Function at 0x409c70
Capabilities:
Copy file
Get keyboard layout
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
push 0x668
mov eax, 0x50cf35
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x674], esi
call fcn.0043f45e
xor eax, eax
lea ecx, [esi + 0x98]
push esi
mov dword [ebp - 4], eax
call fcn.004c4fac
lea ecx, [esi + 0xd0]
mov byte [ebp - 4], 1
call fcn.004461b2
lea ebx, [esi + 0x114]
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004475a0
lea edi, [esi + 0x144]
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.004253c0
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 4
call fcn.004277fc
mov eax, esi
mov byte [ebp - 4], 5
push eax
lea ecx, [eax + 0x3b4]
call fcn.004326e8
mov eax, esi
mov dword [ebx], vtable.CConEmuMain.3.0
mov ebx, esi
mov dword [esi + method.CConEmuMain.5.virtual_0], vtable.CConEmuMain.5.0
push 0x3e
mov byte [ebp - 4], 6
mov dword [eax], vtable.CConEmuMain.0
mov dword [eax + 0x98], vtable.CConEmuMain.1.0
lea esi, [ebx + 0xa30]
mov dword [eax + 0xd0], vtable.CConEmuMain.2.0
mov dword [eax + method.CConEmuMain.6.virtual_0], vtable.CConEmuMain.6.0
xor eax, eax
push eax
mov word [esi], ax
lea eax, [ebx + 0xa32]
push eax
mov dword [edi], vtable.CConEmuMain.4.0
call fcn.004f5a90
xor ecx, ecx
lea edi, [ebx + 0xa72]
push 7
mov word [ebx + 0xa70], cx
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov edi, 0x208
mov word [ebx + 0xa90], ax
push edi
push eax
lea eax, [ebx + 0xa92]
push eax
call fcn.004f5a90
xor eax, eax
push edi
push eax
mov word [ebx + 0xc9a], ax
lea eax, [ebx + 0xc9c]
push eax
call fcn.004f5a90
xor ecx, ecx
lea eax, [ebx + 0xea6]
push edi
push ecx
push eax
mov word [ebx + 0xea4], cx
call fcn.004f5a90
xor eax, eax
push edi
push eax
mov word [ebx + 0x10ae], ax
lea eax, [ebx + 0x10b0]
push eax
call fcn.004f5a90
xor eax, eax
push 0x4e
push eax
mov word [ebx + 0x12b8], ax
lea eax, [ebx + 0x12ba]
push eax
call fcn.004f5a90
add esp, 0x48
lea eax, [ebx + 0x1312]
xor edx, edx
xor ecx, ecx
mov byte [ebx + 0x1308], dl
mov dword [ebx + 0x130c], edx
push 0x206
push edx
push eax
mov word [ebx + 0x1310], cx
call fcn.004f5a90
add esp, 0xc
lea ecx, [ebx + 0x1518]
call fcn.004e25a1
lea ecx, [ebx + 0x1574]
mov byte [ebp - 4], 7
call fcn.004e25a1
xor ecx, ecx
mov dword [ebx + 0x15e8], 0xff
xor eax, eax
mov dword [ebx + 0x15d0], ecx
push edi
mov word [ebx + 0x15f0], ax
lea eax, [ebx + 0x15f2]
push ecx
push eax
mov dword [ebx + 0x15d4], ecx
mov dword [ebx + 0x15d8], ecx
mov dword [ebx + 0x15dc], ecx
mov dword [ebx + 0x15e0], ecx
mov word [ebx + 0x15e4], cx
mov word [ebx + 0x15ed], cx
call fcn.004f5a90
xor eax, eax
push edi
push eax
mov word [ebx + 0x17fa], ax
lea eax, [ebx + 0x17fc]
push eax
call fcn.004f5a90
xor ecx, ecx
lea eax, [ebx + 0x1a06]
push edi
push ecx
push eax
mov word [ebx + 0x1a04], cx
call fcn.004f5a90
xor ecx, ecx
lea eax, [ebx + 0x1c10]
add edi, 0x16
mov word [ebx + 0x1c0e], cx
push edi
push ecx
push eax
call fcn.004f5a90
xor eax, eax
push edi
xor edi, edi
mov word [ebx + 0x1e2e], ax
lea eax, [ebx + 0x1e30]
push edi
push eax
call fcn.004f5a90
mov dword [ebx + 0x204e], 0x13c6
push 0x13c2
lea eax, [ebx + 0x2052]
push edi
push eax
call fcn.004f5a90
add esp, 0x48
lea ecx, [ebx + 0x3414]
call fcn.00409c4c
lea ecx, [ebx + 0x3938]
call fcn.00409c4c
xor edx, edx
mov byte [ebp - 4], 0xa
