Function at 0x4078e0
Capabilities:
Access peb ldr_data
Check mutex on windows
Create pipe
Create process on windows
Create process suspended
Get common file path
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x29c
mov eax, dword [eax + 8]
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x26c], ecx
add eax, 0x18
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebp - 0x274], eax
call eax
mov ebx, dword [esi + 0x68]
sub esp, 4
test ebx, ebx
je 0x40794f
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0x102
je 0x4085c0
mov dword [esi + 0x68], 0
sub dword [ebx + 0x10], 1
mov dword [esp], ebx
call fcn.00406b30
mov dword [esi + 0x70], 0
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call edi
mov ebx, eax
sub esp, 0xc
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x268], eax
call eax
mov dword [ebp - 0x260], eax
sub esp, 0xc
test eax, eax
je 0x408547
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call edi
mov eax, dword [esi + 0x78]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x25c], ecx
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test eax, eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x264], ecx
je 0x4079f5
mov ebx, eax
and ebx, 3
je 0x4080a0
sub eax, 1
cmp eax, 1
jbe 0x407d20
mov dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 4
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x240]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x25c]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [0x41d0d8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x407a64
cmp dword [ebp - 0x220], 4
je 0x408308
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x41d090
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [0x41d0d8]
mov edi, dword fs:[0x18]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [0x41d090]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipe_netNtControlPipe_u
mov dword [esp + 4], 0x27
mov dword [esp], 0x41d040
call fcn.00405be0
add dword [0x41d090], 1
mov dword [esp + 8], 0x28
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x268]
call eax
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4085e0
mov dword [eax + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [ebx + 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x4085b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebx + 0x24], eax
sub esp, 0x10
test eax, eax
je 0x40825c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x2710
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], 0x41d040
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [ebx + 0x20], eax
sub esp, 0x20
cmp eax, 0xffffffff
je 0x40873d
lea edx, [ebp - 0x21c]
mov ecx, 0x10
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x220], 0x44
test byte [esi + 0x35], 1
jne 0x407be1
mov dword [ebp - 0x218], str.__wineservice_winstationDefault
mov eax, dword [0x41d0dc]
test eax, eax
je 0x408750
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [esi + 8]
sub esp, 4
lea edx, [eax + 8]
mov dword [ebx + 8], eax
mov dword [ebx], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 4], edx
mov dword [edx], ebx
mov dword [eax + 0xc], ebx
lock add dword [ebx + 0xc], 1
mov edi, dword fs:[0x18]
mov eax, dword [ebp - 0x26c]
mov dword [esi + 0x68], ebx
mov dword [eax], 0
mov dword [esi + 0x6c], 0
add dword [ebx + 0x10], 1
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x240]
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x25c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov eax, dword [0x41d0dc]
mov dword [esp + 0x14], 0x408
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x260]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [ebp - 0x260]
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
sub esp, 0xc
test esi, esi
je 0x408657
mov eax, dword [ebp - 0x238]
xor edi, edi
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x240]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x270]
sub esp, 4
mov dword [eax], ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x104
mov edi, dword [ebp - 0x25c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp - 0x260]
sub esp, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
sub esp, 0xc
cmp word [ebp - 0x220], 0
je 0x4087db
mov eax, edi
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x407d80
mov ecx, dword [ebp - 0x25c]
sub eax, ecx
add eax, 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x268]
call eax
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x408568
mov ecx, dword [ebp - 0x25c]
xor eax, eax
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x407dd0
cmp word [ebx], 0
mov edx, ebx
je 0x407df9
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x407df0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.winedevice.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x407e00
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x44]
mov ecx, eax
test edi, edi
je 0x408672
mov edi, dword [eax + 0x10]
lea edx, [eax + 0x10]
cmp edi, edx
je 0x407f97
lea esi, [esi]
mov ecx, dword [edi + 0x18]
lea edx, [ecx - 2]
and edx, 0xfffffffd
jne 0x407f88
mov edx, dword [edi + 0x68]
test edx, edx
je 0x407f88
