Function at 0x4062b2
Capabilities:
Accept command line arguments
Check os version
Parse pe header
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x27ec
call fcn.0040a180
mov eax, dword [0x40c090]
xor eax, esp
mov dword [esp + 0x27e8], eax
push ebx
push esi
lea eax, [esp + 0xd8]
mov dword [esp + 0xd0], 1
push edi
mov dword [esp + 0xd0], eax
mov edi, ecx
lea eax, [esp + 0xa60]
mov dword [esp + 0xa60], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x406343
push ebx
push 4
lea eax, [esp + 0x5c]
mov byte [0x40cd9a], bl
push eax
push 0x1a
mov byte [0x40cab5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x406343
cmp dword [esp + 0x54], ebx
je 0x406343
mov byte [0x40cab5], 1
mov eax, dword [0x40b070]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x40b880]
mov word [eax], cx
lea eax, [esp + 0x1fc]
mov dword [esp + 0x1f4], 0x104
mov dword [esp + 0x1f0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop ecx
mov dword [esp + 0x1c], esi
cmp word [esi], cx
jne 0x40638e
add esi, 2
mov dword [esp + 0x1c], esi
jmp 0x406390
mov ecx, eax
movzx eax, word [esi]
test ax, ax
je 0x4063b8
cmp ax, cx
je 0x4063a8
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x406398
mov dword [esp + 0x1c], esi
cmp word [esi], bx
je 0x4063b8
add esi, 2
mov dword [esp + 0x1c], esi
push 0xfffffffffffffff5
mov dword [0x40cdac], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40cabc], eax
cmp eax, 0xffffffff
je 0x4063dc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4063e2
mov dword [0x40cabc], ebx
mov edi, 0x800
mov dword [esp + 0x80], ebx
push edi
lea eax, [esp + 0xdec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x17f0]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x60], ebx
mov dword [0x40c914], ebx
push 9
pop ecx
push 0x20
pop edi
movzx eax, word [esi]
cmp ax, di
je 0x40642f
cmp ax, cx
jne 0x406434
add esi, 2
jmp 0x406422
movzx eax, word [esi]
push 0x2d
pop ecx
push 0x2f
pop edx
mov dword [esp + 0x1c], esi
cmp ax, dx
je 0x40644f
cmp ax, cx
jne 0x406588
lea eax, [esi + 2]
test eax, eax
je 0x406588
mov ax, word [eax]
or ax, di
cmp ax, 0x60
jne 0x406588
add esi, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
call fcn.00405dd4
lea eax, [esp + 0xde8]
push 0x400
lea edx, [esp + 0x30]
mov dword [esp + 0x30], eax
call fcn.00405fc0
pop ecx
test al, al
je 0x406da2
mov eax, dword [esp + 0x1f4]
mov edx, 0x401748
add eax, eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push ecx
call fcn.00402dfb
add esp, 0xc
test eax, eax
jne 0x406e75
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x58]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x406544
mov eax, dword [esp + 0x4c]
push ecx
shr eax, 1
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408455
test al, al
jne 0x40651e
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4065b7
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x58]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x406e75
cmp dword [esp + 0x50], 1
jne 0x406e75
mov esi, dword [esp + 0x1f0]
push 0x20
pop edx
push 9
pop edi
movzx eax, word [esi]
mov dword [esp + 0x10], esi
cmp ax, dx
je 0x406583
cmp ax, di
jne 0x4069b4
add esi, 2
jmp 0x40656e
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
mov ecx, esi
call fcn.00402d3e
test eax, eax
js 0x406951
mov eax, dword [esp + 0x24]
push ecx
inc eax
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408455
test al, al
jne 0x4065bf
push 0xe
pop ebx
jmp 0x406e75
mov eax, dword [esp + 0x1f0]
