Function at 0x40a853
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
sub esp, 0x448
push ebx
push ebp
push esi
push edi
mov esi, str.SeDebugPrivilege
push esi
call fcn.0040a775
push esi
call fcn.0040a775
push str.NtQuerySystemInformation
mov esi, str.ntdll.dll
push esi
call fcn.0040ac96
push str.NtDuplicateObject
push esi
mov edi, eax
call fcn.0040ac96
push str.NtQueryObject
push esi
mov dword [esp + 0x4c], eax
call fcn.0040ac96
add esp, 0x20
mov dword [esp + 0x30], eax
call fcn.0040cb22
xor ebx, ebx
cmp eax, 3
jae 0x40a8c6
push str.Local1680
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40a8c6
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0040cb22
cmp eax, 3
jae 0x40a8e0
lea eax, [esp + 0x44]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov al, byte [esp + 0x460]
mov ebp, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test al, al
jne 0x40a93f
mov esi, 0x10000
push esi
xor eax, eax
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x40a917
add esi, esi
push esi
push ebp
xor eax, eax
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
xor eax, eax
push eax
push esi
push ebp
push 0x10
call edi
cmp eax, 0xc0000004
je 0x40a907
test eax, eax
js 0x40a931
test ebp, ebp
jne 0x40a938
xor al, al
jmp 0x40ac02
mov al, byte [esp + 0x460]
mov ebx, dword [esp + 0x45c]
xor ecx, ecx
mov byte [esp + 0x13], cl
lea edx, [ebp + 4]
test al, al
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov eax, 0xffff
jne 0x40a963
mov eax, dword [ebp]
cmp ecx, eax
jae 0x40abef
mov esi, edx
lea edi, [esp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040cb22
xor esi, esi
cmp eax, 3
jae 0x40a9a5
push str.Global986
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40a99d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x40], 0x12019f
je 0x40abdf
mov edi, dword [esp + 0x34]
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov si, word [esp + 0x3a]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40aa1b
xor eax, eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, si
push eax
push dword [esp + 0x34]
call dword [esp + 0x48]
test eax, eax
jns 0x40aa1b
call fcn.0040cb22
cmp eax, 3
jae 0x40aa0c
push str.Global342
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40abd7
push 0x1000
xor eax, eax
push eax
movzx esi, si
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40aa0c
xor ecx, ecx
push ecx
push 0x1000
push eax
push 2
push esi
call dword [esp + 0x44]
test eax, eax
jns 0x40aa73
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40abd7
push esi
call fcn.0040a518
pop ecx
mov ecx, eax
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x40ab21
xor edx, edx
cmp word [ecx], dx
jbe 0x40ab21
mov al, byte [esp + 0x38]
inc dword [ebx + 0x1c]
mov dword [ebx], edi
mov edi, dword [esp + 0x20]
mov dword [ebx + 8], esi
mov esi, dword [esp + 0x1c]
mov byte [ebx + 0xc], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], edx
mov dword [ebx + 4], esi
cmp dword [eax], edx
je 0x40aba1
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
cmp eax, 1
je 0x40ab10
test eax, eax
je 0x40aba1
cmp eax, 2
je 0x40ab9c
xor ecx, ecx
mov dword [esp + 0x20], ecx
call fcn.0040cb22
cmp eax, 3
jae 0x40ab10
push str.Local1692
push 1
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40ab10
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40aac1
jmp 0x40aba1
inc dword [ebx + 0x1c]
mov dword [ebx], edi
call fcn.0040cb22
cmp eax, 3
jae 0x40ab49
xor eax, eax
push eax
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40ab49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x38]
mov edi, dword [esp + 0x20]
mov dword [ebx + 8], esi
xor esi, esi
mov dword [ebx + 0x14], esi
mov byte [ebx + 0xc], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x18], esi
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov dword [ebx + 0x10], edi
mov dword [ebx + 4], esi
cmp dword [eax], ecx
je 0x40aba1
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
mov ecx, dword [ebx + 0x18]
cmp eax, 1
je 0x40ab91
test eax, eax
je 0x40aba1
cmp eax, 2
je 0x40ab9c
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40ab72
jmp 0x40aba1
mov byte [esp + 0x13], 1
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40abc9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
jne 0x40abf1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov al, byte [esp + 0x460]
inc ecx
add edx, 0x10
jmp 0x40a94f
xor edi, edi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret