Function at 0x418690
Capabilities:
Accept command line arguments
Enumerate processes
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa141
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1158
call fcn.00481cf0
mov eax, dword [0x4d9164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc20], 0
mov dword [ebp - 0xc10], eax
mov byte [ebp - 0x60], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc0c], str.dll_dirs_F67BB3AD_7B5E_4C2D_A22B_747BC163AB78
mov eax, dword [ebp - 0xc0c]
push str.kernel32.dll
mov dword [ebp - 0xc0c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41872a
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41872a
push 0x1000
mov ecx, esi
call dword [0x4b3390]
call esi
lea ecx, [ebp - 0xe48]
call fcn.0040b640
push eax
lea ecx, [ebp - 0x78]
call fcn.0040baf0
lea ecx, [ebp - 0xe48]
call fcn.0041c8b0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 1
call fcn.00428cb0
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.0040bbc0
mov byte [ebp - 4], 3
cmp byte [ebp - 0x48], 0
jne 0x41879f
cmp byte [ebp - 0x4c], 0
je 0x418782
lea ecx, [ebp - 0x5c]
call fcn.0040b3d0
lea ecx, [ebp - 0x9c]
call fcn.00419ee0
lea ecx, [ebp - 0x78]
call fcn.0041c8b0
mov eax, 5
jmp 0x419de4
push 0x4c455c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4de108]
cmp eax, dword [ecx + 0x58]
jle 0x4187f6
push 0x4de108
call fcn.004812aa
add esp, 4
cmp dword [0x4de108], 0xffffffff
jne 0x4187f6
mov ecx, 0x4de10c
call fcn.0040b470
push 0x4b15a0
call fcn.004815bc
push 0x4de108
call fcn.00481260
add esp, 8
xor al, al
mov byte [ebp - 0xa0], al
mov byte [ebp - 4], 4
cmp byte [0x4de124], al
je 0x418822
push 0x4de10c
lea ecx, [ebp - 0xb8]
call fcn.0041ea30
mov al, 1
mov byte [ebp - 0xa0], al
mov byte [ebp - 4], 5
test al, al
je 0x419db3
cmp dword [ebp - 0xa4], 8
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.0041c8b0
push 5
xorps xmm0, xmm0
mov dword [ebp - 0xca0], 0
xor eax, eax
movq qword [ebp - 0x30], xmm0
push str._stop
lea ecx, [ebp - 0xca0]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xc90], 0
mov dword [ebp - 0xc8c], 7
mov word [ebp - 0xca0], ax
call fcn.00437950
lea eax, [ebp - 0xc88]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xca0]
push eax
push ecx
lea ecx, [ebp - 0xec8]
call fcn.0041b770
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc88]
push 4
xor eax, eax
mov dword [ebp - 0xc88], 0
push str.stop
mov dword [ebp - 0xc78], 0
mov dword [ebp - 0xc74], 7
mov word [ebp - 0xc88], ax
call fcn.00437950
lea eax, [ebp - 0xc70]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc88]
push eax
push ecx
lea ecx, [ebp - 0xea8]
call fcn.0041b770
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc70]
push 8
xor eax, eax
mov dword [ebp - 0xc70], 0
push str.stop_all
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0xc5c], 7
mov word [ebp - 0xc70], ax
call fcn.00437950
lea eax, [ebp - 0xc58]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc70]
push eax
push ecx
lea ecx, [ebp - 0xe88]
call fcn.0041b770
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc58]
push 9
xor eax, eax
mov dword [ebp - 0xc58], 0
push str._stop_all
mov dword [ebp - 0xc48], 0
mov dword [ebp - 0xc44], 7
mov word [ebp - 0xc58], ax
call fcn.00437950
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc58]
lea eax, [ebp - 0xc40]
push eax
push ecx
lea ecx, [ebp - 0xe68]
call fcn.0041b770
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0xe48]
push dword [ebp - 0xc00]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
lea eax, [ebp - 0xec8]
mov dword [ebp - 0x2c], 0
push eax
mov dword [ebp - 0x28], 0
call fcn.00429590
push fcn.00419e30
push 4
push 0x20
lea eax, [ebp - 0xec8]
mov byte [ebp - 4], 0x12
push eax
call fcn.00481635
push fcn.00405c30
push 1
push 0x18
lea eax, [ebp - 0xc58]
mov byte [ebp - 4], 0x13
push eax
call fcn.00481635
push fcn.00405c30
push 1
push 0x18
lea eax, [ebp - 0xc70]
mov byte [ebp - 4], 0x14
push eax
call fcn.00481635
push fcn.00405c30
push 1
push 0x18
lea eax, [ebp - 0xc88]
mov byte [ebp - 4], 0x15
push eax
call fcn.00481635
push fcn.00405c30
push 1
push 0x18
lea eax, [ebp - 0xca0]
mov byte [ebp - 4], 0x16
push eax
call fcn.00481635
push ecx
lea ecx, [ebp - 0x5c]
call fcn.00411820
test al, al
je 0x418aa2
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00411970
test al, al
je 0x418df7
lea ecx, [ebp - 0xc08]
call fcn.00407790
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0x19
mov eax, dword [0x4de0c4]
add eax, dword [0x4de0c8]
je 0x418c08
mov dword [ebp - 0xc18], 0
call fcn.0041e030
mov dword [ebp - 0xc1c], eax
lock inc dword [ebp - 0xc18]
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc20], 1
jne 0x418b37
call fcn.0041e030
mov dword [ebp - 0xc1c], eax
lock inc dword [ebp - 0xc18]
mov eax, dword [ebp - 0xc1c]
or edi, 0xffffffff
push 0
push 2
mov dword [ebp - 0xc0c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x418bbf
push 0x228
lea eax, [ebp - 0x3cc]
push 0
push eax
call fcn.00483710
add esp, 0xc
mov dword [ebp - 0x3d0], 0x22c
lea eax, [ebp - 0x3d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x418bb8
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x3c8], eax
je 0x418bb2
lea eax, [ebp - 0x3d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x418b90
jmp 0x418bb8
mov edi, dword [ebp - 0x3b8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0xc10]
mov ecx, 0x4c565c
test edx, edx
mov dword [ebp - 0xc00], 0x10
cmovne ecx, edx
push ecx
push edi
push eax
push str.First_log:_pid_lu_parent_pid_lu_lpCmdLine__s_
push str.wWinMain
push 0x400000
lea eax, [ebp - 0xc00]
push eax
push 0
push dword [ebp - 0xc0c]
call fcn.00401c70
add esp, 0x24
mov dword [ebp - 4], 0x19
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xc0c], eax
test al, 1
je 0x418c5e
and eax, 0xfffffffe
mov dword [ebp - 0xc20], eax
mov dword [ebp - 0xc0c], eax
or eax, 0xffffffff
mov dword [ebp - 0xc1c], 0
lock xadd dword [ebp - 0xc18], eax
js 0x418c57
call fcn.004271d0
or eax, 0xffffffff
lock xadd dword [ebp - 0xc18], eax
jns 0x418c45
lock inc dword [ebp - 0xc18]
push ecx
push str.wWinMain
push 0x10
lea ecx, [ebp - 0x1018]
call fcn.00403580
mov edi, dword [ebp - 0xc0c]
or edi, 8
mov byte [ebp - 4], 0x1b
cmp byte [ebp - 0xfd0], 0
je 0x418c9b
lea eax, [ebp - 0x1018]
push str.Cmd_line_arguments:
push eax
call fcn.004280f0
add esp, 8
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x1018]
call fcn.00429030
lea ecx, [ebp - 0xfb8]
call fcn.004037b0
lea eax, [ebp - 0xfb8]
mov byte [ebp - 4], 0x1c
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x18], 2
jae 0x418dae
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xe2c]
call fcn.00403580
mov byte [ebp - 4], 0x1d
cmp byte [ebp - 0xde4], 0
je 0x418d13
lea eax, [ebp - 0xe2c]
push str.Config_file_is_missing.
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xdcc]
call fcn.004037b0
lea eax, [ebp - 0xdcc]
mov byte [ebp - 4], 0x1e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
mov eax, dword [ebp - 0x1c]
add esp, 4
test eax, eax
je 0x418d49
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [ebp - 0xc08], 0
je 0x418d5b
cmp dword [ebp - 0xc04], 0
je 0x418d7b
call fcn.004271d0
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x418d7b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc04], 0
lea ecx, [ebp - 0x30]
call fcn.004206b0
cmp byte [ebp - 0x4c], 0
je 0x418d91
lea ecx, [ebp - 0x5c]
call fcn.0040b3d0
lea ecx, [ebp - 0x9c]
call fcn.00419ee0
lea ecx, [ebp - 0x78]
call fcn.0041c8b0
mov eax, 0xa0
jmp 0x419de4
call fcn.00418190
test al, al
mov eax, dword [ebp - 0x1c]
jne 0x418e2a
test eax, eax
je 0x418dc5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [ebp - 0xc08], 0
je 0x418dd7
cmp dword [ebp - 0xc04], 0
je 0x418df7
call fcn.004271d0
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x418df7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc04], 0
lea ecx, [ebp - 0x30]
call fcn.004206b0
cmp byte [ebp - 0x4c], 0
je 0x418e0d
lea ecx, [ebp - 0x5c]
call fcn.0040b3d0
lea ecx, [ebp - 0x9c]
call fcn.00419ee0
lea ecx, [ebp - 0x78]
call fcn.0041c8b0
mov eax, 0x42b
jmp 0x419de4
mov eax, dword [eax + 4]
cmp word [eax], 0x2f
lea esi, [eax + 2]
cmovne esi, eax
mov ecx, esi
mov dword [ebp - 0xc00], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418e42
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x4d9bec
call fcn.00437950
push ecx
push str.wWinMain
push 0x10
lea ecx, [ebp - 0xf70]
call fcn.00403580
or edi, 0x20
mov byte [ebp - 4], 0x1f
cmp byte [ebp - 0xf28], 0
je 0x418ead
lea eax, [ebp - 0xf70]
push str.Config_path:
push eax
call fcn.004280f0
add esp, 8
cmp byte [ebp - 0xf28], 0
je 0x418ead
lea eax, [ebp - 0xf70]
push esi
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xf10]
call fcn.004037b0
lea eax, [ebp - 0xf10]
mov byte [ebp - 4], 0x20
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
xor esi, esi
mov dword [ebp - 0x20], esi
push 0x38
mov byte [ebp - 4], 0x22
call fcn.0048113f
add esp, 8
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x23
xor eax, eax
mov edx, dword [ebp - 0xc00]
mov ecx, edx
mov dword [ebp - 0xcb8], esi
mov word [ebp - 0xcb8], ax
mov dword [ebp - 0xca8], esi
lea eax, [ecx + 2]
mov dword [ebp - 0xca4], 7
mov dword [ebp - 0xc00], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418f22
sub ecx, dword [ebp - 0xc00]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xcb8]
call fcn.00437950
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0xcb8]
mov ecx, dword [ebp - 0xc10]
or edi, 0x40
push eax
mov dword [ebp - 0xc0c], edi
mov dword [ebp - 0xc20], edi
call fcn.0043dc80
mov edi, eax
mov eax, dword [ebp - 0xc0c]
or eax, 0x80
mov dword [ebp - 4], 0x22
test al, 0x40
je 0x418fbf
mov edx, dword [ebp - 0xca4]
cmp edx, 8
jb 0x418fbf
mov ecx, dword [ebp - 0xcb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418fb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419e02
push edx
push ecx
call fcn.00481131
add esp, 8
mov eax, dword [0x4d9c1c]
mov dword [0x4d9c1c], edi
test eax, eax
je 0x418fd4
push eax
call fcn.00421be0
call fcn.00418430
push ecx
push str.wWinMain
push 0x10
lea ecx, [ebp - 0xe2c]
call fcn.00403580
mov byte [ebp - 4], 0x26
cmp byte [ebp - 0xde4], 0
je 0x41900d
lea eax, [ebp - 0xe2c]
push str.Cmd_line_arguments:
push eax
call fcn.004280f0
add esp, 8
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0xe2c]
call fcn.00429030
