Function at 0x402825
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
and dword [esp + 4], 0
push ebx
push ebp
push esi
push edi
push 6
mov byte [esp + 0x38], 0
pop ecx
xor eax, eax
lea edi, [esp + 0x35]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40c774
mov dword [esp + 0x20], 1
mov dword [0x40c8cc], 0x25e36637
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x40c770], eax
call fcn.00406681
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, 0x100000
push ebx
push 0x40
call esi
mov ebp, eax
movzx eax, word [0x40ca16]
push eax
movzx eax, word [0x40ca14]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
movzx eax, byte [0x40ca1a]
push eax
push dword [0x40c990]
mov dword [esp + 0x28], ebp
push dword [0x40c98c]
push dword [0x40c988]
push dword [0x40c984]
push str.ISFB:_Windows_Version__d._d._d___x__x___d._d
push ebp
call edi
add esp, 0x24
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x40c89c], 0
je 0x40291b
push ebx
push 0x40
call esi
push dword [0x40c89c]
mov dword [esp + 0x1c], eax
push str.ISFB:_Started_from___s__n
push eax
call edi
add esp, 0xc
push dword [esp + 0x18]
call ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [0x40c884]
xor eax, eax
call fcn.004057f9
test eax, eax
je 0x40293e
mov dword [0x40c88c], 1
mov dword [esp + 0x14], 8
lea eax, [esp + 0x34]
push eax
call fcn.00405221
test eax, eax
jne 0x40298e
push ebx
push 0x40
call esi
push str.ISFB:_Failed_to_resolve_current_user_SID._n
mov esi, eax
push esi
call edi
pop ecx
pop ecx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor ebx, ebx
cmp dword [esp + 0x1c], ebx
je 0x402984
cmp dword [0x40c89c], ebx
je 0x402984
call fcn.0040653b
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x35], 2
jbe 0x4029b2
movzx eax, byte [esp + 0x35]
add eax, 0xfffffffe
xor ecx, ecx
test eax, eax
jle 0x4029b2
mov edx, dword [esp + ecx*4 + 0x40]
add dword [0x40c804], edx
inc ecx
cmp ecx, eax
jl 0x4029a3
xor dword [0x40c804], 0xcf8558fc
call fcn.004017a3
test eax, eax
jne 0x4029d1
push ebx
push 0x40
call esi
push str.ISFB:_Failed_generating_machine_level_names._n
jmp 0x402956
push dword [esp + 0x14]
call fcn.00401ba6
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x20], eax
jne 0x402a13
cmp dword [0x40c89c], ecx
je 0x402a13
lea eax, [esp + 0x18]
push eax
call fcn.0040264c
test eax, eax
jne 0x402a11
cmp dword [esp + 0x18], 0x1000
jne 0x402a11
call fcn.0040271a
push 5
pop esi
jmp 0x402984
xor ecx, ecx
cmp byte [0x40c888], 5
push ecx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x38], ecx
push 1
jbe 0x402a37
push str.S:_ML__NW___LW_
jmp 0x402a3c
push str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU__A_OICI_GA___BA_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
push dword [0x40c808]
lea eax, [esp + 0x2c]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 0x18], eax
je 0x402967
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402aa9
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push 0x40
call esi
mov esi, eax
push str.ISFB:_Client_update_event_fired__waiting_for_clients_to_unload_n
push esi
call edi
pop ecx
pop ecx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
call fcn.004025e2
xor ebx, ebx
cmp dword [esp + 0x20], ebx
jne 0x402ad1
push dword [esp + 0x14]
call fcn.00401c8b
mov dword [esp + 0x1c], eax
jmp 0x402ad5
mov dword [esp + 0x1c], ebx
push dword [esp + 0x14]
call fcn.00402130
push dword [0x40c80c]
lea eax, [esp + 0x2c]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
cmp esi, ebx
je 0x402b17
or dword [esp + 0x24], 0xffffffff
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x38], 0xff676980
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push esi
call edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
jmp 0x402971