Function at 0x404410
Capabilities:
Accept command line arguments
Access peb ldr_data
Check os version
Create process on windows
Delete directory
Delete file
Delete registry value
Enumerate files on windows
Get common file path
Get hostname
Get process heap flags
Get process heap force flags
Get session user name
Get system firmware table
Get system information on windows
Make suspicious ntquerysysteminformation call
Move file
Persist via winlogon helper dll registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Resolve dns
Self delete
Set current directory
Set registry value
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xee8
mov eax, dword [ecx]
mov dword [ebp - 0xe8c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xe90], eax
call fcn.00404190
mov dword [ebp - 0xe64], 0x40003e
mov dword [ebp - 0xe60], str.KernelObjects__wineboot_event
mov dword [esp + 4], 0x104
mov dword [esp], 0x415240
call dword [sym.imp.kernelbase.dll_GetWindowsDirectoryW]
sub esp, 8
mov dword [esp], 0x415240
call dword [sym.imp.kernelbase.dll_SetCurrentDirectoryW]
sub esp, 4
test eax, eax
jne 0x40448a
test byte [0x408010], 2
jne 0x404e32
mov dword [esp], 0xffffffff
lea eax, [ebp - 0xe7c]
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_IsWow64Process]
sub esp, 8
test eax, eax
je 0x4044b5
cmp dword [ebp - 0xe7c], 0
jne 0x405140
cmp dword [ebp - 0xe8c], 1
mov dword [ebp - 0xe94], 0
jle 0x4047b3
mov dword [ebp - 0xe98], 0
mov edi, 1
mov dword [ebp - 0xea8], 0
mov dword [ebp - 0xea4], 0
mov dword [ebp - 0xeac], 0
mov dword [ebp - 0xea0], 0
mov dword [ebp - 0xe9c], 0
jmp 0x4045df
mov ebx, dword [sym.imp.ucrtbase.dll_strcmp]
mov dword [esp + 4], str.__help
mov dword [esp], esi
call ebx
test eax, eax
je 0x404e26
mov dword [esp + 4], str.__end_session
mov dword [esp], esi
call ebx
test eax, eax
je 0x404720
mov dword [esp + 4], str.__force
mov dword [esp], esi
call ebx
test eax, eax
je 0x404730
mov dword [esp + 4], str.__init
mov dword [esp], esi
call ebx
test eax, eax
je 0x40473f
mov dword [esp + 4], str.__kill
mov dword [esp], esi
call ebx
test eax, eax
je 0x40474e
mov dword [esp + 4], str.__restart
mov dword [esp], esi
call ebx
test eax, eax
je 0x40475d
mov dword [esp + 4], str.__shutdown
mov dword [esp], esi
call ebx
test eax, eax
je 0x4047a4
mov dword [esp + 4], str.__update
mov dword [esp], esi
call ebx
test eax, eax
jne case.0x404626.2
mov dword [ebp - 0xe94], 1
add edi, 1
cmp dword [ebp - 0xe8c], edi
je 0x40466b
mov eax, dword [ebp - 0xe90]
mov esi, dword [eax + edi*4]
cmp byte [esi], 0x2d
jne 0x4045d0
movzx eax, byte [esi + 1]
cmp al, 0x2d
je 0x404518
lea edx, [esi + 2]
test al, al
je 0x4045d0
mov ecx, dword [ebp - 0xea4]
mov ebx, dword [ebp - 0xea8]
mov esi, dword [ebp - 0xe9c]
lea esi, [esi]
sub eax, 0x65
cmp al, 0x10
ja case.0x404626.2
movzx eax, al
jmp dword [eax*4 + 0x40a88c]
mov dword [ebp - 0xe94], 1
lea esi, [esi]
movzx eax, byte [edx]
add edx, 1
test al, al
jne 0x404618
mov dword [ebp - 0xea4], ecx
add edi, 1
mov dword [ebp - 0xea8], ebx
mov dword [ebp - 0xe9c], esi
cmp dword [ebp - 0xe8c], edi
jne 0x4045df
mov eax, dword [ebp - 0xe9c]
test eax, eax
je 0x40476c
mov eax, dword [ebp - 0xea0]
cmp dword [ebp - 0xea4], 0
mov dword [esp], eax
je 0x404e0f
call fcn.00401cb0
test eax, eax
je 0x404792
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call fcn.00401d10
mov dword [ebp - 0xec8], 1
jmp 0x404781
mov dword [ebp - 0xe98], 1
jmp 0x404640
mov ecx, 1
jmp 0x404640
mov ebx, 1
jmp 0x404640
mov esi, 1
jmp 0x404640
mov dword [ebp - 0xea0], 1
jmp 0x404640
mov dword [ebp - 0xeac], 1
jmp 0x404640
mov dword [ebp - 0xe9c], 1
jmp 0x4045d0
mov dword [ebp - 0xea0], 1
jmp 0x4045d0
mov dword [ebp - 0xeac], 1
jmp 0x4045d0
mov dword [ebp - 0xea4], 1
jmp 0x4045d0
mov dword [ebp - 0xea8], 1
jmp 0x4045d0
cmp dword [ebp - 0xea4], 0
jne 0x40469c
xor eax, eax
mov dword [ebp - 0xec8], eax
cmp dword [ebp - 0xe98], 0
je 0x4047c7
xor edi, edi
mov dword [ebp - 0xe9c], edi
mov eax, dword [ebp - 0xe9c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [ebp - 0xe98], 1
jmp 0x4045d0
xor esi, esi
mov dword [ebp - 0xec8], esi
mov dword [ebp - 0xeac], esi
mov dword [ebp - 0xea8], esi
mov dword [ebp - 0xe48], 0x18
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0xe44], eax
lea eax, [ebp - 0xe64]
mov dword [ebp - 0xe40], eax
lea eax, [ebp - 0xe48]
mov dword [ebp - 0xe38], edx
lea edi, [ebp - 0xe2c]
mov dword [ebp - 0xe34], edx
mov dword [ebp - 0xe3c], 0x82
mov dword [esp + 8], eax
lea eax, [ebp - 0xe80]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1f0003
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov eax, dword [ebp - 0xe80]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_ResetEvent]
xor eax, eax
push ecx
mov ecx, 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe5c]
mov dword [ebp - 0xe30], 0x18
mov dword [ebp - 0xe28], eax
lea eax, [ebp - 0xe30]
mov dword [ebp - 0xe5c], 0x4e004c
mov dword [ebp - 0xe58], str.KernelObjects__wine_user_shared_data
mov dword [ebp - 0xe68], ebx
mov dword [ebp - 0xe24], pe_nt_image_headers32
mov dword [esp + 8], eax
lea eax, [ebp - 0xe6c]
mov dword [esp + 4], 0xf001f
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtOpenSection]
sub esp, 0xc
test eax, eax
je 0x404e76
test byte [0x408010], 2
jne 0x406d09
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xe9c], eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0xe98], eax
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xe90], eax
mov eax, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 0xebc], eax
lea eax, [ebp - 0xe54]
mov dword [ebp - 0xeb8], eax
lea eax, [ebp - 0xe68]
mov dword [ebp - 0xeb4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
imul ebx, dword [eax + 0x64], 0x18
mov eax, dword [ebp - 0xe90]
call fcn.00402360
xor eax, eax
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xeb8]
mov dword [esp], 1
mov dword [esp + 4], eax
mov edi, dword [ebp - 0xebc]
call edi
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0xe9c]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call edi
sub esp, 0x10
test eax, eax
je 0x404976
xor eax, eax
mov dword [ebp - 0xa20], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], ebx
mov dword [ebp - 0xe8c], eax
call eax
mov dword [ebp - 0xec0], eax
test eax, eax
je 0x407ced
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0xec0]
mov dword [esp], 0xb
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dword [sym.imp.ntdll.dll_NtPowerInformation]
sub esp, 0x14
test eax, eax
jne 0x406bed
movzx eax, word [ebp - 0xe54]
cmp ax, 9
je 0x406bb7
cmp ax, 0xc
je 0x406b74
cmp ax, 5
je 0x406b74
mov eax, dword [ebp - 0xe98]
mov edx, 0x409790
call fcn.004022d0
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x14], 0xf003f
lea eax, [ebp - 0xe6c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], str.HardwareDescriptionSystem
mov dword [esp], 0x80000002
mov dword [ebp - 0xea0], eax
call eax
sub esp, 0x24
test eax, eax
jne 0x406ce3
movzx edx, word [ebp - 0xe54]
mov eax, dword [ebp - 0xe6c]
cmp dx, 5
je 0x406372
cmp dx, 0xc
je 0x406372
mov ecx, str.AT_compatible
mov edx, str.Identifier
call fcn.004028f0
movzx edx, word [ebp - 0xe54]
mov eax, dword [ebp - 0xe6c]
cmp dx, 5
je 0x405209
cmp dx, 0xc
je 0x405209
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], 0xf003f
lea ecx, [ebp - 0xe5c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], str.FloatingPointProcessor
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
mov eax, dword [ebp - 0xe6c]
jne 0x405209
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x20], edx
mov ecx, dword [ebp - 0xeb4]
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CentralProcessor
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x404b47
xor edi, edi
mov dword [ebp - 0xe68], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x64], 0
je 0x405216
mov eax, dword [ebp - 0xec0]
lea edi, [ebp - 0xe70]
xor ebx, ebx
lea esi, [eax + 4]
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xea4], eax
jmp 0x404c05
movzx eax, word [ebp - 0xe54]
cmp ax, 5
je 0x404bed
cmp ax, 0xc
je 0x404bed
lea eax, [ebp - 0xe30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x4061a1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ebx, 1
add esi, 0x18
cmp ebx, dword [eax + 0x64]
jae 0x405221
mov dword [esp + 0xc], ebx
lea eax, [ebp - 0xe30]
mov dword [esp + 8], 0x409b20
mov dword [esp + 4], 0xa
mov dword [esp], eax
call fcn.00401fa0
lea eax, [ebp - 0xe30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
jne 0x404b80
lea eax, [ebp - 0xe4c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.FeatureSet
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xe70]
sub esp, 0x18
cmp word [ebp - 0x818], 0
mov eax, dword [ebp - 0xe98]
je 0x404ce1
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x404cd8
mov ecx, dword [ebp - 0xe98]
mov dword [esp], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Identifier
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe9c]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe9c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProcessorNameString
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xe70]
sub esp, 0x18
cmp word [ebp - 0xc28], 0
mov eax, dword [ebp - 0xe90]
je 0x404d89
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x404d80
mov ecx, dword [ebp - 0xe90]
mov dword [esp], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.VendorIdentifier
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.MHz
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe70]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
sub esp, 4
jmp 0x404b80
call fcn.004019e0
test eax, eax
jne 0x404779
jmp 0x404792
mov eax, 1
call fcn.00402af0
xor eax, eax
call fcn.00402af0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, 0x415240
call fcn.004027f0
mov dword [esp + 0xc], str.Cannot_set_the_dir_to__s___ld__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.main
mov dword [esp + 0x14], ebx
