Function at 0x4063e3
Capabilities:
Accept command line arguments
Access peb ldr_data
Check os version
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x27ec
call fcn.0040a1f0
mov eax, dword [0x40c090]
xor eax, esp
mov dword [esp + 0x27e8], eax
push ebx
push esi
lea eax, [esp + 0xd8]
mov dword [esp + 0xd0], 1
push edi
mov dword [esp + 0xd0], eax
mov edi, ecx
lea eax, [esp + 0xa60]
mov dword [esp + 0xa60], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x406474
push ebx
push 4
lea eax, [esp + 0x50]
mov byte [0x40cd9a], bl
push eax
push 0x1a
mov byte [0x40cab5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x406474
cmp dword [esp + 0x48], ebx
je 0x406474
mov byte [0x40cab5], 1
mov eax, dword [0x40b070]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x40b880]
mov word [eax], cx
lea eax, [esp + 0x1fc]
mov dword [esp + 0x1f4], 0x104
mov dword [esp + 0x1f0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop edx
mov dword [esp + 0x30], esi
cmp word [esi], dx
jne 0x4064bf
add esi, 2
mov dword [esp + 0x30], esi
jmp 0x4064c1
mov edx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4064eb
cmp cx, dx
je 0x4064db
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4064c9
mov dword [esp + 0x30], esi
cmp word [esi], bx
je 0x4064eb
add esi, 2
mov dword [esp + 0x30], esi
push 0xfffffffffffffff5
mov dword [0x40cdac], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40cabc], eax
cmp eax, 0xffffffff
je 0x40650f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x406515
mov dword [0x40cabc], ebx
mov edi, 0x800
mov dword [esp + 0x84], ebx
push edi
lea eax, [esp + 0xdec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x17f0]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x40c914], ebx
push 9
pop ecx
push 0x20
mov dword [esp + 0x8c], ecx
pop edi
movzx eax, word [esi]
cmp ax, di
je 0x406565
cmp ax, cx
jne 0x40656a
add esi, 2
jmp 0x406558
movzx eax, word [esi]
push 0x2d
pop ecx
push 0x2f
pop edx
mov dword [esp + 0x30], esi
cmp ax, dx
je 0x406585
cmp ax, cx
jne 0x4066be
lea eax, [esi + 2]
test eax, eax
je 0x4066be
mov ax, word [eax]
or ax, di
cmp ax, 0x60
jne 0x4066be
add esi, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
call fcn.00405eea
lea eax, [esp + 0xde8]
push 0x400
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
call fcn.004060f5
pop ecx
test al, al
je 0x406f7f
mov eax, dword [esp + 0x1f4]
mov edx, 0x401768
add eax, eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push ecx
call fcn.00402f5e
add esp, 0xc
test eax, eax
jne 0x407c9f
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x40667a
mov eax, dword [esp + 0x44]
push ecx
shr eax, 1
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408665
test al, al
jne 0x406654
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4066ed
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407c9f
cmp dword [esp + 0x40], 1
jne 0x407c9f
mov esi, dword [esp + 0x1f0]
push 0x20
pop edx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
cmp di, dx
je 0x4066b9
push 9
pop eax
cmp di, ax
jne 0x406ae8
add esi, 2
jmp 0x4066a1
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
mov ecx, esi
call fcn.00402e9c
test eax, eax
js 0x406a72
mov eax, dword [esp + 0x28]
push ecx
inc eax
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408665
test al, al
jne 0x4066f5
push 0xe
pop ebx
jmp 0x407c9f
mov eax, dword [esp + 0x1f0]
lea edi, [esp + 0xc2c]
xor ecx, ecx
mov dword [esp + 0xb90], 0x4017f0
mov esi, 0x401964
mov dword [esp + 0xb9c], 0x401800
push 8
mov word [eax], cx
mov edx, 0x7fffffff
mov eax, dword [0x401954]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc18], eax
mov ax, word [0x401958]
mov word [esp + 0xc1c], ax
mov eax, dword [0x40195c]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc10], eax
mov ax, word [0x401960]
pop ecx
movsd dword es:[edi], dword [esi]
mov word [esp + 0xc10], ax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0xbac], 0x401814
