Function at 0x403355
Capabilities:
Accept command line arguments
Check os version
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
lea edx, [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.0040283d
test eax, eax
js 0x404f4e
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4039ca
push 9
pop edx
dec eax
push 0x20
lea eax, [esi + eax*2]
pop edi
movzx ecx, word [eax]
cmp cx, di
je 0x403990
cmp cx, dx
je 0x403990
movzx ecx, word [esi]
mov dword [esp + 0x1c], esi
test cx, cx
je 0x4020ab
push 9
pop ebx
cmp cx, di
je 0x404fee
cmp cx, bx
je 0x404fee
xor ebx, ebx
mov edi, dword [0x40b0f8]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x54], 0x46
test cx, cx
je 0x402276
mov dword [esp + 0x58], 0x71
cmp cx, word [esp + 0x24]
jne 0x405006
add esi, 2
movzx eax, word [esi]
mov edx, eax
xor ecx, ecx
or edx, 0x20
mov dword [esp + 0x1c], esi
cmp cx, ax
je 0x4020f6
add esi, 2
mov dword [esp + 0x1c], esi
push 0x52
mov ecx, 0x4027f8
pop eax
movzx eax, ax
or eax, 0x20
cmp eax, edx
je 0x402113
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4020fe
movzx eax, word [ecx]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
test ax, ax
je 0x405211
movzx eax, word [esi]
push 0x20
pop ecx
cmp ax, cx
je 0x40213b
test ax, ax
jne 0x4050b4
mov esi, ebx
mov dword [esp + 0x3c], ebx
lea ecx, [esp + 0x1c]
call fcn.004028d1
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x63
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
pop edx
cmp ax, dx
je 0x4050cc
push 0x50
pop ecx
cmp ax, cx
je 0x4050d9
push 0x71
pop ecx
cmp ax, cx
je 0x4039d2
cmp ax, dx
je 0x4039d2
mov ecx, 0x400
lea eax, [esp + 0x38]
lea edx, [esp + 0x1c]
call fcn.0040408a
test al, al
je 0x40525a
lea ecx, [esp + 0x1c]
call fcn.004028d1
mov esi, dword [esp + 0x40]
movzx eax, ax
mov dword [esp + 0x30], eax
movzx eax, word [esi]
push 0x46
pop ecx
cmp ax, cx
je 0x4039df
push 0x71
pop ecx
cmp ax, cx
je 0x4039df
cmp eax, 0x4a
je 0x4039df
cmp eax, 0x6c
je 0x4039df
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
movzx eax, word [esi]
cmp eax, 0x61
jae 0x405186
push 0x50
pop edx
test edi, edi
jne 0x4051b1
mov edi, esi
mov dword [0x40b0f8], edi
cmp ax, dx
je 0x402221
mov eax, 0x400
push ecx
mov edx, eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00402e74
mov eax, dword [esp + 0x28]
push eax
push 0x1e
pop edx
push edx
pop eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00402e74
push 0x45
pop eax
cmp word [esi], ax
je 0x402276
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0xff0], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + 0x28], eax
xor eax, eax
mov word [esp + 0x17f0], ax
mov ecx, dword [esp + 0x30]
test cx, cx
jne 0x405224
test edi, edi
je 0x4052ee
movzx eax, word [edi]
push 0x59
pop edx
push 0x5a
pop ecx
push 0x45
pop esi
cmp si, ax
je 0x4022a4
cmp dx, ax
je 0x4022a4
cmp cx, ax
je 0x4022a4
call fcn.004028ef
mov edi, dword [0x40b0f8]
push 0x50
pop eax
cmp word [edi], ax
mov eax, dword [esp + 0xe0]
je 0x4022ba
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
sub edi, 0x4027f8
sar edi, 1
push eax
call dword [edi*4 + 0x40c5c0]
pop ecx
mov esi, eax
mov eax, dword [0x40b0f8]
movzx eax, word [eax]
pop ecx
push 0x59
pop ecx
mov dword [esp + 0x2c], esi
cmp ax, cx
je 0x4039ef
push 0x5a
pop ecx
cmp ax, cx
je 0x4039ef
test esi, esi
je 0x40526e
cmp esi, 0x8000
jne 0x405297
mov dword [0x40b0fc], ebx
mov eax, ebx
mov ebx, eax
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.00402449
lea esi, [esp + 0xe0]
call fcn.0040242d
mov ecx, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040234c
mov esp, ebp
pop ebp
ret
movzx eax, word [edi]
test ax, ax
je 0x403707
push 0x2d
pop ecx
cmp ax, cx
je 0x403301
cmp ax, word [esp + 0x24]
jne 0x4036ee
mov eax, dword [esp + 0x18]
lea ecx, [eax - 1]
mov dword [esp + 0x44], ecx
cmp ecx, 1
jne 0x40333b
push 0xffffffffffffffff
push 0x40334c
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x404f7d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
cmp dword [esp + 0x48], ecx
jne 0x4036ee
jmp 0x404f58
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x27ec