mov dword [esp + 4], 0x408010
mov dword [esp], 1
call fcn.00402b80
jmp 0x40448a
xor eax, eax
mov dword [esp + 0x10], 0x710
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp - 0xe6c]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
push eax
test edi, edi
je 0x4075e3
lea eax, [ebp - 0x818]
xor esi, esi
mov dword [ebp - 0x818], 0x11c
mov dword [ebp - 0xe98], eax
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
lea eax, [ebp - 0xa20]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x2c
mov dword [ebp - 0xe9c], eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
mov dword [ebp - 0xebc], ebx
call ebx
xor eax, eax
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xe54]
mov dword [esp + 8], 0xc
mov dword [ebp - 0xeb8], eax
mov dword [esp + 4], eax
mov dword [esp], 1
call ebx
mov dword [edi + 4], 0x1000000
mov dword [edi + 0x244], 0x200000
sub esp, 0x10
movzx eax, byte [ebp - 0x6fe]
movd xmm0, dword [ebp - 0x80c]
mov byte [edi + 0x268], 1
movd xmm2, eax
punpckldq xmm0, xmm2
movq qword [edi + 0x260], xmm0
movzx eax, word [ebp - 0xe54]
mov word [edi + 0x26a], ax
movq xmm3, qword [ebp - 0x814]
movq qword [edi + 0x26c], xmm3
movzx eax, word [ebp - 0x700]
mov dword [edi + 0x2d0], eax
mov eax, dword [ebp - 0xa14]
mov byte [edi + 0x2d5], 2
mov dword [edi + 0x2e8], eax
lea eax, [edi + 0x30]
mov dword [esp + 4], str.C:windows
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
movzx eax, word [ebp - 0xe54]
cmp ax, 9
je 0x406e50
ja 0x4074e4
test ax, ax
je 0x406e50
cmp ax, 5
jne 0x405012
mov eax, dword [ebp - 0xe4c]
movzx edx, al
shr eax, 1
and dl, 1
and eax, 1
mov dh, al
mov word [edi + 0x286], dx
cmp word [ebp - 0xe52], 7
seta byte [edi + 0x291]
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xe90], eax
lea eax, [ebp - 0xe68]
mov dword [ebp - 0xeb4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [edi + 0x29b], 0
mov eax, dword [eax + 0x64]
mov byte [edi + 0x3c4], 1
mov dword [edi + 0x3c0], eax
je 0x405131
xor eax, eax
mov ecx, eax
cpuid
mov esi, eax
test byte [0x408010], 8
jne 0x40790d
cmp eax, 0xc
jle 0x405131
mov eax, 1
xor ecx, ecx
cpuid
and ecx, 0x8000000
je 0x405131
mov eax, 0xd
xor ecx, ecx
cpuid
mov esi, eax
and esi, 2
je 0x405131
mov esi, 0xd
mov dword [edi + 0x600], ebx
mov ecx, 1
movdqa xmm0, xmmword [0x40aac0]
mov dword [edi + 0x604], 0xa0
mov eax, esi
cpuid
mov edx, eax
and eax, 1
movups xmmword [edi + 0x3f4], xmm0
movdqa xmm0, xmmword [0x40aad0]
shr edx, 1
mov ecx, 2
mov dword [edi + 0x608], 0x100
and edx, 1
movups xmmword [edi + 0x3d8], xmm0
mov dword [edi + 0x60c], 0x100
add edx, edx
mov dword [edi + 0x404], 0x100
or eax, edx
movzx edx, byte [edi + 0x3ec]
mov dword [edi + 0x3e8], 0x340
and edx, 0xfffffffc
or eax, edx
mov byte [edi + 0x3ec], al
mov eax, esi
cpuid
test byte [0x408010], 8
jne 0x4079e7
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_UnmapViewOfFile]
push edx
jmp 0x404904
lea edx, [ebp - 0xa1c]
xor eax, eax
mov ecx, 0x10
lea ebx, [ebp - 0x818]
mov edi, edx
rep stosd dword es:[edi], eax
lea esi, [ebp - 0xa20]
mov dword [ebp - 0xa20], 0x44
mov dword [esp + 4], 0x104
mov dword [ebp - 0xe98], ebx
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_GetSystemDirectoryW]
push edx
push edx
mov dword [esp + 4], str.wineboot.exe
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
lea eax, [ebp - 0xe48]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_Wow64DisableWow64FsRedirection]
push ecx
call dword [sym.imp.kernelbase.dll_GetCommandLineW]
lea ecx, [ebp - 0xc28]
mov dword [esp + 0x20], esi
xor esi, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x407a76
test byte [0x408010], 2
jne 0x406d36
mov eax, dword [ebp - 0xe48]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_Wow64RevertWow64FsRedirection]
push eax
jmp 0x4044b5
xor ecx, ecx
mov dword [ebp - 0xe5c], ecx
jmp 0x404af5
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xea4], eax
xor ecx, ecx
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x14], 0xf003f
lea eax, [ebp - 0xe30]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], str.BIOS
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
mov ecx, dword [sym.imp.ucrtbase.dll_free]
sub esp, 0x24
mov dword [ebp - 0xeb0], ecx
test eax, eax
jne 0x40557d
xor eax, eax
mov edi, dword [sym.imp.kernelbase.dll_GetSystemFirmwareTable]
mov dword [esp], 0x52534d42
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call edi
sub esp, 0x10
mov esi, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov ebx, eax
test eax, eax
je 0x40555b
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 0x52534d42
call edi
mov edx, ebx
mov esi, eax
mov eax, dword [ebp - 0xe30]
sub esp, 0x10
mov ecx, esi
mov dword [ebp - 0xeb0], eax
mov eax, 2
call fcn.00402bd0
mov edi, eax
test eax, eax
je 0x405370
mov edx, eax
movzx eax, byte [eax + 1]
sub edx, ebx
lea ecx, [edx + eax]
mov edx, ecx
movzx ecx, byte [edi + 4]
mov dword [esp + 8], esi
mov dword [ebp - 0xec4], edx
mov dword [esp + 4], edx
mov edx, str.BaseBoardManufacturer