lea edi, [esp + 0xc2c]
xor ecx, ecx
mov dword [esp + 0xb90], 0x4017d0
mov esi, 0x401944
mov dword [esp + 0xb94], ebx
push 8
mov word [eax], cx
mov edx, 0x4017f4
mov eax, dword [0x401934]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc18], eax
mov ax, word [0x401938]
mov word [esp + 0xc1c], ax
mov eax, dword [0x40193c]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc10], eax
mov ax, word [0x401940]
pop ecx
movsd dword es:[edi], dword [esi]
mov word [esp + 0xc10], ax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0xb9c], bl
movsw word es:[edi], word [esi]
mov esi, 0x401954
mov dword [esp + 0xba0], 0x4017e0
lea edi, [esp + 0xc40]
mov dword [esp + 0xba4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov byte [esp + 0xba8], bl
mov dword [esp + 0xbac], edx
mov dword [esp + 0xbb0], 0x401804
mov byte [esp + 0xbb4], 1
mov dword [esp + 0xbb8], 0x40180c
mov dword [esp + 0xbbc], 0x401818
mov byte [esp + 0xbc0], 1
mov dword [esp + 0xbc4], 0x401820
mov dword [esp + 0xbc8], 0x40182c
mov byte [esp + 0xbcc], 1
mov dword [esp + 0xbd0], 0x401834
mov dword [esp + 0xbd4], 0x401844
mov byte [esp + 0xbd8], 1
mov dword [esp + 0xbdc], 0x401870
mov dword [esp + 0xbe0], 0x401884
mov byte [esp + 0xbe4], 1
mov dword [esp + 0xbe8], 0x4018b0
mov dword [esp + 0xbec], 0x4018cc
mov byte [esp + 0xbf0], 1
mov dword [esp + 0xbf4], 0x4018e8
mov dword [esp + 0xbf8], 0x401904
mov byte [esp + 0xbfc], 1
mov dword [esp + 0xc00], 0x401924
mov dword [esp + 0xc04], 0x40192c
mov byte [esp + 0xc08], 1
mov dword [esp + 0x34], ebx
call fcn.00402d3e
test eax, eax
js 0x406951
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
jmp 0x4067e3
movzx eax, word [edi]
test ax, ax
je 0x4067fa
push 0x2d
pop ecx
cmp ax, cx
je 0x406786
push 0x2f
pop ecx
cmp ax, cx
jne 0x4067e3
mov eax, dword [esp + 0x38]
lea ecx, [eax - 1]
mov dword [esp + 0x54], ecx
cmp ecx, 1
jne 0x4067bc
push 0xffffffffffffffff
push 0x401974
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406833
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x54]
cmp dword [esp + 0x30], ecx
jne 0x4067e3
push dword [esp + 0x30]
dec eax
push 0x4017f4
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406833
lea edx, [esp + 0x38]
lea ecx, [esp + 0x34]
call fcn.004040c2
mov edi, eax
test edi, edi
jne 0x40676a
lea eax, [esp + 0xc0c]
mov byte [esp + 0xb98], 1
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc14]
mov byte [esp + 0xba4], 1
mov dword [esp + 0xba0], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
jmp 0x40691f
lea eax, [esp + 0xc2c]
mov byte [esp + 0xb98], bl
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc3c]
mov byte [esp + 0xba4], bl
jmp 0x40681f
movzx eax, word [esi]
test ax, ax
je 0x406936
push 0x2d
pop ecx
cmp ax, cx
je 0x406874
push 0x2f
pop ecx
cmp ax, cx
jne 0x4068bd
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xb90]
dec ecx
mov dword [esp + 0x58], eax
mov edi, ebx
mov dword [esp + 0x54], ecx
lea edx, [esi + 2]
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x4068d2
mov eax, dword [esp + 0x58]
lea edx, [esi + 2]
mov ecx, dword [esp + 0x54]
inc edi
add eax, 0xc
mov dword [esp + 0x58], eax
cmp edi, 0xa
jb 0x40688d
push 1
push dword [esp + 0x3c]
mov dword [esp + 0x200], 0x104
mov edx, esi
jmp 0x40690d
imul esi, edi, 0xc
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x1fc], 0x104
mov dword [esp + 0x48], ebx
mov ecx, dword [esp + esi + 0xb98]
call fcn.00402d3e
test eax, eax
js 0x40695b
