Function at 0x40ab53
Capabilities:
Accept command line arguments
Access peb ldr_data
Check os version
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x27ec
call fcn.0040f8d0
mov eax, dword [0x4110a0]
xor eax, esp
mov dword [esp + 0x27e8], eax
push ebx
push esi
lea eax, [esp + 0xd8]
mov dword [esp + 0xd0], 1
push edi
mov dword [esp + 0xd0], eax
mov edi, ecx
lea eax, [esp + 0xa60]
mov dword [esp + 0xa60], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x40abe4
push ebx
push 4
lea eax, [esp + 0x50]
mov byte [0x411f04], bl
push eax
push 0x1a
mov byte [0x411bf1], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x40abe4
cmp dword [esp + 0x48], ebx
je 0x40abe4
mov byte [0x411bf1], 1
mov eax, dword [0x410070]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x410880]
mov word [eax], cx
lea eax, [esp + 0x1fc]
mov dword [esp + 0x1f4], 0x104
mov dword [esp + 0x1f0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop edx
mov dword [esp + 0x30], esi
cmp word [esi], dx
jne 0x40ac2f
add esi, 2
mov dword [esp + 0x30], esi
jmp 0x40ac31
mov edx, eax
movzx ecx, word [esi]
test cx, cx
je 0x40ac5b
cmp cx, dx
je 0x40ac4b
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40ac39
mov dword [esp + 0x30], esi
cmp word [esi], bx
je 0x40ac5b
add esi, 2
mov dword [esp + 0x30], esi
push 0xfffffffffffffff5
mov dword [0x411f1c], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x411c00], eax
cmp eax, 0xffffffff
je 0x40ac7f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x40ac85
mov dword [0x411c00], ebx
mov edi, 0x800
mov dword [esp + 0x84], ebx
push edi
lea eax, [esp + 0xdec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x17f0]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x4119e4], ebx
push 9
pop ecx
push 0x20
mov dword [esp + 0x8c], ecx
pop edi
movzx eax, word [esi]
cmp ax, di
je 0x40acd5
cmp ax, cx
jne 0x40acda
add esi, 2
jmp 0x40acc8
movzx eax, word [esi]
push 0x2d
pop ecx
push 0x2f
pop edx
mov dword [esp + 0x30], esi
cmp ax, dx
je 0x40acf5
cmp ax, cx
jne 0x40ae2e
lea eax, [esi + 2]
test eax, eax
je 0x40ae2e
mov ax, word [eax]
or ax, di
cmp ax, 0x60
jne 0x40ae2e
add esi, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
call fcn.0040a65a
lea eax, [esp + 0xde8]
push 0x400
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
call fcn.0040a865
pop ecx
test al, al
je 0x40b6ef
mov eax, dword [esp + 0x1f4]
mov edx, 0x401c38
add eax, eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push ecx
call fcn.0040363b
add esp, 0xc
test eax, eax
jne 0x40c40f
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x40adea
mov eax, dword [esp + 0x44]
push ecx
shr eax, 1
lea ecx, [esp + 0x1f4]
push eax
call fcn.0040ce05
test al, al
jne 0x40adc4
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ae5d
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40c40f
cmp dword [esp + 0x40], 1
jne 0x40c40f
mov esi, dword [esp + 0x1f0]
push 0x20
pop edx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
cmp di, dx
je 0x40ae29
push 9
pop eax
cmp di, ax
jne 0x40b258
add esi, 2
jmp 0x40ae11
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
mov ecx, esi
call fcn.004034f9
test eax, eax
js 0x40b1e2
mov eax, dword [esp + 0x28]
push ecx
inc eax
lea ecx, [esp + 0x1f4]
push eax
call fcn.0040ce05
test al, al
jne 0x40ae65
push 0xe
pop ebx
jmp 0x40c40f
mov eax, dword [esp + 0x1f0]
lea edi, [esp + 0xc2c]
xor ecx, ecx
mov dword [esp + 0xb90], 0x401cc0
mov esi, 0x401e34
mov dword [esp + 0xb9c], 0x401cd0
push 8
mov word [eax], cx
mov edx, 0x7fffffff
