Function at 0x408ea0
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d00
call fcn.004072e0
mov eax, dword [0x413024]
xor eax, ebp
mov dword [ebp - 0xbc], eax
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00408d60
mov eax, dword [0x4148b0]
and eax, 0x20000000
neg eax
sbb eax, eax
and eax, 0x1000
mov dword [0x4148ac], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x94], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00409e20
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 1
jmp 0x408f47
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0xc]
jge 0x408f95
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
cmp dword [eax + edx*4], 0
je 0x408f93
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + eax*4]
push edx
call fcn.004080e0
add esp, 0x18
test eax, eax
jne 0x408f93
jmp 0x408f95
jmp 0x408f3e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x84]
and ecx, 0x20
je 0x408fbb
cmp dword [ebp - 8], 0
jne 0x408fbb
mov edx, dword [ebp - 0x84]
and edx, 0xffffffdf
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x84]
and eax, 8
je 0x408ff9
cmp dword [ebp - 0x30], 0
jne 0x408ff9
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x8c], eax
jmp 0x408f16
mov ecx, dword [ebp - 0x84]
and ecx, 2
je 0x409036
push 0x40
push str.Hstart___Command_Line
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004080a0
add esp, 0xc
cmp dword [ebp - 0x94], 0
je 0x409036
push 0x40
push str.Hstart___Starting_Directory
mov eax, dword [ebp - 0x94]
push eax
call fcn.004080a0
add esp, 0xc
mov ecx, dword [0x4148b0]
and ecx, 0x20000000
je 0x4095a7
mov edx, dword [ebp - 0x84]
and edx, 0x8000
je 0x4090c2
call fcn.004088f0
test eax, eax
jne 0x409080
mov eax, dword [ebp - 0x84]
and eax, 0x400
jne 0x409080
mov ecx, dword [ebp - 0x84]
or ecx, 0x200
mov dword [ebp - 0x84], ecx
jmp 0x4090c2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0040a370
mov dword [ebp - 0x98], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x98], 0
jge 0x4090bb
push 0
push str.Failed_to_register_the_Hstart_UAC_task.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
xor eax, eax
jmp 0x409ce3
mov edx, dword [ebp - 0x84]
and edx, 0x10000
je 0x40913c
call fcn.004088f0
test eax, eax
jne 0x4090fa
mov eax, dword [ebp - 0x84]
and eax, 0x400
jne 0x4090fa
mov ecx, dword [ebp - 0x84]
or ecx, 0x200
mov dword [ebp - 0x84], ecx
jmp 0x40913c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0040bb50
mov dword [ebp - 0x9c], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x9c], 0
jge 0x409135
push 0
push str.Failed_to_unregister_the_Hstart_UAC_task.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
xor eax, eax
jmp 0x409ce3
mov edx, dword [ebp - 0x84]
and edx, 0x4000
je 0x4092a1
cmp dword [ebp - 0x88], 0
jne 0x4092a1
mov eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [str.MyTestFileMappingObject]
push ecx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4091a1
push 0
push str.OpenFileMapping_failed.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
push 0x1000
push 0
push 0
push 4
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x4091ee
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.MapViewOfFile_failed.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
mov ecx, dword [str.MyTestFileMappingEvent]
push ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x409228
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00409e20
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x8c], 0
jne 0x40927a
push 0
push str.Failed_to_parse_the_command_line_arguments__UACTASK_.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
mov dword [ebp - 0x88], 1
call fcn.00408ca0
test eax, eax
je 0x40929c
mov edx, dword [ebp - 0x88]
add edx, 1
mov dword [ebp - 0x88], edx
jmp 0x408f16
mov eax, dword [ebp - 0x84]
and eax, 0x2000
je 0x4093ff
call fcn.004088f0
test eax, eax
jne 0x4093ff
mov ecx, dword [str.MyTestFileMappingObject]
push ecx
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x409301
push 0
push str.Failed_to_create_file_mapping_object.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
push 0x1000
push 0
push 0
push 0xf001f
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x409351
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Failed_to_map_view_of_file.
call fcn.00408c80
add esp, 8
mov eax, 0x80004005
jmp 0x409ce3
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.00401570
add esp, 0xc
mov edx, dword [str.MyTestFileMappingEvent]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xb8], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp - 0xb8]
push eax
call fcn.0040c560
add esp, 4
mov dword [ebp - 0xb4], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xb4], 0
jge 0x4093f8
push 0
push str.Failed_to_run_Hstart_with__NOUAC_switch._Maybe_the_Hstart_UAC_task_in_Task_Scheduler_is_misconfigured_or_inactive._Run_Hstart_with__REGTASK_switch_to_fix_it.
call fcn.00408c80
add esp, 8
mov eax, 1
jmp 0x409ce3
xor eax, eax
jmp 0x409ce3
mov ecx, dword [ebp - 0x84]
and ecx, 0x200
je 0x4095a7
mov edx, dword [ebp - 0x84]
and edx, 0x400
jne 0x4095a7
call fcn.004088f0
test eax, eax
jne 0x4095a7
push 0x104
lea eax, [ebp - 0x2c8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409593
mov cx, word [0x41136c]
mov word [ebp - 0x12c8], cx
push 0xffe
push 0
lea edx, [ebp - 0x12c6]
push edx
call fcn.004018e0
add esp, 0xc
mov dword [ebp - 0x18], 1
jmp 0x409482
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0xc]
jge 0x409572
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + edx*4]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x4094b6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + eax*4]
movzx eax, word [edx]
cmp eax, 0x2d
jne 0x409523
push 0x41153c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + ecx*4]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4094e1
mov dword [ebp - 0x2cf0], str._UAC2
jmp 0x4094f3
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x2cf0], eax
mov ecx, dword [ebp - 0x2cf0]
push ecx
push 0x800
lea edx, [ebp - 0x12c8]
push edx
call fcn.00401090
push 0x411544
push 0x800
lea eax, [ebp - 0x12c8]
push eax
call fcn.00401090
jmp 0x40956d
push 0x411548
push 0x800
lea ecx, [ebp - 0x12c8]
push ecx
call fcn.00401090
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + edx*4]
push ecx
push 0x800
lea edx, [ebp - 0x12c8]
push edx
call fcn.00401090
push 0x41154c
push 0x800
lea eax, [ebp - 0x12c8]
push eax
call fcn.00401090
jmp 0x409479
push 0
push 0
push 0x411554
push 0
lea ecx, [ebp - 0x12c8]
push ecx
lea edx, [ebp - 0x2c8]
push edx
call fcn.00407770
add esp, 0x18
mov eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x409ce3
mov ecx, dword [ebp - 0x84]
and ecx, 1
jne 0x4095b8
cmp dword [ebp - 0xc], 1
jne 0x4095cf
push 0x40
mov edx, dword [str.Hidden_Start_v4.0___32_bit_]
push edx
mov eax, dword [str.Run_from_command_line:_r_nhstart.exe___PARAMETERS_____PRIORITY____COMMAND_LINES__r_n_r_nPARAMETERS:_r_n_NOCONSOLE___start_console_applications_without_any_windows_r_n_ELEVATE_or__RUNAS___start_applications_in_elevated_mode__Vista_7__r_n_NOELEVATE___start_applications_in_non_elevated_mode__Vista_7__r_n_UAC___run_Hstart_executable_in_elevated_mode__Vista_7__r_n_NOUAC___run_apps_elevated_without_any_UAC_prompts__Vista_7__r_n_SHELL___run_apps__open_docs_and_URLs_in_the_Windows_Shell_r_n_DPATH___set_the_starting_directory_for_executed_applications_r_n_DELAYN___delay_N_seconds_before_command_execution_r_n_WAIT___wait_for_the_application_to_terminate__run_synchronously__r_n_WAITINPUT___wait_for_the_user_input_to_set_the_priority_class_r_n_MSGTEXT___show_the_message_after_command_execution_r_n_TITLETEXT___set_the_title_of_the_message_r_n_ERRTEXT___show_the_error_message_if_an_error_detected_r_n_ERRTITLETEXT___set_the_title_of_the_error_message_r_n_SILENT___silent_mode__no_error_messages_will_be_displayed_r_n_TEST___test_mode__see_what_parameters_are_passed_to_Hstart_r_n_r_nPRIORITY_classes:_r_n__HIGH__ABOVENORMAL__NORMAL__BELOWNORMAL__IDLE__r_n_r_nDont_forget_about_quotes_when_using_complex_COMMAND_LINES:_r_nhstart.exe__NOCONSOLE__D_C:Dir_1_____C:Dir_2_test.bat___param__r_n]
push eax
call fcn.004080a0
add esp, 0xc
mov ecx, dword [0x4148b0]
and ecx, 0x20000000
jne 0x4095ef
mov edx, dword [ebp - 0x84]
and edx, 0xffffefff
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x84]
and eax, 0x1000
je 0x409604
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], 0
mov dword [ebp - 0x90], 0
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x409626
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jge 0x409c70
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + eax*4]
push edx
call fcn.004080e0
add esp, 0x18
test eax, eax
jne 0x409c6b
mov ax, word [0x411560]
mov word [ebp - 0x22c8], ax
push 0xffe
push 0
lea ecx, [ebp - 0x22c6]
push ecx
call fcn.004018e0
add esp, 0xc
push 0x800
lea edx, [ebp - 0x22c8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + eax*4]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ax, word [0x411564]
mov word [ebp - 0x24d0], ax
push 0x206
push 0
lea ecx, [ebp - 0x24ce]
push ecx
call fcn.004018e0
add esp, 0xc
cmp dword [ebp - 0x94], 0
je 0x4096f0
push 0x104
lea edx, [ebp - 0x24d0]
push edx
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebp - 0x84]
and ecx, 2
je 0x40971a
push 0x24
push str.Hstart___Execute_
lea edx, [ebp - 0x22c8]
push edx
call fcn.004080a0
add esp, 0xc
cmp eax, 6
jne 0x409c6b
mov eax, dword [ebp - 0x88]
and eax, 1
je 0x409790
mov ecx, dword [ebp - 0x88]
and ecx, 2
jne 0x409790
mov ecx, 0x83
mov esi, str.You_are_trying_to_run_Hstart_with__NOUAC_switch._This_feature_is_available_only_in_the_registered_version_of_Hstart._You_can_purchase_a_license_for_Hstart_at_NTWind_website___www.ntwind.com._r_n_r_nIn_the_registered_version__the_following_command_will_be_executed:_r_n
lea edi, [ebp - 0x2cd0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x5f2
push 0
lea edx, [ebp - 0x2ac2]
push edx
call fcn.004018e0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + eax*4]
push edx
push 0x400
lea eax, [ebp - 0x2cd0]
push eax
call fcn.00401090
push 0x40
push 0
lea ecx, [ebp - 0x2cd0]
push ecx
call fcn.004080a0
add esp, 0xc
jmp 0x40961d
cmp dword [ebp - 0x14], 0
je 0x4097a6
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x84]
and eax, 0x1140
je 0x409b2c
lea ecx, [ebp - 0x22c8]
mov dword [ebp - 0x2cd8], ecx
mov edx, dword [ebp - 0x2cd8]
movzx eax, word [edx]
cmp eax, 0x22
jne 0x40981a
mov ecx, dword [ebp - 0x2cd8]
add ecx, 2
mov dword [ebp - 0x2cd8], ecx
mov edx, dword [ebp - 0x2cd8]
mov dword [ebp - 0x2cd4], edx
mov eax, dword [ebp - 0x2cd4]
movzx ecx, word [eax]
test ecx, ecx
je 0x409818
mov edx, dword [ebp - 0x2cd4]
movzx eax, word [edx]
cmp eax, 0x22
je 0x409818
mov ecx, dword [ebp - 0x2cd4]
add ecx, 2
mov dword [ebp - 0x2cd4], ecx
jmp 0x4097ec
jmp 0x409890
mov edx, dword [ebp - 0x2cd8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40984a
mov eax, dword [ebp - 0x2cd8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x2cd8]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x2cd4], edx
jmp 0x409890
mov eax, dword [ebp - 0x2cd8]
mov dword [ebp - 0x2cd4], eax
mov ecx, dword [ebp - 0x2cd4]
movzx edx, word [ecx]
test edx, edx
je 0x409890
mov eax, dword [ebp - 0x2cd4]
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x409890
mov edx, dword [ebp - 0x2cd4]
movzx eax, word [edx]
cmp eax, 9
je 0x409890
mov ecx, dword [ebp - 0x2cd4]
add ecx, 2
mov dword [ebp - 0x2cd4], ecx
jmp 0x409856
mov edx, dword [ebp - 0x2cd4]
movzx eax, word [edx]
test eax, eax
je 0x4098f1
xor ecx, ecx
mov edx, dword [ebp - 0x2cd4]
mov word [edx], cx
mov eax, dword [ebp - 0x2cd4]
add eax, 2
mov dword [ebp - 0x2cd4], eax
mov ecx, dword [ebp - 0x2cd4]
movzx edx, word [ecx]
test edx, edx
je 0x4098f1
mov eax, dword [ebp - 0x2cd4]
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x4098e0
mov edx, dword [ebp - 0x2cd4]
movzx eax, word [edx]
cmp eax, 9
jne 0x4098f1
mov ecx, dword [ebp - 0x2cd4]
add ecx, 2
mov dword [ebp - 0x2cd4], ecx
jmp 0x4098b7
mov edx, dword [ebp - 0x84]
and edx, 0x1000
je 0x4099b5
mov eax, dword [ebp - 0x10]
and eax, 0x8000000
je 0x40992c
mov ecx, dword [ebp - 0x2cd8]
push ecx
call fcn.00408b70
add esp, 4
test eax, eax
jne 0x40992c
mov dword [ebp - 0x2cf4], 0
jmp 0x409936
mov dword [ebp - 0x2cf4], 1
mov edx, dword [ebp - 0x84]
and edx, 0x100
je 0x409950
mov dword [ebp - 0x2cf8], 0x41158c
jmp 0x40995a
mov dword [ebp - 0x2cf8], 0x4117a8
mov eax, dword [ebp - 0x2cf4]
push eax
mov ecx, dword [ebp - 0x2cf8]
push ecx
movzx edx, word [ebp - 0x24d0]
neg edx
sbb edx, edx
lea eax, [ebp - 0x24d0]
and edx, eax
push edx
mov ecx, dword [ebp - 0x2cd4]