push 8
pop ecx
xor eax, eax
mov byte [ebx + 0x3e5c], dl
mov dword [ebx + 0x3e68], edx
lea edi, [ebx + 0x3e98]
mov dword [ebx + 0x3e70], edx
mov dword [ebx + 0x3e74], edx
mov dword [ebx + 0x3e88], edx
mov dword [ebx + 0x3e8c], edx
mov dword [ebx + 0x3e90], edx
mov dword [ebx + 0x3e94], edx
rep stosd dword es:[edi], eax
push 0x2c
push edx
lea eax, [ebx + 0x3f00]
mov dword [ebx + 0x3eb8], edx
push eax
call fcn.004f5a90
push 0x34
lea eax, [ebx + 0x3ebc]
push 0
push eax
call fcn.004f5a90
or eax, 0xffffffff
mov dword [ebx + 0x3ef0], eax
mov dword [ebx + 0x3ef4], eax
xor eax, eax
mov dword [ebx + 0x3ef8], eax
push 0x61c
push eax
mov dword [ebx + 0x3efc], eax
lea eax, [ebx + 0x3f2c]
push eax
call fcn.004f5a90
xor ecx, ecx
lea edi, [ebx + 0x4558]
mov byte [ebx + 0x4549], cl
xor eax, eax
mov dword [ebx + 0x454c], ecx
add esp, 0x24
mov byte [ebx + 0x4550], cl
mov dword [ebx + 0x4554], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebx + 0x4568], ecx
lea edi, [ebx + 0x4574]
mov dword [ebx + 0x456c], ecx
mov dword [ebx + 0x4570], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov byte [ebx + 0x4584], cl
lea edi, [ebx + 0x458c]
mov dword [ebx + 0x4588], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x459c], ecx
mov byte [ebx + 0x45a0], cl
mov dword [ebx + 0x45b8], ecx
mov dword [ebx + 0x45bc], ecx
mov dword [ebx + 0x45c0], ecx
mov dword [ebx + 0x45c4], ecx
mov dword [ebx + 0x45c8], ecx
mov word [ebx + 0x45cc], cx
mov dword [ebx + 0x45d0], ecx
mov word [ebx + 0x45d4], cx
lea ecx, [ebx + 0x45d8]
call fcn.00448019
xor eax, eax
xor edi, edi
push 0x97e
mov word [ebx + 0x49f4], ax
lea eax, [ebx + 0x49f6]
push edi
push eax
call fcn.004f5a90
xor eax, eax
push 0xfe
mov word [ebx + 0x5374], ax
lea eax, [ebx + 0x5376]
push edi
push eax
call fcn.004f5a90
xor ecx, ecx
lea edi, [ebx + 0x5490]
or eax, 0xffffffff
mov word [ebx + 0x5476], cx
mov word [ebx + 0x5474], ax
xor eax, eax
mov byte [ebx + 0x5478], cl
mov dword [ebx + 0x547c], ecx
mov byte [ebx + 0x5480], cl
mov dword [ebx + 0x5484], ecx
mov dword [ebx + 0x5488], ecx
mov dword [ebx + 0x548c], ecx
stosd dword es:[edi], eax
push 0x20f8
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebx + 0x54ac]
push eax
mov byte [ebx + 0x549c], cl
mov dword [ebx + 0x54a0], ecx
mov dword [ebx + 0x54a4], ecx
mov dword [ebx + 0x54a8], ecx
call fcn.004f5a90
xor ecx, ecx
xor eax, eax
push 0x206
mov word [ebx + 0x75a8], ax
lea eax, [ebx + 0x75aa]
push ecx
push eax
mov word [ebx + 0x75a4], cx
mov byte [ebx + 0x75a6], cl
call fcn.004f5a90
xor edx, edx
or eax, 0xffffffff
mov byte [ebx + 0x77b0], dl
mov dword [ebx + 0x77b4], edx
mov byte [ebx + 0x77b8], dl
mov dword [ebx + 0x77bc], edx
mov dword [ebx + 0x77c0], edx
mov byte [ebx + 0x77c4], dl
mov dword [ebx + 0x77c8], edx
mov byte [ebx + 0x77cc], dl
mov dword [ebx + 0x77d0], edx
mov dword [ebx + 0x77d4], edx
mov dword [ebx + 0x77d8], edx
mov dword [ebx + 0x77dc], edx
mov dword [ebx + 0x77e0], edx
mov dword [ebx + 0x77e4], edx
mov dword [ebx + 0x77e8], edx
mov dword [ebx + 0x77ec], edx
mov dword [ebx + 0x77f0], eax
mov word [ebx + 0x77f4], dx
mov byte [ebx + 0x77f6], dl
mov dword [ebx + 0x77f8], edx
mov dword [ebx + 0x7804], edx
mov dword [ebx + 0x7810], edx
mov dword [ebx + 0x78b4], edx
lea edi, [ebx + 0x78b8]
push 6
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebx + 0x78d0], edx