movzx eax, byte [esp + esi + 0xb98]
mov edx, dword [esp + esi + 0xb94]
push eax
push dword [esp + 0x48]
lea ecx, [esp + 0x1f8]
call fcn.004041c2
pop ecx
pop ecx
test eax, eax
jne 0x406960
lea edx, [esp + 0x38]
lea ecx, [esp + 0x34]
call fcn.004040c2
mov esi, eax
test esi, esi
jne 0x406858
mov esi, dword [esp + 0x1f0]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.00402d3e
test eax, eax
jns 0x406967
mov ebx, 0x65b
jmp 0x406e75
mov eax, 0x65b
mov ebx, eax
jmp 0x406e75
mov eax, dword [esp + 0x24]
push 0x20
pop edx
push 9
pop edi
test eax, eax
je 0x4069a8
dec eax
lea eax, [esi + eax*2]
movzx ecx, word [eax]
cmp cx, dx
je 0x406986
cmp cx, di
jne 0x4069a8
cmp eax, esi
jb 0x4069a8
xor ecx, ecx
mov word [eax], cx
sub eax, 2
mov esi, dword [esp + 0x1f0]
jmp 0x406979
cmp ax, dx
je 0x4069a5
cmp ax, di
jne 0x4069b4
add esi, 2
movzx eax, word [esi]
mov dword [esp + 0x10], esi
test ax, ax
jne 0x40699b
mov edi, dword [0x40c870]
mov dword [esp + 0x20], ebx
test ax, ax
je 0x406db1
mov dword [esp + 0x54], 0x71
push 0x2f
pop ecx
cmp ax, cx
je 0x406a89
push 0x2d
pop ecx
cmp ax, cx
je 0x406a89
push 0x208
lea eax, [esp + 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x854]
mov edi, 0x104
mov dword [esp + 0x848], eax
lea edx, [esp + 0x848]
mov dword [esp + 0x84c], edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x850], edi
call fcn.00405ffa
test eax, eax
je 0x406d60
mov esi, dword [esp + 0x848]
test esi, esi
je 0x406a4f
mov ecx, esi
call fcn.004045f5
mov esi, dword [esp + 0x848]
lea ecx, [esp + 0x10]
call fcn.00405dd4
movzx eax, ax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x84c], edi
jle 0x406a7e
test esi, esi
je 0x406a7e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [0x40c870]
jmp 0x406d4b
mov edi, dword [0x40c870]
jmp 0x406d4f
add esi, 2
mov dword [esp + 0x10], esi
movzx eax, word [esi]
mov ecx, eax
or ecx, edx
xor edx, edx
cmp dx, ax
je 0x406aa5
add esi, 2
mov dword [esp + 0x10], esi
push 0x52
mov edx, 0x402590
pop eax
movzx eax, ax
or eax, 0x20
cmp eax, ecx
je 0x406ac2
add edx, 2
movzx eax, word [edx]
test ax, ax
jne 0x406aad
movzx eax, word [edx]
mov dword [esp + 0x44], edx
test ax, ax
je 0x406ce7
movzx eax, word [esi]
push 0x20
pop ecx
cmp ax, cx
je 0x406af2
test ax, ax
je 0x406af2
push 9
pop ecx
mov dword [esp + 0x34], 1
cmp ax, cx
jne 0x406af6
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x10]
call fcn.00405dd4
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xde8]
push 0x63
mov dword [esp + 0x30], eax
pop ecx
movzx eax, word [esi]
cmp ax, cx
mov ecx, dword [esp + 0x34]
jne 0x406b25
test ecx, ecx
jne 0x406ce7
push 0x50
pop edx
cmp ax, dx
jne 0x406b80
push ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
lea ecx, [esp + 0xd4]
push eax
call fcn.00408577
test al, al
je 0x406d9a
mov eax, dword [esp + 0xd0]
lea edx, [esp + 0x64]
push dword [esp + 0xd4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x68], eax
call fcn.00405fc0
pop ecx
test al, al
je 0x406da2
mov edi, dword [0x40c870]
jmp 0x406baf
push 0x71
pop edx
cmp ax, dx
je 0x406b90
push 0x63
pop edx
cmp ax, dx
jne 0x406b94
test ecx, ecx
je 0x406baf
push 0x400
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
call fcn.00405fc0
pop ecx
test al, al
je 0x406da2
lea ecx, [esp + 0x10]
call fcn.00405dd4
movzx eax, ax
push 0x46
mov dword [esp + 0x20], eax
movzx eax, word [esi]
pop ecx
cmp ax, cx
je 0x406bee
push 0x71
pop ecx
cmp ax, cx
je 0x406bee
cmp eax, 0x4a
je 0x406bee
lea ecx, [esp + 0x17f0]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0xde8]
cmp eax, 0x6c
jne 0x406c55
lea ecx, [esp + 0x17f0]
lea edx, [esp + 0xde8]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x34], ebx
je 0x406c55
mov dword [esp + 0x2c], ecx
mov ecx, edx
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x64], edx
cmp ax, word [esp + 0x54]
je 0x406c55
push 0x400
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
call fcn.00405fc0
pop ecx
test al, al
je 0x406da2
lea ecx, [esp + 0x10]
call fcn.00405dd4
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [esi]
cmp eax, 0x61
jb 0x406c8e
cmp eax, 0x7a
ja 0x406c8e
sub esi, 0x402590
sar esi, 1
push edx
push ecx
mov esi, dword [esi*4 + 0x401010]
mov ecx, esi
call dword [0x40d214]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x406ce7
mov edi, dword [0x40c870]
jmp 0x406d39
push 0x50
pop ecx
test edi, edi
je 0x406cfa
push 0x41
cmp ax, cx
pop ecx
jne 0x406cd1
cmp word [edi], cx
jne 0x406cd1
lea edx, [esp + 0x1ff0]
call fcn.004052c8
test eax, eax
jne 0x406ce7
push 0x1e
push dword [esp + 0x28]
mov edi, esi
lea ecx, [esp + 0xc64]
push 0x1e
pop edx
mov dword [0x40c870], edi
call fcn.00402bd9
jmp 0x406d39
push 0x50
pop esi
cmp word [edi], si
jne 0x406ce7
cmp ax, cx
jne 0x406ce7
call fcn.004052c8
test eax, eax
je 0x406d39
call fcn.00404269
mov esi, 0x667
mov dword [esp + 0x20], esi
jmp 0x406ed9
mov edi, esi
mov dword [0x40c870], edi
cmp ax, cx
je 0x406d1c
mov eax, 0x400
lea ecx, [esp + 0x1ff0]
push eax
push edx
mov edx, eax
call fcn.00402bd9
push 0x1e
push dword [esp + 0x28]
lea ecx, [esp + 0xc64]
push 0x1e
pop edx
call fcn.00402bd9
push 0x45
pop eax
cmp word [esi], ax
je 0x406db1
xor eax, eax
mov word [esp + 0xde8], ax
mov word [esp + 0x17f0], ax
mov eax, dword [esp + 0x1c]
test ax, ax
je 0x406db1
mov esi, dword [esp + 0x10]
push 0x20
pop edx
jmp 0x4069cf
call fcn.00404269
mov esi, 0x667
mov dword [esp + 0x20], esi
cmp dword [esp + 0x84c], edi
jle 0x406ed9
cmp dword [esp + 0x848], ebx
je 0x406ed9
push dword [esp + 0x848]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406ed9
push 0xe
pop esi
jmp 0x406cf1
call fcn.00404269
mov ebx, 0x667
jmp 0x406e75
test edi, edi
je 0x406ed7
movzx eax, word [edi]
push 0x59
pop edx
push 0x5a
pop ecx
push 0x45
pop esi
cmp si, ax
je 0x406ddf
cmp dx, ax
je 0x406ddf
cmp cx, ax
je 0x406ddf
call fcn.00406252
mov edi, dword [0x40c870]
push 0x50
pop eax
cmp word [edi], ax
mov eax, dword [esp + 0xd0]
je 0x406df5
lea eax, [esp + 0x1ff0]
sub edi, 0x402590
sar edi, 1
push eax
lea eax, [esp + 0xc60]
push eax
mov esi, dword [edi*4 + 0x401010]
mov ecx, esi
call dword [0x40d214]
call esi
pop ecx
pop ecx
mov ecx, dword [0x40c870]
mov esi, eax
push 0x59
mov dword [esp + 0x24], esi
movzx eax, word [ecx]
pop ecx
cmp ax, cx
je 0x406ed3
push 0x5a
pop ecx
cmp ax, cx
je 0x406ed3
test esi, esi
jne 0x406e67
push 0x45
pop edx
cmp ax, dx
jne 0x406e56
mov dword [0x40c914], 1
xor ecx, ecx
cmp ax, dx
setne cl
mov dword [esp + 0x60], ecx
jmp 0x406f06
cmp esi, 0x8000
jne 0x406e7c
mov dword [0x40c914], ebx
mov edi, ebx
jmp 0x407b61
mov eax, 0x4eb
cmp esi, eax
jg 0x406eaa
je 0x406efc
cmp esi, 0xfffffffe
jl 0x406eca
test esi, esi
js 0x406efe
cmp esi, 1
jle 0x406eca
cmp esi, 3
jle 0x406e9f
cmp esi, 0x7b
jne 0x406eca
mov esi, 0x653
mov dword [esp + 0x20], esi
jmp 0x406eca
cmp esi, 0x642
jl 0x406eca
cmp esi, 0x644
jle 0x406efc
cmp esi, 0x669
je 0x406efc
cmp esi, 0xbc2
je 0x406efc
mov ecx, esi
call fcn.00405b6d
jmp 0x406efc
mov ebx, esi
jmp 0x406e75
mov esi, ebx
call fcn.00406252
test esi, esi
jne 0x407b5d
cmp dword [0x40c870], ebx
jne 0x406f0a
call fcn.00404269
mov esi, 0x667
mov dword [esp + 0x20], esi
test esi, esi
jne 0x407b5d
mov ecx, ebx
test ecx, ecx
jne 0x406f16
cmp dword [0x40c914], ebx
je 0x407b5d
push ebx
cmp dword [0x40c914], ebx
je 0x406f32
mov esi, dword [0x40b01c]
mov ecx, esi
push ebx
call dword [0x40d214]
call esi
jmp 0x406f42
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x401980
call fcn.00408f86
cmp dword [esp + 0x60], ebx
je 0x406f8f
cmp dword [0x40c914], ebx
jne 0x406f9b
mov esi, 0x402500
mov edi, ebx
lea eax, [edi + 0x40c6ac]
push eax
push 1
push 4
lea eax, [edi + 0x40b064]
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x406f84
add esi, 0x10
add edi, 4
cmp esi, 0x402510
jl 0x406f57
jmp 0x406f8f
mov dword [esp + 0x80], 1
cmp dword [0x40c914], ebx
je 0x407b1a
mov eax, dword fs:[0x30]
lea edi, [esp + 0xc1c]
mov esi, dword [esp + 0x10]
mov ecx, ebx
push 0x30
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
movzx edx, word [esi]
mov dword [esp + 0x30], ecx
cmp dx, di
jb 0x406fe2
cmp edx, 0x39
ja 0x406fe2
and cl, 1
mov eax, edx
movzx ecx, cl
neg ecx
sbb ecx, ecx
sub eax, edi
jmp 0x406fff
push 0x41
pop eax
cmp dx, ax
jb 0x40703c
push 0x46
pop eax
cmp dx, ax
ja 0x40703c
and cl, 1
lea eax, [edx - 0x37]
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff1
add ecx, 0x10
push 0x20
imul ecx, eax
mov eax, dword [esp + 0x34]
pop edx
cmp eax, edx
jge 0x40702f
mov eax, eax
test eax, eax
jns 0x40701c
add eax, 1
sar eax, 1
or byte [esp + eax + 0xc1c], cl
mov ecx, dword [esp + 0x30]
inc ecx
add esi, 2
jmp 0x406fc1
push 0x57
pop edx
mov ecx, 0x4019a0
jmp 0x407b0b
push 0x20
pop eax
cmp ecx, eax
je 0x407050
push 0x57
pop edx
mov ecx, 0x4019e8
jmp 0x407b0b
mov byte [esp + 0x50], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x30], bl
cmp word [esi], bx
je 0x40706c
add esi, 2
movzx eax, word [esi]
cmp eax, 0x43
jne 0x4070bc
mov byte [esp + 0x50], 1
or dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40714b
or dword [esp + 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x40714b
mov ecx, 0x401b20
jmp 0x407b09
cmp eax, 0x55
jne 0x4070cd
mov byte [esp + 0x50], 1
mov byte [esp + 0x2b], 1
jmp 0x407079
push 0x41
pop ecx
cmp ax, cx
jne 0x4070dc
mov byte [esp + 0x30], 1
jmp 0x407079
cmp eax, 0x4d
je 0x4070f8
push 0x52
pop edx
cmp ax, dx
je 0x4070fd
push 0x45
pop ecx
cmp ax, cx
jne 0x407079
cmp ax, dx
jne 0x407102
jmp 0x4070fd
mov byte [esp + 0x17], 1
mov byte [esp + 0x2c], 1
lea eax, [esi + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x407afe
cmp esi, 0xffffffff
je 0x407afe
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x407079
mov edx, edi
mov ecx, 0x401ab0
jmp 0x407b0b
cmp byte [esp + 0x17], bl
jne 0x407157
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x17], bl
je 0x407179
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0x10], eax
lea eax, [esp + 0x88]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407238
lea ecx, [esp + 0x68]
call fcn.00402fb3
test eax, eax
jne 0x407229
lea eax, [esp + 0x94]
push eax
push 0x50
pop eax
push eax
lea eax, [esp + 0xca0]
push eax
push 1
push dword [esp + 0x98]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x407229
push dword [esp + 0x68]
push dword [esp + 0xc9c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40721a
xor eax, eax
cmp byte [0x40cd9a], bl
je 0x40720a
cmp byte [esp + 0x2c], al
sete al
