Function at 0x40970a
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate gui resources
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x277c
call fcn.0040d5c0
push ebx
push esi
push edi
call fcn.00403fef
test eax, eax
jne 0x409730
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040ccad
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edi, edi
push edi
push 0x40bdf8
push edi
mov dword [0x4130c4], 0x11223344
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea eax, [esp + 0x28]
call fcn.0040664c
push dword [ebp + 0x10]
mov dword [esp + 0x54], 0x20
push eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x60], edi
call fcn.0040686a
push str.SeDebugPrivilege
call fcn.0040a42b
lea esi, [esp + 0x2c]
mov dword [esp], str._RunAsService
call fcn.00406a11
test eax, eax
jne 0x4097f8
push str.SeTcbPrivilege
call fcn.0040a42b
pop ecx
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x40ff70
mov dword [esp + 0x18], 0x40c044
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
lea esi, [esp + 0x28]
call fcn.0040666e
lea esi, [esp + 0x48]
call fcn.0040af41
lea esi, [esp + 0x28]
call fcn.0040666e
mov eax, edi
jmp 0x409727
push str._SpecialRun
lea esi, [esp + 0x2c]
call fcn.00406a11
cmp eax, edi
jne 0x40987f
cmp dword [esp + 0x58], 3
jne 0x40987f
lea eax, [esp + 0x1738]
call fcn.004044bc
lea eax, [esp + 0x10]
push eax
xor ecx, ecx
push str._I64x
inc ecx
mov eax, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00406a01
push eax
call sub.msvcrt.dll_swscanf
add esp, 0xc
push 2
pop ecx
mov eax, esi
call fcn.00406a01
push eax
call sub.msvcrt.dll__wtoi
pop ecx
push edi
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x1744]
push dword [esp + 0x1c]
push eax
call fcn.00401b99
lea edi, [esp + 0x1738]
mov esi, eax
call fcn.004044e4
mov edi, esi
jmp 0x4097d6
push str._SpecialRunSystem
lea esi, [esp + 0x2c]
call fcn.00406a11
cmp eax, edi
jne 0x409909
cmp dword [esp + 0x58], 3
jne 0x409909
push str.SeTcbPrivilege
call fcn.0040a42b
pop ecx
lea eax, [esp + 0x6e8]
call fcn.004044bc
lea eax, [esp + 0x20]
push eax
xor ecx, ecx
push str._I64x
inc ecx
mov eax, esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00406a01
push eax
call sub.msvcrt.dll_swscanf
add esp, 0xc
push 2
pop ecx
mov eax, esi
call fcn.00406a01
push eax
call sub.msvcrt.dll__wtoi
pop ecx
push 1
push eax
push dword [esp + 0x2c]
lea eax, [esp + 0x6f4]
push dword [esp + 0x2c]
push eax
call fcn.00401b99
lea edi, [esp + 0x6e8]
jmp 0x409871
push str._CallShellExecute
lea esi, [esp + 0x2c]
call fcn.00406a11
cmp eax, edi
jne 0x4099cf
cmp dword [esp + 0x58], 5
jne 0x4099cf
xor ecx, ecx
inc ecx
mov eax, esi
call fcn.00406a01
push 2
mov esi, eax
pop ecx
lea eax, [esp + 0x28]
call fcn.00406a01
push 3
mov ebx, eax
pop ecx
lea eax, [esp + 0x28]
call fcn.00406a01
push 4
mov dword [esp + 0x24], eax
pop ecx
lea eax, [esp + 0x28]
call fcn.00406a01
push eax
call sub.msvcrt.dll__wtoi
pop ecx
push 0x38
mov dword [esp + 0x14], eax
lea eax, [esp + 0x84]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x7c], 0x3c
mov dword [esp + 0x94], eax
mov dword [esp + 0x8c], ebx
cmp word [esi], di
je 0x4099a4
mov dword [esp + 0x88], esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x98], eax
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4097d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4097d6
push str._Run
lea esi, [esp + 0x2c]
call fcn.00406a11
cmp eax, edi
jl 0x409b7f
lea ecx, [eax + 1]
mov eax, esi
call fcn.00406a01
cmp word [eax], di
mov dword [esp + 0x10], eax
je 0x409b05
mov ebx, 0x208
push ebx
lea eax, [esp + 0x4de]
push edi
push eax
mov word [esp + 0x4e4], di