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call fcn.00402950
movzx ecx, byte [edi + 5]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.BaseBoardProduct
call fcn.00402950
movzx ecx, byte [edi + 6]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.BaseBoardVersion
call fcn.00402950
mov eax, dword [ebp - 0xe30]
mov ecx, esi
mov edx, ebx
mov dword [ebp - 0xeb0], eax
xor eax, eax
call fcn.00402bd0
mov edi, eax
test eax, eax
je 0x405467
mov edx, eax
movzx eax, byte [eax + 1]
sub edx, ebx
lea ecx, [edx + eax]
mov edx, ecx
movzx ecx, byte [edi + 4]
mov dword [esp + 8], esi
mov dword [ebp - 0xec4], edx
mov dword [esp + 4], edx
mov edx, str.BIOSVendor
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call fcn.00402950
movzx ecx, byte [edi + 5]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.BIOSVersion
call fcn.00402950
movzx ecx, byte [edi + 8]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.BIOSReleaseDate
call fcn.00402950
cmp byte [edi + 1], 0x17
jbe 0x406e01
movzx ecx, byte [edi + 0x14]
mov edx, str.BiosMajorRelease
mov eax, dword [ebp - 0xeb0]
call fcn.004028b0
movzx ecx, byte [edi + 0x15]
mov edx, str.BiosMinorRelease
mov eax, dword [ebp - 0xeb0]
call fcn.004028b0
movzx ecx, byte [edi + 0x16]
mov edx, str.ECFirmwareMajorVersion
mov eax, dword [ebp - 0xeb0]
call fcn.004028b0
movzx ecx, byte [edi + 0x17]
mov edx, str.ECFirmwareMinorVersion
mov eax, dword [ebp - 0xeb0]
call fcn.004028b0
mov eax, dword [ebp - 0xe30]
mov ecx, esi
mov edx, ebx
mov dword [ebp - 0xeb0], eax
mov eax, 1
call fcn.00402bd0
mov edi, eax
test eax, eax
je 0x40555b
mov edx, eax
movzx eax, byte [eax + 1]
sub edx, ebx
lea ecx, [edx + eax]
mov edx, ecx
movzx ecx, byte [edi + 4]
mov dword [esp + 8], esi
mov dword [ebp - 0xec4], edx
mov dword [esp + 4], edx
mov edx, str.SystemManufacturer
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call fcn.00402950
movzx ecx, byte [edi + 5]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.SystemProductName
call fcn.00402950
movzx ecx, byte [edi + 6]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.SystemVersion
call fcn.00402950
cmp byte [edi + 1], 0x1a
jbe 0x406d7b
movzx ecx, byte [edi + 0x19]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.SystemSKU
call fcn.00402950
movzx ecx, byte [edi + 0x1a]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0xec4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb0]
mov edx, str.SystemFamily
call fcn.00402950
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
mov dword [ebp - 0xeb0], eax
call eax
mov eax, dword [ebp - 0xe30]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov ebx, dword [ebp - 0xea4]
call ebx
push edi
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0xec0]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb0]
call eax
xor ecx, ecx
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], str.PerfStatsStatData
mov dword [esp], 0x80000006
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x406b5d
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x14], 0x20006
mov dword [esp + 4], str.Config_ManagerEnum
mov dword [esp], 0x80000006
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x406b46
lea eax, [ebp - 0xe30]
mov dword [esp + 4], str.SystemCurrentControlSetControlSession_ManagerEnvironment
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x4057fc
mov eax, dword [ebp - 0xe9c]
call fcn.00402360
xor eax, eax
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe90]
mov dword [esp], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xebc]
call eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0x10
mov eax, dword [eax + 0x64]
mov dword [esp + 8], 0x409b20
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov ebx, dword [ebp - 0xe98]
mov dword [esp], ebx
call fcn.00401fa0
mov eax, dword [ebp - 0xe30]
mov ecx, ebx
mov edx, str.NUMBER_OF_PROCESSORS
call fcn.004028f0
cmp word [ebp - 0xc28], 9
je 0x4073be
mov ebx, 0x409790
mov ecx, ebx
mov eax, dword [ebp - 0xe30]
mov edx, str.PROCESSOR_ARCHITECTURE
call fcn.004028f0
movzx eax, word [ebp - 0xc28]
cmp ax, 5
je 0x406c0a
cmp ax, 0xc
je 0x406c0a
mov edx, ebx
mov ebx, dword [ebp - 0xe98]
mov eax, ebx
call fcn.004022d0
mov dword [esp + 4], 0x409ea2
mov dword [esp], ebx
call fcn.00401f60
push esi
push esi
mov eax, dword [ebp - 0xe9c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00401f60
push edi
push edi
mov ebx, dword [ebp - 0xe98]
mov edx, 0x409ea8
mov eax, dword [ebp - 0xe30]
mov ecx, ebx
call fcn.004028f0
movzx eax, word [ebp - 0xc26]
mov dword [esp], ebx
mov dword [esp + 8], 0x409b20
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
call fcn.00401fa0
mov eax, dword [ebp - 0xe30]
mov ecx, ebx
mov edx, str.PROCESSOR_LEVEL
call fcn.004028f0
movzx eax, word [ebp - 0xc24]
mov dword [esp], ebx
mov dword [esp + 8], str._04x
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
call fcn.00401fa0
mov eax, dword [ebp - 0xe30]
mov ecx, ebx
mov edx, str.PROCESSOR_REVISION
