Function at 0x415a04
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x598], eax
push ebx
push esi
push edi
mov esi, 0x403540
or dword [esp + 0x4c], 0xffffffff
lea edi, [esp + 0x388]
mov dword [esp + 0x28], ecx
xor eax, eax
mov dword [esp + 0x44], 0xffff
xor ecx, ecx
xor ebx, ebx
movsd dword es:[edi], dword [esi]
inc ebx
push 0x48
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x1f], cl
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x58], ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], ecx
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x74]
mov byte [esp + 0x25], cl
stosd dword es:[edi], eax
pop esi
push esi
push ecx
stosd dword es:[edi], eax
mov dword [esp + 0x64], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x80010
mov dword [esp + 0x80], esi
mov word [esp + 0xb0], bx
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xbc], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xc0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp dword [esp + 0x28], 0
mov dword [esp + 0xc0], eax
je 0x4214f2
xor eax, eax
mov byte [esp + 0x37c], bl
mov esi, 0x104
mov dword [esp + 0x378], eax
push esi
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0x388], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x17c]
add esp, 0xc
cmp byte [esp + 0x37c], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e330
test eax, eax
js 0x415f83
mov edi, 0x402724
mov esi, 0x4000
push edi
push esi
call fcn.00416dc5
push edi
push esi
mov dword [esp + 0x34], eax
call fcn.00416dc5
push edi
push esi
mov dword [esp + 0x4c], eax
call fcn.00416dc5
push edi
push 0x4000
mov esi, eax
call fcn.00416dc5
mov edi, eax
push 0x402724
push 0x4000
mov dword [esp + 0x80], edi
call fcn.00416dc5
push 0x402724
push 0x4000
mov dword [esp + 0x80], eax
call fcn.00416dc5
push 0x402724
push 0x4000
mov dword [esp + 0x78], eax
call fcn.00416dc5
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x24], 0
mov dword [esp + 0x3c], ecx
je 0x415f1b
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415f1b
test esi, esi
je 0x415f1b
test edi, edi
je 0x415f1b
cmp dword [esp + 0x50], 0
je 0x415f1b
cmp dword [esp + 0x40], 0
je 0x415f1b
test ecx, ecx
je 0x415f1b
xor ecx, ecx
mov dword [esp + 0x64], 5
mov word [edi], cx
mov word [eax], cx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp word [eax], cx
je 0x415c72
mov ecx, eax
call fcn.0040aa9f
push 0x22
pop edx
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x421502
lea edx, [esp + 0x14]
push 0x2000
cmp ecx, 0x2f
je 0x415fb6
push edi
xor ecx, ecx
call fcn.004160e0
cmp eax, ebx
je 0x415f1b
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp word [eax], cx
je 0x415c72
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.0040f2e0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x60], eax
xor eax, eax
cmp word [edi], ax
je 0x42196d
push 0x22
pop eax
cmp word [edi], ax
je 0x415c98
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x421986
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f2e0
mov ecx, edi
call fcn.0040ffb0
push eax
mov edx, 0x2000
mov ecx, edi
call fcn.0040f2e0
xor eax, eax
mov edx, edi
mov byte [esp + 0x22], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x14]
push eax
push 0x2d
pop ecx
call fcn.0040ecd0
cmp eax, 0xffffffff
jne 0x4219d9
mov ecx, dword [esp + 0x50]
mov edx, 0x2000
push edi
call fcn.0040f2e0
push 0x2000
mov edx, edi
mov dword [esp + 0x14c], edi
lea ecx, [esp + 0x114]
call fcn.0040f350
cmp eax, 3
je 0x4219b4
test eax, eax
je 0x4219c0
push 5
pop ecx
cmp eax, ecx
je 0x4219c0
cmp eax, 2
je 0x4219d9
push dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edx, 0x2000
call fcn.0040f2e0
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push 0x40233c
call fcn.0040fb80
mov eax, dword [esp + 0x60]
test eax, eax
je 0x415d67
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push eax
call fcn.0040fb80
cmp byte [esp + 0x1a], 0
jne 0x421af9
push 0x44
pop eax
push eax
xor eax, eax
push eax
lea eax, [esp + 0xd0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
cmp byte [esp + 0x13], 0
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x88], eax
jne 0x421b08
xor ecx, ecx
lea eax, [esp + 0x68]
