Function at 0x401250
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a622
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x576f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00408263
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40129d
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x55c], eax
mov dword [ebp - 4], 0
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4012d0
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x54c], edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x4012f4
xor ecx, ecx
jmp 0x40130f
mov ecx, eax
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401300
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x55c]
call fcn.00403e40
lea ecx, [ebp - 0x55c]
call fcn.00403120
mov ecx, eax
call fcn.004031a0
mov ecx, dword [ebp - 0x55c]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x40138f
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x401379
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x401379
push eax
call fcn.00403b40
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40136e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebx + 0x10]
mov dword [ebp - 0x54c], edi
jmp 0x40138f
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x54c]
call fcn.00403e40
mov edi, dword [ebp - 0x54c]
mov esi, dword [edi - 0xc]
test esi, esi
jns 0x4013a0
push 0x80070057
call fcn.00403f80
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x4013c3
push esi
lea ecx, [ebp - 0x54c]
call fcn.00403d70
mov edi, dword [ebp - 0x54c]
lea ecx, [esi + 1]
push ecx
push edi
call fcn.00507c22
add esp, 8
cmp esi, dword [edi - 8]
jg 0x401396
xor edx, edx
mov dword [edi - 0xc], esi
push 0x5573dc
lea ecx, [ebp - 0x52c]
mov word [edi + esi*2], dx
call fcn.00403a80
push 0x5573dc
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 2
call fcn.00403a80
mov byte [ebp - 4], 3
call fcn.00402c70
mov ebx, eax
push 0x5573c0
mov dword [ebp - 0x530], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40145b
push str.GetSystemWow64DirectoryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40145b
push 0x104
lea ecx, [ebp - 0x524]
push ecx
call eax
test eax, eax
jne 0x40144f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x40145b
mov dword [ebp - 0x544], 1
jmp 0x401465
mov dword [ebp - 0x544], 0
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40147f
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x538], eax
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x53c], 0
call fcn.0040bd30
mov byte [ebp - 4], 5
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4014c8
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x528], eax
push 0x5573dc
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 6
call fcn.00403a80
mov byte [ebp - 4], 7
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40150c
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x550], esi
mov byte [ebp - 4], 8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40154c
push 0x104
lea ecx, [ebp - 0x550]
call fcn.00403d70
mov esi, dword [ebp - 0x550]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0050794a
add esp, 8
test eax, eax
js 0x401396
cmp eax, dword [esi - 8]
jg 0x401396
xor ecx, ecx
push 0x5c
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call fcn.005079ca
add esp, 8
test eax, eax
jne 0x401595
or eax, 0xffffffff
jmp 0x401599
sub eax, esi
sar eax, 1
inc eax
push eax
lea edx, [ebp - 0x560]
push edx
lea ecx, [ebp - 0x550]
call fcn.00402e60
mov byte [ebp - 4], 9
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea edi, [esi - 0x10]
cmp eax, edi
je 0x401614
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x4015fe
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4015fe
push eax
call fcn.00403b40
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4015ed
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
lea esi, [ebx + 0x10]
mov ebx, dword [ebp - 0x530]
mov dword [ebp - 0x550], esi
jmp 0x401614
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x550]
call fcn.00403e40
mov esi, dword [ebp - 0x550]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x560]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40163a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x31c]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x31c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401660
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x31c]
push edx
lea ecx, [ebp - 0x538]
call fcn.00403e40
mov eax, dword [ebp - 0x544]
sub eax, 0
je 0x401699
dec eax
jne 0x4016ab
push 3
push 0x557178
jmp 0x4016a0
push 3
push 0x557170
lea ecx, [ebp - 0x534]
call fcn.00403e40
cmp ebx, 4
ja case.default.0x4016b4
jmp dword [ebx*4 + 0x402b50]
push str.XP_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x538]
push ecx
lea edx, [ebp - 0x544]
push edx
call fcn.00402ed0
lea ecx, [ebp - 0x534]
push ecx
push eax
lea edx, [ebp - 0x560]
mov bl, 0xa
push edx
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xb
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x560]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401736
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x544]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40175c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.VISTA_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5ec]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x530]
mov bl, 0xc
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xd
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x530]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4017f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5ec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40181f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.SEVEN_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5c8]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5c0]
mov bl, 0xe
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xf
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5c0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5c8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push 0x5573bc
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x5e8]
push eax
call fcn.00403660
lea ecx, [ebp - 0x534]
push ecx
push eax
lea edx, [ebp - 0x5e0]
mov bl, 0x10
push edx
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x11
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40196d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5e8]
jmp 0x40227d
push str.VISTA_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5f0]
mov bl, 0x12
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x13
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4019f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5d4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.SEVEN_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x58c]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5dc]
mov bl, 0x14
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x15
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401aba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x58c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ae0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.XP_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x594]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5c4]
mov bl, 0x16
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x17
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5c4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401b7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x594]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ba3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push 0x5573bc
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x59c]
push eax
call fcn.00403660
lea ecx, [ebp - 0x534]
push ecx
push eax
lea edx, [ebp - 0x580]
mov bl, 0x18
push edx
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x19
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x580]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x59c]
jmp 0x40227d
push str.SEVEN_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5a4]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5cc]
mov bl, 0x1a
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x1b
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5cc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401cb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5a4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401cde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.VISTA_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5ac]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5d0]
mov bl, 0x1c
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x1d
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5d0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5ac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401da1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.XP_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5d8]
mov bl, 0x1e
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x1f
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5d8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5b4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push 0x5573bc
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x5bc]
push eax
call fcn.00403660
lea ecx, [ebp - 0x534]
push ecx
push eax
lea edx, [ebp - 0x5e4]
push edx
mov byte [ebp - 4], 0x20
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x21
call fcn.00403bb0
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x5e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401eef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5bc]
jmp 0x40227d
push str.WIN8_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x588]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x584]
mov bl, 0x22
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x23
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x584]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401f79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x588]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401f9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.SEVEN_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x598]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x590]
mov bl, 0x24
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x25
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x590]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40203c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x598]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402062
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.VISTA_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5a8]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5a0]