push ecx
mov edx, dword [ebp - 0x2cd8]
push edx
call fcn.00407d20
add esp, 0x14
mov dword [ebp - 0x2cdc], eax
cmp dword [ebp - 0x2cdc], 0
jl 0x4099b0
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
jmp 0x409b27
mov dword [ebp - 0x2ce0], 0
mov ecx, dword [ebp - 0x10]
and ecx, 0x8000000
je 0x4099e9
mov edx, dword [ebp - 0x2cd8]
push edx
call fcn.00408b70
add esp, 4
test eax, eax
jne 0x4099e9
mov dword [ebp - 0x2cfc], 0
jmp 0x4099f3
mov dword [ebp - 0x2cfc], 1
mov eax, dword [ebp - 0x84]
and eax, 0x100
je 0x409a0c
mov dword [ebp - 0x2d00], str.runas
jmp 0x409a16
mov dword [ebp - 0x2d00], str.open
lea ecx, [ebp - 0x2ce0]
push ecx
mov edx, dword [ebp - 0x2cfc]
push edx
mov eax, dword [ebp - 0x2d00]
push eax
movzx ecx, word [ebp - 0x24d0]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x24d0]
and ecx, edx
push ecx
mov eax, dword [ebp - 0x2cd4]
push eax
mov ecx, dword [ebp - 0x2cd8]
push ecx
call fcn.00407770
add esp, 0x18
mov dword [ebp - 0x2ce4], eax
cmp dword [ebp - 0x2ce4], 0
je 0x409a73
mov edx, dword [ebp - 0x90]
add edx, 1
mov dword [ebp - 0x90], edx
cmp dword [ebp - 0x2ce4], 0
je 0x409b27
cmp dword [ebp - 0x2ce0], 0
je 0x409b27
mov eax, dword [ebp - 0x84]
and eax, 0x10
je 0x409add
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x2ce0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2ce8], 0
lea edx, [ebp - 0x2ce8]
push edx
mov eax, dword [ebp - 0x2ce0]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x409adb
cmp dword [ebp - 0x2ce8], 0
je 0x409adb
mov ecx, dword [ebp - 0x2ce8]
mov dword [ebp - 4], ecx
jmp 0x409b1a
mov edx, dword [ebp - 0x84]
and edx, 0x20
je 0x409b1a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2ce0]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x2ce0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, dword [ebp - 8]
je 0x409b1a
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2ce0]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [ebp - 0x2ce0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409c6b
mov edx, dword [ebp - 0x10]
and edx, 0xffff3e1f
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
call section..text
add esp, 8
push 0x44
lea edx, [ebp - 0x80]
push edx
call section..text
add esp, 8
mov dword [ebp - 0x80], 0x44
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
push ecx
movzx edx, word [ebp - 0x24d0]
neg edx
sbb edx, edx
lea eax, [ebp - 0x24d0]
and edx, eax
push edx
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x22c8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409c46
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x84]
and edx, 0x10
je 0x409c06
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2cec], 0
lea ecx, [ebp - 0x2cec]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x409c04
cmp dword [ebp - 0x2cec], 0
je 0x409c04
mov eax, dword [ebp - 0x2cec]
mov dword [ebp - 4], eax
jmp 0x409c3a
mov ecx, dword [ebp - 0x84]
and ecx, 0x20
je 0x409c3a
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, dword [ebp - 8]
je 0x409c3a
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409c6b
mov ecx, dword [ebp - 0x84]
and ecx, 4
jne 0x409c6b
push str.Failed_to_create_process___Hstart
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00408c80
add esp, 8
jmp 0x40961d
mov edx, dword [ebp - 0x84]
and edx, 0x1000
je 0x409c84
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 4], 0
jne 0x409cb5
cmp dword [0x4148b4], 0
je 0x409cb3
cmp dword [ebp - 0x90], 0
jle 0x409cb3
push 0x40
mov eax, dword [0x4148b8]
push eax
mov ecx, dword [0x4148b4]
push ecx
call fcn.004080a0
add esp, 0xc
jmp 0x409cd3
cmp dword [0x4148bc], 0
je 0x409cd3
mov edx, dword [0x4148c0]
push edx
mov eax, dword [0x4148bc]
push eax
call fcn.00408c80
add esp, 8
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov ecx, dword [ebp - 0xbc]
xor ecx, ebp
call fcn.00401432
mov esp, ebp
pop ebp
ret 0x10