push eax
push ecx
push 2
push ecx
mov byte [esp + 0x23], cl
mov dword [esp + 0x78], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x421b4d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x4219a9
push dword [esp + 0x68]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x421b5c
lea eax, [esp + 0x68]
push eax
xor eax, eax
push eax
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x421b69
xor ecx, ecx
mov dword [esp + 0x6c], 1
push ecx
push ecx
push 4
lea eax, [esp + 0x78]
push eax
push 0x60001
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421b94
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc4], ebx
cmp eax, 0xffff
jne 0x421ba8
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x50]
mov eax, dword [esp + 0x18]
push dword [esp + 0x60]
or eax, 0x400
push eax
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x60]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x18]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ebx, ebx
inc ebx
cmp byte [esp + 0x1a], 0
jne 0x421bce
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp byte [esp + 0x13], 0
mov dword [0x435798], eax
jne 0x421ca8
cmp byte [esp + 0x14], 0
je 0x421c8d
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x421bdd
cmp byte [esp + 0x21], 0
jne 0x421c7e
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x415f17
cmp byte [esp + 0x23], 0
jne 0x421d3e
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x415f2b
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x415f3b
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x415f4b
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
je 0x415f57
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x415f63
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415f73
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x415f83
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x378]
xor ecx, ecx
mov dword [esp + 0x378], ecx
test eax, eax
je 0x415f9f
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x5a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416ad0
mov esp, ebp
pop ebp
ret
add eax, 2
mov ecx, ebx
push esi
mov dword [esp + 0x1c], eax
call fcn.004160e0
cmp eax, ebx
je 0x415f1b
push 0x4026e0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421565
push 0x4026c8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421678
push 0x4026b0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421685
push 0x4026ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421692
push 0x402698
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4216ac
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x4216b9
push 0x40268c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4160cf
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x42175b
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x421930
push 0x402684
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4160d9
push 0x40267c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421773
or dword [esp + 0xac], ebx
or word [esp + 0xb0], 7
mov eax, dword [esp + 0x14]
jmp 0x415c0d
or dword [esp + 0xc], 0x80
jmp 0x4160c6
or dword [esp + 0xc], 0x40
jmp 0x4160c6
lea eax, [esp + 0x388]
mov dword [esp + 0x28], eax
jmp 0x415adf
cmp dword [esp + 0x8c], 0
jne 0x415c2e
push 0x104
lea eax, [esp + 0x39c]
mov ecx, ebx
push eax
lea edx, [esp + 0x1c]
call fcn.004160e0
cmp eax, ebx
je 0x415f1b
lea ecx, [esp + 0x398]
call fcn.0040ffb0
push eax
mov edx, 0x104
lea ecx, [esp + 0x39c]
call fcn.0040f2e0
lea eax, [esp + 0x398]
mov byte [esp + 0x1b], bl
mov dword [esp + 0x8c], eax
jmp 0x4160c6
mov ecx, dword [esp + 0x14]
call fcn.0040aa9f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.004160e0
cmp eax, ebx
je 0x4218f4
cmp word [esi], 0x30
mov edx, esi
mov dword [esp + 0x28], edx
jne 0x4215ae
movzx ecx, word [esi + 2]
mov eax, edx
cmp ecx, 0x78
je 0x4215a7
cmp ecx, 0x58
jne 0x4215ae
lea edx, [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4215b7
sub ecx, dword [esp + 0x1c]
sar ecx, 1
cmp ecx, 8
ja 0x421813
xor eax, eax
mov dword [esp + 0x30], eax
movzx eax, word [edx]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x421813
mov ecx, dword [esp + 0x1c]
test cx, cx