call fcn.00403ca7
mov eax, dword [0x40b1b0]
xor eax, esp
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
push ebx
push esi
lea eax, [esp + 0xe8]
push edi
mov dword [esp + 0xe0], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov edi, ecx
mov dword [esp + 0xe8], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x4033dd
push ebx
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1a
mov byte [0x40b0c4], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x4033dd
cmp dword [esp + 0x44], ebx
jne 0x404e25
mov eax, dword [0x40b4f0]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x40bd00]
mov word [eax], cx
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x104
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop ecx
mov dword [esp + 0x18], esi
cmp word [esi], cx
je 0x404e31
mov ecx, eax
movzx eax, word [esi]
test ax, ax
je 0x40344d
cmp ax, cx
je 0x40343d
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x40342d
mov dword [esp + 0x18], esi
cmp word [esi], bx
je 0x40344d
add esi, 2
mov dword [esp + 0x18], esi
push 0xfffffffffffffff5
mov dword [0x40b0f0], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40b0e8], eax
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x403471
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x403477
mov dword [0x40b0e8], ebx
xor eax, eax
mov edi, 0x7fe
push edi
mov word [esp + 0xff4], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push ebx
push eax
mov dword [esp + 0x80], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
push edi
mov word [esp + 0x17f4], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 9
lea eax, reloc.ADVAPI32.dll_TraceMessage
pop edi
mov dword [esp + 0x20], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x20
mov dword [esp + 0x2c], eax
mov dword [esp + 0x60], ebx
mov dword [0x40b0fc], ebx
pop ecx
movzx eax, word [esi]
cmp ax, cx
je 0x4039ac
cmp ax, di
je 0x4039ac
movzx eax, word [esi]
push 0x2d
mov dword [esp + 0x28], 0x2f
mov dword [esp + 0x1c], esi
pop edx
cmp ax, word [esp + 0x24]
jne 0x4039b4
lea eax, [esi + 2]
test eax, eax
je 0x40352a
mov ax, word [eax]
or ax, cx
cmp ax, 0x60
je 0x404e3d
lea edx, [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.0040283d
test eax, eax
js 0x404f4e
mov edi, dword [esp + 0x30]
lea edi, [edi + 1]
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004029a0
test al, al
je 0x4039c2
mov eax, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
xor ecx, ecx
mov word [eax], cx
mov esi, 0x403950
lea edi, reloc.ADVAPI32.dll_TraceMessage
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x403958
lea edi, reloc.ADVAPI32.dll_TraceMessage
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x403960
lea edi, reloc.ADVAPI32.dll_TraceMessage
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
mov eax, 0x4027e4
pop ecx
mov esi, 0x403970
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x48]
mov ecx, eax
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x4037fc
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
mov byte [esp + 0xb98], bl
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x40380c
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
mov byte [esp + 0xba4], bl
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403820
mov byte [esp + 0xbb0], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403828
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403834
mov byte [esp + 0xbbc], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x40383c
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403848
mov byte [esp + 0xbc8], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403850
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403860
mov byte [esp + 0xbd4], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x40388c
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x4038a0
mov byte [esp + 0xbe0], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x4038cc
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x4038e8
mov byte [esp + 0xbec], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403904