mov bl, 0x26
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x27
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5a0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4020ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5a8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402125
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push str.XP_
lea ecx, [ebp - 0x52c]
call fcn.00403f30
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5b8]
push ecx
call fcn.00402ed0
lea edx, [ebp - 0x534]
push edx
push eax
lea eax, [ebp - 0x5b0]
mov bl, 0x28
push eax
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x29
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x5b0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x5b8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
test eax, eax
jne case.default.0x4016b4
push 0x5573bc
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x554]
push eax
call fcn.00403660
lea ecx, [ebp - 0x534]
push ecx
push eax
lea edx, [ebp - 0x558]
mov bl, 0x2a
push edx
mov byte [ebp - 4], bl
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x2b
call fcn.00403bb0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x558]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402273
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x554]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402299
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x528]
push 0
push ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd7
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x54c]
cmp dword [eax - 0xc], 0
jl 0x40237a
push 0x5571bc
push eax
call fcn.0050796a
add esp, 8
test eax, eax
je 0x40237a
sub eax, dword [ebp - 0x54c]
sar eax, 1
mov ebx, eax
test ebx, ebx
jle 0x40237a
lea edx, [ebp - 0x54c]
push edx
lea ecx, [ebp - 0x548]
call fcn.00403bb0
xor edi, edi
test ebx, ebx
jle 0x402368
test edi, edi
js 0x401396
mov eax, dword [ebp - 0x548]
mov esi, dword [eax - 0xc]
cmp edi, esi
jge 0x401396
cmp dword [eax - 4], 1
jle 0x402334
push esi
lea ecx, [ebp - 0x548]
call fcn.00403c90
mov eax, dword [ebp - 0x548]
mov ecx, 0x20
mov word [eax + edi*2], cx
test esi, esi
js 0x401396
mov eax, dword [ebp - 0x548]
cmp esi, dword [eax - 8]
jg 0x401396
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x548]
xor edx, edx
inc edi
mov word [eax + esi*2], dx
cmp edi, ebx
jl 0x402303
lea ecx, [ebp - 0x548]
call fcn.00403120
mov ecx, eax
call fcn.004031a0
mov esi, dword [ebp - 0x528]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x5571c0
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x554]
push edx
call fcn.00403660
add esp, 0xc
mov byte [ebp - 4], 0x2c
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x4023fd
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4023ed
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4023ed
push eax
call fcn.00403b40
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4023e2
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x528], ebx
jmp 0x4023fd
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x528]
call fcn.00403e40
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x554]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402423
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40243d
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x540], eax
mov ecx, 0x5573dc
mov byte [ebp - 4], 0x2d
test ecx, 0xffff0000
jne 0x40247e
mov edx, ecx
movzx esi, dx
push esi
call fcn.0040b80c
test eax, eax
je 0x402490
push esi
push eax
lea ecx, [ebp - 0x540]
call fcn.004038d0
jmp 0x402490
push 0
push 0x5573dc
lea ecx, [ebp - 0x540]
call fcn.00403e40
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x540]
lea eax, [edx - 0x10]
lea esi, [ecx - 0x10]
cmp eax, esi
je 0x4024fb
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4024e5
mov ecx, dword [eax]
cmp ecx, dword [esi]
jne 0x4024e5
push eax
call fcn.00403b40
add esp, 4
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [edi], edx
dec edx
test edx, edx
jg 0x4024da
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x540], ecx
jmp 0x4024fb
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [ebp - 0x540]
call fcn.00403e40
mov ecx, dword [ebp - 0x540]
cmp dword [ecx - 0xc], 0
jl 0x4028e2
push 0x5571d8
push ecx
call fcn.0050796a
mov ecx, dword [ebp - 0x540]
add esp, 8
test eax, eax
je 0x4025c0
sub eax, ecx
sar eax, 1
test eax, eax
jle 0x4025c0
mov esi, dword [ecx - 0xc]
mov edi, eax
cmp eax, esi
jge 0x4025a8
mov ebx, 1
jmp 0x402540
test edi, edi
js 0x401396
cmp edi, esi
jge 0x401396
cmp dword [ecx - 4], ebx
jle 0x40256a
mov eax, dword [ecx - 0xc]
push eax
lea ecx, [ebp - 0x540]
call fcn.00403c90
mov ecx, dword [ebp - 0x540]
mov edx, 0x20
mov word [ecx + edi*2], dx
test esi, esi
js 0x401396
mov eax, dword [ebp - 0x540]
cmp esi, dword [eax - 8]
jg 0x401396
mov dword [eax - 0xc], esi
mov ecx, dword [ebp - 0x540]
xor eax, eax
mov word [ecx + esi*2], ax
mov ecx, dword [ebp - 0x540]
mov esi, dword [ecx - 0xc]
add edi, ebx
cmp edi, esi
jl 0x402540
lea ecx, [ebp - 0x540]
call fcn.00403120
mov ecx, eax
call fcn.004031a0
mov ecx, dword [ebp - 0x540]
cmp dword [ecx - 0xc], 0
jl 0x4028e2
push 0x5571dc
push ecx
call fcn.0050796a
add esp, 8
test eax, eax
je 0x4028e2
sub eax, dword [ebp - 0x540]
sar eax, 1
js 0x4028e2
push 0x80
lea edx, [ebp - 0x110]
push 0