mov ecx, dword [edi + 0x78]
test ecx, ecx
jne 0x407f88
mov edx, dword [edi + 0x40]
test edx, edx
je 0x407f88
mov dword [esp + 4], ebx
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x407f80
mov eax, dword [edi + 0x44]
test eax, eax
je 0x407f80
mov edx, dword [esi + 0x44]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x407f80
mov edx, dword [edi + 0x68]
test edx, edx
je 0x40866f
lock add dword [edx + 0xc], 1
mov eax, dword fs:[0x18]
mov dword [ebp - 0x25c], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
sub esp, 0xc
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov ebx, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x25c]
sub esp, 4
lock add dword [edx + 0xc], 1
mov eax, dword [ebp - 0x26c]
mov dword [esi + 0x68], edx
mov dword [eax], 1
mov dword [esi + 0x6c], 1
add dword [edx + 0x10], 1
mov eax, dword [esi + 8]
mov dword [ebp - 0x25c], edx
add eax, 0x18
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp + 4], 0x7530
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x25c]
sub esp, 8
test eax, eax
mov edi, eax
jne 0x408716
mov eax, dword [ebp - 0x270]
mov dword [eax], edx
jmp 0x407d16
mov eax, dword [esi + 8]
lea esi, [esi]
nop
mov edi, dword [edi]
lea edx, [eax + 0x10]
mov ecx, eax
cmp edi, edx
jne 0x407e38
mov dword [ebp - 0x260], ecx
mov edi, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x268], ebx
mov ebx, edx
lea esi, [esi]
mov eax, dword [0x41d0d0]
add eax, 1
mov dword [0x41d0d0], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Winedevice_u
mov dword [esp + 4], 0x17
mov dword [esp], 0x41d0a0
call fcn.00405be0
mov eax, dword [ebp - 0x260]
mov esi, dword [eax + 0x10]
cmp ebx, esi
je 0x408728
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esi + 0x10]
mov dword [esp], 0x41d0a0
mov dword [esp + 4], eax
call edi
test eax, eax
je 0x407fb8
mov esi, dword [esi]
cmp ebx, esi
jne 0x408000
mov edx, ebx
mov ecx, dword [ebp - 0x260]
mov esi, dword [ebp - 0x278]
mov ebx, dword [ebp - 0x268]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x260], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x41d0a0
call fcn.00406150
mov edi, eax
test eax, eax
je 0x408330
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
mov eax, dword [esi + 8]
sub esp, 0xc
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x407d16
mov dword [esp + 4], 0x104
mov edi, dword [ebp - 0x25c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
cmp word [ebp - 0x220], 0
je 0x408819
mov eax, edi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4080d0
mov ecx, dword [ebp - 0x25c]
sub eax, ecx
mov dword [ebp - 0x264], eax
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x260]
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x25c]
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov edi, eax
test eax, eax
jne 0x40867a
mov dword [esp + 4], 0x104
mov ecx, dword [ebp - 0x25c]
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
mov eax, dword [ebp - 0x260]
sub esp, 8
cmp word [eax], 0
je 0x408153
mov edi, eax
lea esi, [esi]
nop
add edi, 2
cmp word [edi], 0
jne 0x408140
mov eax, dword [ebp - 0x260]
sub edi, eax
sar edi, 1
cmp word [ebp - 0x220], 0
je 0x40817d
mov eax, dword [ebp - 0x25c]
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408168
mov ecx, dword [ebp - 0x25c]
sub eax, ecx
sar eax, 1
add edi, eax
add edi, edi
mov dword [esp + 4], 0
mov dword [esp + 8], edi
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x278], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x268]
call eax
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x278]
mov edi, eax
sub esp, 0xc
xor eax, eax
test edi, edi
je 0x408523
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x4081c8
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x264]
add ecx, eax
cmp word [edi], 0
mov eax, edi
je 0x408200
nop
add eax, 2
cmp word [eax], 0
jne 0x4081f0
lea esi, [esi]
movzx edx, word [ecx + ebx]
mov word [eax + ebx], dx
add ebx, 2
test dx, dx
jne 0x408200
mov ecx, dword [ebp - 0x260]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x264], eax
call eax
sub esp, 0xc
test byte [0x419070], 8
jne 0x4086a0
mov dword [ebp - 0x260], edi
mov eax, dword [esi + 0x34]
jmp 0x4079f5
mov eax, dword [ebx + 0x1c]
mov edi, dword [edi + 0x34]
test eax, eax
je 0x408285
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x408285
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
sub esp, 0xc
test edi, edi
je 0x407bb6
test byte [0x419070], 2
jne 0x4085ea
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x260]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x240]
mov edx, dword [0x41d090]
add eax, 1
cmp eax, edx
cmovb eax, edx
mov dword [0x41d090], eax
jmp 0x407a64
mov edi, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x268], ecx
mov dword [edi + 0x78], 0
mov dword [edi + 0x34], 0x10
mov dword [edi + 0x38], 3
mov dword [edi + 0x14], 0x10
mov dword [esp], ebx
call fcn.00409440
mov dword [edi + 0x40], eax
test eax, eax
je 0x4086fe
mov dword [esp], str.LocalSystem
call fcn.00409440
mov dword [edi + 0x50], eax
test eax, eax
je 0x4086fe
mov dword [esp], 0x41d0a0
call fcn.00409440
mov dword [edi + 0x54], eax
test eax, eax
je 0x4086fe
mov eax, dword [esi + 0x44]
mov ecx, dword [ebp - 0x268]
mov edx, dword [ebp - 0x278]
test eax, eax
je 0x4083f5
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x268], ecx
mov dword [esp], eax
call fcn.00409440
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x278]
test eax, eax
mov dword [ecx + 0x44], eax
mov ecx, dword [ebp - 0x268]
je 0x4086fe
mov edi, dword [ebp - 0x260]
mov dword [edi + 8], ecx
mov dword [edi], edx
mov eax, dword [ecx + 0x14]
mov edx, dword fs:[0x18]
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 0x14], edi
mov dword [edi + 0x74], 1
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x268], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
mov eax, dword [edi + 0x44]
sub esp, 0xc
mov dword [esp], eax
call fcn.00409440
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebp - 0x220], eax
lea eax, [ecx + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x25c]
xor eax, eax
sub esp, 4
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x220]
mov dword [esp], edi
test edx, edx
setne al
mov dword [esp + 4], eax
call fcn.004088b0
mov edi, eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
sub esp, 0xc
test edi, edi
jne 0x4087e5
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x274]
call eax
mov eax, dword [ebp - 0x260]
sub esp, 4
mov edx, dword [eax + 0x68]
test edx, edx
je 0x4087f8
lock add dword [edx + 0xc], 1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x25c], edx
mov dword [esp], eax
call fcn.00406da0
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov edx, dword [ebp - 0x25c]
sub esp, 4
jmp 0x407f0b
mov eax, dword [ebp - 0x260]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esi + 8]
mov edi, 0x46a
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov edi, 0x46a
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x264]
call eax
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [edi + 0x34]
jmp 0x408272
mov eax, dword [esi + 8]
mov edi, 0x420
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x407d16
mov edi, 0x46a
jmp 0x4082b3
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x40882a
mov eax, ebx
shr eax, 0x10
je 0x40868e
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x41ac0d
test edx, edx
jne 0x408626
mov eax, ebx
call fcn.00405e30
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_create_process_object_for__s__error___lu_n
mov dword [esp + 8], str.service_start_process
mov dword [esp + 4], 0x419070
mov dword [esp], 1
call fcn.00405ff0
jmp 0x4082c0
mov edi, dword [edi + 0x34]
mov dword [esp], ebx
call fcn.00407850
mov dword [esp], ebx
call fcn.00406b30
jmp 0x407d16
mov ecx, dword [esi + 8]
lea edx, [ecx + 0x10]
jmp 0x407f97
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x264], ecx
jmp 0x4079f5
mov dword [esp + 4], ebx
mov dword [esp], 0x41ac00
call fcn.00406080
jmp 0x408626
mov eax, edi
shr eax, 0x10
je 0x408834
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x41ac0d
test edx, edx
jne 0x4086d1
mov eax, edi
call fcn.00405e30
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.redirected_to__s_n
mov dword [esp + 8], str.get_service_binary_path
mov dword [esp + 4], 0x419070
mov dword [esp], 3
call fcn.00405ff0
jmp 0x40824e
mov eax, dword [ebp - 0x260]
mov edi, 0x46a
mov dword [esp], eax
call fcn.00406bf0
jmp 0x40805a
mov dword [esp], edx
call fcn.00406b30
mov edi, 0x41d
jmp 0x407d16
mov edx, ebx
mov esi, dword [ebp - 0x278]
mov ebx, dword [ebp - 0x268]
mov ecx, eax
jmp 0x40802e
mov eax, dword [ebx + 0x1c]
mov edi, dword [edi + 0x34]
test eax, eax
jne 0x408266
jmp 0x408272
lea eax, [ebp - 0x254]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call sub.advapi32.dll_OpenProcessToken
sub esp, 0xc
test eax, eax
je 0x407bee
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x254]
mov dword [esp], 0x41d0dc
mov dword [esp + 4], eax
call sub.userenv.dll_CreateEnvironmentBlock
lea eax, [ebp - 0x240]
sub esp, 0xc
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], str.WINEBOOTSTRAPMODE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x408849
mov eax, dword [ebp - 0x254]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x407bee
mov eax, 0x20
jmp 0x407d94
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call fcn.00406da0
jmp 0x407d16
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call fcn.00406da0
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call ebx
sub esp, 4
jmp 0x40871e
mov dword [ebp - 0x264], 0
xor eax, eax
jmp 0x4080e9
mov eax, 0x41ac06
jmp 0x408626
mov dword [esp + 4], edi
mov dword [esp], 0x41ac00
call fcn.00406080
jmp 0x4086d1
mov eax, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea edi, [ebp - 0x250]
mov dword [esp + 4], str.WINEBOOTSTRAPMODE
mov dword [esp], edi
mov dword [ebp - 0x268], eax
call eax
lea eax, [ebp - 0x240]
sub esp, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x248]
mov dword [esp], eax
mov eax, dword [ebp - 0x268]
call eax
lea eax, [ebp - 0x248]
sub esp, 8
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x41d0dc
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
sub esp, 0xc
jmp 0x4087c4