lea ecx, [ebp - 0xdcc]
call fcn.004037b0
lea eax, [ebp - 0xdcc]
mov byte [ebp - 4], 0x27
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
push 0xb0
lea eax, [ebp - 0x1a4]
mov byte [ebp - 4], 0x28
push 0
push eax
call fcn.00483710
add esp, 0x10
lea ecx, [ebp - 0x1a4]
push 1
call fcn.0041d2a0
lea eax, [ebp - 0x194]
mov byte [ebp - 4], 0x29
push 0x4c5760
push eax
call fcn.004280f0
add esp, 8
mov edx, 0x4d9c04
cmp dword [0x4d9c18], 8
mov ecx, eax
cmovae edx, dword [0x4d9c04]
push dword [0x4d9c14]
call fcn.00430840
add esp, 4
push 0x4c5758
push eax
call fcn.004280f0
add esp, 8
lea eax, [ebp - 0x194]
push 0x4c5760
push eax
call fcn.004280f0
add esp, 8
mov edx, 0x4d9bec
cmp dword [0x4d9c00], 8
mov ecx, eax
cmovae edx, dword [0x4d9bec]
push dword [0x4d9bfc]
call fcn.00430840
add esp, 4
push 0x4c5760
push eax
call fcn.004280f0
mov edi, dword [0x4d9c1c]
lea eax, [ebp - 0xd84]
add esp, 8
lea ecx, [ebp - 0x18c]
push eax
call fcn.00421ca0
push edi
lea edx, [ebp - 0xd84]
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x3c]
call fcn.00417db0
lea ecx, [ebp - 0x20]
add esp, 4
cmp ecx, eax
je 0x419135
mov esi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edi
test edi, edi
je 0x41919d
mov byte [ebp - 4], 0x2c
mov ecx, dword [edi + 0x10]
call fcn.0040a9a0
cmp byte [edi + 0x40], 0
lea ecx, [edi + 0x18]
mov dword [ebp - 0xc10], ecx
je 0x419192
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0xc00], edx
test edx, edx
je 0x419192
mov eax, dword [edx]
cmp edx, ecx
mov edi, dword [eax + 0x10]
setne al
push eax
mov ecx, edi
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov eax, dword [ebp - 0xc10]
mov edi, dword [ebp - 0x24]
mov dword [eax + 0x24], 0
push 0x50
push edi
call fcn.00481131
add esp, 8
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0xd70]
cmp edx, 8
jb 0x4191e1
mov ecx, dword [ebp - 0xd84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4191d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419e07
push edx
push ecx
call fcn.00481131
add esp, 8
lea ecx, [ebp - 0x1a4]
call fcn.00404590
mov dword [ebp - 4], 0x22
jmp 0x419274
mov eax, dword [0x4d9c1c]
movzx ecx, word [eax + 0x32]
mov eax, ecx
shr eax, 8
test al, al
je 0x419290
xor eax, eax
cmp cl, 1
sete al
jmp 0x419292
xor eax, eax
test al, al
je 0x419718
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
call fcn.004101a0
mov edi, dword [ebp - 0x3c]
test edi, edi
je 0x419718
push str.bd::process_broker::client::this_process_should_be_started_by_broker
lea ecx, [ebp - 0xbf8]
mov byte [ebp - 4], 0x30
call fcn.00401cc0
call fcn.00411100
test al, al
jne 0x4192e3
lea ecx, [ebp - 0xbf8]
call fcn.00401dd0
xor al, al
jmp 0x41938f
lea eax, [ebp - 0xbfc]
mov dword [ebp - 0x44], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x44]
mov word [ebp - 0x40], 0x500
push eax
mov dword [ebp - 0xbfc], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x419368
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push dword [ebp - 0xbfc]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0xbfc]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x38], 1
jne 0x419368
lea ecx, [ebp - 0xbf8]
call fcn.00401dd0
xor al, al
jmp 0x41938f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.0040fb60
test al, al
lea ecx, [ebp - 0xbf8]
sete byte [ebp - 0xc11]
call fcn.00401dd0
mov al, byte [ebp - 0xc11]
mov byte [ebp - 4], 0x2f
test al, al
je 0x419702
push 0x26
mov dword [ebp - 0xc38], 0
lea ecx, [ebp - 0xc38]
push str.6917A0A7_7341_43EB_B354_FC4C103B1EC1
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0xc24], 0xf