call fcn.004028f0
mov eax, dword [ebp - 0xe30]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push ecx
mov edi, dword [ebp - 0xe9c]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x100
mov ebx, dword [ebp - 0xe98]
mov dword [esp], ebx
call dword [sym.imp.ws2_32.dll_gethostname]
mov ecx, dword [sym.imp.advapi32.dll_RegOpenKeyW]
push edx
push edx
mov dword [ebp - 0xebc], ecx
test eax, eax
jne 0x405962
mov dword [ebp - 0xa20], 2
mov eax, dword [ebp - 0xeb4]
mov dword [esp + 0xc], eax
mov edi, dword [ebp - 0xe9c]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], edi
call sub.ws2_32.dll_getaddrinfo
sub esp, 0x10
test eax, eax
jne 0x405898
mov eax, dword [ebp - 0xe68]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x405898
mov dword [esp + 4], str.localhost
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__stricmp]
test eax, eax
je 0x405898
mov eax, dword [ebp - 0xe68]
mov ebx, dword [eax + 0x14]
jmp 0x40589e
mov ebx, dword [ebp - 0xe98]
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strchr]
test eax, eax
je 0x4073eb
lea edx, [eax + 1]
mov byte [eax], 0
mov esi, dword [sym.imp.kernelbase.dll_SetComputerNameExA]
mov dword [esp + 4], edx
mov dword [esp], 6
call esi
push edi
push edi
mov dword [esp + 4], ebx
mov dword [esp], 5
call esi
push eax
push eax
mov eax, dword [ebp - 0xe98]
cmp ebx, eax
je 0x4058fa
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call sub.ws2_32.dll_freeaddrinfo
push ecx
mov ebx, dword [sym.imp.advapi32.dll_RegOpenKeyW]
lea eax, [ebp - 0xe5c]
mov dword [esp + 4], str.SystemCurrentControlSetControlComputerName
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
mov dword [ebp - 0xebc], ebx
call ebx
sub esp, 0xc
test eax, eax
jne 0x405962
mov eax, dword [ebp - 0xeb8]
mov dword [esp + 4], str.ComputerName
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x407642
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push ebx
mov esi, dword [ebp - 0xe98]
mov edi, 0x400
jmp 0x4059ad
lea ebx, [edi - 2]
cmp eax, ebx
jb 0x4061ce
mov eax, dword [ebp - 0xe98]
cmp esi, eax
je 0x405990
mov dword [esp], esi
mov eax, dword [ebp - 0xeb0]
call eax
lea edx, [edi*4]
mov dword [esp], edx
mov eax, dword [ebp - 0xe8c]
lea ebx, [edi + edi]
call eax
mov esi, eax
test eax, eax
je 0x4059d1
mov edi, ebx
mov dword [esp + 0xc], str.wininit.ini
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.rename
call dword [sym.imp.kernel32.dll_GetPrivateProfileSectionW]
sub esp, 0x10
test eax, eax
jne 0x405970
mov eax, dword [ebp - 0xe98]
xor esi, esi
xor edi, edi
mov dword [ebp - 0xa20], esi
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.SystemCurrentControlSetControlSession_Manager
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x405a68
mov eax, dword [ebp - 0xe9c]
xor ebx, ebx
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x405d69
xor edi, edi
mov dword [esp], edi
mov eax, dword [ebp - 0xeb0]
call eax
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push ecx
mov eax, dword [ebp - 0xeb4]
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp], 0x80000002
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xebc]
call eax
sub esp, 0xc
test eax, eax
je 0x406a84
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
xor ecx, ecx
mov edi, dword [sym.imp.kernelbase.dll_GetSystemDirectoryW]
mov dword [esp + 4], ecx
mov dword [esp], ecx
call edi
push ebx
push ebx
mov ebx, eax
lea eax, [eax + 0xc]
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], eax
call edi
push edi
push edi
mov dword [esp + 4], 0x40a1c4
mov dword [esp], esi
call fcn.00401f60
push eax
push eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_FindFirstFileW]
push edx
push edx
cmp word [esi], 0
mov dword [ebp - 0xec4], eax
mov eax, esi
je 0x405b19
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405b10
mov word [eax - 4], 0
mov eax, dword [ebp - 0xec4]
cmp eax, 0xffffffff
je 0x405e77
mov dword [ebp - 0xebc], esi
mov edi, dword [sym.imp.ucrtbase.dll_wcscmp]
lea ebx, [ebp - 0x7ec]
mov esi, eax
jmp 0x405b66
mov eax, dword [ebp - 0xe98]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x405e71
mov dword [esp + 4], 0x40a1fc
mov dword [esp], ebx
call edi
test eax, eax
je 0x405b48
mov dword [esp + 4], 0x40a200
mov dword [esp], ebx
call edi
test eax, eax
je 0x405b48
mov dword [ebp - 0xe5c], 0x104
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0xe54], 0x104
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xe5c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe90]
mov dword [esp + 0xc], 0x415240
mov dword [esp + 8], 0x415240
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_VerFindFileW]
lea ecx, [ebp - 0xe5c]
mov dword [ebp - 0xe5c], 0x104
sub esp, 0x20
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0xe9c]
mov dword [esp + 0x18], ecx
mov eax, dword [ebp - 0xe90]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xebc]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp], eax
call fcn.00403718
mov edx, eax
