Function at 0x463c67
Capabilities:
Query environment variable
Resume thread
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c4ff
mov eax, dword fs:[0]
push eax
mov eax, 0x20fc
call fcn.004d9200
mov eax, dword [0x577014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x206c], ebx
mov dword [ebp - 0x2078], ebx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x20b4]
mov dword [ebp - 0x2014], ebx
mov dword [ebp - 0x2014], edi
call fcn.0045d071
and dword [ebp - 4], 0
lea edx, [ebp - 0x20b4]
push esi
lea ecx, [ebp - 0x2048]
call fcn.004b382a
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2048], 0
jge 0x463d6c
cmp dword [ebp - 0x2044], 0
mov eax, 0x1242
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x203c]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
add ecx, 0xfffffff0
call fcn.00407189
mov ecx, dword [ebp - 0x2040]
add ecx, 0xfffffff0
call fcn.00407189
lea ecx, [ebp - 0x20b4]
call fcn.004635d5
mov eax, ebx
jmp 0x46537b
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
xor esi, esi
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
and dword [ebp - 0x2054], esi
and dword [ebp - 0x2050], esi
mov dword [ebp - 0x2058], esi
mov byte [ebp - 4], 3
or dword [ebp - 0x20b8], 0xffffffff
or dword [ebp - 0x20bc], 0xffffffff
mov edx, dword [ebp - 0x2094]
test edx, edx
jne 0x463dcd
mov eax, dword [ebp - 0x2098]
cmp eax, 0xffffffff
jne 0x463dcd
mov cl, byte [ebp - 0x2090]
test cl, cl
je 0x4640c7
lea eax, [ebp - 0x20b4]
push eax
lea edx, [ebp - 0x205c]
lea ecx, [ebp - 0x2048]
call fcn.0046380d
pop ecx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x2048], 0
jge 0x463e80
cmp dword [ebp - 0x2044], 0
mov eax, 0x124f
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [esi], eax
call fcn.00406620
mov byte [ebp - 4], 5
lea eax, [ebp - 0x203c]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
lea ecx, [ebp - 0x205c]
call fcn.004065be
jmp 0x463d5a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2040]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, esp
lea esi, [ebp - 0x20b0]
push 0x5446d4
call fcn.00406fea
mov edx, esi
lea ecx, [ebp - 0x2048]
call fcn.00428612
pop ecx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2048], 0
jge 0x463f0a
cmp dword [ebp - 0x2044], 0
mov eax, 0x1253
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [esi], eax
call fcn.00406620
mov byte [ebp - 4], 7
jmp 0x463e3c
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x2080]
push eax
push 4
lea eax, [ebp - 0x20b8]
push eax
push 0xc
push dword [ebp - 0x2058]
call esi
test eax, eax
jne 0x463f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1255
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
lea eax, [ebp - 0x203c]
mov byte [ebp - 4], 8
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
jmp 0x463e5e
xor eax, eax
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2018], eax
push eax
push 8
lea ecx, [ebp - 0x2024]
call fcn.0040654e
test al, al
jne 0x464038
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1259
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x203c]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, vtable.ATL::CAccessToken.0
lea ecx, [ebp - 0x2024]
mov dword [ebp - 0x2024], esi
call fcn.004065be
mov dword [ebp - 0x205c], esi
jmp 0x463e70
lea eax, [ebp - 0x2080]
push eax
push 4
lea eax, [ebp - 0x20bc]
push eax
push 0xc
push dword [ebp - 0x2020]
call esi
test eax, eax
jne 0x464096
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x125a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0xb
jmp 0x463ffb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2024]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
mov cl, byte [ebp - 0x2090]
mov edx, dword [ebp - 0x2094]
mov eax, dword [ebp - 0x2098]
mov esi, dword [ebp - 0x2058]
test edx, edx
jne 0x4640ea
cmp eax, 0xffffffff
jne 0x4640ea
test cl, cl
jne 0x4640ea
push esi
push edi
lea edx, [ebp - 0x20b4]
mov ecx, ebx
call fcn.004615b4
pop ecx
pop ecx
jmp 0x463e66
cmp byte [ebp - 0x209d], 0
je 0x4644c9
cmp byte [ebp - 0x209c], 0
je 0x4644c9
lea ecx, [ebp - 0x202c]
call fcn.0042b986
push dword [ebp - 0x20b0]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call edi
test eax, eax
jne 0x46418b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x127e
