Function at 0x407ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427a20
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x438018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push str.kernel32.dll
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408080
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x408080
push 0x800
mov ecx, esi
call dword [0x428174]
call esi
test eax, eax
jne 0x408088
lea ecx, [ebp - 0x20]
call fcn.00405660
mov edx, 0x3e8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.00407e70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
push 0xb
xor eax, eax
mov dword [ebp - 0x38], 0
push 0x434208
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
call fcn.00401bb0
mov byte [ebp - 4], 3
cmp byte [ebp - 0xa8], 0
je 0x4080fd
cmp dword [ebp - 0xac], 8
lea eax, [ebp - 0xc0]
push dword [ebp - 0xb0]
cmovae eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0x38]
push eax
call fcn.00401bb0
lea eax, [ebp - 0x38]
mov dword [ebp - 0xdc], str._ManufacturerName_
push eax
lea ecx, [ebp - 0xd8]
call fcn.00404170
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040dc90
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xc4]
cmp edx, 8
jb 0x408171
mov ecx, dword [ebp - 0xd8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408167
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40967d
push edx
push ecx
call fcn.0040f114
add esp, 8
push 0x7e
xor eax, eax
mov dword [ebp - 0x68], 0
push str.This__ManufacturerName__product_cannot_be_installed_on_your_device._Click_OK_to_view_details_about_compatibility_requirements.
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00401bb0
mov edx, 0x3e9
lea ecx, [ebp - 0xa4]
call fcn.00407e70
mov byte [ebp - 4], 6
cmp byte [ebp - 0x8c], 0
je 0x4081db
cmp dword [ebp - 0x90], 8
lea eax, [ebp - 0xa4]
push dword [ebp - 0x94]
cmovae eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x68]
push eax
call fcn.00401bb0
push 0x12
xor eax, eax
mov dword [ebp - 0x2bc], 0
push str._ManufacturerName_
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
lea eax, [ebp - 0x2bc]
mov byte [ebp - 4], 7
push eax
call fcn.004096f0
lea ecx, [ebp - 0x38]
cmp eax, ecx
je 0x40823e
cmp dword [ebp - 0x24], 8
push dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.00401bb0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x408282
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408278
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409637
push edx
push ecx
call fcn.0040f114
add esp, 8
lea ecx, [ebp - 0x68]
call fcn.00407f60
call fcn.00407c50
push ecx
mov bl, al
call fcn.00407b90
add esp, 4
test bl, bl
jne 0x409235
test al, al
je 0x409235
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00404080
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 8
push dword [ebp - 0x70]
cmovae eax, dword [ebp - 0x80]
xor ecx, ecx
mov dword [ebp - 0x2bc], 0
mov word [ebp - 0x2bc], cx
lea ecx, [ebp - 0x2bc]
push eax
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
call fcn.00401bb0
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00407d00
mov esi, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2a4]
push 0xc
xor eax, eax
mov dword [ebp - 0x2a4], 0
push str.bddeploy.exe
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0xe
push eax
mov ecx, esi
call fcn.004036e0
mov byte [ebp - 4], 0xd
mov esi, eax
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x4083ac
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4083a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40963c
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
push esi
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00404170
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xe0]
cmp edx, 8
jb 0x408416
mov ecx, dword [ebp - 0xf4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40840c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409641
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 7
mov word [ebp - 0xf4], ax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x408477
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40846d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409641
push edx
push ecx
call fcn.0040f114
add esp, 8
cmp dword [ebp - 0x6c], 8
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x80]
mov dword [ebp - 0x88], 0
cmovae edx, dword [ebp - 0x80]
lea ecx, [ebp - 0x1b0]
push eax
mov dword [ebp - 0x84], 0x438a30
call fcn.004076b0
add esp, 4
cmp dword [ebp - 0x88], 0
jne 0x408e04
cmp dword [ebp - 0x6c], 8
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x88]
cmovae ecx, dword [ebp - 0x80]
call fcn.004060c0
test al, al
jne 0x408af1
mov eax, dword [ebp - 0x88]
cmp eax, 0x800b0111
je 0x4084ee
cmp eax, 0x800b010c
jne 0x408e04
mov edx, 0x3eb
lea ecx, [ebp - 0xf8]
call fcn.00407e70
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x110]
push 0x67
xor eax, eax
mov dword [ebp - 0x110], 0
push str.Check_for_Bitdefender_certificates_in_the_Untrusted_Certificates_folder._Click_OK_to_view_more_details.
