Function at 0x408700
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401b90
test al, al
je 0x40871a
call fcn.004140a0
call fcn.004084e0
call fcn.00406660
test eax, eax
je 0x40872f
push 0x6f
call fcn.00408080
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push eax
push 0x4200a8
push 0xffffffffffffffff
push 0x7fff
push 0x426248
call fcn.004149b0
mov esi, dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
add esp, 0x14
push 0x426248
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fff
push 0x446248
push 0
call edi
push 0x7fff
push 0x436248
push 0
call edi
push 0x436248
call esi
mov esi, dword [ebp + 8]
cmp esi, 1
jle 0x408b36
mov eax, dword [ebx + 4]
call fcn.00408120
test al, al
je 0x4087c4
push str.02_11_2023
push str.32_bit
push 0x4203cc
push str.INVGATE
push str._s__s__s__s_n
call fcn.00414fc1
add esp, 0x14
push 0
call fcn.00408080
mov ebx, dword [ebx + 4]
mov edi, str.start
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x4087ee
add eax, 8
lea ecx, [esi - 2]
push 0
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.stop
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x408818
add eax, 8
lea ecx, [esi - 2]
push 1
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.restart
call fcn.004080a0
test eax, eax
je 0x40885c
mov edi, dword [ebp + 0xc]
push 1
lea eax, [edi + 8]
lea ecx, [esi - 2]
call fcn.0040f420
add esp, 4
test eax, eax
je 0x408846
push eax
call fcn.00408080
push 0
lea eax, [edi + 8]
lea ecx, [esi - 2]
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.pause
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x408889
add eax, 8
lea ecx, [esi - 2]
push 2
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.continue
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x4088b3
add eax, 8
lea ecx, [esi - 2]
push 3
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.status
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x4088dd
add eax, 8
lea ecx, [esi - 2]
push 4
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.statuscode
call fcn.004080a0
test eax, eax
je 0x40890e
mov ecx, dword [ebp + 0xc]
add ecx, 8
push 1
push ecx
add esi, 0xfffffffe
push esi
mov ecx, 4
call fcn.0040ef30
add esp, 0xc
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.rotate
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x40893e
add eax, 8
lea ecx, [esi - 2]
push 0x80
call fcn.0040f420
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.install
call fcn.004080a0
test eax, eax
je 0x40898d
cmp byte [0x426245], 0
jne 0x40896f
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0x400001f6
call fcn.00408550
add esp, 4
push eax
call fcn.00408080
call fcn.00409a10
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
add esi, 0xfffffffe
push esi
call fcn.0040dc80
add esp, 8
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.edit
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, 0x420b5c
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, 0x420b64
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.reset
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.unset
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.dump
call fcn.004080a0
test eax, eax
jne 0x408abf
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.list
call fcn.004080a0
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x408a49
add esi, 0xfffffffe
add eax, 8
push esi
call fcn.00410bf0
add esp, 4
push eax
call fcn.00408080
mov ebx, dword [eax + 4]
mov edi, str.processes
call fcn.004080a0
test eax, eax
je 0x408a73
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
add esi, 0xfffffffe
push esi
call fcn.00410e50
add esp, 8
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov edi, str.remove
call fcn.004080a0
test eax, eax
je 0x408b36
cmp byte [0x426245], 0
jne 0x408aab
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0x400001f8
call fcn.00408550
add esp, 4
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
add eax, 8
lea ecx, [esi - 2]
call fcn.0040ea70
push eax
call fcn.00408080
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
lea eax, [esi - 1]
push eax
call fcn.0040de30
add esp, 8
mov dword [esp + 0xc], eax
cmp eax, 3
jne 0x408aff
cmp byte [0x426245], 0
jne 0x408aff
cmp esi, eax
jne 0x408aff
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, 0x400001f7
call fcn.00408550
add esp, 4
push eax
call fcn.00408080
xor edi, edi
test esi, esi
jle 0x408b30
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + edi*4]
mov ecx, eax
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x408b10
sub ecx, ebx
sar ecx, 1
lea edx, [ecx + ecx]
call fcn.00402390
inc edi
cmp edi, esi
jl 0x408b05
mov eax, dword [esp + 0xc]
push eax
call fcn.00408080
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp byte [0x426245], 0
mov dword [0x4261f0], eax
je 0x408b4f
call fcn.00409a10
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
jne 0x408b91
lea eax, [esp + 0x10]
xor esi, esi
push eax
mov dword [esp + 0x14], str.INVGATE
mov dword [esp + 0x18], 0x40f550
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x408bbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x408b9c
call fcn.00408460
push eax
call fcn.00408080
push esi
mov edi, eax
call fcn.00402080
push eax
push 0xc00003e9
push 1
call fcn.004021b0
add esp, 0x10
push 0x64
call fcn.00408080
push esi
call fcn.00408080
int3