movsw word es:[edi], word [esi]
mov esi, 0x401974
mov dword [esp + 0xbb0], 0x401824
lea edi, [esp + 0xc40]
mov byte [esp + 0xbb4], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401814
mov dword [esp + 0xbb8], 0x40182c
mov dword [esp + 0xbbc], 0x401838
mov byte [esp + 0xbc0], 1
mov dword [esp + 0xbc4], 0x401840
mov dword [esp + 0xbc8], 0x40184c
mov byte [esp + 0xbcc], 1
mov dword [esp + 0xbd0], 0x401854
mov dword [esp + 0xbd4], 0x401864
mov byte [esp + 0xbd8], 1
mov dword [esp + 0xbdc], 0x401890
mov dword [esp + 0xbe0], 0x4018a4
mov byte [esp + 0xbe4], 1
mov dword [esp + 0xbe8], 0x4018d0
mov dword [esp + 0xbec], 0x4018ec
mov byte [esp + 0xbf0], 1
mov dword [esp + 0xbf4], 0x401908
mov dword [esp + 0xbf8], 0x401924
mov byte [esp + 0xbfc], 1
mov dword [esp + 0xc00], 0x401944
mov dword [esp + 0xc04], 0x40194c
mov byte [esp + 0xc08], 1
mov dword [esp + 0x58], ebx
call fcn.00402ecb
test eax, eax
js 0x406a72
mov esi, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x406904
movzx eax, word [edi]
test ax, ax
je 0x40691b
push 0x2d
pop ecx
cmp ax, cx
je 0x4068a7
push 0x2f
pop ecx
cmp ax, cx
jne 0x406904
mov eax, dword [esp + 0x18]
lea ecx, [eax - 1]
mov dword [esp + 0x48], ecx
cmp ecx, 1
jne 0x4068dd
push 0xffffffffffffffff
push 0x401994
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406954
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x48]
cmp dword [esp + 0x54], ecx
jne 0x406904
push dword [esp + 0x54]
dec eax
push 0x401814
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406954
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.004041d9
mov edi, eax
test edi, edi
jne 0x40688b
lea eax, [esp + 0xc0c]
mov byte [esp + 0xb98], 1
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc14]
mov byte [esp + 0xba4], 1
mov dword [esp + 0xba0], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x406a40
lea eax, [esp + 0xc2c]
mov byte [esp + 0xb98], bl
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc3c]
mov byte [esp + 0xba4], bl
jmp 0x406940
movzx eax, word [esi]
test ax, ax
je 0x406a57
push 0x2d
pop ecx
cmp ax, cx
je 0x406995
push 0x2f
pop ecx
cmp ax, cx
jne 0x4069de
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xb90]
dec ecx
mov dword [esp + 0x50], eax
mov edi, ebx
mov dword [esp + 0x48], ecx
lea edx, [esi + 2]
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x4069f3
mov eax, dword [esp + 0x50]
lea edx, [esi + 2]
mov ecx, dword [esp + 0x48]
inc edi
add eax, 0xc
mov dword [esp + 0x50], eax
cmp edi, 0xa
jb 0x4069ae
push 1
push dword [esp + 0x1c]
mov dword [esp + 0x200], 0x104
mov edx, esi
jmp 0x406a2e
imul esi, edi, 0xc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1fc], 0x104
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + esi + 0xb98]
call fcn.00402e9c
test eax, eax
js 0x406a7c
movzx eax, byte [esp + esi + 0xb98]
mov edx, dword [esp + esi + 0xb94]
push eax
push dword [esp + 0x30]
lea ecx, [esp + 0x1f8]
call fcn.004042fe
pop ecx
pop ecx
test eax, eax
jne 0x406a81
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.004041d9
mov esi, eax
test esi, esi
jne 0x406979
mov esi, dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.00402e9c
test eax, eax
jns 0x406a88
mov ebx, 0x65b
jmp 0x407c9f
mov eax, 0x65b
mov ebx, eax
jmp 0x407c9f
mov eax, dword [esp + 0x28]
push 0x20
pop edx
test eax, eax
je 0x406abe
dec eax
push 9
pop ebx
lea eax, [esi + eax*2]
movzx ecx, word [eax]
cmp cx, dx
je 0x406aa7
cmp cx, bx
jne 0x406abc
cmp eax, esi
jb 0x406abc
xor ecx, ecx
mov word [eax], cx
sub eax, 2
mov esi, dword [esp + 0x1f0]
jmp 0x406a9a
xor ebx, ebx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
test di, di
je 0x406ae8
push 9
pop ebx
cmp di, dx
je 0x406ad7
cmp di, bx
jne 0x406ae6
add esi, 2
mov dword [esp + 0xc], esi
movzx edi, word [esi]
test di, di
jne 0x406acd
xor ebx, ebx
mov dword [esp + 0x20], ebx
test di, di
je 0x406f92
mov eax, dword [0x40c870]
mov dword [esp + 0x48], 0x71
mov dword [esp + 0x18], eax
push 0x2f
pop eax
cmp di, ax
je 0x406bb9
push 0x2d
pop eax
cmp di, ax
je 0x406bb9
push 0x208
lea eax, [esp + 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x854]
mov esi, 0x104
mov dword [esp + 0x848], eax
lea edx, [esp + 0x848]
mov dword [esp + 0x84c], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x850], esi
call fcn.0040612f
test eax, eax
je 0x406f38
mov esi, dword [esp + 0x848]
test esi, esi
je 0x406b86
mov ecx, esi
call fcn.00404725
mov esi, dword [esp + 0x848]
lea ecx, [esp + 0xc]
call fcn.00405eea
cmp dword [esp + 0x84c], 0x104
movzx edi, ax
jle 0x406baa
test esi, esi
je 0x406baa
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406f27
lea ecx, [esi + 2]
xor eax, eax
movzx edi, word [ecx]
or edi, edx
mov dword [esp + 0x2c], ecx
cmp ax, word [ecx]
je 0x406bd3
add ecx, 2
mov dword [esp + 0x2c], ecx
push 0x52
pop edx
push 0x20
mov dword [esp + 0x10], ecx
mov ebx, 0x402670
pop ecx
movzx eax, dx
or eax, ecx
movzx esi, dx
cmp eax, edi
je 0x406bfd
add ebx, 2
movzx eax, word [ebx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x406be2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
push 0
pop ebx
test si, si
je 0x406e50
movzx eax, word [ecx]
push 0x20
pop edi
cmp ax, di
je 0x406c32
test ax, ax
je 0x406c32
push 9
pop ecx
cmp ax, cx
je 0x406c32
xor edi, edi
inc edi
mov dword [esp + 0x2c], edi
jmp 0x406c38
mov edi, ebx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0xc]
call fcn.00405eea
push 0x63
pop ecx
lea eax, [esp + 0xde8]
mov dword [esp + 0x38], eax
cmp si, cx
jne 0x406c5c
test edi, edi
jne 0x406e50
push 0x50
pop eax
cmp si, ax
jne 0x406cc1
push ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
lea ecx, [esp + 0xd4]
push eax
call fcn.0040878a
test al, al
je 0x406f77
mov eax, dword [esp + 0xd0]
lea edx, [esp + 0x8c]
push dword [esp + 0xd4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], eax
call fcn.004060f5
pop ecx
test al, al
je 0x406f7f
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406cf1
push 0x71
pop eax
cmp si, ax
je 0x406cce
cmp si, cx
jne 0x406cd2
test edi, edi
je 0x406ced
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.004060f5
pop ecx
test al, al
je 0x406f7f
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0xc]
call fcn.00405eea
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
cmp eax, 0x46
je 0x406d33
push 0x71
pop ecx
cmp ax, cx
je 0x406d33
cmp eax, 0x4a
je 0x406d33
lea edx, [esp + 0xde8]
mov ecx, eax
mov dword [esp + 0x28], edx
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
cmp eax, 0x6c
jne 0x406da2
cmp dword [esp + 0x2c], 0
lea edx, [esp + 0xde8]
mov dword [esp + 0x28], edx
mov ecx, eax
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
je 0x406da2
mov ecx, edx
lea edx, [esp + 0xde8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], ecx
mov ecx, eax
mov dword [esp + 0x24], edx
cmp ax, word [esp + 0x48]
je 0x406da2
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.004060f5
pop ecx
test al, al
je 0x406f7f
lea ecx, [esp + 0xc]
call fcn.00405eea
mov edx, dword [esp + 0x24]
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x406de1
mov eax, dword [esp + 0x1c]
push dword [esp + 0x28]
sub eax, 0x402670
sar eax, 1
push edx
mov esi, dword [eax*4 + 0x401010]
mov ecx, esi
call dword [0x40d210]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x406e50
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406f15
push 0x50
test esi, esi
je 0x406ec4
pop edx
push 0x41
pop eax
cmp cx, dx
jne 0x406e33
cmp word [esi], ax
jne 0x406e33
lea edx, [esp + 0x1ff0]
mov ecx, eax
call fcn.0040541a
test eax, eax
jne 0x406e50
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0xc5c]
push 0x1e
push dword [esp + 0x28]
mov dword [esp + 0x20], esi
push 0x1e
pop edx
mov dword [0x40c870], esi
call fcn.00402d39
jmp 0x406f15
cmp word [esi], dx