lea eax, [eax*2 + 3]
jmp 0x407225
cmp byte [esp + 0x2c], al
sete al
lea eax, [eax*2 + 2]
jmp 0x407225
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0x10], eax
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407271
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [esp + 0x15ec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x15e8]
push esi
push 0x401b70
push 0x104
push eax
call fcn.00402cd7
add esp, 0x10
mov eax, dword [esp + 0x10]
cmp byte [esp + 0x2b], bl
je 0x407296
cmp eax, 1
jne 0x40728b
push 9
pop edx
mov eax, edx
mov dword [esp + 0x10], eax
jmp 0x407299
test eax, eax
jne 0x4072a7
push 8
pop eax
mov dword [esp + 0x10], eax
push 9
pop edx
cmp byte [esp + 0x30], bl
je 0x4072cf
test eax, eax
jne 0x4072b4
push 6
jmp 0x4072bb
push 0x57
pop edx
mov ecx, 0x401bb0
jmp 0x407b0b
cmp eax, 1
jne 0x4072c2
push 7
pop eax
mov dword [esp + 0x10], eax
jmp 0x4072d3
push 0x57
pop edx
mov ecx, 0x401c78
jmp 0x407b0b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x8c], 0x100
push 3
pop ecx
test eax, eax
je 0x4072fd
cmp eax, 1
je 0x4072fd
cmp eax, 6
je 0x4072fd
cmp eax, 7
je 0x4072fd
cmp eax, 8
je 0x4072fd
cmp eax, edx
jne 0x407300
push 2
pop ecx
push ecx
push ecx
lea edx, [esp + 0x94]
lea ecx, [esp + 0xcf0]
call fcn.0040306c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40733f
cmp dword [esp + 0x18], 0xffffffff
je 0x40732e
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x401d50
call fcn.004058ab
jmp 0x407b61
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0xe0]
push eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x88], eax
call fcn.00408410
push dword [esp + 0x74]
lea ecx, [esp + 0x40c]
call fcn.00408410
push dword [esp + 0x70]
lea ecx, [esp + 0x73c]
call fcn.00408410
push dword [esp + 0x6c]
lea ecx, [esp + 0x62c]
call fcn.00408410
push dword [esp + 0x84]
lea ecx, [esp + 0x51c]
call fcn.00408410
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x51c]
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x634]
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x74c]
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x424]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x104]
lea eax, [esp + 0xd10]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x407434
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x18], 0xffffffff
mov edi, eax
je 0x407423
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x401da0
call fcn.004058ab
jmp 0x407944
mov esi, dword [0x40b020]
or edi, 0xffffffff
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push edi
push dword [esp + 0x100]
mov ecx, esi
call dword [0x40d214]
call esi
mov esi, eax
test esi, esi
je 0x40747a
cmp dword [esp + 0x18], edi
je 0x40746e
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov ecx, 0x401de8
jmp 0x40793a
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x4c], eax
test eax, eax
jne 0x4074ad
cmp dword [esp + 0x18], edi
je 0x40749d
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401e48
jmp 0x407938
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x4074df
cmp dword [esp + 0x18], edi
je 0x4074cf
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401eb8
jmp 0x407938
mov dword [esp + 0x40], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x48], ebx
call fcn.0040615c
mov esi, eax
test esi, esi
jne 0x40751c
cmp dword [esp + 0x18], edi
je 0x407506
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x641
mov ecx, 0x401f40
mov edx, edi
call fcn.004058ab
