dword [esp + 0x54]
dec eax
push 0x401824
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406b2a
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
call fcn.00404356
mov edi, eax
test edi, edi
jne 0x406a61
lea eax, [esp + 0xaac]
mov byte [esp + 0xa30], 1
mov dword [esp + 0xa2c], eax
lea eax, [esp + 0xaa4]
mov byte [esp + 0xa3c], 1
mov dword [esp + 0xa38], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
jmp 0x406c16
lea eax, [esp + 0xab4]
mov byte [esp + 0xa30], bl
mov dword [esp + 0xa2c], eax
lea eax, [esp + 0xad4]
mov byte [esp + 0xa3c], bl
jmp 0x406b16
movzx eax, word [esi]
test ax, ax
je 0x406c2d
push 0x2d
pop ecx
cmp ax, cx
je 0x406b6b
push 0x2f
pop ecx
cmp ax, cx
jne 0x406bb4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xa28]
dec ecx
mov dword [esp + 0x28], eax
mov edi, ebx
mov dword [esp + 0x2c], ecx
lea edx, [esi + 2]
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406bc9
mov eax, dword [esp + 0x28]
lea edx, [esi + 2]
mov ecx, dword [esp + 0x2c]
inc edi
add eax, 0xc
mov dword [esp + 0x28], eax
cmp edi, 0xa
jb 0x406b84
push 1
push dword [esp + 0x14]
mov dword [esp + 0xa8], 0x104
mov edx, esi
jmp 0x406c04
imul esi, edi, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0xa4], 0x104
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + esi + 0xa30]
call fcn.00402fae
test eax, eax
js 0x406c52
movzx eax, byte [esp + esi + 0xa30]
mov edx, dword [esp + esi + 0xa2c]
push eax
push dword [esp + 0x2c]
lea ecx, [esp + 0xa0]
call fcn.00404475
pop ecx
pop ecx
test eax, eax
jne 0x406c57
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
call fcn.00404356
mov esi, eax
test esi, esi
jne 0x406b4f
mov esi, dword [esp + 0x98]
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.00402fae
test eax, eax
jns 0x406c5e
mov ebx, 0x65b
jmp 0x407cc0
mov eax, 0x65b
mov ebx, eax
jmp 0x407cc0
mov eax, dword [esp + 0x1c]
push 0x20
pop edx
test eax, eax
je 0x406c94
dec eax
push 9
pop ebx
lea eax, [esi + eax*2]
movzx ecx, word [eax]
cmp cx, dx
je 0x406c7d
cmp cx, bx
jne 0x406c92
cmp eax, esi
jb 0x406c92
xor ecx, ecx
mov word [eax], cx
sub eax, 2
mov esi, dword [esp + 0x98]
jmp 0x406c70
xor ebx, ebx
movzx edi, word [esi]
mov dword [esp + 0x10], esi
test di, di
je 0x406cbe
push 9
pop ebx
cmp di, dx
je 0x406cad
cmp di, bx
jne 0x406cbc
add esi, 2
mov dword [esp + 0x10], esi
movzx edi, word [esi]
test di, di
jne 0x406ca3
xor ebx, ebx
mov dword [esp + 0x4c], 0x50
test di, di
je 0x407072
mov dword [esp + 0x40], 0x71
push 0x2f
pop eax
cmp di, ax
je 0x406d63
push 0x2d
pop eax
cmp di, ax
je 0x406d63
push 0x208
lea eax, [esp + 0x3e0]
push ebx
push eax
call sub.msvcrt.dll_memset
mov ecx, 0x104
lea eax, [esp + 0x3e8]
add esp, 0xc
mov dword [esp + 0x3d4], ecx
mov dword [esp + 0x3d8], ecx
lea edx, [esp + 0x3d0]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3d0], eax
call fcn.00406320
test eax, eax
je 0x407038
mov edx, dword [esp + 0x3d0]
call fcn.0040487b
lea ecx, [esp + 0x10]
call fcn.004060c3
lea ecx, [esp + 0x3d0]
movzx edi, ax
call fcn.004086ed
jmp 0x407027
lea ecx, [esi + 2]
movzx eax, word [ecx]
or eax, edx
mov dword [esp + 0x2c], eax
xor eax, eax
cmp ax, word [ecx]
je 0x406d79
add ecx, 2
push 0x52
mov edx, 0x402668
mov dword [esp + 0x14], ecx
pop eax
mov dword [esp + 0x14], edx
mov edi, eax
movzx eax, di
or eax, 0x20
movzx esi, di
cmp eax, dword [esp + 0x2c]
je 0x406db6
add edx, 2
mov dword [esp + 0x14], edx
movzx eax, word [edx]
mov edi, eax
mov esi, eax
test ax, ax
jne 0x406d8b
test si, si
je 0x406fb7
movzx eax, word [ecx]
push 0x20
pop ecx
cmp ax, cx