mov byte [ebp - 0xc38], 0
call fcn.00437d60
push str.bd::process_broker::client::spawn_process_with_current_params
lea ecx, [ebp - 0x7e4]
mov byte [ebp - 4], 0x31
mov byte [ebp - 0xc3c], 0
call fcn.00401cc0
push dword [ebp - 0xc3c]
mov byte [ebp - 4], 0x32
push dword [ebp - 0xc40]
sub esp, 0x1c
mov eax, esp
mov byte [eax + 0x18], 0
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00410850
lea ecx, [ebp - 0x7e4]
call fcn.00401dd0
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0xc24]
cmp edx, 0x10
jb 0x419462
mov ecx, dword [ebp - 0xc38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x419458
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419e0c
push edx
push ecx
call fcn.00481131
add esp, 8
cmp byte [ebp - 0xbc], 0
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0xc24], 0xf
mov byte [ebp - 0xc38], 0
jne 0x4195de
cmp byte [ebp - 0xd8], 0
je 0x4195de
push ecx
push str.wWinMain
push 0x10
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x35
cmp byte [ebp - 0xd18], 0
je 0x4194cb
lea eax, [ebp - 0xd60]
push str.Process_will_be_respawned_by_process_broker_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
lea eax, [ebp - 0xd00]
mov byte [ebp - 4], 0x36
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
lea ecx, [ebp - 0xdc]
call fcn.0041b860
test edi, edi
je 0x419514
mov ecx, edi
call fcn.0040df90
push 0x30
push edi
call fcn.00481131
add esp, 8
mov byte [ebp - 4], 0x19
test esi, esi
je 0x41956e
mov byte [ebp - 4], 0x37
mov ecx, dword [esi + 0x10]
call fcn.0040a9a0
cmp byte [esi + 0x40], 0
lea eax, [esi + 0x18]
je 0x419563
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xc00], ecx
test ecx, ecx
je 0x419563
mov edx, dword [ecx]
cmp ecx, eax
setne al
movzx eax, al
mov edi, dword [edx + 0x10]
mov ecx, edi
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov dword [esi + 0x3c], 0
push 0x50
push esi
call fcn.00481131
add esp, 8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41957c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [ebp - 0xc08], 0
je 0x41958e
cmp dword [ebp - 0xc04], 0
je 0x4195ae
call fcn.004271d0
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x4195ae
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc04], 0
lea ecx, [ebp - 0x30]
call fcn.004206b0
cmp byte [ebp - 0x4c], 0
je 0x4195c4
lea ecx, [ebp - 0x5c]
call fcn.0040b3d0
lea ecx, [ebp - 0x9c]
call fcn.00419ee0
lea ecx, [ebp - 0x78]
call fcn.0041c8b0
xor eax, eax
jmp 0x419de4
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x38
cmp byte [ebp - 0xd18], 0
je 0x419612
lea eax, [ebp - 0xd60]
push str.Process_browker_spawn_failed_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
lea eax, [ebp - 0xd00]
mov byte [ebp - 4], 0x39
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
lea ecx, [ebp - 0xdc]
call fcn.0041b860
test edi, edi
je 0x41965b
mov ecx, edi
call fcn.0040df90
push 0x30
push edi
call fcn.00481131
add esp, 8
mov byte [ebp - 4], 0x19
test esi, esi
je 0x4196b5
mov byte [ebp - 4], 0x3a
mov ecx, dword [esi + 0x10]
call fcn.0040a9a0
cmp byte [esi + 0x40], 0
lea eax, [esi + 0x18]
je 0x4196aa
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xc00], ecx
test ecx, ecx
je 0x4196aa
mov edx, dword [ecx]
cmp ecx, eax
setne al
movzx eax, al
mov edi, dword [edx + 0x10]
mov ecx, edi
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov dword [esi + 0x3c], 0
push 0x50
push esi
call fcn.00481131
add esp, 8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4196c3
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [ebp - 0xc08], 0
je 0x4196d5
cmp dword [ebp - 0xc04], 0