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403920
mov byte [esp + 0xbf8], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403940
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x403948
mov byte [esp + 0xc04], 1
mov dword [esp + 0x48], ebx
call fcn.0040283d
test eax, eax
js 0x404f4e
mov esi, dword [esp + 0x18]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x50]
call fcn.00402cbe
mov edi, eax
pop ecx
test edi, edi
jne 0x4032e2
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
mov byte [esp + 0xb98], 1
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov byte [esp + 0xba4], 1
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x50]
mov dword [esp + 0x50], esi
mov dword [esp + 0x1c], ebx
call fcn.00402cbe
mov edi, eax
pop ecx
test edi, edi
je 0x40203f
movzx eax, word [edi]
test ax, ax
je 0x40203f
push 0x2d
pop ecx
cmp ax, cx
je 0x40376f
cmp ax, word [esp + 0x24]
jne 0x4037bc
mov ecx, dword [esp + 0x18]
dec ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov esi, ebx
mov dword [esp + 0x44], ecx
lea edx, [edi + 2]
mov dword [esp + 0x3c], eax
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x404fa5
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
inc esi
add eax, 0xc
mov dword [esp + 0x3c], eax
lea edx, [edi + 2]
cmp esi, 0xa
jb 0x403788
push 1
push dword [esp + 0x1c]
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x104
push edi
lea ebx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00402d90
add esp, 0xc
test eax, eax
jne 0x402316
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x50]
call fcn.00402cbe
xor ebx, ebx
jmp 0x403749
cmp eax, esi
jb 0x402088
xor ecx, ecx
mov word [eax], cx
mov esi, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
sub eax, 2
jmp 0x402073
add esi, 2
jmp 0x4034e1
cmp ax, dx
je 0x403513
jmp 0x40352a
push 0xe
pop ebx
jmp 0x402318
push 0x20
pop edi
jmp 0x402088
test esi, esi
jne 0x402186
jmp 0x4021a0
cmp dword [esp + 0x3c], 0
jne 0x405132
jmp 0x4021e1
mov ebx, esi
jmp 0x402318
mov byte [0x40b0c4], 1
jmp 0x4033dd
add esi, 2
mov dword [esp + 0x18], esi
jmp 0x403425
add esi, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.004028d1
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + 0x38], eax
mov ecx, 0x400
lea eax, [esp + 0x38]
lea edx, [esp + 0x1c]
call fcn.0040408a
test al, al
je 0x40525a
mov eax, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
add eax, eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x64]
push eax
push 0x405e00
mov dword [esp + 0x70], ebx
call fcn.0040712d
pop ecx
pop ecx
test eax, eax
jne 0x402318
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x644]
lea eax, [esp + 0x70]
push eax
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [esp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x404f0d
mov edi, dword [esp + 0x6c]
shr edi, 1
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004029a0
test al, al
je 0x4039c2
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x644]
lea eax, [esp + 0x70]
push eax
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [esp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 9
mov esi, eax
pop edi
push dword [esp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402318
cmp dword [esp + 0x68], 1
jne 0x402318
mov esi, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
push 0x20
pop eax
movzx ecx, word [esi]
mov dword [esp + 0x1c], esi
cmp cx, ax
je 0x404f49
cmp cx, di
jne 0x4020ab
add esi, 2
jmp 0x404f34
mov ebx, 0x65b
jmp 0x402318
push dword [esp + 0x48]
dec eax
push 0x4027e4
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4036ee
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
mov byte [esp + 0xb98], bl
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov byte [esp + 0xba4], bl
jmp 0x40372c
imul esi, esi, 0xc
mov ecx, dword [esp + esi + reloc.ADVAPI32.dll_TraceMessage]
lea edx, [esp + 0x40]
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], 0x104
mov dword [esp + 0x40], ebx
call fcn.0040283d
test eax, eax
js 0x404fe4
movzx eax, byte [esp + esi + 0xb98]
push eax
push dword [esp + 0x44]
push dword [esp + esi + 0xb9c]
jmp 0x4037ce
mov eax, 0x65b
jmp 0x402316
add esi, 2
movzx ecx, word [esi]
mov dword [esp + 0x1c], esi
test cx, cx
je 0x4020a9
jmp 0x402097
push 0x2d
pop eax
cmp cx, ax
je 0x4020d9
push 0x208
lea eax, reloc.ADVAPI32.dll_TraceMessage
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, [esp + 0x20]
mov edi, 0x104
push eax
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], edi
call fcn.004095fe
pop ecx
pop ecx
test eax, eax
je 0x40522d
mov esi, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
test esi, esi
je 0x40507e
push esi
call fcn.00407ba4
mov esi, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
pop ecx
lea ecx, [esp + 0x1c]
call fcn.004028d1
movzx ecx, ax
mov dword [esp + 0x30], ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x4050a9
push esi
call fcn.00408ff6
mov edi, dword [0x40b0f8]
pop ecx
jmp 0x402269
mov edi, dword [0x40b0f8]
jmp 0x40226d
push 9
pop ecx
cmp ax, cx
je 0x40213b
xor esi, esi
inc esi
mov dword [esp + 0x3c], esi
jmp 0x402141
test esi, esi
je 0x402165
jmp 0x405211
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + 0xa]
lea esi, [esp + 0xe0]
call fcn.0040994d
test al, al
je 0x405269
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x90]
lea edx, [esp + 0x1c]
call fcn.0040408a
test al, al
je 0x40525a
mov edi, dword [0x40b0f8]
jmp 0x4021a0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ecx
cmp ax, word [esp + 0x58]
je 0x4021e9
mov ecx, 0x400
lea eax, [esp + 0x38]
lea edx, [esp + 0x1c]
call fcn.0040408a
test al, al
je 0x40525a
lea ecx, [esp + 0x1c]
call fcn.004028d1
movzx eax, ax
mov dword [esp + 0x30], eax
jmp 0x4021e1
cmp eax, 0x7a
ja 0x4021f5
push ecx
sub esi, 0x4027f8
sar esi, 1
push edx
call dword [esi*4 + 0x40c5c0]
pop ecx
pop ecx
test eax, eax
jne 0x405211
mov edi, dword [0x40b0f8]
jmp 0x40223f
push 0x41
cmp ax, dx
pop edx
jne 0x4051f3
cmp word [edi], dx
jne 0x4051f3
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov ecx, edx
call fcn.004089a0
test eax, eax
jne 0x405211
mov eax, dword [esp + 0x28]
push eax
push 0x1e
pop edx
push edx
mov edi, esi
pop eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [0x40b0f8], edi
call fcn.00402e74
jmp 0x40223f
push 0x50
pop esi
cmp word [edi], si
jne 0x405211
cmp ax, dx
jne 0x405211
mov eax, ecx
mov ecx, edx
call fcn.004089a0
test eax, eax
je 0x40223f
call fcn.004077f5
mov esi, 0x667
mov dword [esp + 0x2c], esi
jmp 0x4052f2
mov esi, dword [esp + 0x1c]
jmp 0x4020ce
call fcn.004077f5
mov esi, 0x667
mov dword [esp + 0x2c], esi
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x4052f2
push dword [esp + 0x858]
call fcn.00408ff6
pop ecx
jmp 0x4052f2
call fcn.004077f5
mov ebx, 0x667
jmp 0x402318
push 0xe
pop esi
jmp 0x40521b
push 0x45
pop ecx
cmp ax, cx
jne 0x405285
mov dword [0x40b0fc], 1
jmp 0x40532e
mov eax, dword [0x40b0fc]
mov dword [esp + 0x5c], 1
jmp 0x40532a
mov eax, 0x4eb
cmp esi, eax
jg 0x4052c5
je 0x405315
cmp esi, 0xfffffffe
jl 0x4052e5
test esi, esi
js 0x405317
cmp esi, 1
jle 0x4052e5
cmp esi, 3
jle 0x4052ba
cmp esi, 0x7b
jne 0x4052e5
mov esi, 0x653
mov dword [esp + 0x2c], esi
jmp 0x4052e5
cmp esi, 0x642
jl 0x4052e5
cmp esi, 0x644
jle 0x405315
cmp esi, 0x669
je 0x405315
cmp esi, 0xbc2
je 0x405315
mov ecx, esi
call fcn.004091f3
jmp 0x405315
mov esi, dword [esp + 0x2c]
call fcn.004028ef
test esi, esi
jne 0x405df6
cmp dword [0x40b0f8], esi
jne 0x40531d
call fcn.004077f5
mov esi, 0x667
mov dword [esp + 0x2c], esi
test esi, esi
jne 0x405df6
mov eax, dword [0x40b0fc]
test eax, eax
je 0x405df6
test eax, eax
je 0x405338
push ebx
push ebx
call dword [0x40b18c]
jmp 0x405349
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x405e88
call fcn.00403d99
cmp dword [esp + 0x5c], 0
je 0x405395
cmp dword [0x40b0fc], 0
jne 0x4053a2
mov esi, 0x402828
mov edi, ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push 4
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x40538d
add esi, 0x10
add edi, 4
cmp esi, 0x402838
jge 0x405395
jmp 0x405360
mov dword [esp + 0x74], 1
cmp dword [0x40b0fc], 0
je 0x405da1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
mov ecx, dword [esp + 0x1c]
xor eax, eax
lea edi, reloc.ADVAPI32.dll_TraceMessage
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
mov esi, ebx
pop edi
movzx eax, word [ecx]
mov dword [esp + 0x40], ecx
cmp ax, di
jb 0x4053f0
cmp eax, 0x39
ja 0x4053f0
mov ecx, esi
and ecx, 0x80000001
jns 0x4053e8
dec ecx
or ecx, 0xfffffffe
inc ecx
neg ecx
sbb ecx, ecx
sub eax, edi
jmp 0x405415
push 0x41
pop edx
cmp ax, dx
jb 0x405443
cmp ax, word [esp + 0x54]
ja 0x405443
mov ecx, esi
and ecx, 0x80000001
jns 0x40540e
dec ecx
or ecx, 0xfffffffe
inc ecx
neg ecx
sbb ecx, ecx
add eax, 0xffffffc9
and ecx, 0xfffffff1
add ecx, 0x10
imul ecx, eax
push 0x20
pop eax
cmp esi, eax
jge 0x405d97
mov eax, esi
cdq
sub eax, edx
sar eax, 1
lea eax, reloc.ADVAPI32.dll_TraceMessage
or byte [eax], cl
mov ecx, dword [esp + 0x40]
inc esi
add ecx, 2
jmp 0x4053c8
push 0x20
pop eax
cmp esi, eax
jne 0x405d97
mov byte [esp + 0x38], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x48], bl
cmp word [ecx], bx
je 0x405466
add ecx, 2
movzx eax, word [ecx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0x43
jne 0x405564
mov byte [esp + 0x38], 1
or dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
lea eax, [esp + 0x14]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4054b2
or dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x405d97
cmp byte [esp + 0x13], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jne 0x4054c1
call edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x13], 0
je 0x4054e3
call edi
lea eax, [esp + 0x7c]
push eax
mov edi, ebx
push 8
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4055f1
lea edi, [esp + 0x50]
call fcn.00407160
test eax, eax
jne 0x4055e7
lea eax, [esp + 0xa4]
push eax
push 0x50
pop eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push dword [esp + 0x8c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4055e7
push dword [esp + 0x50]
push dword [esp + 0xc9c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edi, eax
neg edi
sbb edi, edi
and edi, 2
mov dword [esp + 0x18], edi
jmp 0x4055e9
cmp eax, 0x55
jne 0x405578
mov byte [esp + 0x38], 1
mov byte [esp + 0x37], 1
jmp 0x40547d
cmp ax, dx
jne 0x405587
mov byte [esp + 0x48], 1
jmp 0x40547d
cmp eax, 0x4d
je 0x405599
push 0x45
pop edx
cmp ax, dx
je 0x40559e
jmp 0x40547d
mov byte [esp + 0x13], 1
lea eax, [ecx + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
test edi, edi
je 0x405d85
cmp edi, reloc.ADVAPI32.dll_TraceMessage
je 0x405d85
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov dword [esp + 0x58], eax
call esi
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40547d
mov edi, 0x405f10
jmp 0x405d90
mov edi, ebx
push dword [esp + 0x7c]
call esi
jmp 0x40563a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
push 0x206
mov word [esp + 0xdec], cx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ebx
push ecx
mov esi, eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push 0x405f80
mov eax, 0x104
lea ebx, reloc.ADVAPI32.dll_TraceMessage
call fcn.004070cc
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
pop ecx
xor ebx, ebx
cmp byte [esp + 0x37], 0
je 0x405662
cmp edi, 1
jne 0x40564a
push 7
jmp 0x405650
test edi, edi
jne 0x405657
push 6
pop edi
mov dword [esp + 0x18], edi
jmp 0x405666
push ebx
mov edi, 0x405fc0
jmp 0x405d91
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x48], 0
je 0x405687
test edi, edi
jne 0x405675
push 4
jmp 0x405680
cmp edi, 1
jne 0x405d97
push 5
pop eax
mov dword [esp + 0x18], eax
jmp 0x40568b
mov eax, dword [esp + 0x18]
push 3
mov dword [esp + 0x84], 0x100
pop ecx
test eax, eax
je 0x4056b6
cmp eax, 1
je 0x4056b6
cmp eax, 4
je 0x4056b6
cmp eax, 5
je 0x4056b6
cmp eax, 6
je 0x4056b6
cmp eax, 7
jne 0x4056b9
push 2
pop ecx
push ecx
lea eax, [esp + 0x84]
push eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00402f07
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4056ea
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x4056e3
push dword [esp + 0x14]
call esi
mov ebx, edi