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x203c]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [ebp - 0x202c]
call edi
mov ecx, dword [ebp - 0x202c]
jmp 0x463e5e
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2010]
push esi
push eax
call fcn.004d9f30
add esp, 0xc
lea eax, [ebp - 0x2010]
push 0x1000
push eax
push dword [ebp - 0x20a8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4641fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1281
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0xe
jmp 0x46415c
mov dword [ebp - 0x203c], esi
mov dword [ebp - 0x2038], esi
lea eax, [ebp - 0x2068]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x203c]
call fcn.0046008f
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x2068], 0
jge 0x4642b1
cmp dword [ebp - 0x2064], 0
mov eax, 0x1285
mov edi, dword [ebp - 0x2060]
cmovne eax, dword [ebp - 0x2064]
push eax
push dword [ebp - 0x2068]
push ecx
mov esi, esp
lea ecx, [edi - 0x10]
mov dword [ebp - 0x2014], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2048]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 0x11
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x202c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x464180
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2108]
push 0
push eax
call fcn.004d9f30
xor eax, eax
mov dword [ebp - 0x2108], esi
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2018], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2048]
mov edx, dword [ebp - 0x2058]
mov esi, 0x128a
push esi
call fcn.0045d2a3
add esp, 0x10
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x2048], 0
jge 0x4643cb
cmp dword [ebp - 0x2044], 0
cmovne esi, dword [ebp - 0x2044]
push esi
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2068]
mov dword [esi], eax
call fcn.00406620
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x2068]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4643a8
push dword [ebp - 0x2020]
call esi
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x4643c0
push dword [ebp - 0x2024]
call esi
and dword [ebp - 0x2024], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x464178
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x2040]
add ecx, 0xfffffff0
call fcn.00407189
mov esi, dword [ebp - 0x2058]
lea eax, [ebp - 0x2024]
push 0
push 0
push eax
lea eax, [ebp - 0x2108]
push eax
push ecx
lea eax, [ebp - 0x2010]
mov ecx, esp
push eax
call fcn.00406fea
mov edx, esi
lea ecx, [ebp - 0x2048]
call fcn.0046122f
add esp, 0x14
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x2048], 0
jge 0x46446b
cmp dword [ebp - 0x2044], 0
mov eax, 0x128c
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2068]
mov dword [esi], eax
call fcn.00406620
mov byte [ebp - 4], 0x16
jmp 0x464360
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x464497
push dword [ebp - 0x2020]
call esi
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x4644af
push dword [ebp - 0x2024]
call esi
and dword [ebp - 0x2024], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
jmp 0x464178
mov edx, str.SeCreateGlobalPrivilege
lea ecx, [ebp - 0x203c]
call fcn.0040124a
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x2030]
call fcn.004282f6
lea eax, [ebp - 0x2030]
mov byte [ebp - 4], 0x17
push eax
mov edx, str.Global_
lea ecx, [ebp - 0x2078]
call fcn.004093b4
pop ecx
xor edi, edi
push dword [eax]
push 0x2000000
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 0x202c], esi
mov ecx, dword [ebp - 0x2078]
lea ecx, [ecx - 0x10]
call fcn.00407189
test esi, esi
jne 0x46459f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12b8
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
lea eax, [ebp - 0x203c]
mov byte [ebp - 4], 0x19
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2030]
jmp 0x463e5e
push 0x2000000
push edi
push edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x20c0], edi
test edi, edi
jne 0x46461e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12ca
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
lea eax, [ebp - 0x203c]
mov byte [ebp - 4], 0x1b
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464594
lea ecx, [ebp - 0x2074]
call fcn.0040687a
push ecx
lea eax, [ebp - 0x20b4]
mov byte [ebp - 4], 0x1c
push eax
lea edx, [ebp - 0x2074]
lea ecx, [ebp - 0x2068]