push edx
call fcn.00508de0
add esp, 0xc
push 0x80
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402632
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x530], eax
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x2f
test ecx, 0xffff0000
jne 0x402674
mov edx, ecx
movzx esi, dx
push esi
call fcn.0040b80c
test eax, eax
je 0x4026a2
push esi
push eax
lea ecx, [ebp - 0x530]
call fcn.004038d0
jmp 0x4026a2
lea eax, [ebp - 0x110]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402680
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x530]
call fcn.00403e40
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x530]
push 0x5c
push ecx
call fcn.005079ca
mov ecx, dword [ebp - 0x530]
add esp, 8
test eax, eax
je 0x402760
sub eax, ecx
sar eax, 1
test eax, eax
jle 0x402760
mov esi, dword [ecx - 0xc]
mov edi, eax
cmp eax, esi
jge 0x402748
lea ebx, [ebx]
test edi, edi
js 0x401396
cmp edi, esi
jge 0x401396
cmp dword [ecx - 4], 1
jle 0x40270b
mov edx, dword [ecx - 0xc]
push edx
lea ecx, [ebp - 0x530]
call fcn.00403c90
mov ecx, dword [ebp - 0x530]
mov eax, 0x20
mov word [ecx + edi*2], ax
test esi, esi
js 0x401396
mov eax, dword [ebp - 0x530]
cmp esi, dword [eax - 8]
jg 0x401396
mov dword [eax - 0xc], esi
mov edx, dword [ebp - 0x530]
xor ecx, ecx
mov word [edx + esi*2], cx
mov ecx, dword [ebp - 0x530]
mov esi, dword [ecx - 0xc]
inc edi
cmp edi, esi
jl 0x4026e0
lea ecx, [ebp - 0x530]
call fcn.00403120
mov ecx, eax
call fcn.004031a0
mov ecx, dword [ebp - 0x530]
lea esi, [ecx - 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x402786
cmp eax, dword [esi]
jne 0x402786
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x4027c2
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x40279f
call fcn.00403d20
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.005077de
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x544], edi
push 8
mov bl, 0x31
push str._run.bat
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], bl
call fcn.00403420
lea ecx, [ebp - 0x60c]
call fcn.0040bd30
mov byte [ebp - 4], 0x32
mov esi, dword [ebp - 0x544]
push 0
push esi
lea ecx, [ebp - 0x60c]
call fcn.0040bdd7
cmp eax, 1
jne 0x40288e
push 0x38
lea ecx, [ebp - 0x644]
push 0
push ecx
call fcn.00508de0
mov eax, 1
add esp, 0xc
mov dword [ebp - 0x648], 0x3c
mov dword [ebp - 0x644], 0x40
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x62c], eax
cmp dword [esi - 4], eax
jle 0x402864
mov edx, dword [esi - 0xc]
push edx
lea ecx, [ebp - 0x544]
call fcn.00403c90
mov esi, dword [ebp - 0x544]
lea eax, [ebp - 0x648]
push eax
mov dword [ebp - 0x638], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0x610]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], bl
call fcn.0040bd62
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x30
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4028bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x530]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4028e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x53c], 1
jne 0x402886
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0040a9fd
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402912
push 0x80004005
call fcn.00403f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x530], esi
push 0x44
lea ecx, [ebp - 0x650]
push 0
push ecx
mov byte [ebp - 4], 0x33
call fcn.00508de0
xor eax, eax
lea edx, [ebp - 0x558]
push edx
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x650], 0x44
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
call fcn.00402f90
lea ecx, [ebp - 0x548]
push ecx
push eax
lea edx, [ebp - 0x554]
push edx
mov byte [ebp - 4], 0x34
call fcn.00402ed0
add esp, 0x1c
mov byte [ebp - 4], 0x35
mov eax, dword [eax]
lea edi, [eax - 0x10]
lea ebx, [esi - 0x10]
cmp edi, ebx
je 0x402a48
cmp dword [ebx + 0xc], 0
jl 0x402a32
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x402a32
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x4029d2
cmp eax, dword [edi]
jne 0x4029d2
mov esi, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x402a0e
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x4029eb
call fcn.00403d20
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.005077de
add esp, 0x10
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402a27
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
add esi, 0x10
mov dword [ebp - 0x530], esi
jmp 0x402a48
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x530]
call fcn.00403e40
mov esi, dword [ebp - 0x530]
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x554]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0x558]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi - 4], 1
jle 0x402aaf
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [ebp - 0x530]
call fcn.00403c90
mov esi, dword [ebp - 0x530]
lea edx, [ebp - 0x600]
push edx
lea eax, [ebp - 0x650]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0050794a
add esp, 8
test eax, eax
js 0x401396
cmp eax, dword [esi - 8]
jg 0x401396
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x402b26
mov edx, dword [ebp - 0x600]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x600]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x5fc]
push ecx
call edi
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2e
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402886
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x402886