jmp 0x407785
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], ebx
call fcn.00403cdc
mov ecx, eax
mov edi, 0x641
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], edi
test ecx, ecx
jne 0x407557
cmp dword [esp + 0x18], 0xffffffff
je 0x40754d
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x401fa0
jmp 0x40776e
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407573
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d214]
call edi
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov edi, dword [ecx]
push eax
push 0x402538
push ecx
mov ecx, dword [edi]
call dword [0x40d214]
call dword [edi]
mov ecx, dword [esp + 0x44]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x40d214]
call edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4075c2
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d214]
call edi
lea eax, [esp + 0x78]
mov dword [esp + 0x48], ebx
mov edi, dword [esi]
push eax
lea eax, [esp + 0x4c]
push eax
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0xc2c]
push 0x10
push eax
lea eax, [esp + 0x74]
push eax
push esi
call dword [0x40d214]
call dword [edi + 0x38]
test eax, eax
je 0x407616
cmp dword [esp + 0x18], 0xffffffff
je 0x40760c
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x402010
jmp 0x40776a
push dword [esp + 0x58]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x68], eax
test eax, eax
jne 0x40765a
cmp dword [esp + 0x18], 0xffffffff
je 0x40763f
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x402080
call fcn.004058ab
mov edi, dword [esp + 0x3c]
jmp 0x407775
push dword [esp + 0x48]
mov edi, dword [0x40b028]
mov ecx, edi
call dword [0x40d214]
call edi
test eax, eax
jne 0x40768d
cmp dword [esp + 0x18], 0xffffffff
je 0x407683
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x4020f0
jmp 0x40776a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x40]
push ecx
push 0x4025d0
push eax
mov edi, dword [eax]
mov ecx, dword [edi]
call dword [0x40d214]
call dword [edi]
mov eax, dword [esp + 0x10]
mov ecx, ebx
cmp eax, dword [esp + 0x5c]
jne 0x4076c0
cmp eax, 8
je 0x4076c0
push 9
pop edi
cmp eax, edi
jne 0x4076c4
lea ecx, [esp + 0x5c]
mov eax, dword [esp + 0x40]
lea edx, [esp + 0xc1c]
push edx
push ecx
push eax
mov edi, dword [eax]
mov edi, dword [edi + 0xa0]
mov ecx, edi
call dword [0x40d214]
call edi
mov eax, dword [esp + 0x40]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xa8]
mov ecx, edi
call dword [0x40d214]
call edi
mov eax, dword [esp + 0x40]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xac]
mov ecx, edi
call dword [0x40d214]
call edi
push dword [esp + 0x18]
mov eax, dword [esp + 0x44]
push dword [esp + 0x7c]
push dword [esp + 0x34]
mov edi, dword [eax]
push dword [esp + 0x3c]
push dword [esp + 0x60]
mov edi, dword [edi + 0xa4]
mov ecx, edi
push dword [esp + 0x6c]
push eax
call dword [0x40d214]
call edi
cmp dword [esp + 0x18], 0xffffffff
mov edi, eax
je 0x407761
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x18], 0xffffffff
test edi, edi
je 0x4077be
mov ecx, 0x402158
mov edi, dword [esp + 0x3c]
mov edx, edi
call fcn.004058ab
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d214]
call esi
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40779d
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d214]
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407944
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d214]
call esi
jmp 0x407944
mov eax, dword [esp + 0x40]
