Function at 0x405190
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x544
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x540], eax
mov eax, dword [0x403300]
mov dword [esp + 0x324], eax
mov eax, dword [0x403304]
mov dword [esp + 0x328], eax
mov eax, dword [0x403308]
push ebx
mov dword [esp + 0x330], eax
mov ebx, ecx
mov eax, dword [0x40330c]
push esi
push edi
mov dword [esp + 0x33c], eax
lea edi, [esp + 0x60]
xor eax, eax
mov dword [esp + 0x24], 0
stosd dword es:[edi], eax
push 0x48
push 0
mov dword [esp + 0x5c], 0
stosd dword es:[edi], eax
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x34], 0
mov dword [esp + 0x50], 0
stosd dword es:[edi], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0xffff
mov dword [esp + 0x14], 0x80010
stosd dword es:[edi], eax
lea eax, [esp + 0x78]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x70], 0x48
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
push 0xfffffffffffffff6
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 0
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xac], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xb0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
mov dword [esp + 0xb0], eax
mov dword [esp + 0x38], 0
test ebx, ebx
je 0x418629
push 0x104
lea eax, [esp + 0x11c]
mov dword [esp + 0x324], 0
push 0
push eax
mov byte [esp + 0x330], 1
mov dword [esp + 0x334], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [esp + 0x324], 0
je 0x418635
mov eax, 0x7fe7
push eax
lea ecx, [esp + 0x11c]
call fcn.0040fba0
test eax, eax
js 0x41863f
push 0x42d198
push 0x4000
call fcn.00416fc5
push 0x42d198
push 0x4000
mov dword [esp + 0x28], eax
call fcn.00416fc5
push 0x42d198
push 0x4000
mov dword [esp + 0x38], eax
call fcn.00416fc5
mov edi, eax
push 0x42d198
push 0x4000
mov dword [esp + 0x7c], edi
call fcn.00416fc5
push 0x42d198
push 0x4000
mov esi, eax
call fcn.00416fc5
push 0x42d198
push 0x4000
mov dword [esp + 0x70], eax
call fcn.00416fc5
push 0x42d198
push 0x4000
mov dword [esp + 0x6c], eax
call fcn.00416fc5
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x18], 0
mov dword [esp + 0x30], ecx
je 0x418c6d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x418c6d
test edi, edi
je 0x418c6d
test esi, esi
je 0x418c6d
cmp dword [esp + 0x40], 0
je 0x418c6d
cmp dword [esp + 0x34], 0
je 0x418c6d
test ecx, ecx
je 0x418c6d
xor ecx, ecx
mov word [esi], cx
mov word [eax], cx
cmp word [ebx], cx
je 0x40547b
nop
mov ecx, ebx
call fcn.0040ce09
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp ecx, 0x22
je 0x418649
lea edx, [esp + 0x14]
push 0x2000
cmp ecx, 0x2f
je 0x405784
push esi
xor ecx, ecx
call fcn.004058bf
cmp eax, 1
je 0x418c6d
mov eax, dword [esp + 0x14]
cmp word [eax], 0
je 0x40547b
mov ecx, dword [esp + 0x20]
mov edx, 0x2000
push eax
call fcn.00410820
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
cmp word [esi], 0
je 0x418adf
cmp word [esi], 0x22
je 0x40549f
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
add esp, 8
test eax, eax
jne 0x418af8
mov ecx, dword [esp + 0x30]
mov edx, 0x2000
push esi
call fcn.00410820
mov ecx, esi
call fcn.00411150
push eax
mov edx, 0x2000
mov ecx, esi
call fcn.00410820
lea eax, [esp + 0x14]
xor bl, bl
push eax
mov edx, esi
mov byte [esp + 0x17], bl
mov ecx, 0x2d
call fcn.0040ced0
cmp eax, 0xffffffff
jne 0x418b41
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push esi
call fcn.00410820
push 0x2000
mov edx, esi
mov dword [esp + 0xf4], esi
lea ecx, [esp + 0xbc]
call fcn.0040ff70
cmp eax, 3
je 0x418c66
test eax, eax
je 0x418b1b
cmp eax, 2
je 0x418b41
cmp eax, 5
je 0x418b36
push dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edx, 0x2000
call fcn.00410820
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push 0x402318
call fcn.00410770
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40556a
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.00410770
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x48], 0
jne 0x418c46
push 0x40