mov eax, dword [0x401e24]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc18], eax
mov ax, word [0x401e28]
mov word [esp + 0xc1c], ax
mov eax, dword [0x401e2c]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc10], eax
mov ax, word [0x401e30]
pop ecx
movsd dword es:[edi], dword [esi]
mov word [esp + 0xc10], ax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0xbac], 0x401ce4
movsw word es:[edi], word [esi]
mov esi, 0x401e44
mov dword [esp + 0xbb0], 0x401cf4
lea edi, [esp + 0xc40]
mov byte [esp + 0xbb4], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401ce4
mov dword [esp + 0xbb8], 0x401cfc
mov dword [esp + 0xbbc], 0x401d08
mov byte [esp + 0xbc0], 1
mov dword [esp + 0xbc4], 0x401d10
mov dword [esp + 0xbc8], 0x401d1c
mov byte [esp + 0xbcc], 1
mov dword [esp + 0xbd0], 0x401d24
mov dword [esp + 0xbd4], 0x401d34
mov byte [esp + 0xbd8], 1
mov dword [esp + 0xbdc], 0x401d60
mov dword [esp + 0xbe0], 0x401d74
mov byte [esp + 0xbe4], 1
mov dword [esp + 0xbe8], 0x401da0
mov dword [esp + 0xbec], 0x401dbc
mov byte [esp + 0xbf0], 1
mov dword [esp + 0xbf4], 0x401dd8
mov dword [esp + 0xbf8], 0x401df4
mov byte [esp + 0xbfc], 1
mov dword [esp + 0xc00], 0x401e14
mov dword [esp + 0xc04], 0x401e1c
mov byte [esp + 0xc08], 1
mov dword [esp + 0x58], ebx
call fcn.00403528
test eax, eax
js 0x40b1e2
mov esi, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x40b074
movzx eax, word [edi]
test ax, ax
je 0x40b08b
push 0x2d
pop ecx
cmp ax, cx
je 0x40b017
push 0x2f
pop ecx
cmp ax, cx
jne 0x40b074
mov eax, dword [esp + 0x18]
lea ecx, [eax - 1]
mov dword [esp + 0x48], ecx
cmp ecx, 1
jne 0x40b04d
push 0xffffffffffffffff
push 0x401e64
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40b0c4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x48]
cmp dword [esp + 0x54], ecx
jne 0x40b074
push dword [esp + 0x54]
dec eax
push 0x401ce4
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40b0c4
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.00408959
mov edi, eax
test edi, edi
jne 0x40affb
lea eax, [esp + 0xc0c]
mov byte [esp + 0xb98], 1
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc14]
mov byte [esp + 0xba4], 1
mov dword [esp + 0xba0], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x40b1b0
lea eax, [esp + 0xc2c]
mov byte [esp + 0xb98], bl
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc3c]
mov byte [esp + 0xba4], bl
jmp 0x40b0b0
movzx eax, word [esi]
test ax, ax
je 0x40b1c7
push 0x2d
pop ecx
cmp ax, cx
je 0x40b105
push 0x2f
pop ecx
cmp ax, cx
jne 0x40b14e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xb90]
dec ecx
mov dword [esp + 0x50], eax
mov edi, ebx
mov dword [esp + 0x48], ecx
lea edx, [esi + 2]
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40b163
mov eax, dword [esp + 0x50]
lea edx, [esi + 2]
mov ecx, dword [esp + 0x48]
inc edi
add eax, 0xc
mov dword [esp + 0x50], eax
cmp edi, 0xa
jb 0x40b11e
push 1
push dword [esp + 0x1c]
mov dword [esp + 0x200], 0x104
mov edx, esi
jmp 0x40b19e
imul esi, edi, 0xc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1fc], 0x104
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + esi + 0xb98]
call fcn.004034f9
test eax, eax
js 0x40b1ec
movzx eax, byte [esp + esi + 0xb98]
mov edx, dword [esp + esi + 0xb94]
push eax
push dword [esp + 0x30]
lea ecx, [esp + 0x1f8]
call fcn.00408a7e
pop ecx
pop ecx
test eax, eax
jne 0x40b1f1
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.00408959
mov esi, eax
test esi, esi
jne 0x40b0e9
mov esi, dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.004034f9
test eax, eax
jns 0x40b1f8
mov ebx, 0x65b
jmp 0x40c40f
mov eax, 0x65b
mov ebx, eax
jmp 0x40c40f
mov eax, dword [esp + 0x28]
push 0x20
pop edx
test eax, eax
je 0x40b22e
dec eax
push 9
pop ebx
lea eax, [esi + eax*2]
movzx ecx, word [eax]
cmp cx, dx
je 0x40b217
cmp cx, bx
jne 0x40b22c
cmp eax, esi
jb 0x40b22c
xor ecx, ecx
mov word [eax], cx
sub eax, 2
mov esi, dword [esp + 0x1f0]
jmp 0x40b20a
xor ebx, ebx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
test di, di
je 0x40b258
push 9
pop ebx
cmp di, dx
je 0x40b247
cmp di, bx
jne 0x40b256
add esi, 2
mov dword [esp + 0xc], esi
movzx edi, word [esi]
test di, di
jne 0x40b23d
xor ebx, ebx
mov dword [esp + 0x20], ebx
test di, di
je 0x40b702
mov eax, dword [0x4118c4]
mov dword [esp + 0x48], 0x71
mov dword [esp + 0x18], eax
push 0x2f
pop eax
cmp di, ax
je 0x40b329
push 0x2d
pop eax
cmp di, ax
je 0x40b329
push 0x208
lea eax, [esp + 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x854]
mov esi, 0x104
mov dword [esp + 0x848], eax
lea edx, [esp + 0x848]
mov dword [esp + 0x84c], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x850], esi
call fcn.0040a89f
test eax, eax
je 0x40b6a8
mov esi, dword [esp + 0x848]
test esi, esi
je 0x40b2f6
mov ecx, esi
call fcn.00408ea5
mov esi, dword [esp + 0x848]
lea ecx, [esp + 0xc]
call fcn.0040a65a
cmp dword [esp + 0x84c], 0x104
movzx edi, ax
jle 0x40b31a
test esi, esi
je 0x40b31a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [0x4118c4]
mov dword [esp + 0x18], esi
jmp 0x40b697
lea ecx, [esi + 2]
xor eax, eax
movzx edi, word [ecx]
or edi, edx
mov dword [esp + 0x2c], ecx
cmp ax, word [ecx]
je 0x40b343
add ecx, 2
mov dword [esp + 0x2c], ecx
push 0x52
pop edx
push 0x20
mov dword [esp + 0x10], ecx
mov ebx, 0x402bb0
pop ecx
movzx eax, dx
or eax, ecx
movzx esi, dx
cmp eax, edi
je 0x40b36d
add ebx, 2
movzx eax, word [ebx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x40b352
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
push 0
pop ebx
test si, si
je 0x40b5c0
movzx eax, word [ecx]
push 0x20
pop edi
cmp ax, di
je 0x40b3a2
test ax, ax
je 0x40b3a2
push 9
pop ecx
cmp ax, cx
je 0x40b3a2
xor edi, edi
inc edi
mov dword [esp + 0x2c], edi
jmp 0x40b3a8
mov edi, ebx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0xc]
call fcn.0040a65a
push 0x63
pop ecx
lea eax, [esp + 0xde8]
mov dword [esp + 0x38], eax
cmp si, cx
jne 0x40b3cc
test edi, edi
jne 0x40b5c0
push 0x50
pop eax
cmp si, ax
jne 0x40b431
push ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
lea ecx, [esp + 0xd4]
push eax
call fcn.0040d030
test al, al
je 0x40b6e7
mov eax, dword [esp + 0xd0]
lea edx, [esp + 0x8c]
push dword [esp + 0xd4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], eax
call fcn.0040a865
pop ecx
test al, al
je 0x40b6ef
mov esi, dword [0x4118c4]
mov dword [esp + 0x18], esi
jmp 0x40b461
push 0x71
pop eax
cmp si, ax
je 0x40b43e
cmp si, cx
jne 0x40b442
test edi, edi
je 0x40b45d
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.0040a865
pop ecx
test al, al
je 0x40b6ef
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0xc]
call fcn.0040a65a
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
cmp eax, 0x46
je 0x40b4a3
push 0x71
pop ecx
cmp ax, cx
je 0x40b4a3
cmp eax, 0x4a
je 0x40b4a3
lea edx, [esp + 0xde8]
mov ecx, eax
mov dword [esp + 0x28], edx
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
cmp eax, 0x6c
jne 0x40b512
cmp dword [esp + 0x2c], 0
lea edx, [esp + 0xde8]
mov dword [esp + 0x28], edx
mov ecx, eax
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
je 0x40b512
mov ecx, edx
lea edx, [esp + 0xde8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], ecx
mov ecx, eax
mov dword [esp + 0x24], edx
cmp ax, word [esp + 0x48]
je 0x40b512
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.0040a865
pop ecx
test al, al
je 0x40b6ef
lea ecx, [esp + 0xc]
call fcn.0040a65a
mov edx, dword [esp + 0x24]
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x40b551
mov eax, dword [esp + 0x1c]
push dword [esp + 0x28]
sub eax, 0x402bb0
sar eax, 1
push edx
mov esi, dword [eax*4 + 0x401010]
mov ecx, esi
call dword [0x413278]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x40b5c0
mov esi, dword [0x4118c4]
mov dword [esp + 0x18], esi
jmp 0x40b685
push 0x50
test esi, esi
je 0x40b634
pop edx
push 0x41
pop eax
cmp cx, dx
jne 0x40b5a3
cmp word [esi], ax
jne 0x40b5a3
lea edx, [esp + 0x1ff0]
mov ecx, eax
call fcn.00409b9a
test eax, eax
jne 0x40b5c0
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0xc5c]
push 0x1e
push dword [esp + 0x28]
mov dword [esp + 0x20], esi
push 0x1e
pop edx
mov dword [0x4118c4], esi
call fcn.004033b9
jmp 0x40b685
cmp word [esi], dx
jne 0x40b5c0
cmp cx, ax
jne 0x40b5c0
mov edx, dword [esp + 0x28]
mov ecx, eax
call fcn.00409b9a
test eax, eax
je 0x40b685
push ebx
push ebx
call fcn.00408b20
pop ecx
pop ecx
mov eax, 0x667
mov dword [esp + 0x20], eax
call fcn.0040ab10
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40b5f9
cmp dword [0x4118c4], eax
jne 0x40b5f9
push ebx
push ebx
call fcn.00408b20
pop ecx
mov eax, 0x667
pop ecx
mov dword [esp + 0x20], eax
mov edi, ebx
mov dword [esp + 0x50], edi
test eax, eax
jne 0x40c45a
mov ecx, dword [0x4119e4]
test ecx, ecx
je 0x40c45a
test ecx, ecx
je 0x40b847
mov esi, dword [0x41001c]
mov ecx, esi
push ebx
push ebx
call dword [0x413278]
call esi
jmp 0x40b858
mov esi, dword [esp + 0x20]
pop eax
mov dword [esp + 0x18], esi
mov dword [0x4118c4], esi
cmp cx, ax
je 0x40b660
mov eax, 0x400
lea ecx, [esp + 0x1ff0]
push eax
push dword [esp + 0x2c]
mov edx, eax
call fcn.004033b9
push 0x1e
push dword [esp + 0x28]
lea ecx, [esp + 0xc64]
push 0x1e
pop edx
call fcn.004033b9
mov eax, dword [esp + 0x1c]
push 0x45
pop edx
cmp word [eax], dx
je 0x40b70b
xor eax, eax
mov word [esp + 0xde8], ax
mov word [esp + 0x17f0], ax
test di, di
je 0x40b708
mov esi, dword [esp + 0xc]
push 0x20
pop edx
jmp 0x40b276
push ebx
push ebx
call fcn.00408b20
mov eax, 0x667
pop ecx
pop ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x84c], esi
jle 0x40b5d2
cmp dword [esp + 0x848], 0
je 0x40b5d2
push dword [esp + 0x848]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40b5d2
push 0xe
pop eax
jmp 0x40b5ce
push ebx
push ebx
call fcn.00408b20
pop ecx
pop ecx
mov ebx, 0x667
jmp 0x40c40f
mov esi, dword [0x4118c4]
push 0x45
pop edx
test esi, esi
je 0x40b5d2
movzx eax, word [esi]
push 0x59
pop ecx
push 0x5a
pop edi
cmp dx, ax
je 0x40b736
cmp cx, ax
je 0x40b736
cmp di, ax
je 0x40b736
call fcn.0040ab10
mov esi, dword [0x4118c4]
push 0x50
pop eax
cmp word [esi], ax
mov eax, dword [esp + 0xd0]
je 0x40b74c
lea eax, [esp + 0x1ff0]
sub esi, 0x402bb0
sar esi, 1
push eax
lea eax, [esp + 0xc60]
push eax
mov esi, dword [esi*4 + 0x401010]
mov ecx, esi
call dword [0x413278]
call esi
pop ecx
pop ecx
mov ecx, dword [0x4118c4]
push 0x59
pop edx
mov dword [esp + 0x20], eax
movzx ecx, word [ecx]
cmp cx, dx
je 0x40b1f1
cmp cx, di
je 0x40b1f1
test eax, eax
jne 0x40b7c5
push 0x45
pop eax
cmp cx, ax
jne 0x40b7b3
mov edi, ebx
mov dword [0x4119e4], 1
mov dword [esp + 0x50], edi
jmp 0x40b61d
mov ecx, dword [0x4119e4]
xor edi, edi
inc edi
mov dword [esp + 0x50], edi
jmp 0x40b615
cmp eax, 0x8000
jne 0x40b7d9
mov dword [0x4119e4], ebx
mov eax, ebx
jmp 0x40c45a
mov ecx, 0x4eb
cmp eax, ecx
jg 0x40b80f
je 0x40b5f9
cmp eax, 0xfffffffe
jl 0x40b837
test eax, eax
js 0x40b5f9
cmp eax, 1
jle 0x40b837
cmp eax, 3
jle 0x40b804
cmp eax, 0x7b
jne 0x40b837
mov eax, 0x653
mov dword [esp + 0x20], eax
jmp 0x40b837
cmp eax, 0x642
jl 0x40b837
cmp eax, 0x644
jle 0x40b5f9
cmp eax, 0x669
je 0x40b5f9
cmp eax, 0xbc2
je 0x40b5f9
mov ecx, eax
call fcn.0040a3f4
mov eax, dword [esp + 0x20]
jmp 0x40b5f9
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x401e70
call fcn.0040e57c
test edi, edi
je 0x40b8a4
cmp dword [0x4119e4], 0
jne 0x40b8b1
mov esi, 0x402b08
mov edi, ebx
lea eax, [edi + 0x4116fc]
push eax
push 1
push 4
lea eax, [edi + 0x410064]
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x40b899
add esi, 0x10
add edi, 4
cmp esi, 0x402b18
jl 0x40b86c
jmp 0x40b8a4
mov dword [esp + 0x84], 1
cmp dword [0x4119e4], 0
je 0x40c413
mov eax, dword fs:[0x30]
lea edi, [esp + 0xc1c]
mov ecx, dword [esp + 0xc]
mov esi, ebx
push 0x20
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
movzx edx, word [ecx]
mov dword [esp + 0x2c], ecx
lea eax, [edx - 0x30]
cmp ax, word [esp + 0x88]
ja 0x40b8f9
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x30
jmp 0x40b90e
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x40b94a
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x37
and cl, 0xf1
movzx eax, dl
add cl, 0x10
movzx ecx, cl
imul ecx, eax
cmp esi, edi
jge 0x40b93d
mov eax, esi
test eax, eax
jns 0x40b92a
add eax, 1
sar eax, 1
or byte [esp + eax + 0xc1c], cl
inc esi
mov ecx, dword [esp + 0x2c]
add ecx, 2
jmp 0x40b8d7
push 0x57
pop edx
mov ecx, 0x401e90
jmp 0x40c405
cmp esi, edi
je 0x40b95b
push 0x57
pop edx
mov ecx, 0x401ed8
jmp 0x40c405
mov byte [esp + 0x44], bl
mov eax, edx
mov byte [esp + 0x13], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x40], bl
test dx, dx
je 0x40b97c
add ecx, 2
movzx eax, word [ecx]
cmp ax, 0x43
jne 0x40b9ca
mov byte [esp + 0x44], 1
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40ba5b
or dword [esp + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x40ba5b
mov ecx, 0x402010
jmp 0x40c403
cmp ax, 0x55
jne 0x40b9dc
mov byte [esp + 0x44], 1
mov byte [esp + 0x37], 1
jmp 0x40b987
push 0x41
pop edx
cmp ax, dx
jne 0x40b9eb
mov byte [esp + 0x40], 1
jmp 0x40b987
cmp ax, 0x4d
je 0x40ba08
push 0x52
pop esi
cmp ax, si
je 0x40ba0d
push 0x45
pop edx
cmp ax, dx
jne 0x40b987
cmp ax, si
jne 0x40ba12
jmp 0x40ba0d
mov byte [esp + 0x13], 1
mov byte [esp + 0x3c], 1
lea eax, [ecx + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x40c3f8
cmp esi, 0xffffffff
je 0x40c3f8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b987
mov edx, edi
mov ecx, 0x401fa0
jmp 0x40c405
cmp byte [esp + 0x13], 0
jne 0x40ba68
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x13], 0
je 0x40ba8b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
cmp byte [0x411f04], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0x64]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bb3b
lea ecx, [esp + 0x60]
call fcn.004037cf
test eax, eax
jne 0x40bb2b
lea eax, [esp + 0x94]
push eax
push 0x50
pop eax
push eax
lea eax, [esp + 0xca0]
push eax
push 1
push dword [esp + 0x74]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40bb2b
push dword [esp + 0x60]
push dword [esp + 0xc9c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40bb1c
movzx ecx, byte [esp + 0x3c]
xor eax, eax
xor ecx, 1
add ecx, ecx
cmp byte [0x411f04], al
setne al
lea edi, [eax + 2]
add edi, ecx
mov dword [esp + 0xc], edi
jmp 0x40bb2f
xor eax, eax
cmp byte [0x411f04], al
setne al
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40bb78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [esp + 0x15ec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x15e8]
push esi
push 0x402060
push 0x104
push eax
call fcn.004034b5
mov edi, dword [esp + 0x1c]
add esp, 0x10
cmp byte [esp + 0x37], 0
je 0x40bba9
cmp edi, 1
jne 0x40bb8f
push 9
pop edx
mov eax, edx
mov dword [esp + 0xc], eax
jmp 0x40bbb0
test edi, edi
jne 0x40bb9c
push 8
pop eax
mov dword [esp + 0xc], eax
jmp 0x40bbad
push 0x57
pop edx
mov ecx, 0x4020a0
jmp 0x40c405
mov eax, dword [esp + 0xc]
push 9
pop edx
cmp byte [esp + 0x40], 0
je 0x40bbda
test eax, eax
jne 0x40bbbf
push 6
jmp 0x40bbc6
cmp eax, 1
jne 0x40bbcd
push 7
pop eax
mov dword [esp + 0xc], eax
jmp 0x40bbde
push 0x57
pop edx
mov ecx, 0x402168
jmp 0x40c405
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], 0x100
push 3
pop ecx
test eax, eax
je 0x40bc05
cmp eax, 1
je 0x40bc05
cmp eax, 6
je 0x40bc05
cmp eax, 7
je 0x40bc05
cmp eax, 8
je 0x40bc05
cmp eax, edx
jne 0x40bc08
push 2
pop ecx
push ebx
push ecx
lea edx, [esp + 0x70]
lea ecx, [esp + 0xcf0]
call fcn.00403887
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40bc44
cmp dword [esp + 0x14], 0xffffffff
je 0x40bc33
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x402240
call fcn.0040a162
jmp 0x40c45c
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0xe0]
push eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
call fcn.0040cdc0
push dword [esp + 0x78]
lea ecx, [esp + 0x40c]
call fcn.0040cdc0
push dword [esp + 0x74]
lea ecx, [esp + 0x73c]
call fcn.0040cdc0
push dword [esp + 0x70]
lea ecx, [esp + 0x62c]
call fcn.0040cdc0
push dword [esp + 0x6c]
lea ecx, [esp + 0x51c]
call fcn.0040cdc0
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x51c]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x634]
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x74c]
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x424]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x104]
lea eax, [esp + 0xd10]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x40bd28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x40bd1c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402290
mov esi, edi
jmp 0x40bdcc
mov esi, dword [0x410020]
or edi, 0xffffffff
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push edi
push dword [esp + 0x100]
mov ecx, esi
call dword [0x413278]
call esi
mov esi, eax
test esi, esi
je 0x40bd6e
cmp dword [esp + 0x14], edi
je 0x40bd62
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x641
mov ebx, 0x4022d8
jmp 0x40bdcc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x38], eax
test eax, eax
jne 0x40bd98
cmp dword [esp + 0x14], edi
je 0x40bd91
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402338
jmp 0x40bdbf
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x40bdda
cmp dword [esp + 0x14], edi
je 0x40bdba
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x4023a8
mov edi, 0x641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.0040a162
jmp 0x40c23e
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x4c], ebx
call fcn.0040aa18
mov esi, eax
mov edi, 0x641
mov dword [esp + 0x28], edi
test esi, esi
jne 0x40be15