call fcn.004b3906
pop ecx
pop ecx
mov byte [ebp - 4], 0x1d
cmp dword [ebp - 0x2068], 0
jge 0x4646f2
cmp dword [ebp - 0x2064], 0
mov eax, 0x12d3
cmovne eax, dword [ebp - 0x2064]
push eax
push dword [ebp - 0x2068]
mov eax, dword [ebp - 0x2060]
push ecx
add eax, 0xfffffff0
mov ebx, esp
mov ecx, eax
mov dword [ebp - 0x2014], ebx
mov dword [ebp - 0x2078], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [ebx], eax
call fcn.00406620
mov ecx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov byte [ebp - 4], 0x1e
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2078]
call fcn.00407189
mov ecx, dword [ebp - 0x2074]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x465347
mov ecx, dword [ebp - 0x2060]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [ebp - 0x2074]
add eax, 0xfffffff0
mov dword [ebp - 0x2070], eax
mov eax, dword [eax + 4]
add eax, eax
cmp eax, 0x1fffffa
jb 0x46476f
push 0x12d5
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
lea eax, [ebp - 0x203c]
mov byte [ebp - 4], 0x1f
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2070]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x464612
lea ebx, [eax + 2]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push ebx
push dword [ebp - 0x2074]
lea ecx, [edi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4647f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12d9
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov ecx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov byte [ebp - 4], 0x20
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2070]
jmp 0x4646da
mov ecx, dword [ebp - 0x2070]
call fcn.00407189
lea ecx, [ebp - 0x2074]
call fcn.0040687a
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x2079], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x22
call fcn.0044f24f
mov ecx, dword [eax + 0x60]
sub ecx, 0x10
call fcn.004070e7
lea esi, [eax + 0x10]
mov dword [ebp - 0x2070], esi
lea ecx, [ebp - 0x2079]
mov byte [ebp - 4], 0x24
call fcn.0044f694
push ecx
add esi, 0xfffffff0
mov ebx, esp
mov dword [ebp - 0x2078], ebx
mov ecx, esi
mov dword [ebp - 0x2078], esi
call fcn.004070e7
add eax, 0x10
lea edx, [ebp - 0x2074]
lea ecx, [ebp - 0x2048]
mov dword [ebx], eax
call fcn.00463633
pop ecx
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x2048], 0
jge 0x46492d
cmp dword [ebp - 0x2044], 0
mov eax, 0x12e5
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [esi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov byte [ebp - 4], 0x26
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2078]
call fcn.00407189
mov ecx, dword [ebp - 0x2074]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x202c]
jmp 0x4646e7
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, esi
mov byte [ebp - 4], 0x21
call fcn.00407189
lea eax, [ebp - 0x2030]
mov edx, str.__runsetup
push eax
lea ecx, [ebp - 0x2078]
call fcn.004093b4
pop ecx
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x2074]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004d5d16
mov ecx, dword [ebp - 0x2078]
add ecx, 0xfffffff0
call fcn.00407189
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x2108]
push ebx
push eax
call fcn.004d9f30
add esp, 0xc
mov dword [ebp - 0x2108], esi
mov dword [ebp - 0x2024], ebx
mov dword [ebp - 0x2020], ebx
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x2018], ebx
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0x2058], ebx
jne 0x464a60
push 0x12ed
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x29
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x464a26
push dword [ebp - 0x2020]
call esi
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x464a3e
push dword [ebp - 0x2024]
call esi
and dword [ebp - 0x2024], 0
mov ecx, dword [ebp - 0x2074]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x202c]
call esi
jmp 0x464594
lea ecx, [ebp - 0x204c]
call fcn.0042b986
push dword [ebp - 0x20b0]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call esi
test eax, eax
jne 0x464aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12f0
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x2b
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [ebp - 0x204c]
call esi
mov ecx, dword [ebp - 0x204c]
jmp 0x464a00
mov dword [ebp - 0x2028], ebx
mov dword [ebp - 0x203c], ebx