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [esp + 0x4dc]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x4d8]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x409af4
push ebx
lea eax, [esp + 0x2ce]
push edi
push eax
mov word [esp + 0x2d4], di
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [esp + 0xbe]
push edi
push eax
mov word [esp + 0xc4], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x2c8]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
pop ecx
lea eax, [esp + 0x4d8]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, esi
pop ecx
jae 0x409ad5
lea eax, [esp + 0x4d8]
push eax
lea eax, [esp + 0x2cc]
push eax
lea eax, [esp + 0xc0]
call fcn.00405d9b
pop ecx
pop ecx
jmp 0x409add
mov word [esp + 0xb8], di
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x4dc]
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [esp + 0x4d8]
push eax
xor eax, eax
call fcn.00403e75
jmp 0x409b1d
push 0x40f9b4
lea esi, [esp + 0x2c]
call fcn.00406a11
test eax, eax
jge 0x409b1e
push edi
call fcn.00403de0
pop ecx
mov dword [esp + 0x78], edi
mov dword [esp + 0x70], edi
lea eax, [esp + 0x28]
mov dword [esp + 0x74], eax
mov eax, dword [0x4130c8]
xor edi, edi
inc edi
push edi
add eax, 0x10
lea esi, [esp + 0x70]
mov dword [esp + 0x70], 0x40ef34
call fcn.00401799
mov esi, dword [0x4130c8]
lea eax, [esp + 0xf10]
mov dword [esi + 0x4634], edi
call fcn.004044bc
lea eax, [esp + 0xf10]
add esi, 0x10
push eax
call fcn.00402045
lea edi, [esp + 0xf10]
jmp 0x409871
push str._cfg
lea esi, [esp + 0x2c]
call fcn.00406a11
cmp eax, edi
jl 0x409c8a
mov ecx, dword [0x4130c8]
mov esi, 0x104
add ecx, 0x5920
push esi
push ecx
lea ecx, [eax + 1]
lea eax, [esp + 0x30]
call fcn.00406a01
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [0x4130c8]
add eax, 0x5920
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x409c8a
mov ebx, 0x208
push ebx
lea eax, [esp + 0xbe]
push edi
push eax
mov word [esp + 0xc4], di
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [esp + 0x2ce]
push edi
push eax
mov word [esp + 0x2d4], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xb8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [0x4130c8]
add eax, 0x5920
push eax
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
pop ecx
lea eax, [esp + 0xb8]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, esi
pop ecx
jae 0x409c68
push dword [esp + 0x10]
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0x2d0]
call fcn.00405d9b
pop ecx
pop ecx
jmp 0x409c70
mov word [esp + 0x2c8], di
lea eax, [esp + 0x2c8]
push eax
mov eax, dword [0x4130c8]
add eax, 0x5920
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x40f9b4
lea esi, [esp + 0x2c]
call fcn.00406a11
test eax, eax
jge 0x409ca3
push edi
call fcn.00403de0
pop ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x64], eax
mov eax, dword [0x4130c8]
xor ebx, ebx
inc ebx
push ebx
add eax, 0x10
lea esi, [esp + 0x60]
mov dword [esp + 0x60], 0x40ef34
mov dword [esp + 0x6c], edi
mov dword [esp + 0x64], edi
call fcn.00401799
mov esi, dword [0x4130c8]
cmp dword [esi + 0x5b2c], edi
je 0x409d0c
lea eax, [esp + 0x1f60]
call fcn.004044bc
lea eax, [esp + 0x1f60]
mov dword [esi + 0x4634], ebx
add esi, 0x10
push eax
call fcn.00402045
lea edi, [esp + 0x1f60]
jmp 0x409871
push str._savelangfile
lea esi, [esp + 0x2c]
call fcn.00406a11
test eax, eax
jl 0x409d28
call fcn.00407797
jmp 0x4097d6
call fcn.004075f9
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [0x4130c8]
add ebx, 0x10
mov esi, 0x41a9d8
call fcn.00409d7b
mov eax, dword [0x419358]
push edi
mov ecx, 0x419358
call dword [eax + 8]
mov esi, dword [0x4130c8]
add esi, 0x10
mov ebx, 0x41a9d8
call fcn.00409d7b
push 1
call fcn.00403de0
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4097d6