je 0x406dd7
test ax, ax
je 0x406dd7
push 9
pop ecx
cmp ax, cx
je 0x406dd7
xor edi, edi
inc edi
mov dword [esp + 0x28], edi
jmp 0x406ddd
mov edi, ebx
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x10]
call fcn.004060c3
push 0x63
pop ecx
lea eax, [esp + 0xc30]
mov dword [esp + 0x18], eax
cmp si, cx
jne 0x406e01
test edi, edi
jne 0x406fb7
push 0x50
pop eax
cmp si, ax
jne 0x406e44
push ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
lea ecx, [esp + 0x8c]
push eax
call fcn.00408951
test al, al
je 0x407057
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x2c]
push dword [esp + 0x8c]
mov dword [esp + 0x30], eax
jmp 0x406e5e
push 0x71
pop eax
cmp si, ax
je 0x406e51
cmp si, cx
jne 0x406e55
test edi, edi
je 0x406e70
push 0x400
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.004062e0
pop ecx
test al, al
je 0x40705f
lea ecx, [esp + 0x10]
call fcn.004060c3
mov esi, dword [esp + 0x14]
movzx edi, ax
movzx eax, word [esi]
cmp eax, 0x46
je 0x406eb1
push 0x71
pop ecx
cmp ax, cx
je 0x406eb1
cmp eax, 0x4a
je 0x406eb1
mov ecx, eax
lea edx, [esp + 0xc30]
lea eax, [esp + 0x1430]
mov dword [esp + 0x1c], eax
movzx eax, word [esi]
cmp eax, 0x6c
jne 0x406f23
cmp dword [esp + 0x28], 0
lea edx, [esp + 0xc30]
movzx ecx, ax
lea eax, [esp + 0x1430]
mov dword [esp + 0x1c], eax
movzx eax, word [esi]
je 0x406f23
lea ecx, [esp + 0x1430]
mov dword [esp + 0x18], ecx
mov ecx, edx
lea edx, [esp + 0x1430]
mov dword [esp + 0x1c], ecx
mov ecx, eax
mov dword [esp + 0x2c], edx
cmp ax, word [esp + 0x40]
je 0x406f23
push 0x400
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.004062e0
pop ecx
test al, al
je 0x40705f
lea ecx, [esp + 0x10]
call fcn.004060c3
movzx ecx, word [esi]
mov edx, dword [esp + 0x2c]
movzx edi, ax
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x406f4e
sub esi, 0x402668
sar esi, 1
push edx
push dword [esp + 0x20]
mov esi, dword [esi*4 + 0x401008]
mov ecx, esi
call dword [0x40e210]
call esi
pop ecx
pop ecx
jmp 0x406fb3
mov eax, dword [0x40c870]
test eax, eax
je 0x406fcf
cmp cx, word [esp + 0x4c]
jne 0x406f9c
push 0x41
pop ebx
cmp word [eax], bx
push 0
pop ebx
jne 0x406f9c
push 0x41
pop eax
lea edx, [esp + 0x1c30]
mov ecx, eax
call fcn.004055bb
test eax, eax
jne 0x406fb7
push 0x1e
push dword [esp + 0x20]
mov dword [0x40c870], esi
push ecx
push 0x1e
pop edx
lea ecx, [esp + 0xb00]
call fcn.0040302e
jmp 0x407015
push 0x50
pop esi
cmp word [eax], si
jne 0x406fb7
push 0x41
pop eax
cmp cx, ax
jne 0x406fb7
mov ecx, eax
call fcn.004055bb
test eax, eax
je 0x407015
push ebx
push ebx
call fcn.00404520
pop ecx
pop ecx
mov esi, 0x667
call fcn.00406576
jmp 0x407d0b
push 0x50
pop eax
mov dword [0x40c870], esi
cmp cx, ax
je 0x406ff3
mov eax, 0x400
push eax
push edx
push ecx
mov edx, eax
lea ecx, [esp + 0x1c3c]
call fcn.0040302e
push 0x1e
push dword [esp + 0x20]
push ecx
push 0x1e
pop edx
lea ecx, [esp + 0xb00]
call fcn.0040302e
mov edx, dword [esp + 0x14]
push 0x45
pop eax
cmp word [edx], ax
je 0x407078
xor eax, eax
mov word [esp + 0xc30], ax
mov word [esp + 0x1430], ax
test di, di
je 0x407072
mov esi, dword [esp + 0x10]
push 0x20
pop edx
jmp 0x406cd7
push ebx
push ebx
call fcn.00404520
pop ecx
pop ecx
lea ecx, [esp + 0x3d0]
mov esi, 0x667
call fcn.004086ed
jmp 0x406fc5
push 0xe
pop esi
jmp 0x406fc5
push ebx
push ebx
call fcn.00404520
pop ecx
pop ecx
mov ebx, 0x667
jmp 0x407cc0
mov esi, dword [0x40c870]
test esi, esi
je 0x4071e2
movzx eax, word [esi]
push 0x59
pop edx
push 0x5a
pop ecx
push 0x45
pop edi
cmp di, ax
je 0x4070a6
cmp dx, ax
je 0x4070a6
cmp cx, ax
je 0x4070a6
call fcn.00406576
mov esi, dword [0x40c870]
mov eax, esi
sub eax, 0x402668
sar eax, 1
push 0x50
mov edi, dword [eax*4 + 0x401008]
pop eax
cmp word [esi], ax
mov eax, dword [esp + 0x88]
je 0x4070cc
lea eax, [esp + 0x1c30]
push eax
lea eax, [esp + 0xaf8]
mov ecx, edi
push eax
call dword [0x40e210]
call edi
pop ecx
pop ecx
mov ecx, dword [0x40c870]
mov esi, eax
push 0x59
mov dword [esp + 0x2c], esi
movzx eax, word [ecx]
pop ecx
cmp ax, cx
je 0x4071db
push 0x5a
pop ecx
cmp ax, cx
je 0x4071db
test esi, esi
jne 0x40713a
push 0x45
pop ecx
cmp ax, cx
jne 0x407129
mov edi, ebx
mov dword [0x40c914], 1
mov dword [esp + 0x68], edi
jmp 0x4071c7
mov eax, dword [0x40c914]
xor edi, edi
inc edi
mov dword [esp + 0x68], edi
jmp 0x4071c3
cmp esi, 0x8000
jne 0x40714f
mov dword [0x40c914], ebx
mov esi, ebx
jmp 0x407d0b
mov eax, 0x4eb
cmp esi, eax
jg 0x40717d
je 0x4071a8
cmp esi, 0xfffffffe
jl 0x4071a1
test esi, esi
js 0x4071a8
cmp esi, 1
jle 0x4071a1
cmp esi, 3
jle 0x407172
cmp esi, 0x7b
jne 0x4071a1
mov esi, 0x653
mov dword [esp + 0x28], esi
jmp 0x4071a1
cmp esi, 0x642
jl 0x4071a1
cmp esi, 0x644
jle 0x4071a8
cmp esi, 0x669
je 0x4071a8
cmp esi, 0xbc2
je 0x407d0b
mov ecx, esi
call fcn.00405e55
mov edi, ebx
mov dword [esp + 0x68], edi
test esi, esi
jne 0x407d0b
mov eax, dword [0x40c914]
test eax, eax
je 0x407d0b
test eax, eax
je 0x407209
mov esi, dword [0x40b018]
mov ecx, esi
push ebx
push ebx
call dword [0x40e210]
call esi
jmp 0x40721a
mov ebx, esi
jmp 0x407cc0
call fcn.00406576
cmp dword [0x40c870], 0
mov esi, ebx
mov dword [esp + 0x28], esi
jne 0x4071a8
push ebx
push ebx
call fcn.00404520
pop ecx
pop ecx
mov esi, 0x667
jmp 0x407d0b
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x4019a8
call fcn.0040924a
test edi, edi
je 0x407263
cmp dword [0x40c914], 0
jne 0x407270
mov esi, 0x4025e8
mov edi, ebx
lea eax, [edi + 0x40c6ac]
push eax
push 1
push 4
lea eax, [edi + 0x40b054]
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x40725b
add esi, 0x10
add edi, 4
cmp esi, 0x4025f8
jl 0x40722e
jmp 0x407263
mov dword [esp + 0x50], 1
cmp dword [0x40c914], 0
je 0x407cc4
mov eax, dword fs:[0x30]
lea edi, [esp + 0xac4]
mov ecx, dword [esp + 0x10]
mov esi, ebx
push 0x20
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
movzx edx, word [ecx]
mov dword [esp + 0x3c], ecx
lea eax, [edx - 0x30]
cmp ax, word [esp + 0x48]
ja 0x4072b5
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x30
jmp 0x4072ca
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x407306
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x37
and cl, 0xf1
movzx eax, dl
add cl, 0x10
movzx ecx, cl
imul ecx, eax
cmp esi, edi
jge 0x4072f9
mov eax, esi
test eax, eax
jns 0x4072e6
add eax, 1
sar eax, 1
or byte [esp + eax + 0xac4], cl
inc esi
mov ecx, dword [esp + 0x3c]
add ecx, 2
jmp 0x407296
push 0x57
pop edx
mov ecx, 0x4019c8
jmp 0x407cb6
cmp esi, edi
je 0x407317
push 0x57
pop edx
mov ecx, 0x401a10
jmp 0x407cb6
mov byte [esp + 0x60], bl
mov eax, edx
mov byte [esp + 0x23], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x5c], bl
test dx, dx
je 0x407338
add ecx, 2
movzx eax, word [ecx]
cmp ax, 0x43
jne 0x407386
mov byte [esp + 0x60], 1
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x407412
or dword [esp + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x407412
mov ecx, 0x401b48
jmp 0x407cb4
cmp ax, 0x55
jne 0x407398
mov byte [esp + 0x60], 1
mov byte [esp + 0x33], 1
jmp 0x407343
push 0x41
pop edx
cmp ax, dx
jne 0x4073a7
mov byte [esp + 0x5c], 1
jmp 0x407343
cmp ax, 0x4d
je 0x4073bf
push 0x52
pop edx
cmp ax, dx
je 0x4073c4
push 0x45
pop edx
cmp ax, dx
jne 0x407343
jmp 0x4073c9
mov byte [esp + 0x23], 1
mov byte [esp + 0x38], 1
lea eax, [ecx + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x407ca9
cmp esi, 0xffffffff
je 0x407ca9
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x407343
mov edx, edi
mov ecx, 0x401ad8
jmp 0x407cb6
cmp byte [esp + 0x23], 0
jne 0x40741f
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x23], 0
je 0x407442
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
cmp byte [0x40cd92], al
setne al
mov dword [esp + 0x10], eax
lea eax, [esp + 0x74]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4074f6
lea ecx, [esp + 0x40]
call fcn.0040322b
test eax, eax
jne 0x4074e6
lea eax, [esp + 0xaac]
push eax
push 0x50
pop eax
push eax
lea eax, [esp + 0xa30]
push eax
push 1
push dword [esp + 0x84]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4074e6
push dword [esp + 0x40]
push dword [esp + 0xa2c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4074d7
movzx esi, byte [esp + 0x38]
xor esi, 1
add esi, esi
cmp byte [0x40cd92], 0
je 0x4074ce
add esi, 3
jmp 0x4074d1
add esi, 2
mov dword [esp + 0x10], esi
jmp 0x4074ea
xor eax, eax
cmp byte [0x40cd92], al
setne al
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [esp + 0x3d4]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x3d0]
push esi
push 0x401b98
push 0x104
push eax
call fcn.00402f47
mov esi, dword [esp + 0x20]
add esp, 0x10
cmp byte [esp + 0x33], 0
je 0x407564
cmp esi, 1
jne 0x40754a
push 9
pop edx
mov eax, edx
mov dword [esp + 0x10], eax
jmp 0x40756b
test esi, esi
jne 0x407557
push 8
pop eax
mov dword [esp + 0x10], eax
jmp 0x407568
push 0x57
pop edx
mov ecx, 0x401bd8
jmp 0x407cb6
mov eax, dword [esp + 0x10]
push 9
pop edx
cmp byte [esp + 0x5c], 0
je 0x4075a4
test eax, eax
jne 0x407588
mov dword [esp + 0x10], 6
mov dword [esp + 0x34], 0x100
jmp 0x4075e3
cmp eax, 1
jne 0x407597
mov dword [esp + 0x10], 7
jmp 0x40757e
push 0x57
pop edx
mov ecx, 0x401ca0
jmp 0x407cb6
mov dword [esp + 0x34], 0x100
mov ecx, eax
test eax, eax
je 0x4075e3
mov dword [esp + 0x10], ecx
cmp ecx, 1
je 0x4075e3
mov dword [esp + 0x10], ecx
cmp ecx, 6
je 0x4075e3
mov dword [esp + 0x10], ecx
cmp ecx, 7
je 0x4075e3
mov esi, ecx
mov dword [esp + 0x10], esi
cmp ecx, 8
je 0x4075e3
mov dword [esp + 0x10], esi
push 3
pop eax
cmp ecx, edx
jne 0x4075e6
push 2
pop eax
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0xb38]
call fcn.004032e8
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x407622
cmp dword [esp + 0x14], 0xffffffff
je 0x407611
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x401d78
call fcn.00405bbb
jmp 0x407d0d
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x5e8]
push eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x74], eax
call fcn.004086a2
push dword [esp + 0x80]
lea ecx, [esp + 0x2b4]
call fcn.004086a2
push dword [esp + 0x7c]
lea ecx, [esp + 0x6fc]
call fcn.004086a2
push dword [esp + 0x78]
lea ecx, [esp + 0x91c]
call fcn.004086a2
push dword [esp + 0x70]
lea ecx, [esp + 0x80c]
call fcn.004086a2
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x80c]
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x924]
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x70c]
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x2cc]
lea eax, [esp + 0xa4]
push eax
push dword [esp + 0x60c]
lea eax, [esp + 0xb58]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x407712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x407706
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401dc8
mov esi, edi
jmp 0x4077b6
mov esi, dword [0x40b01c]
or edi, 0xffffffff
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push edi
push dword [esp + 0x608]
mov ecx, esi
call dword [0x40e210]
call esi
mov esi, eax
test esi, esi
je 0x407758
cmp dword [esp + 0x14], edi
je 0x40774c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x641
mov ebx, 0x401e10
jmp 0x4077b6
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x407782
cmp dword [esp + 0x14], edi
je 0x40777b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401e70
jmp 0x4077a9
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x40], eax
test eax, eax
jne 0x4077c4
cmp dword [esp + 0x14], edi
je 0x4077a4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401ee0
mov edi, 0x641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.00405bbb
jmp 0x407bcc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0040649e
mov esi, eax
mov edi, 0x641
mov dword [esp + 0x4c], esi
mov dword [esp + 0x6c], edi
test esi, esi
jne 0x407803
cmp dword [esp + 0x14], 0xffffffff
je 0x4077f9
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x401f68
jmp 0x407a58
mov dword [esp + 0x64], ebx
mov dword [esp + 0x48], ebx
call fcn.00403f70
mov dword [esp + 0xaa4], eax
test eax, eax
jne 0x407836
cmp dword [esp + 0x14], 0xffffffff
je 0x40782c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x401fc8
jmp 0x407a58
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], ecx
test eax, eax
je 0x40785a
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40e210]
call edi
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0xaa4]
lea eax, [esp + 0x18]
push eax
push 0x402620
push edi
call dword [0x40e210]
call dword [esp + 0x50]
mov eax, dword [edi]
push edi
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x40e210]
call edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x58], edi
mov eax, dword [esi]
mov ecx, dword [eax + 0x38]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x44], ecx
test eax, eax
je 0x4078b7
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40e210]
call edi
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0xad4]
push 0x10
push eax
lea eax, [esp + 0x70]
push eax
push esi
call dword [0x40e210]
call dword [esp + 0x64]
test eax, eax
je 0x407907
cmp dword [esp + 0x14], 0xffffffff
je 0x4078f9
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x6c]
mov esi, 0x402038
jmp 0x407a58
push dword [esp + 0x64]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xaa4], eax
test eax, eax
jne 0x407947
cmp dword [esp + 0x14], 0xffffffff
je 0x407933
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x4020a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x6c]
jmp 0x407a5a
mov esi, dword [0x40b024]
mov ecx, esi
push dword [esp + 0x1c]
call dword [0x40e210]
call esi
test eax, eax
jne 0x40797a
cmp dword [esp + 0x14], 0xffffffff
je 0x407970
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x402118
jmp 0x407a53
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 0x4026a8
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x40e210]
call dword [esi]
mov ecx, ebx
cmp edi, dword [esp + 0x58]
jne 0x4079a9
cmp edi, 8
je 0x4079a9
push 9
pop eax
cmp edi, eax
jne 0x4079ad
lea ecx, [esp + 0x58]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xac4]
push edx
push ecx
push eax
mov esi, dword [eax]
mov esi, dword [esi + 0xa0]
mov ecx, esi
call dword [0x40e210]
call esi
mov eax, dword [esp + 0x24]
push dword [esp + 0x3c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xa8]
mov ecx, esi
call dword [0x40e210]
call esi
mov eax, dword [esp + 0x24]
push dword [esp + 0x40]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xac]
mov ecx, esi
call dword [0x40e210]
call esi
push dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
push dword [esp + 0x4c]
push dword [esp + 0x40]
mov eax, dword [ecx]
push dword [esp + 0x68]
push dword [esp + 0x70]
mov esi, dword [eax + 0xa4]
push dword [esp + 0x78]
push ecx
mov ecx, esi
call dword [0x40e210]
call esi
cmp dword [esp + 0x14], 0xffffffff
mov esi, eax
je 0x407a4a
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x407a83
mov esi, 0x402180
mov edi, 0x641
mov eax, edi
mov edx, eax
mov ecx, esi
call fcn.00405bbb
lea ecx, [esp + 0x4c]
call fcn.00408666
lea ecx, [esp + 0x1c]
call fcn.00408666
lea ecx, [esp + 0x18]
call fcn.00408666
jmp 0x407bcc
mov eax, dword [esp + 0x24]
push dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x9c]
mov ecx, esi
call dword [0x40e210]
call esi
lea ecx, [esp + 0x4c]
call fcn.00408666
lea ecx, [esp + 0x1c]
call fcn.00408666
lea ecx, [esp + 0x18]
call fcn.00408666
mov edi, dword [esp + 0xaa4]
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0xab4], edi
mov dword [esp + 0xab8], esi
mov dword [esp + 0xabc], eax
jmp 0x407b82
cmp eax, 1
je 0x407c0d
cmp eax, 2
jne 0x407b36
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
mov ecx, esi
call dword [0x40e210]
call esi
push dword [esp + 0x2c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407ba4
mov dword [esp + 0xab4], edi
jmp 0x407b82
cmp eax, 3
jne 0x407c17
jmp 0x407b6b
cmp dword [esp + 0xad8], 0x12
je 0x407c17
lea eax, [esp + 0xad4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xad4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xae4]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x407b41
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xac0]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x407ae2
jmp 0x407c17
cmp dword [esp + 0x14], 0xffffffff
je 0x407bb5
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x4020a8
call fcn.00405bbb
mov edi, 0x641
lea ecx, [esp + 0x808]
call fcn.00408685
lea ecx, [esp + 0x918]
call fcn.00408685
lea ecx, [esp + 0x6f8]
call fcn.00408685
lea ecx, [esp + 0x2b0]
call fcn.00408685
lea ecx, [esp + 0x5e8]
call fcn.00408685
jmp 0x407d0d
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40e210]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x808]
call fcn.00408685
lea ecx, [esp + 0x918]
call fcn.00408685
lea ecx, [esp + 0x6f8]
call fcn.00408685
lea ecx, [esp + 0x2b0]
call fcn.00408685
lea ecx, [esp + 0x5e8]
call fcn.00408685
cmp dword [esp + 0x68], 0
je 0x407c8e
cmp dword [0x40c914], 0
jne 0x407c8e
mov eax, dword [0x40c6ac]
test eax, eax
je 0x407c8e
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x50], 0
je 0x407d07
mov edi, 0x641
mov ecx, edi
call fcn.00405e55
jmp 0x407d0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401a70
mov edx, eax
call fcn.00405bbb
mov ebx, 0x641
mov edi, ebx
jmp 0x407d0d
push ebx
push ebx
push ebx
lea eax, [esp + 0xae0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x407ce9
cmp dword [0x40cb78], eax
je 0x407c6e
cmp dword [0x40c910], eax
je 0x407c6e
lea eax, [esp + 0xad4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xad4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x407cc4
mov esi, dword [esp + 0x28]
mov edi, esi
lea ecx, [esp + 0x98]
call fcn.00408784
lea ecx, [esp + 0x88]
call fcn.004087ad
mov ecx, dword [esp + 0x2434]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004097e0
mov esp, ebp
pop ebp
ret