mov dword [ebp - 0x2038], ebx
lea eax, [ebp - 0x2068]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x203c]
call fcn.0046008f
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0x2068], 0
jge 0x464c55
cmp dword [ebp - 0x2064], 0
mov eax, 0x12f8
mov ebx, dword [ebp - 0x2060]
cmovne eax, dword [ebp - 0x2064]
push eax
push dword [ebp - 0x2068]
push ecx
mov esi, esp
lea ecx, [ebx - 0x10]
mov dword [ebp - 0x2014], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2048]
mov dword [esi], eax
call fcn.00406620
mov esi, dword [ebp - 0x206c]
lea eax, [ebp - 0x2048]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2f
call fcn.0040121b
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebx - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x2028], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x464bb9
push dword [ebp - 0x2028]
call ebx
and dword [ebp - 0x2028], 0
push dword [ebp - 0x204c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x204c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
je 0x464beb
push dword [ebp - 0x2020]
call ebx
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x464c03
push dword [ebp - 0x2024]
call ebx
and dword [ebp - 0x2024], 0
mov ecx, dword [ebp - 0x2074]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x202c]
call ebx
mov ecx, dword [ebp - 0x2030]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x205c]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
lea ecx, [ebp - 0x20b4]
call fcn.004635d5
mov eax, esi
jmp 0x46537b
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x2060]
add ecx, 0xfffffff0
call fcn.00407189
lea eax, [ebp - 0x2028]
push eax
push 1
push 3
push ebx
push 0xf01ff
push dword [ebp - 0x203c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x464d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12fd
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2068]
call fcn.00406620
mov byte [ebp - 4], 0x30
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x2068]
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x2028], 0
je 0x464d0b
push dword [ebp - 0x2028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2028], 0
push dword [ebp - 0x204c]
call esi
mov ecx, dword [ebp - 0x204c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
je 0x464d3d
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x464d59
push dword [ebp - 0x2024]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2024], 0
mov ecx, dword [ebp - 0x2074]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x202c]
jmp 0x464613
push 4
lea eax, [ebp - 0x20b8]
push eax
push 0xc
push dword [ebp - 0x2028]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x464dd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1300
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2068]
call fcn.00406620
mov byte [ebp - 4], 0x31
jmp 0x464cc7
mov ebx, dword [ebp - 0x2028]
lea eax, [ebp - 0x2024]
push 0
push 4
push eax
lea eax, [ebp - 0x2108]
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x2070], esi
mov eax, dword [ebp - 0x2074]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x2070], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2048]
mov edx, ebx
mov dword [esi], eax
call fcn.0046122f
add esp, 0x14
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x2048], 0
jge 0x464f1f
cmp dword [ebp - 0x2044], 0
mov eax, 0x1302
cmovne eax, dword [ebp - 0x2044]
push eax
push dword [ebp - 0x2048]
push ecx
mov ecx, dword [ebp - 0x2040]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2068]
mov dword [esi], eax
call fcn.00406620
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x2068]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x33
call fcn.0040121b
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x2028], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x464eca
push dword [ebp - 0x2028]
call esi
and dword [ebp - 0x2028], 0
push dword [ebp - 0x204c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x204c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
je 0x464efc
push dword [ebp - 0x2020]
call esi
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x464f14
push dword [ebp - 0x2024]
call esi
and dword [ebp - 0x2024], 0
mov ecx, dword [ebp - 0x2070]
jmp 0x464a47
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov edx, dword [ebp - 0x2058]
