Function at 0x416120
Capabilities:
Acquire debug privileges
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e9568
mov eax, dword fs:[0]
push eax
sub esp, 0x868
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0xf4], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0xff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x80c]
call fcn.005954d3
call fcn.00523d20
push 0x6284c0
mov ecx, 0x661cf4
call fcn.0040bf30
push eax
call fcn.005b14c5
add esp, 8
test eax, eax
jne 0x4161a7
push 0x60a0df
mov ecx, 0x661cf4
call fcn.0040bee0
push 1
push 2
lea ecx, [ebp - 0x194]
call fcn.0040b160
mov dword [ebp - 4], 0
mov ecx, 0x661cf4
call fcn.0040bf30
push eax
push str._change:
push 0x6284d0
lea ecx, [ebp - 0x194]
push ecx
call fcn.00409c80
add esp, 8
push eax
call fcn.00409c80
add esp, 8
push eax
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x6b0]
push edx
lea ecx, [ebp - 0x194]
call fcn.00409610
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x814]
call fcn.0040bf30
push eax
push 0x6284ec
push 0x74
push 0x628508
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6b0]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.00409ef0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416345
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x628518
lea edx, [ebp - 0x214]
push edx
call fcn.005b0b2c
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x294]
call fcn.0040b160
mov dword [ebp - 4], 2
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x294]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x6cc]
push edx
lea ecx, [ebp - 0x294]
call fcn.00409610
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x81c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x81c]
call fcn.0040bf30
push eax
push 0x628534
push 0x81
push 0x628550
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6cc]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.00409ef0
xor eax, eax
jmp 0x416a9b
push 0
push 2
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416433
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x628560
lea edx, [ebp - 0x314]
push edx
call fcn.005b0b2c
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x394]
call fcn.0040b160
mov dword [ebp - 4], 4
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x394]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x6e8]
push edx
lea ecx, [ebp - 0x394]
call fcn.00409610
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x824], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x824]
call fcn.0040bf30
push eax
push 0x628584
push 0x8f
push 0x6285a0
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6e8]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.00409ef0
xor eax, eax
jmp 0x416a9b
push 0
call fcn.0059886a
add esp, 4
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
push 1
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
call fcn.00404950
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x704]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0040cbd0
mov dword [ebp - 0x828], eax
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x82c]
call fcn.0040bf30
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x661c34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call fcn.0040c050
cmp dword [0x661c34], 0
je 0x4164f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41659f
push 1
push 2
lea ecx, [ebp - 0x414]
call fcn.0040b160
mov dword [ebp - 4], 7
push 0x6285b0
lea ecx, [ebp - 0x414]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x720]
push edx
lea ecx, [ebp - 0x414]
call fcn.00409610
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x834]
call fcn.0040bf30
push eax
push 0x6285c0
push 0xb0
push 0x6285dc
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x720]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00409ef0
xor eax, eax
jmp 0x416a9b
push 1
lea ecx, [ebp - 0x73c]
push ecx
call fcn.005000f0
add esp, 8
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x838]
mov dword [ebp - 0x83c], edx
mov dword [ebp - 4], 9
push 0x628600
mov eax, dword [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x758]
push ecx
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0x840], eax
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x844], edx
mov byte [ebp - 4], 0xa
push 0x6285f4
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x774]
push ecx
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 0xb
push str..lck
mov eax, dword [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x774]
call fcn.0040c050
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x758]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x73c]
call fcn.0040c050
push 0
push 0x4000080
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.0040bf30
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x41676c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x41676c
push 1
push 2
lea ecx, [ebp - 0x494]
call fcn.0040b160
mov byte [ebp - 4], 0x10
push 0x628604
lea edx, [ebp - 0x494]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x494]
call fcn.00409610
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x854], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x854]
call fcn.0040bf30
push eax
push 0x628614
push 0xbd
push 0x628630
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x790]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x494]
call fcn.00409ef0
mov dword [ebp - 0x794], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040c050
mov eax, dword [ebp - 0x794]
jmp 0x416a9b
push 1
push 0x628640
call fcn.004feb80
add esp, 8
test eax, eax
jne 0x41681c
push 1
push 2
lea ecx, [ebp - 0x514]
call fcn.0040b160
mov byte [ebp - 4], 0x12
push str.SeDebugPrivilege
lea edx, [ebp - 0x514]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0x514]
call fcn.00409610
mov dword [ebp - 0x858], eax
mov ecx, dword [ebp - 0x858]
mov dword [ebp - 0x85c], ecx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x85c]
call fcn.0040bf30
push eax
push 0x628668
push 0xd0
push 0x628684
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7b0]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x514]
call fcn.00409ef0
push 1
push 0x628694
call fcn.004feb80
add esp, 8
test eax, eax
jne 0x4168cc
push 1
push 2
lea ecx, [ebp - 0x594]
call fcn.0040b160
mov byte [ebp - 4], 0x14
push str.SeBackupPrivilege
lea edx, [ebp - 0x594]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x594]
call fcn.00409610
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x864], ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x864]
call fcn.0040bf30
push eax
push 0x6286bc
push 0xd5
push 0x6286d8
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7cc]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x594]
call fcn.00409ef0
push 1
push 0x6286e8
call fcn.004feb80
add esp, 8
test eax, eax
jne 0x41697c
push 1
push 2
lea ecx, [ebp - 0x614]
call fcn.0040b160
mov byte [ebp - 4], 0x16
push str.SeSecurityPrivilege
lea edx, [ebp - 0x614]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x614]
call fcn.00409610
mov dword [ebp - 0x868], eax
mov ecx, dword [ebp - 0x868]
mov dword [ebp - 0x86c], ecx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x86c]
call fcn.0040bf30
push eax
push 0x628710
push 0xda
push 0x62872c
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x7e8]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x614]
call fcn.00409ef0
push 1
push 0x62873c
call fcn.004feb80
add esp, 8
test eax, eax
jne 0x416a2c
push 1
push 2
lea ecx, [ebp - 0x694]
call fcn.0040b160
mov byte [ebp - 4], 0x18
push str.SeSystemtimePrivilege
lea edx, [ebp - 0x694]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x694]
call fcn.00409610
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x870]
mov dword [ebp - 0x874], ecx
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x874]
call fcn.0040bf30
push eax
push str.CEDSClientApp::InitInstance
push 0xdf
push str..EDSClient.cpp
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x804]
call fcn.0040c050
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x694]
call fcn.00409ef0
push 0x415c90
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00506c80
push 0
lea ecx, [ebp - 0xec]
call fcn.00417380
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x80c]
lea eax, [ebp - 0xec]
mov dword [edx + 0x20], eax
lea ecx, [ebp - 0xec]
call fcn.005965c4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x808], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xec]
call fcn.00416ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040c050
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xf4]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret