Function at 0x414b80
Capabilities:
Accept command line arguments
Acquire debug privileges
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a1d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x10f4
call fcn.004929f0
push ebx
push esi
push edi
push 0x414a80
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x80000400
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp byte [0x4c7dca], 0
jne 0x414bd2
call fcn.0042de30
cmp byte [0x4c7dcb], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
je 0x414c01
call esi
push str._nocompat
push eax
call fcn.00474087
add esp, 8
test eax, eax
jne 0x414c01
mov byte [0x4c7d60], 1
call fcn.0042f010
mov eax, dword [str.pl_rsrc_english.dll]
push eax
mov dword [str.pl_rsrc_english.dll], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
or edi, 0xffffffff
push edi
push str.ioloGovernor
push 0x104
push 0x4c8f74
mov dword [0x4c7dd0], eax
call fcn.004740e7
mov eax, dword [0x4c7dd0]
add esp, 0x10
mov dword [0x4c917c], 0x4ab2fc
mov dword [0x4c8948], eax
mov dword [0x4c8944], 4
call fcn.004084f0
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.00402ba0
mov dword [esp + 0x110c], 0
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 0xc]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047125f
mov ecx, dword [esp + 0x14]
add esp, 4
cmp dword [ecx - 4], 1
mov ebx, eax
mov dword [esp + 0xc], ebx
jle 0x414cb1
mov eax, dword [ecx - 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00401ff0
mov ecx, dword [esp + 0x10]
mov edx, ebx
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x414cb3
push ebx
call fcn.00473d7d
add esp, 4
push ebx
call fcn.00414690
add esp, 4
push str._exit
push ebx
call fcn.00474087
add esp, 8
test eax, eax
je 0x414d41
call fcn.00430590
mov dword [esp + 0x110c], edi
test al, al
mov eax, dword [esp + 0x10]
je 0x414d0e
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jmp 0x415289
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x414d27
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1104]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._configfile
push ebx
call fcn.00474087
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, eax
add esp, 8
test esi, esi
je 0x414d7e
push 0x4c74c8
call edi
add esi, 0x18
push esi
mov ecx, 0x4cb834
call fcn.0042a3b0
add esp, 4
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str._logfolder
push ebx
call fcn.00474087
mov esi, eax
add esp, 8
test esi, esi
je 0x414e74
push 0x4c74c8
call edi
add esi, 0x16
push esi
mov ecx, 0x4cb830
call fcn.0042a3b0
add esp, 4
mov ebx, 0x4cb830
call fcn.00416a10
mov ebx, eax
call fcn.00416a90
mov eax, dword [0x4cb830]
mov ecx, 0x4ae8fc
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x414df6
test dx, dx
je 0x414df2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x414df6
add eax, 4
add ecx, 4
test dx, dx
jne 0x414dd0
xor eax, eax
jmp 0x414dfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x414e25
push 0x4cb830
mov ecx, 0x4ae900
call fcn.004153a0
test eax, eax
je 0x414e25
push 0x4cb830
mov ecx, 0x4ae908
call fcn.004153a0
test eax, eax
jne 0x414e65
lea ecx, [esp + 0x100]
push ecx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x100]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414e42
sub eax, edx
lea edx, [esp + 0x100]
sar eax, 1
push edx
push 0x4cb830
mov ebx, eax
call fcn.00402e20
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0xc]
push str._configfolder
push ebx
call fcn.00474087
mov esi, eax
add esp, 8
test esi, esi
je 0x414fa0
push 0x4c74c8
add esi, 0x1c
call edi
push esi
mov ecx, 0x4cb834
call fcn.0042a3b0
add esp, 4
mov ebx, 0x4cb834
call fcn.00416a10
mov ebx, eax
call fcn.00416a90
mov eax, dword [0x4cb834]
mov ecx, 0x4ae8fc
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x414ee6
test dx, dx
je 0x414ee2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x414ee6
add eax, 4
add ecx, 4
test dx, dx
jne 0x414ec0
xor eax, eax
jmp 0x414eeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x414f15
push 0x4cb834
mov ecx, 0x4ae900
call fcn.004153a0
test eax, eax
je 0x414f15
push 0x4cb834
mov ecx, 0x4ae908
call fcn.004153a0
test eax, eax
jne 0x414f55
lea eax, [esp + 0x100]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x100]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414f32
sub eax, edx
lea ecx, [esp + 0x100]
sar eax, 1
push ecx
push 0x4cb834
mov ebx, eax
call fcn.00402e20
mov edx, dword [0x4cb834]
mov ecx, dword [edx - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x414fc4
cmp eax, ecx
jg 0x414fc4
cmp word [edx + eax*2], 0x5c
jne 0x414f80
dec ecx
push 0x4cb834
mov eax, 1
call fcn.004153f0
push 0xd
push 0x4ae930
mov ebx, 0x4cb834
call fcn.00418c50
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0xc]
push ebx
call fcn.00472958
add esp, 4
call fcn.00430530
test al, al
je 0x414fce
push str.Governor_already_running_in_this_session.