je 0x4196f5
call fcn.004271d0
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x4196f5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc04], 0
lea ecx, [ebp - 0x30]
call fcn.004206b0
jmp 0x418774
test edi, edi
je 0x419718
mov ecx, edi
call fcn.0040df90
push 0x30
push edi
call fcn.00481131
add esp, 8
push 0x3c
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0x3b
push 0
push eax
call fcn.00483710
add esp, 0xc
lea ecx, [ebp - 0xf4]
call fcn.0043a900
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0xf4]
cmp dword [ebp - 0x18], 2
mov dword [0x4d9c20], eax
mov byte [0x4d9c24], 1
jbe 0x41998f
mov edi, dword [ebp - 0x1c]
push 7
push str.crash
mov edi, dword [edi + 8]
push edi
call fcn.0048e937
add esp, 0xc
test eax, eax
jne 0x419842
mov edx, str.crash
mov ecx, edi
call fcn.004115b0
mov dword [ebp - 0xbfc], eax
test eax, eax
jns 0x4197b4
mov edx, str.abort
mov ecx, edi
call fcn.004115b0
mov dword [ebp - 0xbfc], eax
test eax, eax
jns 0x4197b4
mov edx, str.terminate
mov ecx, edi
call fcn.004115b0
mov edi, eax
jmp 0x4197ba
mov edi, dword [ebp - 0xbfc]
push ecx
push str.check_intentional_crash
push 0x10
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x3d
cmp byte [ebp - 0xd18], 0
je 0x419803
lea eax, [ebp - 0xd60]
push str.Crash_interval:
push eax
call fcn.004280f0
add esp, 8
cmp byte [ebp - 0xd18], 0
je 0x419803
push edi
lea ecx, [ebp - 0xd60]
call fcn.0041ddf0
lea ecx, [ebp - 0xd00]
call fcn.004037b0
lea eax, [ebp - 0xd00]
mov byte [ebp - 4], 0x3e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
mov ecx, edi
call fcn.004116a0
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
jmp 0x419c99
push str.stop
push edi
call fcn.0048e836
add esp, 8
test eax, eax
je 0x4198ff
push str._stop
push edi
call fcn.0048e836
add esp, 8
test eax, eax
je 0x4198ff
push str.stop_all
push edi
call fcn.0048e836
add esp, 8
test eax, eax
je 0x419896
push str._stop_all
push edi
call fcn.0048e836
add esp, 8
test eax, eax
jne 0x41998f
call fcn.00417c40
test al, al
je 0x4198ba
lea ecx, [ebp - 0xf4]
call fcn.0043c640
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
jmp 0x419c99
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x41
cmp byte [ebp - 0xd18], 0
je 0x4198ee
lea eax, [ebp - 0xd60]
push str.Stopping_processes_requires_admin_rigths_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
mov byte [ebp - 4], 0x42
jmp 0x419966
call fcn.00417c40
test al, al
je 0x419923
lea ecx, [ebp - 0xf4]
call fcn.0043c280
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
jmp 0x419c99
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x3f
cmp byte [ebp - 0xd18], 0
je 0x419957
lea eax, [ebp - 0xd60]
push str.Stopping_process_requires_admin_rigths_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0xd00]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.0043f761
add esp, 4
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
jmp 0x419c99
mov ecx, dword [0x4d9c1c]
movzx eax, word [ecx + 0x30]
mov dword [ebp - 0xc00], eax
shr eax, 8
test al, al
je 0x419a8e
call fcn.00417c40
cmp al, byte [ebp - 0xc00]
je 0x419a88
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x43
cmp byte [ebp - 0xd18], 0
je 0x4199ef
lea eax, [ebp - 0xd60]
push str.Admin_rights_mismatch_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
lea eax, [ebp - 0xd00]
mov byte [ebp - 4], 0x44
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
mov byte [ebp - 4], 0x19
test esi, esi
je 0x419c01
mov byte [ebp - 4], 0x45
mov ecx, dword [esi + 0x10]
call fcn.0040a9a0
cmp byte [esi + 0x40], 0
lea eax, [esi + 0x18]
je 0x419a75