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 7
mov word [ebp - 0x110], ax
call fcn.00401bb0
mov byte [ebp - 4], 0x14
cmp byte [ebp - 0xe0], 0
je 0x408579
cmp dword [ebp - 0xe4], 8
lea eax, [ebp - 0xf8]
push dword [ebp - 0xe8]
cmovae eax, dword [ebp - 0xf8]
lea ecx, [ebp - 0x110]
push eax
call fcn.00401bb0
lea ecx, [ebp - 0x110]
call fcn.00407f60
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
push 0x31
cmovae ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x110]
cmp dword [ebp - 0xfc], 8
push ecx
cmovae eax, dword [ebp - 0x110]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x40879e
mov edx, 0x3ec
lea ecx, [ebp - 0xdc]
call fcn.00407e70
mov byte [ebp - 4], 0x15
mov al, byte [ebp - 0xc4]
test al, al
je 0x408756
xor eax, eax
mov dword [ebp - 0x2bc], 0
push eax
push 0x433c48
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
xor eax, eax
mov byte [ebp - 4], 0x16
push eax
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2a4]
push 0x433c48
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
mov byte [ebp - 4], 0x17
cmp byte [ebp - 0xc4], 0
je 0x409646
sub esp, 8
lea eax, [ebp - 0x2bc]
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0xdc]
push eax
call fcn.00401a90
mov byte [ebp - 4], 0x16
add esp, 0xc
mov edx, dword [ebp - 0x290]
mov bl, al
cmp edx, 8
jb 0x4086b8
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4086ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40964b
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
cmp edx, 8
jb 0x408719
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40870f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40964b
push edx
push ecx
call fcn.0040f114
add esp, 8
mov al, byte [ebp - 0xc4]
test al, al
je 0x409650
test bl, bl
jne 0x408756
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xdc]
push 5
cmovae eax, dword [ebp - 0xdc]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [ebp - 0xc4]
mov byte [ebp - 4], 0x14
test al, al
je 0x40879e
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x40879e
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408794
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409655
push edx
push ecx
call fcn.0040f114
add esp, 8
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xfc]
cmp edx, 8
jb 0x4087e2
mov ecx, dword [ebp - 0x110]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4087d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 7
mov word [ebp - 0x110], ax
cmp byte [ebp - 0xe0], al
je 0x408868
mov edx, dword [ebp - 0xe4]
cmp edx, 8
jb 0x40884b
mov ecx, dword [ebp - 0xf8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408841
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 7
mov word [ebp - 0xf8], ax
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4088bc
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4088b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x40890e
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408904
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
cmp byte [ebp - 0x8c], al
je 0x40898b
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x40896e
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408964
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x4089c9
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4089bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x408a1b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x408a98
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x408a7b
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965a
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x408ad9
nop dword [eax]
mov dword [ebp - 4], 0x18
mov eax, dword [edi + 4]
test eax, eax
je 0x408acb
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x428174]
call esi
add edi, 8
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x408ab0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call fcn.0040a470
mov eax, 1
jmp 0x409619
mov byte [ebp - 4], 0x19
lea edx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x250]
cmovae edx, dword [ebp - 0x50]
call fcn.00407ae0
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x220]
cmp dword [ebp - 0x20c], 8
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x170]
cmovae edx, dword [ebp - 0x220]
cmp dword [ebp - 0x16c], 8
cmovae ecx, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x210]
jne 0x408f4f
push eax
call fcn.00404750
add esp, 4
test eax, eax
jne 0x408f4f
cmp dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x50]
cmovae ecx, dword [ebp - 0x50]
call fcn.00406570
lea ecx, [ebp - 0x208]
test al, al
jne 0x408df4
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x408bdc
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408bd2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x408c2e
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408c24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
cmp byte [ebp - 0x8c], al
je 0x408cab
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x408c8e
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408c84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x408ce9
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408cdf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x408d3b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408d31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x408db8
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x408d9b
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408d91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x408ad9
mov dword [ebp - 4], 0x1c
mov eax, dword [edi + 4]
test eax, eax
je 0x408de8
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x428174]