lea eax, [esp + 0xc0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xb8], 0x44
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x78], eax
test bl, bl
jne 0x418c55
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0
push 2
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x418c5c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x7a
jne 0x418c77
push dword [esp + 0x44]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x418c77
lea eax, [esp + 0x44]
push eax
push 0
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x418c84
push 0
push 0
push 4
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 1
push eax
push 0x60001
push 0
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x418c91
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xb4], ebx
cmp eax, 0xffff
jne 0x418cb5
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x40]
mov eax, dword [esp + 0x18]
push dword [esp + 0x60]
or eax, 0x400
push eax
mov eax, dword [esp + 0x38]
push 1
push 0
push 0
push eax
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessW]
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_DeleteProcThreadAttributeList]
push ebx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x48], 0
jne 0x418cdc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
test ebx, ebx
je 0x418d85
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jne 0x418ceb
push dword [esp + 0x64]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ResumeThread]
push dword [esp + 0x64]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x405706
cmp dword [esp + 0x50], 0
jne 0x418dec
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
push dword [esp + 0x30]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push dword [esp + 0x34]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push dword [esp + 0x40]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push dword [esp + 0x18]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
push dword [esp + 0x320]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov ecx, dword [esp + 0x550]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
add eax, 2
mov ecx, 1
push edi
mov dword [esp + 0x1c], eax
call fcn.004058bf
cmp eax, 1
je 0x418c6d
push 0x401ed0
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4186a6
push 0x401eb8
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4187ab
push 0x401ea0
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4187b8
push 0x401e9c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4187c5
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
add esp, 4
cmp ax, 0x44
je 0x4187ea
push 0x401e90
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x418892
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
add esp, 4
cmp ax, 0x49
je 0x41889f
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
add esp, 4
cmp ax, 0x3f
je 0x418a9d
push 0x401e88
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4058b8
push 0x401e80
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4188b7
mov ax, word [esp + 0xa0]
mov ecx, 0xfffe
or dword [esp + 0x9c], 1
and ax, cx
or ax, 7
mov word [esp + 0xa0], ax
mov ebx, dword [esp + 0x14]
cmp word [ebx], 0
jne 0x405420
jmp 0x40547b
or dword [esp + 0xc], 0x40
jmp 0x4058a5
lea ebx, [esp + 0x330]
jmp 0x4052e6
mov eax, 0x104
jmp 0x40532e
mov ebx, 1
jmp 0x40575d
cmp dword [esp + 0x7c], 0
jne 0x405437
push 0x104
lea eax, [esp + 0x344]
mov ecx, 1
push eax
lea edx, [esp + 0x1c]
call fcn.004058bf
cmp eax, 1
je 0x418c6d
lea ecx, [esp + 0x340]
call fcn.00411150
push eax
mov edx, 0x104
lea ecx, [esp + 0x344]
call fcn.00410820
lea eax, [esp + 0x340]
mov dword [esp + 0x7c], eax
jmp 0x4058a5
mov ecx, dword [esp + 0x14]
call fcn.0040ce09
push 0x2000
push edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, 1
call fcn.004058bf
cmp eax, 1
je 0x418a32
cmp word [edi], 0x30
mov edx, edi
mov dword [esp + 0x1c], edx
jne 0x4186f1
movzx eax, word [edi + 2]
cmp eax, 0x78
je 0x4186ea
cmp eax, 0x58
jne 0x4186f1
lea edx, [edi + 4]
mov dword [esp + 0x1c], edx
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4186f6
sub ecx, ebx
sar ecx, 1
cmp ecx, 8
ja 0x41896d
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, word [edx]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x20], 2
add esp, 4
movzx ebx, ax
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
jne 0x41896d
test bx, bx
je 0x418795
mov ecx, dword [esp + 0x2c]
lea eax, [ebx - 0x30]
shl ecx, 4
cmp ax, 9
ja 0x418755
add ecx, 0xffffffd0
jmp 0x418765
lea eax, [ebx - 0x61]
cmp ax, 5
ja 0x41896d
add ecx, 0xffffffa9
movzx eax, bx
add ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x20], 2
add esp, 4
movzx ebx, ax
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
je 0x41873b
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41896d
or dword [esp + 0xc], 4
jmp 0x4058a5
or dword [esp + 0xc], 0x8000
jmp 0x4058a5
or dword [esp + 0xc], 0x4000
jmp 0x4058a5
mov eax, dword [esp + 0xc]
and eax, 0xffffffef
mov dword [esp + 0x50], 0
or eax, 0x200
mov dword [esp + 0x48], 1
mov dword [esp + 0xc], eax
jmp 0x4058a5
lea edx, [edi + 2]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4187f2
sub ecx, ebx
sar ecx, 1
jne 0x41882f
mov ecx, dword [esp + 0x14]
call fcn.0040ce09
push 0x2000
push edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, 1
call fcn.004058bf
cmp eax, 1
je 0x418c6d
mov edx, edi
mov ecx, edx
call fcn.00411150
push eax
lea ecx, [esp + 0x11c]
call fcn.0040fcb9
mov ebx, dword [esp + 0x320]
mov dword [esp + 0x38], ebx
test ebx, ebx
jne 0x41885d
lea ebx, [esp + 0x118]
mov dword [esp + 0x38], ebx
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418862
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7fe7
jbe 0x4058a5
push ebx
push 1
push 0x2362
call fcn.00414802
add esp, 0xc
jmp 0x418c6d
or dword [esp + 0xc], 0x80
jmp 0x4058a5
mov eax, dword [0x433840]
test eax, eax
je 0x4058a5
mov eax, dword [eax]
mov dword [esp + 0x54], eax
jmp 0x4058a5
push 0x403bf8
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4188f3
mov ax, word [esp + 0xa0]
mov ecx, 0xfffe
or dword [esp + 0x9c], 1
and ax, cx
or ax, 3
mov word [esp + 0xa0], ax
jmp 0x4058a5
push 0x403c00
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x418982
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0040ce09
push 0x2000
push edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, 1
call fcn.004058bf
cmp eax, 1
je 0x418a32
push 0xa
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x4c], ebx
test ebx, ebx
jne 0x418958
mov ecx, dword [esp + 0x1c]
cmp word [ecx], ax
jne 0x41896d
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
cmp ebx, dword [esp + 0x28]
jbe 0x4058a5
push edi
push 1
push 0x2362
call fcn.00414802
add esp, 0xc
jmp 0x418c6d
push 0x403c0c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x41899f
or dword [esp + 0xc], 0x20
jmp 0x4058a5
push 0x403c1c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4189bf
or dword [esp + 0xc], 0x100
jmp 0x4058a5
push 0x403c30
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4189df
or dword [esp + 0xc], 0x800
jmp 0x4058a5
push 0x403c44
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4189ff
or dword [esp + 0xc], 0x1000
jmp 0x4058a5
push 0x403c54
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x418a25
push 0x403c60
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x418a32
mov dword [esp + 0x50], 1
jmp 0x4058a5
mov eax, dword [esp + 0x18]
mov ecx, 0x403560
sub ecx, eax
mov ebx, 0x2000
mov edx, eax
mov dword [esp + 0x28], ecx
lea ecx, [ebx + 0x7fffdffe]
test ecx, ecx
je 0x418a6c
mov ecx, dword [esp + 0x28]
movzx ecx, word [ecx + edx]
test cx, cx
je 0x418a6c
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x418a48
jmp 0x418a70
test ebx, ebx
jne 0x418a73
sub edx, 2
xor ecx, ecx
mov word [edx], cx
mov edx, 0x2000
push edi
mov ecx, eax
call fcn.00410770
push dword [esp + 0x18]
push 1
push 0x2375
call fcn.00414802
add esp, 0xc
jmp 0x418c6d
call fcn.0042913a
push 0
push 0x40002397
call fcn.00415469
add esp, 8