call fcn.004261a0
add esp, 4
jmp 0x41526a
push 0x80070057
call fcn.004018d0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, str.SeAssignPrimaryTokenPrivilege
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str.SeDebugPrivilege
mov dword [esp + 0x1c], str.SeChangeNotifyPrivilege
mov dword [esp + 0x20], str.SeIncreaseBasePriorityPrivilege
mov dword [esp + 0x24], str.SeIncreaseQuotaPrivilege
mov dword [esp + 0x28], str.SeProfileSingleProcessPrivilege
mov dword [esp + 0x2c], str.SeCreateGlobalPrivilege
mov dword [esp + 0x30], str.SeBackupPrivilege
mov dword [esp + 0x34], str.SeRestorePrivilege
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0xc]
push ecx
push 0x28
call edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x415076
lea edx, [esp + 0x40]
push edx
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
lea eax, [esp + 0x48]
push eax
push 0
push ecx
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
setne al
test al, al
jne 0x415084
push esi
push str.pg.warning:_Couldnt_get_priviledge__s
call fcn.004261a0
add esp, 8
mov esi, dword [esp + ebx*4 + 0x18]
inc ebx
test esi, esi
jne 0x415023
push 1
push 0x110
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.00407ed0
push 0x80
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
cmp byte [0x4c7dca], 0
jne 0x4150ed
call fcn.0042de30
cmp byte [0x4c7dcb], 0
je 0x4151e8
lea esi, [esp + 0x50]
call fcn.00460c80
mov byte [esp + 0x110c], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x200
call edi
mov esi, eax
test esi, esi
je 0x415151
push 4
lea edx, [esp + 0x10]
push edx
push 0x27
push esi
mov dword [esp + 0x1c], 5
call dword [esp + 0xc0]
push esi
test eax, eax
je 0x4152ac
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ERROR:_Could_not_set_self_memory_priority
call fcn.004261a0
add esp, 4
mov dword [esp + 0xc], 2
call ebx
push eax
push 0
push 0x200
call edi
mov esi, eax
test esi, esi
je 0x4151a3
push 4
lea eax, [esp + 0x10]
push eax
push 0x21
push esi
call dword [esp + 0xc0]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4151a3
push str.ERROR:_Could_not_set_self_I_O_priority
call fcn.004261a0
add esp, 4
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x4151c2
push eax
call fcn.00472958
add esp, 4
mov dword [esp + 0xe4], 0
mov eax, dword [esp + 0x98]
test eax, eax
je 0x4151d4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [esp + 0x6c]
call fcn.00461b80
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0x4145a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
xor edi, edi
test esi, esi
je 0x41522d
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, edi
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x415210
push 0xffffffffffffffff
push esi
call ebx
cmp eax, edi
jne 0x415210
mov eax, dword [0x4c7d5c]
cmp eax, edi
je 0x41525f
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4c7d5c]
lea ecx, [esp + 0xc]
push ecx
push eax
mov esi, eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x41525f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esp + 0x110c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415295
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1104]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41515e