call esi
mov dword [ebp - 4], 0xffffffff
add edi, 8
jmp 0x408dc5
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x268], xmm0
cmovae eax, dword [ebp - 0x50]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x28c]
push eax
movlpd qword [ebp - 0x260], xmm0
movlpd qword [ebp - 0x258], xmm0
mov dword [ebp - 0x28c], 0x3c
mov dword [ebp - 0x288], 0x40
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], str.runas
mov dword [ebp - 0x278], 0x433c48
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x26c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x408ea6
push 0xffffffffffffffff
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x408efa
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ef0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965f
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x409451
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409447
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40965f
jmp 0x409447
lea ecx, [ebp - 0x208]
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x408fb9
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408faf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x40900b
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409001
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
cmp byte [ebp - 0x8c], al
je 0x409088
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x40906b
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409061
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x4090c6
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4090bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x409118
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40910e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x409195
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x409178
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40916e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409664
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x408ad9
mov dword [ebp - 4], 0x1b
mov eax, dword [edi + 4]
test eax, eax
je 0x4091c5
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x428174]
call esi
mov dword [ebp - 4], 0xffffffff
add edi, 8
jmp 0x4091a2
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
push 0x31
cmovae ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x54], 8
push ecx
cmovae eax, dword [ebp - 0x68]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x409451
mov edx, 0x3ea
lea ecx, [ebp - 0xdc]
call fcn.00407e70
mov byte [ebp - 4], 8
mov al, byte [ebp - 0xc4]
test al, al
je 0x409409
xor eax, eax
mov dword [ebp - 0x2bc], 0
push eax
push 0x433c48
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
xor eax, eax
mov byte [ebp - 4], 9
push eax
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2a4]
push 0x433c48
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
mov byte [ebp - 4], 0xa
cmp byte [ebp - 0xc4], 0
je 0x409669
sub esp, 8
lea eax, [ebp - 0x2bc]
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0xdc]
push eax
call fcn.00401a90
mov byte [ebp - 4], 9
add esp, 0xc
mov edx, dword [ebp - 0x290]
mov bl, al
cmp edx, 8
jb 0x40936b
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409361
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40966e
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
cmp edx, 8
jb 0x4093cc
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4093c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40966e
push edx
push ecx
call fcn.0040f114
add esp, 8
mov al, byte [ebp - 0xc4]
test al, al
je 0x409673
test bl, bl
jne 0x409409
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xdc]
push 5
cmovae eax, dword [ebp - 0xdc]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [ebp - 0xc4]
mov byte [ebp - 4], 6
test al, al
je 0x409451
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x409451
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409447
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409678
push edx
push ecx
call fcn.0040f114
add esp, 8
mov byte [ebp - 4], 5
cmp byte [ebp - 0x8c], 0
je 0x4094bb
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x40949e
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409494
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40967d
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x4094f9
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4094ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40967d
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x40954b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409541
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40967d
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x4095c8
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x4095ab
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4095a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40967d
push edx
push ecx
call fcn.0040f114
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x409609
nop dword [eax]
mov dword [ebp - 4], 0x1e
mov eax, dword [edi + 4]
test eax, eax
je 0x4095fb
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x428174]
call esi
add edi, 8
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x4095e0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call fcn.0040a470
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ee8a
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041342a
call fcn.0041342a
call fcn.0041342a
call fcn.00401d70
call fcn.0041342a
call fcn.00401d70
call fcn.0041342a
call fcn.0041342a
call fcn.0041342a
call fcn.0041342a
call fcn.00401d70
call fcn.0041342a
call fcn.00401d70
call fcn.0041342a
call fcn.0041342a
int3