je 0x42165f
mov edx, dword [esp + 0x30]
lea eax, [ecx - 0x30]
shl edx, 4
cmp ax, 9
ja 0x42161e
add edx, 0xffffffd0
jmp 0x42162f
lea eax, [ecx - 0x61]
cmp ax, word [esp + 0x64]
ja 0x421813
add edx, 0xffffffa9
movzx eax, cx
add edx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], edx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x421600
cmp dword [esp + 0x30], 0
je 0x421813
or dword [esp + 0xc], 4
mov byte [esp + 0x21], bl
jmp 0x4160c6
or dword [esp + 0xc], 0x8000
jmp 0x4160c6
or dword [esp + 0xc], 0x4000
jmp 0x4160c6
mov ecx, dword [esp + 0xc]
and ecx, 0xffffffef
mov byte [esp + 0x1a], bl
or ecx, 0x200
mov dword [esp + 0xc], ecx
jmp 0x4160c6
mov dword [esp + 0x5c], 2
jmp 0x4160c6
lea edx, [esi + 2]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4216c5
sub ecx, dword [esp + 0x1c]
sar ecx, 1
jne 0x421702
mov ecx, dword [esp + 0x14]
call fcn.0040aa9f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.004160e0
cmp eax, ebx
je 0x415f1b
mov edx, esi
mov ecx, edx
call fcn.0040ffb0
push eax
lea ecx, [esp + 0x174]
call fcn.0040a586
mov eax, dword [esp + 0x378]
mov dword [esp + 0x48], eax
test eax, eax
jne 0x421730
lea eax, [esp + 0x170]
mov dword [esp + 0x48], eax
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x421735
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7fe7
jbe 0x4160c6
push dword [esp + 0x48]
jmp 0x421814
mov eax, dword [0x431580]
test eax, eax
je 0x4160c6
mov eax, dword [eax]
mov dword [esp + 0x54], eax
jmp 0x4160c6
push 0x403f50
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42179c
or dword [esp + 0xac], ebx
push 3
pop eax
or word [esp + 0xb0], ax
jmp 0x4160c6
push 0x403f58
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42181f
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0040aa9f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.004160e0
cmp eax, ebx
je 0x4218f4
push 0xa
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x44], eax
test eax, eax
jne 0x4217fa
mov ecx, dword [esp + 0x1c]
cmp word [ecx], ax
jne 0x421813
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0x2c]
jbe 0x4160c6
push esi
push ebx
push 0x2362
jmp 0x4218e7
push 0x403f64
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42183b
or dword [esp + 0xc], 0x20
jmp 0x4160c6
push 0x403f74
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42185a
or dword [esp + 0xc], 0x100
jmp 0x4160c6
push 0x403f88
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421879
or dword [esp + 0xc], 0x800
jmp 0x4160c6
push 0x403f9c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421898
or dword [esp + 0xc], 0x1000
jmp 0x4160c6
push 0x403fac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4218bc
push 0x403fb8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4218f4
mov byte [esp + 0x23], bl
jmp 0x4160c6
sub edx, 2
xor ecx, ecx
mov word [edx], cx
mov edx, 0x2000
push esi
mov ecx, eax
call fcn.0040fb80
push dword [esp + 0x24]
xor ebx, ebx
inc ebx
push ebx
push 0x2375
call fcn.00407834
add esp, 0xc
jmp 0x415f1b
mov eax, dword [esp + 0x24]
mov ecx, 0x403720
sub ecx, eax
mov ebx, 0x2000
mov edx, eax
mov edi, ecx
lea ecx, [ebx + 0x7fffdffe]
test ecx, ecx
je 0x421926
movzx ecx, word [edx + edi]
test cx, cx
je 0x421926
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x421908
mov edi, dword [esp + 0x58]
test ebx, ebx
jne 0x4218c8
jmp 0x4218c5
call fcn.0042984e
xor eax, eax
push eax
push 0x40002397
call fcn.0040630a
cmp byte [0x435745], 0
pop ecx
pop ecx
je 0x42195c
xor eax, eax
push eax
push 0x400023bf
call fcn.0040630a
pop ecx
pop ecx
xor eax, eax
mov byte [0x448047], al
mov dword [0x4484fc], eax
jmp 0x415f1b
lea eax, [esp + 0x388]
mov edx, 0x2000
push eax
mov ecx, edi
call fcn.0040f2e0
jmp 0x415c7d
mov ecx, edi
call fcn.0040ffb0
push eax
push 0x403fbc
push 0x2000
push dword [esp + 0x48]
call fcn.004099ff
add esp, 0x10
jmp 0x415cbb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x435798], eax
mov ecx, edi
call fcn.00425a74
jmp 0x415f1b
push dword [esp + 0x50]
mov edx, 0x2000
mov ecx, edi
call fcn.0040f2e0
mov byte [esp + 0x13], bl
jmp 0x415d2b
mov ecx, 0x4024c0
call fcn.0040eb6e
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x4219fd