lea ecx, [ebp - 0x2068]
mov esi, 0x1304
push esi
call fcn.0045d2a3
pop ecx
mov byte [ebp - 4], 0x34
cmp dword [ebp - 0x2068], 0
jge 0x464fc3
cmp dword [ebp - 0x2064], 0
cmovne esi, dword [ebp - 0x2064]
push esi
push dword [ebp - 0x2068]
push ecx
mov ecx, dword [ebp - 0x2060]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2048]
mov dword [esi], eax
call fcn.00406620
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x2048]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x35
call fcn.0040121b
mov ecx, dword [ebp - 0x2040]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2060]
jmp 0x464e9e
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
and dword [ebp - 0x2078], 0
mov esi, dword [ebp - 0x2024]
mov ebx, dword [ebp - 0x2058]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [ebp - 0x2078]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x465049
call fcn.00406710
push 0
push dword [ebp - 0x2024]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x130c
push esi
push ecx
mov ecx, esp
call fcn.0040687a
mov ebx, dword [ebp - 0x206c]
mov ecx, ebx
call fcn.00406620
jmp 0x464ea6
xor ebx, ebx
lea eax, [ebp - 0x2078]
push ebx
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4650bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x130f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2068]
call fcn.00406620
mov byte [ebp - 4], 0x36
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x2068]
push eax
mov ecx, ebx
call fcn.0040121b
jmp 0x464fb8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test eax, eax
jne 0x465104
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1311
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2068]
call fcn.00406620
mov byte [ebp - 4], 0x37
jmp 0x4650a2
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2028], ebx
je 0x46512c
push dword [ebp - 0x2028]
call esi
mov byte [ebp - 4], 0x28
push dword [ebp - 0x204c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x204c]
add ecx, 0xfffffff0
call fcn.00407189
push 0x3e8
push dword [ebp - 0x2024]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x46514a
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x2080], ebx
push eax
push dword [ebp - 0x2024]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4651d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1325
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0x38
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
jmp 0x464edc
cmp dword [ebp - 0x2080], ebx
je 0x465204
push 0x1327
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x203c]
call fcn.00406620
mov byte [ebp - 4], 0x39
jmp 0x4651ba
push ecx
xor eax, eax
mov ecx, esp
push edi
mov word [edi + 0x1fffffe], ax
call fcn.00406fea
mov ebx, dword [ebp - 0x2014]
lea ecx, [ebp - 0x2068]
mov edx, ebx
call fcn.004b3a3e
pop ecx
mov byte [ebp - 4], 0x3a
cmp dword [ebp - 0x2068], 0
jge 0x4652f3
cmp dword [ebp - 0x2064], 0
mov eax, 0x132e
cmovne eax, dword [ebp - 0x2064]
push eax
push dword [ebp - 0x2068]
push ecx
mov ecx, dword [ebp - 0x2060]
mov esi, esp
mov dword [ebp - 0x2014], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x203c]
mov dword [esi], eax
call fcn.00406620
mov ebx, dword [ebp - 0x206c]
lea eax, [ebp - 0x203c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x3b
call fcn.0040121b
mov ecx, dword [ebp - 0x2034]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x2020], 0
je 0x4652cc
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2024], 0
je 0x4652e8
push dword [ebp - 0x2024]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2024], 0
mov ecx, dword [ebp - 0x2070]
jmp 0x464d62
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x2060]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x206c]
lea eax, [ebx + 0xc]
cmp dword [eax], 0
jge 0x46531b
push eax
call fcn.0040121b
jmp 0x465322
push 0
call fcn.00406602
lea ecx, [ebp - 0x2024]
call fcn.0045ce02
mov ecx, dword [ebp - 0x2070]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x202c]
call esi
mov ecx, dword [ebp - 0x2030]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x205c]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
lea ecx, [ebp - 0x20b4]
call fcn.004635d5
mov eax, dword [ebp - 0x206c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d818b
leave
ret