mov dword [ebx + 0x78d4], edx
mov dword [ebx + 0x78d8], edx
mov dword [ebx + 0x78dc], edx
mov dword [ebx + 0x78e0], edx
mov dword [ebx + 0x78e4], edx
mov dword [ebx + 0x78f8], edx
mov dword [ebx + 0x78e8], 0xc
mov dword [ebx + 0x78ec], edx
mov dword [ebx + 0x78f0], edx
mov dword [ebx + 0x78f4], 0xcccccccc
mov dword [ebx + 0x78fc], edx
lea edi, [ebx + 0x7900]
stosd dword es:[edi], eax
mov byte [ebp - 4], 0xd
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [0x5a22a0], ebx
call fcn.004d4aaf
call fcn.00424422
push 0x20
call fcn.004e1bc1
add esp, 0x34
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x40a254
push 1
mov ecx, eax
call fcn.004e772f
jmp 0x40a256
xor eax, eax
mov dword [ebx + 0x3e78], eax
lea edi, [ebp - 0x20]
xor eax, eax
mov byte [ebp - 4], 0xd
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
mov edi, 0x514870
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [ebp - 0x20], 0
je 0x40a28e
cmp word [ebp - 0x1e], 0
mov eax, 0x521b6c
jne 0x40a290
mov eax, edi
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0x1c
push 5
push 0x12
push 0x521b70
lea edi, [ebx + 0xa70]
push edi
call fcn.00409b1f
push 0x514870
push 0x20
push edi
push 0x524518
push esi
call fcn.00401104
add esp, 0x30
mov ecx, ebx
call fcn.004194b8
push 0x78
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x40a2ea
mov ecx, eax
call fcn.0045848f
xor esi, esi
jmp 0x40a2ee
xor esi, esi
mov eax, esi
push 0xf784
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e60], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x40a31b
push ebx
mov ecx, eax
call fcn.004baff1
jmp 0x40a31d
mov eax, esi
push 0xaa0
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e6c], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x40a349
mov ecx, eax
call fcn.004be38e
jmp 0x40a34b
mov eax, esi
push 0x88
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e64], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x40a377
mov ecx, eax
call fcn.00437f8b
jmp 0x40a379
mov eax, esi
push 0xc
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e7c], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x40a3a2
mov ecx, eax
call fcn.004404f9
jmp 0x40a3a4
mov eax, esi
push 0x44
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e80], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x40a3cd
mov ecx, eax
call fcn.004a06bc
jmp 0x40a3cf
mov eax, esi
push 0x20
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e84], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x40a3f9
push ebx
mov ecx, eax
call fcn.00403229
jmp 0x40a3fb
mov eax, esi
push 8
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x54a4], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x16
test eax, eax
je 0x40a424
mov ecx, eax
call fcn.004474b5
jmp 0x40a426
mov eax, esi
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x3e88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x77fc], eax
mov eax, 0x601
cmp word [0x58115c], ax
jne 0x40a4a2
push 8
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x40a469
mov ecx, eax
call fcn.004e4003
jmp 0x40a46b
mov eax, esi
push 0x20
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x7904], eax
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x18
test eax, eax
je 0x40a496
push 1
mov ecx, eax
call fcn.004e772f
jmp 0x40a498
mov eax, esi
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x7900], eax
push 0x20
call fcn.004e1bc1
pop ecx
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x19
test eax, eax
je 0x40a4c3
push 1
mov ecx, eax
call fcn.004e772f
jmp 0x40a4c5
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push esi
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x78fc], eax
call edi
push 0x7f00
push esi
mov dword [ebx + 0x45a4], eax
call edi
push 0x7f86
push esi
mov dword [ebx + 0x45a8], eax
call edi
push 0x7f01
push esi
mov dword [ebx + 0x45b0], eax
call edi
push 0x7f8a
push esi
mov dword [ebx + 0x45b4], eax
call edi
push 0x7c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebx + 0x45ac], eax
call esi
push eax
call edi
push 0x7e
push 0
mov dword [ebx + 0x45b8], eax
call esi
push eax
call edi
push 0x7d
push 0
mov dword [ebx + 0x45bc], eax
call esi
push eax
call edi
mov dword [ebx + 0x45c0], eax
lea eax, [ebx + 0x3ee4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebx + 0x77fc]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push str.user32.dll
mov dword [ebx + 0x54a8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a589
push str.GetLayeredWindowAttributes
push eax
call esi
xor edi, edi
jmp 0x40a58d
xor edi, edi
mov eax, edi
mov dword [ebx + 0x78d4], eax
mov eax, 0x501
cmp word [0x58115c], ax
jb 0x40a62a
push str.Imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 0x78d8], eax
test eax, eax
je 0x40a62a
push str.ImmSetCompositionFontW
push eax
call esi
push str.ImmSetCompositionWindow
mov dword [ebx + 0x78dc], eax
push dword [ebx + 0x78d8]
call esi
push str.ImmGetContext
mov dword [ebx + 0x78e0], eax
push dword [ebx + 0x78d8]
call esi
mov dword [ebx + 0x78e4], eax
cmp dword [ebx + 0x78dc], edi
je 0x40a602
cmp dword [ebx + 0x78e0], edi
je 0x40a602
test eax, eax
jne 0x40a62a
xor eax, eax
mov dword [ebx + 0x78dc], eax
mov dword [ebx + 0x78e0], eax
mov dword [ebx + 0x78e4], eax
push dword [ebx + 0x78d8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
mov dword [ebx + 0x78d8], edi
lea eax, [ebp - 0x670]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea esi, [ebx + 0x1310]
test eax, eax
jne 0x40a68d
lea eax, [ebp - 0x664]
mov dword [ebp - 0x664], 0x206
push eax
push esi
xor eax, eax
push eax
push eax
push str.ComSpec
push dword [ebp - 0x670]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a681
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x670]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov edi, 0x104
cmp word [esi], ax
jne 0x40a6a4
push eax
push edi
push esi
call fcn.004e3275
add esp, 0xc
lea ecx, [ebp - 0x604]
call fcn.004e25a1
lea ecx, [ebp - 0x5a8]
mov byte [ebp - 4], 0x1a
call fcn.004e25a1
push edi
push edi
lea ecx, [ebp - 0x604]
mov byte [ebp - 4], 0x1b
call fcn.004e2851
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40acaf
push 0x5c
push dword [ebp - 0x604]
call fcn.004f6844
pop ecx
pop ecx
test eax, eax
je 0x40acaf
lea ecx, [ebp - 0x604]
call fcn.0044612f
push eax
call fcn.004edf56
pop ecx
mov dword [ebp - 0x664], eax
lea ecx, [ebp - 0x5a8]
lea eax, [ebp - 0x664]
push eax
call fcn.004e2618
push edi
lea ecx, [ebp - 0x5a8]
lea esi, [ebx + 0xa90]
call fcn.0044612f
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
lea edx, [ebp - 0x604]
lea ecx, [ebp - 0x5a8]
cmove ecx, edx
call fcn.0044612f
push eax
mov edi, 0x105
push edi
push esi
call fcn.00401a0b
push esi
push edi
lea edi, [ebx + 0xc9a]
push edi
call fcn.00401a0b
push 0x5c
push edi
call fcn.004f6844
pop ecx
pop ecx
test eax, eax
je 0x40a780
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov ecx, ebx
push eax
call fcn.0041bf18
lea ecx, [ebp - 0x54c]
call fcn.004e25a1
lea eax, [ebp - 0x54c]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebx + 0x3b4]
call fcn.00432ddb
test al, al
je 0x40a7b9
or dword [ebx + 0x15e0], 0x1000
push edi
push 0x105
lea esi, [ebx + 0xea4]
push esi
call fcn.00401a0b
push 0x524688
push 0x105
push esi
call fcn.004019cd
mov ecx, ebx
call fcn.0040b818
test al, al
jne 0x40a87f
push edi
push 0x105
push esi
call fcn.00401a0b
mov ecx, ebx
call fcn.0040b818
test al, al
jne 0x40a87f
push 0x5c
push edi
call fcn.004f6844
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a87f
push str._bin
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a87f
sub esi, ebx
sub esi, 0xc9a
sar esi, 1
lea eax, [esi + esi]
push eax
lea eax, [ebx + 0xea4]
push edi
push eax
call fcn.004f5d30
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2 + 0xea4], ax
lea esi, [ebx + 0xea4]
push str.libexecConEmu
push 0x105
push esi
call fcn.004019cd
mov ecx, ebx
call fcn.0040b818
test al, al
je 0x40a873
or dword [ebx + 0x15e0], 1
jmp 0x40a87f
push edi
push 0x105
push esi
call fcn.00401a0b
mov eax, dword [ebx + 0x15e0]
xor esi, esi
shr eax, 0xc
test al, 1
je 0x40a8d4
push esi
push str.....git_bash.exe
push edi
call fcn.004e5466
add esp, 0xc
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x664]
lea ecx, [ebp - 0x54c]
push eax
call fcn.004e2618
push esi
lea ecx, [ebp - 0x54c]
call fcn.0044612f
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x40a8d4
or dword [ebx + 0x15e0], 5
mov ecx, dword [ebx + 0x15e0]
mov edx, 0x1001
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x40a8f9
push esi
lea ecx, [ebx + 0x3b4]
call fcn.0043545e
mov cl, byte [ebx + 0x15e0]
test cl, 1
jne 0x40aa03
mov dword [ebp - 0x66c], str...AppInfoLauncherConEmuPortable.ini
mov dword [ebp - 0x668], str...DefaultData_settingsConEmu.xml
push edi
push 0x144
lea eax, [ebp - 0x2e8]
push eax
call fcn.00401a0b
push dword [ebp + esi*4 - 0x66c]
lea eax, [ebp - 0x2e8]
push 0x144
push eax
call fcn.004019cd
xor eax, eax
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x40aa03
inc esi
cmp esi, 2
jb 0x40a916
push edi
push 0x105
lea esi, [ebx + 0x15f0]
push esi
call fcn.00401a0b
push 0x5c
push esi
call fcn.004f6844
pop ecx
pop ecx
test eax, eax
je 0x40aa03
xor ecx, ecx
push 0x5c
push esi
mov word [eax], cx
call fcn.004f6844
pop ecx
pop ecx
test eax, eax
je 0x40a9f4
push 0x524794
push 0x105
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.004019cd
push esi
call fcn.004eda34
pop ecx
test al, al
jne 0x40a9bd
push esi
call fcn.004ee21a
pop ecx
push str.ConEmu.xml
push 0x105
push esi
call fcn.004019cd
xor eax, eax
push eax
push esi
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x40a9ed
xor eax, eax
push eax
push esi
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
or dword [ebx + 0x15e0], 2
mov eax, dword [ebx + 0x15e0]
test al, 2
jne 0x40aa03
xor eax, eax
mov word [esi], ax
xor eax, eax
mov byte [ebx + 0x15ec], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov esi, str.ConEmuBlockChildDebuggers
test eax, eax
je 0x40aa46
push 0x20
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40aa46
push 0x524800
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
neg eax
sbb al, al
inc al
mov byte [ebx + 0x15ec], al
xor eax, eax
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call esi
call fcn.004ea09e
push edi
push str.ConEmuDir
mov byte [ebx + 0x45a0], al
call esi
lea eax, [ebx + 0xea4]
push eax
push str.ConEmuBaseDir
call esi
xor eax, eax
push eax
lea eax, [ebx + 0xea4]
push eax
call fcn.004e361b
pop ecx
pop ecx
mov dword [ebp - 0x668], eax
lea ecx, [ebp - 0x660]
lea eax, [ebp - 0x668]
push eax
call fcn.004e24e8
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 0x1d
call fcn.004e2932
mov ecx, dword [ebp - 0x660]
test al, al
lea eax, [ebx + 0xea4]
cmovne ecx, eax
push ecx
push str.ConEmuBaseDirShort
call esi
lea eax, [ebx + 0xa70]
push eax
push str.ConEmuBuild
call esi
push 0x514870
push str.ConEmuConfig
call esi
push 0x514870
push str.ConEmuCfgDir
call esi
push 0x514870
push str.ConEmuArgs
call esi
push 0x514870
push str.ConEmuArgs2
call esi
xor ecx, ecx
mov eax, str.ADMIN
cmp byte [ebx + 0x45a0], cl
cmove eax, ecx
push eax
push str.ConEmuIsAdmin
call esi
push 0x514870
push str.ConEmuArgs
call esi
push 0x514870
push str.ConEmuArgs2
call esi
push 0x104
lea eax, [ebp - 0x4f0]
push eax
push edi
call fcn.004e46f1
add esp, 0xc
push eax
push str.ConEmuDrive
call esi
xor eax, eax
mov ecx, ebx
push eax
call fcn.0040cf15
mov ecx, ebx
call fcn.0040ce39
lea esi, [ebx + 0xea4]
push esi
push 0x105
lea eax, [ebx + 0x1a04]
push eax
call fcn.00401a0b
push str.ConEmu.chm
lea eax, [ebx + 0x1a04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
push eax
lea eax, [ebx + 0x1a04]
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x40abec
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40abe3
push edi
push 0x105
lea edi, [ebx + 0x1a04]
push edi
call fcn.00401a0b
push str.ConEmu.chm
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
push eax
push edi
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x40abec
xor ecx, ecx
mov word [ebx + 0x1a04], cx
jmp 0x40abec
xor eax, eax
mov word [ebx + 0x1a04], ax
push esi
push 0x110
lea edi, [ebx + 0x1c0e]
push edi
call fcn.00401a0b
push 0x523280
push 0x110
push edi
call fcn.004019cd
lea edi, [ebx + 0x1e2e]
call fcn.004e3cd3
test al, al
je 0x40ac6d
push esi
mov esi, 0x110
push esi
push edi
call fcn.00401a0b
push 0x523260
push esi
push edi
call fcn.004019cd
xor eax, eax
push eax
push edi
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x40ac4f
lea eax, [ebx + 0x1c0e]
push eax
push esi
jmp 0x40ac79
xor eax, eax
lea esi, [ebx + 0x1c0e]
push eax
push esi
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x40ac7f
push edi
push 0x110
push esi
jmp 0x40ac7a
lea eax, [ebx + 0x1c0e]
push eax
push 0x110
push edi
call fcn.00401a0b
mov ecx, ebx
call fcn.0040b89d
lea ecx, [ebx + 0xd0]
mov dword [ebx + 0x15dc], eax
call fcn.004464ec
lea ecx, [ebp - 0x660]
call fcn.004e25e0
lea ecx, [ebp - 0x54c]
call fcn.004e25e0
jmp 0x40acd1
xor eax, eax
push eax
push eax
push eax
push eax
push str.GetModuleFileName_failed
call fcn.00420ad9
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x5a8]
call fcn.004e25e0
lea ecx, [ebp - 0x604]
call fcn.004e25e0
mov eax, ebx
call fcn.004f418c
ret