push eax
push 0x400023d2
call fcn.00407834
pop ecx
pop ecx
jmp 0x415f1b
push dword [esp + 0x3c]
push 0x403fc8
push 0x2000
push dword [esp + 0x30]
call fcn.004099ff
add esp, 0x10
mov edx, 0x2000
mov ecx, edi
push dword [esp + 0x2c]
call fcn.0040f2e0
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f2e0
push 0x403fd8
push dword [esp + 0x28]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421ae8
mov ecx, dword [esp + 0x34]
xor eax, eax
cmp word [ecx], ax
je 0x421ae8
mov edx, ecx
lea eax, [edx + 2]
mov dword [esp + 0x2c], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x38]
jne 0x421a67
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, eax
sar edx, 1
mov dword [esp + 0x1c], edx
lea edx, [edi + 2]
mov dword [esp + 0x64], edx
mov dx, word [edi]
add edi, 2
cmp dx, word [esp + 0x38]
jne 0x421a8b
mov edx, edi
mov dword [esp + 0x2c], edi
sub edx, dword [esp + 0x64]
mov edi, dword [esp + 0x58]
sar edx, 1
add edx, dword [esp + 0x1c]
cmp edx, 0x2000
jae 0x421ad9
push 0x40233c
mov edx, 0x2000
mov ecx, eax
call fcn.0040fb80
push dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov edx, 0x2000
call fcn.0040fb80
jmp 0x421ae8
push ecx
push ebx
push 0x2363
call fcn.00407834
add esp, 0xc
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov byte [esp + 0x22], bl
jmp 0x415d2b
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415d72
cmp dword [esp + 0x5c], 2
je 0x415dba
cmp dword [esp + 0x30], 0
jne 0x415dba
cmp dword [esp + 0x44], 0xffff
jne 0x415dba
cmp dword [esp + 0x54], 0
jne 0x415dba
call fcn.00417378
test al, al
je 0x415dba
mov byte [esp + 0x13], bl
jmp 0x415eb0
mov dword [0x435798], 0x54f
jmp 0x4219b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x435798], eax
jmp 0x421b85
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x435798], eax
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, edi
call fcn.00425a74
xor ebx, ebx
inc ebx
jmp 0x415f1b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov dword [0x435798], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
jmp 0x421b74
xor ecx, ecx
mov word [esp + 0x14], ax
push ecx
push ecx
push 2
lea eax, [esp + 0x20]
push eax
push 0x20004
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421b94
jmp 0x415e5e
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415ebb
xor eax, eax
lea edi, [esp + 0x164]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x164]
push eax
push dword [esp + 0x78]
call dword [sym.imp.api_ms_win_core_processtopology_l1_1_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x421c0a
mov eax, dword [esp + 0x164]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x44]
cmp ecx, 0xffff
je 0x421c60
xor eax, eax
lea edi, [esp + 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x421c5c
mov eax, dword [esp + 0x158]
and eax, dword [esp + 0x4c]
je 0x421c5c
mov dword [esp + 0x4c], eax
xor eax, eax
push eax
push dword [esp + 0x15c]
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl ebx, cl
jmp 0x421c60
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x4c]
and ebx, eax
je 0x421c6a
mov eax, ebx
push eax
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
mov edi, dword [esp + 0x58]
jmp 0x415ee8
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
jmp 0x415ef3
cmp byte [0x435745], 0
je 0x421c9d
cmp eax, 0xc1
je 0x421ca8
cmp eax, 0x2e4
jne 0x4219b4
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x421cad
sub ecx, edx
push 5
sar ecx, 1
pop eax
cmp ecx, eax
jb 0x421ce5
add ecx, 0xfffffffc
push eax
push 0x404058
lea eax, [edi + ecx*2]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
neg eax
sbb al, al
and al, byte [esp + 0x1b]
jmp 0x421ce9
mov al, byte [esp + 0x1b]
and dword [esp + 0xc], 0xfffffffb
lea ecx, [esp + 0x398]
movzx eax, al
neg eax
sbb eax, eax
and eax, ecx
cmp byte [esp + 0x22], 0
mov ecx, dword [esp + 0x24]
jne 0x421d0d
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x74]
push edx
push eax
push dword [esp + 0x68]
movzx eax, word [esp + 0xc0]
mov edx, edi
push eax
push dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0042b524
test eax, eax
je 0x4219b4
jmp 0x415efd
mov ecx, eax
call fcn.0040813c
mov dword [0x4355cc], eax
jmp 0x415f17