push dword [esp + 0x48]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x9c]
mov ecx, edi
call dword [0x40d214]
call edi
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d214]
call esi
mov eax, dword [esp + 0x48]
test eax, eax
je 0x407801
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d214]
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407819
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d214]
call esi
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x17], bl
mov dword [esp + 0xb84], edi
mov dword [esp + 0xb88], esi
mov dword [esp + 0xb8c], eax
jmp 0x4078ef
cmp eax, 1
je 0x4079f6
cmp eax, 2
jne 0x40789b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x7c]
mov dword [esp + 0x7c], ebx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
mov ecx, esi
call dword [0x40d214]
call esi
push dword [esp + 0x7c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40791c
mov dword [esp + 0xb84], edi
jmp 0x4078ef
cmp eax, 3
jne 0x407a00
jmp 0x4078cc
cmp dword [esp + 0x9c], 0x12
je 0x407914
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4078a6
mov al, byte [esp + 0x17]
test al, al
jne 0x407a00
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb90]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x407843
jmp 0x407a00
mov al, 1
mov byte [esp + 0x17], al
jmp 0x4078e7
cmp dword [esp + 0x18], 0xffffffff
je 0x40792d
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x402080
mov edx, eax
call fcn.004058ab
mov edi, 0x641
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407969
cmp dword [esp + 0x518], 0
je 0x407969
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407989
cmp dword [esp + 0x628], 0
je 0x407989
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x4079a9
cmp dword [esp + 0x738], 0
je 0x4079a9
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x4079c9
cmp dword [esp + 0x408], 0
je 0x4079c9
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407b61
cmp dword [esp + 0xe0], 0
je 0x407b61
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x407b61
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d214]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407a40
cmp dword [esp + 0x518], 0
je 0x407a40
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407a60
cmp dword [esp + 0x628], 0
je 0x407a60
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x407a80
cmp dword [esp + 0x738], 0
je 0x407a80
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x407aa0
cmp dword [esp + 0x408], 0
je 0x407aa0
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407ac0
cmp dword [esp + 0xe0], 0
je 0x407ac0
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x60], 0
je 0x407ae0
cmp dword [0x40c914], 0
jne 0x407ae0
mov eax, dword [0x40c6ac]
test eax, eax
je 0x407ae0
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x80], 0
je 0x407b5d
mov edi, 0x641
mov ecx, edi
call fcn.00405b6d
jmp 0x407b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401a48
mov edx, eax
call fcn.004058ab
mov ebx, 0x641
jmp 0x406e75
push ebx
push ebx
push ebx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x407b3f
cmp dword [0x40cb80], ebx
je 0x407ac0
cmp dword [0x40c910], ebx
je 0x407ac0
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x407b1a
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
call fcn.004084a2
lea ecx, [esp + 0xd0]
call fcn.004085c1
mov ecx, dword [esp + 0x27f4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409510
mov esp, ebp
pop ebp
ret