jmp 0x402318
mov eax, dword [esp + 0x80]
lea edi, [esp + 0xf0]
mov dword [esp + 0xa0], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], eax
call fcn.004099ee
mov eax, dword [esp + 0x78]
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004099ee
mov eax, dword [esp + 0x8c]
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004099ee
mov eax, dword [esp + 0x84]
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004099ee
mov eax, dword [esp + 0x70]
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004099ee
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x204]
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x31c]
lea eax, [esp + 0x9c]
push eax
push dword [esp + 0x434]
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x54c]
lea eax, [esp + 0xc0]
push eax
push dword [esp + 0x114]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x40584f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0xffffffff
mov ebx, eax
je 0x4057d3
push dword [esp + 0x14]
call esi
mov esi, 0x100
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], esi
jle 0x4057ee
push dword [esp + 0x200]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], esi
jle 0x405804
push dword [esp + 0x310]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], esi
jle 0x40581a
push dword [esp + 0x420]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], esi
jle 0x405830
push dword [esp + 0x530]
call fcn.00408ff6
pop ecx
cmp dword [esp + 0xf4], esi
jle 0x402318
push dword [esp + 0xf0]
call fcn.00408ff6
pop ecx
jmp 0x402318
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push 0xffffffffffffffff
push dword [esp + 0x110]
call dword [0x40b188]
mov edi, eax
test edi, edi
je 0x405905
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x40587e
push dword [esp + 0x14]
call esi
push edi
mov edi, 0x406088
call fcn.00409011
pop ecx
mov ebx, 0x100
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x4058a5
push dword [esp + 0x200]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x4058bb
push dword [esp + 0x310]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x4058d1
push dword [esp + 0x420]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x4058e7
push dword [esp + 0x530]
call fcn.00408ff6
pop ecx
cmp dword [esp + 0xf4], ebx
jle 0x405d97
push dword [esp + 0xf0]
call fcn.00408ff6
jmp 0x405d96
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esp + 0x30], eax
test eax, eax
jne 0x405930
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x40588a
push dword [esp + 0x14]
call esi
jmp 0x40588a
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [esp + 0x50], eax
test eax, eax
je 0x40591a
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00409799
mov esi, eax
test esi, esi
jne 0x405997
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x405966
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov edi, 0x4060e8
call fcn.00409011
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405980
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40588a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40588a
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x88], ebx
call fcn.0040746d
mov edi, eax
test edi, edi
jne 0x4059c6
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x4059be
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x405972
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4059d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x20]
push ecx
push 0x406298
mov dword [esp + 0x28], ebx
mov eax, dword [edi]
push edi
call dword [eax]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x60], edi
test eax, eax
je 0x405a03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x88]
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x44]
push ecx
push dword [esp + 0x2c]
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push 0x10
push ecx
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x40], ebx
mov eax, dword [esi]
push esi
call dword [eax + 0x38]
test eax, eax
je 0x405a58
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x405a47