jne 0x406e50
cmp cx, ax
jne 0x406e50
mov edx, dword [esp + 0x28]
mov ecx, eax
call fcn.0040541a
test eax, eax
je 0x406f15
push ebx
push ebx
call fcn.004043a0
pop ecx
pop ecx
mov eax, 0x667
mov dword [esp + 0x20], eax
call fcn.004063a0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x406e89
cmp dword [0x40c870], eax
jne 0x406e89
push ebx
push ebx
call fcn.004043a0
pop ecx
mov eax, 0x667
pop ecx
mov dword [esp + 0x20], eax
mov edi, ebx
mov dword [esp + 0x50], edi
test eax, eax
jne 0x407cea
mov ecx, dword [0x40c914]
test ecx, ecx
je 0x407cea
test ecx, ecx
je 0x4070d7
mov esi, dword [0x40b01c]
mov ecx, esi
push ebx
push ebx
call dword [0x40d210]
call esi
jmp 0x4070e8
mov esi, dword [esp + 0x20]
pop eax
mov dword [esp + 0x18], esi
mov dword [0x40c870], esi
cmp cx, ax
je 0x406ef0
mov eax, 0x400
lea ecx, [esp + 0x1ff0]
push eax
push dword [esp + 0x2c]
mov edx, eax
call fcn.00402d39
push 0x1e
push dword [esp + 0x28]
lea ecx, [esp + 0xc64]
push 0x1e
pop edx
call fcn.00402d39
mov eax, dword [esp + 0x1c]
push 0x45
pop edx
cmp word [eax], dx
je 0x406f9b
xor eax, eax
mov word [esp + 0xde8], ax
mov word [esp + 0x17f0], ax
test di, di
je 0x406f98
mov esi, dword [esp + 0xc]
push 0x20
pop edx
jmp 0x406b06
push ebx
push ebx
call fcn.004043a0
mov eax, 0x667
pop ecx
pop ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x84c], esi
jle 0x406e62
cmp dword [esp + 0x848], 0
je 0x406e62
push dword [esp + 0x848]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406e62
push 0xe
pop eax
jmp 0x406e5e
push ebx
push ebx
call fcn.004043a0
pop ecx
pop ecx
mov ebx, 0x667
jmp 0x407c9f
mov esi, dword [0x40c870]
push 0x45
pop edx
test esi, esi
je 0x406e62
movzx eax, word [esi]
push 0x59
pop ecx
push 0x5a
pop edi
cmp dx, ax
je 0x406fc6
cmp cx, ax
je 0x406fc6
cmp di, ax
je 0x406fc6
call fcn.004063a0
mov esi, dword [0x40c870]
push 0x50
pop eax
cmp word [esi], ax
mov eax, dword [esp + 0xd0]
je 0x406fdc
lea eax, [esp + 0x1ff0]
sub esi, 0x402670
sar esi, 1
push eax
lea eax, [esp + 0xc60]
push eax
mov esi, dword [esi*4 + 0x401010]
mov ecx, esi
call dword [0x40d210]
call esi
pop ecx
pop ecx
mov ecx, dword [0x40c870]
push 0x59
pop edx
mov dword [esp + 0x20], eax
movzx ecx, word [ecx]
cmp cx, dx
je 0x406a81
cmp cx, di
je 0x406a81
test eax, eax
jne 0x407055
push 0x45
pop eax
cmp cx, ax
jne 0x407043
mov edi, ebx
mov dword [0x40c914], 1
mov dword [esp + 0x50], edi
jmp 0x406ead
mov ecx, dword [0x40c914]
xor edi, edi
inc edi
mov dword [esp + 0x50], edi
jmp 0x406ea5
cmp eax, 0x8000
jne 0x407069
mov dword [0x40c914], ebx
mov eax, ebx
jmp 0x407cea
mov ecx, 0x4eb
cmp eax, ecx
jg 0x40709f
je 0x406e89
cmp eax, 0xfffffffe
jl 0x4070c7
test eax, eax
js 0x406e89
cmp eax, 1
jle 0x4070c7
cmp eax, 3
jle 0x407094
cmp eax, 0x7b
jne 0x4070c7
mov eax, 0x653
mov dword [esp + 0x20], eax
jmp 0x4070c7
cmp eax, 0x642
jl 0x4070c7
cmp eax, 0x644
jle 0x406e89
cmp eax, 0x669
je 0x406e89
cmp eax, 0xbc2
je 0x406e89
mov ecx, eax
call fcn.00405c84
mov eax, dword [esp + 0x20]
jmp 0x406e89
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x4019a0
call fcn.0040908c
test edi, edi
je 0x407134
cmp dword [0x40c914], 0
jne 0x407141
mov esi, 0x4025e0
mov edi, ebx
lea eax, [edi + 0x40c6ac]
push eax
push 1
push 4
lea eax, [edi + 0x40b064]
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x407129
add esi, 0x10
add edi, 4
cmp esi, 0x4025f0
jl 0x4070fc
jmp 0x407134
mov dword [esp + 0x84], 1
cmp dword [0x40c914], 0
je 0x407ca3
mov eax, dword fs:[0x30]
lea edi, [esp + 0xc1c]
mov ecx, dword [esp + 0xc]
mov esi, ebx
push 0x20
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
movzx edx, word [ecx]
mov dword [esp + 0x2c], ecx
lea eax, [edx - 0x30]
cmp ax, word [esp + 0x88]
ja 0x407189
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x30
jmp 0x40719e
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x4071da
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x37
and cl, 0xf1
movzx eax, dl
add cl, 0x10
movzx ecx, cl
imul ecx, eax
cmp esi, edi
jge 0x4071cd
mov eax, esi
test eax, eax
jns 0x4071ba
add eax, 1
sar eax, 1
or byte [esp + eax + 0xc1c], cl
inc esi
mov ecx, dword [esp + 0x2c]
add ecx, 2
jmp 0x407167
push 0x57
pop edx
mov ecx, 0x4019c0
jmp 0x407c95
cmp esi, edi
je 0x4071eb
push 0x57
pop edx
mov ecx, 0x401a08
jmp 0x407c95
mov byte [esp + 0x44], bl
mov eax, edx
mov byte [esp + 0x13], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x40], bl
test dx, dx
je 0x40720c
add ecx, 2
movzx eax, word [ecx]
cmp ax, 0x43
jne 0x40725a
mov byte [esp + 0x44], 1
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4072eb
or dword [esp + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x4072eb
mov ecx, 0x401b40
jmp 0x407c93
cmp ax, 0x55
jne 0x40726c
mov byte [esp + 0x44], 1
mov byte [esp + 0x37], 1
jmp 0x407217
push 0x41
pop edx
cmp ax, dx
jne 0x40727b
mov byte [esp + 0x40], 1
jmp 0x407217
cmp ax, 0x4d
je 0x407298
push 0x52
pop esi
cmp ax, si
je 0x40729d
push 0x45
pop edx
cmp ax, dx
jne 0x407217
cmp ax, si
jne 0x4072a2
jmp 0x40729d
mov byte [esp + 0x13], 1
mov byte [esp + 0x3c], 1
lea eax, [ecx + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x407c88
cmp esi, 0xffffffff
je 0x407c88
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x407217
mov edx, edi
mov ecx, 0x401ad0
jmp 0x407c95
cmp byte [esp + 0x13], 0
jne 0x4072f8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x13], 0
je 0x40731b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0x64]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4073cb
lea ecx, [esp + 0x60]
call fcn.004030f2
test eax, eax
jne 0x4073bb
lea eax, [esp + 0x94]
push eax
push 0x50
pop eax
push eax
lea eax, [esp + 0xca0]
push eax
push 1
push dword [esp + 0x74]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4073bb
push dword [esp + 0x60]
push dword [esp + 0xc9c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4073ac
movzx ecx, byte [esp + 0x3c]
xor eax, eax
xor ecx, 1
add ecx, ecx
cmp byte [0x40cd9a], al
setne al
lea edi, [eax + 2]
add edi, ecx
mov dword [esp + 0xc], edi
jmp 0x4073bf
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407408
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [esp + 0x15ec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x15e8]
push esi
push 0x401b90
push 0x104
push eax
call fcn.00402e35
mov edi, dword [esp + 0x1c]
add esp, 0x10
cmp byte [esp + 0x37], 0
je 0x407439
cmp edi, 1
jne 0x40741f
push 9
pop edx
mov eax, edx
mov dword [esp + 0xc], eax
jmp 0x407440
test edi, edi
jne 0x40742c
push 8
pop eax
mov dword [esp + 0xc], eax
jmp 0x40743d
push 0x57
pop edx
mov ecx, 0x401bd0
jmp 0x407c95
mov eax, dword [esp + 0xc]
push 9
pop edx
cmp byte [esp + 0x40], 0
je 0x40746a
test eax, eax
jne 0x40744f
push 6
jmp 0x407456
cmp eax, 1
jne 0x40745d
push 7
pop eax
mov dword [esp + 0xc], eax
jmp 0x40746e
push 0x57
pop edx
mov ecx, 0x401c98
jmp 0x407c95
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], 0x100
push 3
pop ecx
test eax, eax
je 0x407495
cmp eax, 1
je 0x407495
cmp eax, 6
je 0x407495
cmp eax, 7
je 0x407495
cmp eax, 8
je 0x407495
cmp eax, edx
jne 0x407498
push 2
pop ecx
push ebx
push ecx
lea edx, [esp + 0x70]
lea ecx, [esp + 0xcf0]
call fcn.004031a9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4074d4
cmp dword [esp + 0x14], 0xffffffff
je 0x4074c3
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x401d70
call fcn.004059f2
jmp 0x407cec
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0xe0]
push eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
call fcn.00408620
push dword [esp + 0x78]
lea ecx, [esp + 0x40c]
call fcn.00408620
push dword [esp + 0x74]
lea ecx, [esp + 0x73c]
call fcn.00408620
push dword [esp + 0x70]
lea ecx, [esp + 0x62c]
call fcn.00408620
push dword [esp + 0x6c]
lea ecx, [esp + 0x51c]
call fcn.00408620
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x51c]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x634]
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x74c]
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x424]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x104]
lea eax, [esp + 0xd10]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x4075b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x4075ac
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401dc0
mov esi, edi
jmp 0x40765c
mov esi, dword [0x40b020]
or edi, 0xffffffff
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push edi
push dword [esp + 0x100]
mov ecx, esi
call dword [0x40d210]
call esi
mov esi, eax
test esi, esi
je 0x4075fe
cmp dword [esp + 0x14], edi
je 0x4075f2
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x641
mov ebx, 0x401e08
jmp 0x40765c
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x38], eax
test eax, eax
jne 0x407628
cmp dword [esp + 0x14], edi
je 0x407621
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401e68
jmp 0x40764f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x40766a
cmp dword [esp + 0x14], edi
je 0x40764a
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401ed8
mov edi, 0x641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.004059f2
jmp 0x407ace
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x4c], ebx
call fcn.004062a8
mov esi, eax
mov edi, 0x641
mov dword [esp + 0x28], edi
test esi, esi
jne 0x4076a5
cmp dword [esp + 0x14], 0xffffffff
je 0x40769b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401f60
jmp 0x4078e7
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x7c], ebx
call fcn.00403dfa
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x4076d7
cmp dword [esp + 0x14], 0xffffffff
je 0x4076cd
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401fc0
jmp 0x4078e7
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4076f3
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx]
lea eax, [esp + 0x30]
push eax
push 0x402618
push ecx
mov ecx, dword [edi]
call dword [0x40d210]
call dword [edi]
mov ecx, dword [esp + 0x2c]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x58], edi
test eax, eax
je 0x40773e
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov edi, dword [esi]
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x50]
push eax
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0xc2c]
push 0x10
push eax
lea eax, [esp + 0x70]
push eax
push esi
call dword [0x40d210]
call dword [edi + 0x38]
test eax, eax
je 0x407792
cmp dword [esp + 0x14], 0xffffffff
je 0x407784
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x28]
mov ebx, 0x402030
jmp 0x4078e7
push dword [esp + 0x5c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x60], eax
test eax, eax
jne 0x4077cf
cmp dword [esp + 0x14], 0xffffffff
je 0x4077bb
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x4020a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x28]
jmp 0x4078e9
push dword [esp + 0x4c]
mov edi, dword [0x40b028]
mov ecx, edi
call dword [0x40d210]
call edi
test eax, eax
jne 0x407802
cmp dword [esp + 0x14], 0xffffffff
je 0x4077f8
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402110
jmp 0x4078e2
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push ecx
push 0x4026b0
push eax
mov edi, dword [eax]
mov ecx, dword [edi]
call dword [0x40d210]
call dword [edi]
mov eax, dword [esp + 0xc]
mov ecx, ebx
cmp eax, dword [esp + 0x58]
jne 0x407835
cmp eax, 8
je 0x407835
push 9
pop edx
cmp eax, edx
jne 0x407839
lea ecx, [esp + 0x58]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xc1c]
push edx
push ecx
push eax
mov edi, dword [eax]
mov edi, dword [edi + 0xa0]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x38]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xa8]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xac]
mov ecx, edi
call dword [0x40d210]
call edi
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push dword [esp + 0x80]
push dword [esp + 0x44]
mov edi, dword [eax]
push dword [esp + 0x4c]
push dword [esp + 0x54]
mov edi, dword [edi + 0xa4]
mov ecx, edi
push dword [esp + 0x70]
push eax
call dword [0x40d210]
call edi
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x4078d9
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x14], 0xffffffff
test edi, edi
je 0x40793f
mov ebx, 0x402178
mov edi, 0x641
mov eax, edi
mov edx, eax
mov ecx, ebx
call fcn.004059f2
test esi, esi
je 0x407906
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40791e
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x407ace
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
jmp 0x407ace
mov eax, dword [esp + 0x1c]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x9c]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x407982
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40799a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x13], bl
mov dword [esp + 0xb84], edi
mov dword [esp + 0xb88], esi
mov dword [esp + 0xb8c], eax
jmp 0x407a79
cmp eax, 1
je 0x407b80
cmp eax, 2
jne 0x407a25
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], ebx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
mov ecx, esi
call dword [0x40d210]
call esi
push dword [esp + 0x80]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407aa6
mov dword [esp + 0xb84], edi
jmp 0x407a79
cmp eax, 3
jne 0x407b8a
jmp 0x407a56
cmp dword [esp + 0x9c], 0x12
je 0x407a9e
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x407a30
mov al, byte [esp + 0x13]
test al, al
jne 0x407b8a
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb90]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x4079c4
jmp 0x407b8a
mov al, 1
mov byte [esp + 0x13], al
jmp 0x407a71
cmp dword [esp + 0x14], 0xffffffff
je 0x407ab7
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x4020a0
call fcn.004059f2
mov edi, 0x641
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407af3
cmp dword [esp + 0x518], 0
je 0x407af3
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407b13
cmp dword [esp + 0x628], 0
je 0x407b13
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x407b33
cmp dword [esp + 0x738], 0
je 0x407b33
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x407b53
cmp dword [esp + 0x408], 0
je 0x407b53
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407cec
cmp dword [esp + 0xe0], 0
je 0x407cec
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x407cec
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407bca
cmp dword [esp + 0x518], 0
je 0x407bca
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407bea
cmp dword [esp + 0x628], 0
je 0x407bea
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x407c0a
cmp dword [esp + 0x738], 0
je 0x407c0a
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x407c2a
cmp dword [esp + 0x408], 0
je 0x407c2a
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407c4a
cmp dword [esp + 0xe0], 0
je 0x407c4a
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x50], 0
je 0x407c6a
cmp dword [0x40c914], 0
jne 0x407c6a
mov eax, dword [0x40c6ac]
test eax, eax
je 0x407c6a
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x84], 0
je 0x407ce6
mov edi, 0x641
mov ecx, edi
call fcn.00405c84
jmp 0x407cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401a68
mov edx, eax
call fcn.004059f2
mov ebx, 0x641
mov edi, ebx
jmp 0x407cec
push ebx
push ebx
push ebx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x407cc8
cmp dword [0x40cb80], eax
je 0x407c4a
cmp dword [0x40c910], eax
je 0x407c4a
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x407ca3
mov eax, dword [esp + 0x20]
mov edi, eax
lea ecx, [esp + 0x1f0]
call fcn.004086b2
lea ecx, [esp + 0xd0]
call fcn.004087d4
mov ecx, dword [esp + 0x27f4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004095e0
mov esp, ebp
pop ebp
ret