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xc00], ecx
test ecx, ecx
je 0x419a75
mov edx, dword [ecx]
cmp ecx, eax
setne al
movzx eax, al
mov edi, dword [edx + 0x10]
mov ecx, edi
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov dword [esi + 0x3c], 0
push 0x50
push esi
call fcn.00481131
mov eax, dword [ebp - 0x1c]
add esp, 8
jmp 0x418dba
mov ecx, dword [0x4d9c1c]
movzx ecx, word [ecx + 0x34]
mov eax, ecx
shr eax, 8
test al, al
je 0x419aa5
xor eax, eax
cmp cl, 1
sete al
jmp 0x419aa7
xor eax, eax
test al, al
je 0x419c0c
push 4
call fcn.0048113f
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc00], ecx
sub esp, 0x28
mov byte [ebp - 4], 0x46
mov eax, esp
mov dword [ecx], 0
push 1
mov dword [eax], 0x4c6a78
mov dword [eax + 0x24], eax
call fcn.0040c580
mov edi, eax
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0xc10], edi
mov dword [ebp - 0x34], edi
mov eax, dword [edi]
test eax, eax
je 0x419c0c
mov eax, dword [eax]
test eax, eax
je 0x419c0c
mov al, byte [eax + 0x1c]
test al, al
jne 0x419c09
push ecx
push str.wWinMain
push 4
lea ecx, [ebp - 0xd60]
call fcn.00403580
mov byte [ebp - 4], 0x47
cmp byte [ebp - 0xd18], 0
je 0x419b42
lea eax, [ebp - 0xd60]
push str.Multiple_instances_not_allowed_
push eax
call fcn.004280f0
add esp, 8
lea ecx, [ebp - 0xd00]
call fcn.004037b0
lea eax, [ebp - 0xd00]
mov byte [ebp - 4], 0x48
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043f761
add esp, 4
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
mov byte [ebp - 4], 0x19
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x419bd8
mov byte [ebp - 4], 0x49
mov ecx, dword [esi + 0x10]
call fcn.0040a9a0
cmp byte [esi + 0x40], 0
lea eax, [esi + 0x18]
je 0x419bcd
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xc00], ecx
test ecx, ecx
je 0x419bcd
mov edx, dword [ecx]
cmp ecx, eax
setne al
movzx eax, al
mov edi, dword [edx + 0x10]
mov ecx, edi
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov edi, dword [ebp - 0xc10]
mov dword [esi + 0x3c], 0
push 0x50
push esi
call fcn.00481131
add esp, 8
mov eax, dword [edi]
test eax, eax
je 0x419bf6
push eax
mov dword [edi], 0
call fcn.00420ed0
mov eax, dword [edi]
test eax, eax
je 0x419bf6
push eax
call fcn.00420ed0
push 4
push edi
call fcn.00481131
add esp, 8
mov eax, dword [ebp - 0x1c]
jmp 0x418dba
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xf4]
call fcn.0043bd80
lea ecx, [ebp - 0xf4]
call fcn.0043acb0
jmp 0x419c99
mov byte [0x4d9c24], 0
mov dword [ebp - 4], 0x19
test esi, esi
je 0x419cfd
mov byte [ebp - 4], 0x4e
mov ecx, dword [esi + 0x10]
call fcn.0040a9a0
cmp byte [esi + 0x40], 0
lea eax, [esi + 0x18]
je 0x419cf2
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xc00], ecx
test ecx, ecx
je 0x419cf2
mov edx, dword [ecx]
cmp ecx, eax
setne al
movzx eax, al
mov edi, dword [edx + 0x10]
mov ecx, edi
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0xc00]
call edi
mov dword [esi + 0x3c], 0
push 0x50
push esi
call fcn.00481131
add esp, 8
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x41956e
mov eax, dword [esi]
test eax, eax
je 0x419d26
push eax
mov dword [esi], 0
call fcn.00420ed0
mov eax, dword [esi]
test eax, eax
je 0x419d26
push eax
call fcn.00420ed0
push 4
push dword [ebp - 0x34]
jmp 0x419566
lea ecx, [ebp - 0xb8]
call fcn.0041c8b0
cmp byte [ebp - 0x4c], 0
je 0x419dcc
lea ecx, [ebp - 0x5c]
call fcn.0040b3d0
lea ecx, [ebp - 0x9c]
call fcn.00419ee0
lea ecx, [ebp - 0x78]
call fcn.0041c8b0
mov eax, 0x1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 0x10
call fcn.004861f9
call fcn.004861f9
call fcn.004861f9
int3