cmp dword [esp + 0x14], 0xffffffff
je 0x40be0b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402430
jmp 0x40c057
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x7c], ebx
call fcn.0040857a
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x40be47
cmp dword [esp + 0x14], 0xffffffff
je 0x40be3d
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402490
jmp 0x40c057
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40be63
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x413278]
call edi
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx]
lea eax, [esp + 0x30]
push eax
push 0x402b48
push ecx
mov ecx, dword [edi]
call dword [0x413278]
call dword [edi]
mov ecx, dword [esp + 0x2c]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x413278]
call edi
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x58], edi
test eax, eax
je 0x40beae
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x413278]
call edi
mov edi, dword [esi]
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x50]
push eax
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0xc2c]
push 0x10
push eax
lea eax, [esp + 0x70]
push eax
push esi
call dword [0x413278]
call dword [edi + 0x38]
test eax, eax
je 0x40bf02
cmp dword [esp + 0x14], 0xffffffff
je 0x40bef4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x28]
mov ebx, 0x402500
jmp 0x40c057
push dword [esp + 0x5c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x60], eax
test eax, eax
jne 0x40bf3f
cmp dword [esp + 0x14], 0xffffffff
je 0x40bf2b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402570
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x28]
jmp 0x40c059
push dword [esp + 0x4c]
mov edi, dword [0x410028]
mov ecx, edi
call dword [0x413278]
call edi
test eax, eax
jne 0x40bf72
cmp dword [esp + 0x14], 0xffffffff
je 0x40bf68
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x4025e0
jmp 0x40c052
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push ecx
push 0x402c08
push eax
mov edi, dword [eax]
mov ecx, dword [edi]
call dword [0x413278]
call dword [edi]
mov eax, dword [esp + 0xc]
mov ecx, ebx
cmp eax, dword [esp + 0x58]
jne 0x40bfa5
cmp eax, 8
je 0x40bfa5
push 9
pop edx
cmp eax, edx
jne 0x40bfa9
lea ecx, [esp + 0x58]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xc1c]
push edx
push ecx
push eax
mov edi, dword [eax]
mov edi, dword [edi + 0xa0]
mov ecx, edi
call dword [0x413278]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x38]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xa8]
mov ecx, edi
call dword [0x413278]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xac]
mov ecx, edi
call dword [0x413278]
call edi
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push dword [esp + 0x80]
push dword [esp + 0x44]
mov edi, dword [eax]
push dword [esp + 0x4c]
push dword [esp + 0x54]
mov edi, dword [edi + 0xa4]
mov ecx, edi
push dword [esp + 0x70]
push eax
call dword [0x413278]
call edi
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x40c049
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x14], 0xffffffff
test edi, edi
je 0x40c0af
mov ebx, 0x402648
mov edi, 0x641
mov eax, edi
mov edx, eax
mov ecx, ebx
call fcn.0040a162
test esi, esi
je 0x40c076
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x413278]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40c08e
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x413278]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40c23e
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x413278]
call esi
jmp 0x40c23e
mov eax, dword [esp + 0x1c]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x9c]
mov ecx, edi
call dword [0x413278]
call edi
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x413278]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40c0f2
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x413278]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40c10a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x413278]
call esi
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x13], bl
mov dword [esp + 0xb84], edi
mov dword [esp + 0xb88], esi
mov dword [esp + 0xb8c], eax
jmp 0x40c1e9
cmp eax, 1
je 0x40c2f0
cmp eax, 2
jne 0x40c195
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], ebx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
mov ecx, esi
call dword [0x413278]
call esi
push dword [esp + 0x80]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40c216
mov dword [esp + 0xb84], edi
jmp 0x40c1e9
cmp eax, 3
jne 0x40c2fa
jmp 0x40c1c6
cmp dword [esp + 0x9c], 0x12
je 0x40c20e
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x40c1a0
mov al, byte [esp + 0x13]
test al, al
jne 0x40c2fa
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb90]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x40c134
jmp 0x40c2fa
mov al, 1
mov byte [esp + 0x13], al
jmp 0x40c1e1
cmp dword [esp + 0x14], 0xffffffff
je 0x40c227
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x402570
call fcn.0040a162
mov edi, 0x641
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x40c263
cmp dword [esp + 0x518], 0
je 0x40c263
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x40c283
cmp dword [esp + 0x628], 0
je 0x40c283
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x40c2a3
cmp dword [esp + 0x738], 0
je 0x40c2a3
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x40c2c3
cmp dword [esp + 0x408], 0
je 0x40c2c3
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x40c45c
cmp dword [esp + 0xe0], 0
je 0x40c45c
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40c45c
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x413278]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x40c33a
cmp dword [esp + 0x518], 0
je 0x40c33a
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x40c35a
cmp dword [esp + 0x628], 0
je 0x40c35a
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x40c37a
cmp dword [esp + 0x738], 0
je 0x40c37a
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x40c39a
cmp dword [esp + 0x408], 0
je 0x40c39a
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x40c3ba
cmp dword [esp + 0xe0], 0
je 0x40c3ba
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x50], 0
je 0x40c3da
cmp dword [0x4119e4], 0
jne 0x40c3da
mov eax, dword [0x4116fc]
test eax, eax
je 0x40c3da
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x84], 0
je 0x40c456
mov edi, 0x641
mov ecx, edi
call fcn.0040a3f4
jmp 0x40c45c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401f38
mov edx, eax
call fcn.0040a162
mov ebx, 0x641
mov edi, ebx
jmp 0x40c45c
push ebx
push ebx
push ebx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x40c438
cmp dword [0x411cd0], eax
je 0x40c3ba
cmp dword [0x4119e0], eax
je 0x40c3ba
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40c413
mov eax, dword [esp + 0x20]
mov edi, eax
lea ecx, [esp + 0x1f0]
call fcn.0040ce52
lea ecx, [esp + 0xd0]
call fcn.0040d07a
mov ecx, dword [esp + 0x27f4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ead0
mov esp, ebp
pop ebp
ret