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x406148
push ebx
call fcn.00409011
pop ecx
jmp 0x4059be
push dword [esp + 0x3c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x54], eax
test eax, eax
jne 0x405a8f
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x405a81
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0x4061b8
jmp 0x405a4d
push dword [esp + 0x24]
call dword [0x40c75c]
test eax, eax
je 0x4059ad
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x406288
push eax
call dword [ecx]
mov edx, ebx
cmp edi, dword [esp + 0x60]
jne 0x405ac6
cmp edi, 6
je 0x405ac6
cmp edi, 7
jne 0x405aca
lea edx, [esp + 0x60]
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
lea edi, reloc.ADVAPI32.dll_TraceMessage
push edi
push edx
push eax
call dword [ecx + 0xa0]
mov eax, dword [esp + 0x28]
push dword [esp + 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa8]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x50]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xac]
push dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x8c]
mov ecx, dword [eax]
push dword [esp + 0x50]
push dword [esp + 0x44]
push dword [esp + 0x4c]
push eax
call dword [ecx + 0xa4]
cmp dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x50], eax
je 0x405b45
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x50]
test eax, eax
je 0x405b53
mov edi, 0x406228
jmp 0x405a4c
mov eax, dword [esp + 0x28]
push dword [esp + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x9c]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405b78
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x405b86
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x54]
push 3
pop ecx
push 0x1cff
push 0xffffffffffffffff
mov dword [esp + 0xa0], eax
push ebx
lea eax, [esp + 0xa0]
push eax
push ecx
mov dword [0x40b0e4], ecx
mov byte [esp + 0x27], bl
mov dword [esp + 0xa8], esi
mov dword [esp + 0xb0], edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x405cbf
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, 1
je 0x405cb5
cmp eax, 2
jne 0x405c1f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x5c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb0]
push dword [esp + 0x58]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405c93
mov dword [esp + 0x94], esi
jmp 0x405c6a
cmp eax, 3
je 0x405c4f
jmp 0x405cbf
cmp dword [esp + 0xac], 0x12
je 0x405c8b
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xb8]
push eax
call edi
test eax, eax
jne 0x405c29
mov al, byte [esp + 0x13]
test al, al
jne 0x405cbf
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa0]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x405cbf
jmp 0x405bd5
mov al, 1
mov byte [esp + 0x13], al
jmp 0x405c66
cmp dword [esp + 0x14], reloc.ADVAPI32.dll_TraceMessage
je 0x405ca4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0x4061b8
jmp 0x405884
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x405ceb
push dword [esp + 0x200]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x405d01
push dword [esp + 0x310]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x405d17
push dword [esp + 0x420]
call fcn.00408ff6
pop ecx
cmp dword [esp + reloc.ADVAPI32.dll_TraceMessage], ebx
jle 0x405d2d
push dword [esp + 0x530]
call fcn.00408ff6
pop ecx
cmp dword [esp + 0xf4], ebx
jle 0x405d43
push dword [esp + 0xf0]
call fcn.00408ff6
pop ecx
cmp dword [esp + 0x5c], 0
je 0x405d63
cmp dword [0x40b0fc], 0
jne 0x405d63
mov eax, dword [0x40b1a8]
test eax, eax
je 0x405d63
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x74], 0
je 0x405df6
mov ebx, 0x641
mov ecx, ebx
call fcn.004091f3
jmp 0x402318
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x405ea8
push eax
call fcn.00409011
pop ecx
mov ebx, 0x641
jmp 0x402318
mov dword [0x40b0e4], 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xd0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x405dd8
cmp dword [0x40cb00], eax
je 0x405d43
cmp dword [0x40c580], eax
je 0x405d43
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x405dab
mov eax, dword [esp + 0x2c]
jmp 0x402316