cmp byte [0x443cd9], 0
je 0x418ac9
push 0
push 0x400023bf
call fcn.00415469
add esp, 8
mov byte [0x44847d], 0
mov dword [0x44851c], 0
jmp 0x418c6d
lea eax, [esp + 0x330]
mov edx, 0x2000
push eax
mov ecx, esi
call fcn.00410820
jmp 0x405485
mov ecx, esi
call fcn.00411150
push eax
push 0x403c64
push 0x2000
push dword [esp + 0x3c]
call fcn.0040c4ef
add esp, 0x10
jmp 0x4054c2
push dword [esp + 0x40]
mov bl, 1
mov edx, 0x2000
mov ecx, esi
mov byte [esp + 0x17], bl
call fcn.00410820
jmp 0x405572
mov bl, 1
mov byte [esp + 0x13], bl
jmp 0x405572
mov ecx, 0x40212c
call fcn.0040c222
mov ebx, eax
test ebx, ebx
jne 0x418b64
push eax
push 0x400023d2
call fcn.00414802
add esp, 8
jmp 0x418c6d
push dword [esp + 0x30]
push 0x403c70
push 0x2000
push dword [esp + 0x24]
call fcn.0040c4ef
add esp, 0x10
mov edx, 0x2000
mov ecx, esi
push ebx
call fcn.00410820
mov ecx, dword [esp + 0x30]
mov edx, 0x2000
push esi
call fcn.00410820
push 0x403c80
push dword [esp + 0x1c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x418c35
mov eax, dword [esp + 0x20]
cmp word [eax], 0
je 0x418c35
mov edx, eax
lea ebx, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x418bc3
mov ecx, dword [esp + 0x18]
sub edx, ebx
mov ebx, ecx
sar edx, 1
mov dword [esp + 0x24], edx
lea edx, [ebx + 2]
mov dword [esp + 0x28], edx
mov dx, word [ebx]
add ebx, 2
test dx, dx
jne 0x418be3
sub ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
sar ebx, 1
add edx, ebx
cmp edx, 0x2000
jae 0x418c25
push 0x402318
mov edx, 0x2000
call fcn.00410770
push dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0x2000
call fcn.00410770
jmp 0x418c35
push eax
push 1
push 0x2363
call fcn.00414802
add esp, 0xc
mov eax, dword [esp + 0x18]
mov bl, byte [esp + 0x13]
mov dword [esp + 0x24], eax
jmp 0x40552e
push 1
push 0
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x40557d
xor ebx, ebx
jmp 0x4056ae
mov dword [0x443d00], 0x54f
mov ecx, esi
call fcn.00425420
mov ebx, 1
jmp 0x405708
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
jmp 0x418c66
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
jmp 0x418ca3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push ebx
mov dword [0x443d00], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_DeleteProcThreadAttributeList]
push ebx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x418c66
push 0
push 0
push 2
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
push 0x20004
push 0
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x418c91
jmp 0x405661
push 0
push 0
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x4056b9
xor eax, eax
lea edi, [esp + 0x100]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x100]
push eax
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_core_processtopology_l1_2_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x418d18
mov eax, dword [esp + 0x100]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x4c]
cmp ecx, 0xffff
je 0x418d67
xor eax, eax
lea edi, [esp + 0x10c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x418d65
mov ecx, dword [esp + 0x10c]
mov eax, ecx
and eax, dword [esp + 0x3c]
je 0x418d65
push 0
push ecx
mov dword [esp + 0x44], eax
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl ebx, cl
jmp 0x418d67
xor ebx, ebx
mov ecx, dword [esp + 0x3c]
and ebx, ecx
je 0x418d71
mov ecx, ebx
push ecx
push dword [esp + 0x64]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
mov edi, dword [esp + 0x5c]
jmp 0x4056d8
cmp byte [esp + 0x13], 0
jne 0x418da7
cmp byte [0x443cd9], 0
je 0x418d9c
cmp eax, 0xc1
je 0x418da7
cmp eax, 0x2e4
jne 0x418c66
call fcn.004174b8
test al, al
je 0x418c66
call fcn.00413f50
push 0x443d00
lea eax, [esp + 0x64]
push eax
movzx eax, word [esp + 0xa8]
push eax
push dword [esp + 0x44]
push dword [esp + 0x30]
push esi
push dword [esp + 0x24]
call dword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_ShellExecuteWorker]
test eax, eax
je 0x418c66
jmp 0x4056ec
mov ecx, eax
call fcn.00413f8e
mov dword [0x43b8c0], eax
jmp 0x405706