Function at 0x4036eb
Capabilities:
Create thread

Disassembly:
push 0x4c
mov eax, 0x437a99
call fcn.00420112
mov ebx, ecx
mov dword [ebp - 0x30], ebx
call fcn.0040d70e
xor esi, esi
inc esi
xor edi, edi
mov dword [0x514d9c], esi
mov dword [0x514d90], esi
mov dword [0x514d94], esi
mov dword [0x514db8], edi
mov dword [0x514da4], edi
mov dword [0x514da0], edi
mov dword [0x50cad8], ebx
call fcn.00406720
push edi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00410b96
mov dword [ebp - 0x34], eax
cmp eax, edi
je 0x40354f
call fcn.0040a75b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401660
push 0x65
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00401545
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], edi
je 0x403540
mov eax, dword [ebp - 0x34]
push edi
push edi
push 0x800
push dword [eax + 4]
call dword [sym.imp.USER32.dll_AppendMenuW]
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
push 0x10
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_AppendMenuW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401108
push dword [ebx + 0x74]
push esi
mov esi, 0x80
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0x74]
push edi
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x43d8d8
lea eax, [ebp - 0x28]
push str.HWCX_ADMIN_MODE.txt
push eax
call fcn.0041d2e1
add esp, 0xc
test eax, eax
jne 0x4035d0
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push 5
push 1
push eax
call fcn.0041d5d4
add esp, 0x10
cmp eax, 5
jne 0x4035c7
push eax
pop ecx
mov edi, str.super
lea esi, [ebp - 0x1c]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4035b7
sbb eax, eax
sbb eax, 0xffffffff
xor edi, edi
test eax, eax
jne 0x4035c7
mov dword [ebx + 0x402f0], 1
push dword [ebp - 0x28]
call fcn.0041d668
pop ecx
xor esi, esi
inc esi
cmp dword [ebx + 0x402f0], edi
je 0x4035ef
push esi
push 0x400
mov ecx, ebx
call fcn.004161e2
mov ecx, eax
call fcn.0041637c
push edi
lea ecx, [ebx + 0x40604]
call fcn.0041633a
push 0x43d8d8
lea eax, [ebp - 0x28]
push str.chinese.txt
push eax
call fcn.0041d2e1
add esp, 0xc
test eax, eax
jne 0x403633
push dword [ebp - 0x28]
call fcn.0041d668
pop ecx
mov eax, 0x407
push eax
push 0x408
mov byte [0x514d35], 0
push eax
jmp 0x403646
mov eax, 0x408
push eax
push eax
mov byte [0x514d35], 1
push 0x407
mov ecx, ebx
call fcn.004161b8
push esi
call fcn.0040596d
pop ecx
test eax, eax
jne 0x403675
cmp dword [0x514d90], edi
je 0x403675
push edi
push edi
push 0x10
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
call fcn.0042016e
ret
call fcn.0040a75b
push eax
lea ecx, [ebp - 0x20]
call fcn.00401660
mov dword [ebp - 4], esi
call fcn.0040513e
push eax
mov ecx, 0x514dac
call fcn.004013e5
push 0x514da8
mov byte [ebp - 4], 2
call fcn.0040540a
pop ecx
cmp eax, edi
jne 0x4036e8
cmp dword [0x514d90], edi
je 0x4036e8
movzx eax, byte [0x514d35]
shl eax, 2
push dword [eax + 0x44a7f0]
push dword [eax + 0x44a7b8]
call fcn.00401309
pop ecx
pop ecx
push edi
push edi
push 0x10
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401108
jmp 0x40366d
mov dword [ebp - 4], esi
call fcn.0040a75b
push eax
lea ecx, [ebp - 0x24]
call fcn.00401660
push 0x43d8f8
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.004049d2
push 0x7f
lea ebx, [ebp - 0x24]
call fcn.0040521f
mov dword [esp], 0x514dac
lea eax, [ebp - 0x44]
push str.MAC:
push eax
call fcn.0040491f
mov esi, 0x43daac
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 5
call fcn.004048c7
mov ecx, ebx
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 6
call fcn.00404870
push esi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 7
call fcn.004048c7
push 0x43daa4
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 8
call fcn.004048c7
push 0x514da8
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 9
call fcn.00404870
add esp, 0x48
push 0x43da9c
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0xa
call fcn.004048c7
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.004016a3
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00401108
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00401108
mov eax, dword [ebp - 0x20]
mov edi, dword [eax - 0xc]
lea ecx, [ebp - 0x20]
call fcn.00401565
push eax
lea esi, [ebp - 0x58]
call fcn.004064b9
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.0040157f
mov edi, dword [ebp - 0x58]
push edi
xor esi, esi
push esi
mov eax, str.xb_data_SUG0_821_GS128.txt
call fcn.00405f27
pop ecx
pop ecx
cmp eax, esi
je 0x4038e9
cmp dword [0x514d90], esi
je 0x4038e9
movzx eax, byte [0x514d35]
shl eax, 2
push dword [eax + 0x44a9e8]
push dword [eax + 0x44a7d8]
call fcn.00401309
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
push esi
push esi
push 0x10
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 4
cmp edi, esi
je 0x403882
push edi
call fcn.0040a6ad
pop ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401108
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401108
mov eax, esi
jmp 0x40366f
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.0040392e
push esi
push esi
push ebx
push 0x4032b0
push esi
mov dword [0x514db8], esi
push esi
mov dword [ebx + 0x4030c], esi
call fcn.0041dde6
add esp, 0x18
mov dword [ebx + 0x40308], eax
mov byte [ebp - 4], 4
cmp edi, esi
je 0x403926
push edi
call fcn.0040a6ad
pop ecx
xor esi, esi
inc esi
jmp 0x403882