mov eax, dword [sym.imp.kernelbase.dll_DeleteFileW]
sub esp, 0x20
mov dword [ebp - 0xec0], eax
test edx, edx
je 0x405c6e
test byte [0x408010], 4
jne 0x406c4d
mov eax, dword [ebp - 0xe9c]
mov dword [esp], eax
mov eax, dword [sym.imp.kernelbase.dll_DeleteFileW]
mov dword [ebp - 0xec0], eax
call eax
push ecx
mov dword [esp + 8], 0x103
mov eax, dword [ebp - 0xebc]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe30]
mov dword [esp], eax
call fcn.00401f00
lea eax, [ebp - 0xe30]
sub esp, 0xc
cmp word [ebp - 0xe30], 0
je 0x405cb1
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405ca8
lea ecx, [ebp - 0xe30]
sub eax, ecx
mov edx, eax
lea eax, [ebp + eax - 0xe2e]
sar edx, 1
mov word [ebp + edx*2 - 0xe30], 0x5c
lea ecx, [edx + 1]
mov edx, 0x104
sub edx, ecx
mov dword [ebp - 0xe5c], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00401f00
lea eax, [ebp - 0xe30]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0xec0]
call eax
push edx
test eax, eax
jne 0x405b48
test byte [0x408010], 4
je 0x405b48
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
lea eax, [ebp - 0xe30]
mov dword [ebp - 0xec0], edx
call fcn.004027f0
mov edx, dword [ebp - 0xec0]
mov dword [esp + 0xc], str.failed_to_delete__s:_error__lu_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ProcessWindowsFileProtection
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 2
call fcn.00402b80
jmp 0x405b48
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov edi, eax
mov eax, dword [ebp - 0x818]
test edi, edi
je 0x405a49
mov ecx, dword [ebp - 0xe9c]
mov dword [esp + 0x10], edi
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
call ebx
sub esp, 0x18
test eax, eax
jne 0x405a4b
mov eax, dword [ebp - 0xa20]
cmp eax, 3
jbe 0x405a4b
and eax, 0xfffffffe
cmp word [edi + eax - 2], 0
jne 0x405a4b
cmp word [edi + eax - 4], 0
jne 0x405a4b
mov esi, edi
mov eax, esi
sub eax, edi
cmp eax, dword [ebp - 0xa20]
jae 0x4078b9
movzx edx, word [esi]
test dx, dx
je 0x4078b9
mov eax, esi
add eax, 2
cmp word [eax], 0
jne 0x405e04
lea ebx, [eax + 2]
cmp dx, 0x5c
je 0x40736c
xor eax, eax
cmp word [ebx], 0x21
jne 0x405e2a
add ebx, 2
mov eax, 1
cmp word [ebx], 0x5c
je 0x407395
cmp word [ebx], 0
jne 0x4071f7
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x405e63
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x10b
jne 0x405e63
jmp 0x407a20
add ebx, 2
cmp word [ebx], 0
jne 0x405e60
lea esi, [ebx + 2]
jmp 0x405de6
mov esi, dword [ebp - 0xebc]
mov eax, dword [ebp - 0xec4]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_FindClose]
push eax
mov dword [esp], esi
mov eax, dword [ebp - 0xeb0]
call eax
xor eax, eax
mov ecx, 1
mov edx, str.RunServicesOnce
mov dword [esp], eax
mov eax, 0x80000002
call fcn.00403580
mov eax, dword [ebp - 0xea8]
mov ecx, dword [ebp - 0xec8]
xor eax, 1
and eax, ecx
or eax, dword [ebp - 0xeac]
je 0x405f58
xor eax, eax
xor ecx, ecx
mov edx, str.RunServices
mov dword [esp], eax
lea edi, [ebp - 0x814]
mov eax, 0x80000002
call fcn.00403580
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xe9c]
mov dword [ebp - 0x818], 0x44
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 1
mov dword [esp], str.C:windows_system32_services.exe
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x406737
test byte [0x408010], 2
jne 0x4073fc
mov eax, dword [ebp - 0xeac]
or eax, dword [ebp - 0xe94]
jne 0x406386
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xe90]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], str.Volatile_Environment
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
jne 0x406152
mov edi, dword [ebp - 0xe98]
xor eax, eax
mov dword [esp + 4], 0x801a
mov dword [esp + 0xc], eax
mov ebx, dword [0x416488]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 0x10], edi
call ebx
sub esp, 0x14
test eax, eax
js 0x405ffe
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.APPDATA
call fcn.004028f0
mov eax, dword [ebp - 0xc28]
mov ecx, str.Console
mov edx, str.CLIENTNAME
call fcn.004028f0
mov edi, dword [ebp - 0xe98]
xor eax, eax
mov dword [esp + 4], 0x8028
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 0x10], edi
call ebx
sub esp, 0x14
test eax, eax
js 0x406080
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.USERPROFILE
call fcn.004028f0
mov eax, dword [ebp - 0xc28]
lea ecx, [ebp - 0x814]
mov edx, str.HOMEPATH
call fcn.004028f0
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.HOMEDRIVE
mov word [ebp - 0x814], 0
call fcn.004028f0
mov dword [ebp - 0xe30], 0x104
lea eax, [ebp - 0xe30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetUserNameW]
push edi
push edi
test eax, eax
jne 0x406c91
mov eax, dword [ebp - 0xc28]
mov ecx, 0x409288
mov edx, str.HOMESHARE
xor esi, esi
call fcn.004028f0
mov edi, dword [ebp - 0xe98]
xor ecx, ecx
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x801c
mov dword [esp + 0x10], edi
call ebx
sub esp, 0x14
test eax, eax
js 0x4060fe
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.LOCALAPPDATA
call fcn.004028f0
mov dword [ebp - 0xe30], 0x10
lea eax, [ebp - 0xe30]
lea ebx, [ebp - 0xa1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
push edx
push edx
test eax, eax
jne 0x406cac
mov eax, dword [ebp - 0xc28]
mov ecx, str.Console
mov edx, str.SESSIONNAME
call fcn.004028f0
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
mov eax, 0x80000002
mov ecx, 1
mov edx, str.RunOnce
mov dword [esp], 1
call fcn.00403580
mov eax, dword [ebp - 0xea8]
or eax, dword [ebp - 0xeac]
je 0x4067fc
test byte [0x408010], 8
jne 0x4067d3
mov eax, dword [ebp - 0xe80]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_SetEvent]
push edx
jmp 0x40478a
mov ecx, dword [ebp - 0xe98]
mov edx, str.Identifier
mov eax, dword [ebp - 0xe70]
call fcn.004028f0
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push edx
jmp 0x404bed
movzx eax, word [esi]
mov edi, esi
test ax, ax
je 0x406270
cmp ax, 0x3b
je 0x40636b
mov dword [esp + 4], 0x3d
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x40636b
mov word [eax], 0
lea ebx, [eax + 2]
mov dword [esp + 4], edi
mov dword [esp], 0x409ff4
call dword [sym.imp.kernelbase.dll_lstrcmpiW]
push ecx
push ecx
test eax, eax
jne 0x4062f0
test byte [0x408010], 8
jne 0x406a50
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_DeleteFileW]
push edx
test eax, eax
jne 0x40624a
test byte [0x408010], 4
jne 0x4074b0
cmp word [ebx], 0
mov eax, ebx
je 0x406261
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x406258
lea edi, [eax + 2]
movzx eax, word [edi]
test ax, ax
jne 0x4061dc
mov eax, dword [ebp - 0xe98]
cmp esi, eax
je 0x406285
mov dword [esp], esi
mov eax, dword [ebp - 0xeb0]
call eax
mov dword [esp + 8], 1
mov dword [esp + 4], str.wininit.bak
mov dword [esp], str.wininit.ini
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
jne 0x4059d1
test byte [0x408010], 2
je 0x4059d1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_rename_wininit.ini__error__ld_n
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x408010
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.00402b80
jmp 0x4059d1
test byte [0x408010], 8
jne 0x406a05
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
jne 0x40624a
test byte [0x408010], 4
je 0x40624a
mov eax, edi
call fcn.004027f0
mov edi, eax
mov eax, ebx
call fcn.004027f0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Error_renaming__s_to__s_n
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x408010
mov dword [esp], 2
call fcn.00402b80
jmp 0x40624a
mov ebx, edi
jmp 0x40624a
mov ecx, str.ARM_processor_family
mov edx, str.Identifier
call fcn.004028f0
jmp 0x404a80
mov ebx, dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp], str.WINECONFIGDIR
call ebx
mov dword [esp], str.WINEBUILDDIR
mov edi, eax
call ebx
test eax, eax
je 0x4072ea
mov dword [esp], eax
mov ebx, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [ebp - 0xebc], eax
call ebx
add eax, 0x11
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov esi, eax
test eax, eax
je 0x407827
mov edx, dword [ebp - 0xebc]
xor eax, eax
movzx ecx, word [edx + eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x4063db
mov dword [esp + 4], str.loader
mov dword [esp], esi
call fcn.00401f60
push eax
push eax
mov dword [esp + 4], str.wine.inf
mov dword [esp], esi
call fcn.00401f60
push eax
push eax
xor eax, eax
mov word [esi + 2], 0x5c
mov dword [esp + 4], eax
mov eax, dword [sym.imp.ucrtbase.dll__wopen]
mov dword [esp], esi
mov dword [ebp - 0xec4], eax
call eax
mov edx, eax
cmp eax, 0xffffffff
je 0x4077dd
mov eax, dword [ebp - 0xe90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0xebc], edx
call dword [sym.imp.ucrtbase.dll__fstat32]
mov edx, dword [ebp - 0xebc]
mov eax, dword [sym.imp.ucrtbase.dll__close]
mov dword [esp], edx
mov dword [ebp - 0xec0], eax
call eax
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xebc], eax
mov dword [esp], edi
call ebx
add eax, 0x13
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov ebx, eax
test eax, eax
je 0x4065e7
xor eax, eax
movzx edx, word [edi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x406492
mov dword [esp + 4], str..update_timestamp
mov dword [esp], ebx
call fcn.00401f60
push edi
push edi
mov dword [esp + 4], 2
mov dword [esp], ebx
mov eax, dword [ebp - 0xec4]
call eax
mov edi, eax
cmp eax, 0xffffffff
je 0x406f71
mov dword [esp + 8], 0x63
mov eax, dword [ebp - 0xe98]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__read]
test eax, eax
js 0x406548
mov byte [ebp + eax - 0x818], 0
mov dword [esp + 8], 7
mov dword [esp + 4], str.disable
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call sub.ucrtbase.dll_strncmp
test eax, eax
je 0x4065d1
xor eax, eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strtoul]
cmp dword [ebp - 0xebc], eax
je 0x4065d1
xor edx, edx
mov dword [esp], edi
mov dword [esp + 8], edx
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll__lseek]
xor ecx, ecx
mov dword [esp], edi
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll__chsize]
mov eax, dword [ebp - 0xebc]
mov dword [esp + 4], str._lu_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call fcn.00402860
mov dword [esp + 8], eax
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__write]
mov edx, dword [ebp - 0xe8c]
cmp edx, eax
je 0x407843
test byte [0x408010], 4
jne 0x407cb9
xor eax, eax
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
mov dword [esp], edi
mov eax, dword [ebp - 0xec0]
call eax
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call eax
cmp dword [ebp - 0xe94], 0
je 0x4071e7
lea edi, [ebp - 0xe78]
xor eax, eax
mov dword [ebp - 0xe78], eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], 0xb5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
sub esp, 0x18
test eax, eax
je 0x406640
xor eax, eax
mov dword [ebp - 0xe30], eax
mov ecx, 1
mov edx, str.PreInstall
mov eax, esi
call fcn.00402d10
mov dword [ebp - 0xe78], eax
test eax, eax
je 0x40701f
call fcn.00401ff0
xor edx, edx
mov ebx, eax
mov dword [esp], edx
call dword [sym.imp.kernelbase.dll_GetModuleHandleW]
push ecx
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 0xc], 0x402280
mov dword [esp + 4], 0x65
mov dword [esp], eax
call dword [0x416560]
sub esp, 0x14
mov dword [ebp - 0xe8c], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [0x4165ac]
push eax
push eax
cmp dword [ebp - 0xe78], 0
je 0x4066fe
xor eax, eax
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 1
call dword [0x416590]
sub esp, 0x14
test eax, eax
jne 0x406dd0
mov eax, dword [ebp - 0xe78]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
push eax
mov eax, dword [ebp + ebx*4 - 0xe30]
test eax, eax
je 0x40700f
test eax, 0x40000
je 0x406ffb
mov ecx, 1
mov edx, str.DefaultInstall
mov eax, esi
call fcn.00402d10
mov dword [ebp - 0xe78], eax
add ebx, 1
jmp 0x4066b3
mov eax, dword [ebp - 0xa1c]
xor esi, esi
xor edi, edi
mov ebx, dword [sym.imp.kernelbase.dll_CloseHandle]
mov dword [esp], eax
call ebx
push ecx
mov dword [esp + 0xc], str.__wine_SvcctlStarted
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CreateEventW]
movd xmm1, dword [ebp - 0xa20]
sub esp, 0x10
movd xmm0, eax
xor eax, eax
punpckldq xmm0, xmm1
movq qword [ebp - 0xc28], xmm0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe90]
mov dword [esp], 2
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_WaitForMultipleObjects]
sub esp, 0x10
sub eax, 1
je 0x40785e
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call ebx
push eax
jmp 0x405f58
mov dword [esp + 0xc], str.Operation_done_n
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x40618c
xor eax, eax
xor ecx, ecx
mov edx, 0x40a738
mov dword [esp], eax
mov eax, 0x80000002
call fcn.00403580
xor eax, eax
xor ecx, ecx
mov edx, 0x40a738
mov dword [esp], eax
mov eax, 0x80000001
call fcn.00403580
xor eax, eax
mov dword [ebp - 0xe6c], eax
mov dword [ebp - 0xe68], eax
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0xc28], eax
test byte [0x408010], 8
jne 0x407619
lea eax, [ebp - 0xe6c]
mov dword [esp], eax
call dword [0x416484]
test eax, eax
push edi
js 0x4072b4
lea eax, [ebp - 0xe5c]
xor esi, esi
mov dword [esp + 4], 7
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [0x41648c]
sub esp, 0xc
test eax, eax
js 0x406fab
mov eax, dword [ebp - 0xe6c]
xor ebx, ebx
mov ecx, dword [ebp - 0xeb4]
mov edx, dword [eax]
mov dword [esp + 0xc], 0x40faf8
mov dword [esp + 0x10], ecx
mov dword [esp + 8], ebx
mov ecx, dword [ebp - 0xe5c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x14]
sub esp, 0x14
test eax, eax
js 0x4078d7
mov eax, dword [ebp - 0xe68]
mov ecx, dword [ebp - 0xe90]
mov edx, dword [eax]
mov dword [esp + 8], 0xc0
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x10
test eax, eax
js 0x407d3c
mov esi, dword [0x4164a0]
mov ebx, dword [0x416494]
jmp 0x406926
test byte [0x408010], 8
jne 0x407343
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
call dword [0x416480]
push edi
mov eax, dword [ebp - 0xc28]
lea ecx, [ebp - 0xe30]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0xeb8]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], ecx
call dword [edx + 0xc]
sub esp, 0x10
test eax, eax
jne 0x406fb8
cmp dword [ebp - 0xe30], 1
jne 0x406fb8
mov eax, dword [ebp - 0xe68]
mov ecx, dword [ebp - 0xe9c]
mov edx, dword [eax]
mov dword [esp + 8], 0x8000
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0xe54]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x2c]
sub esp, 0x10
test eax, eax
js 0x406909
mov dword [esp + 0xc], 0x104
mov eax, dword [ebp - 0xe98]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe9c]
mov dword [esp], eax
call esi
sub esp, 0x10
test eax, eax
jns 0x407432
test byte [0x408010], 8
je 0x406916
mov dword [esp + 0xc], str.Unable_to_parse_display_name._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x406916
mov eax, edi
call fcn.004027f0
mov dword [ebp - 0xec0], eax
mov eax, ebx
call fcn.004027f0
mov ecx, dword [ebp - 0xec0]
mov dword [esp + 0xc], str.Renaming_file__s_to__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], ecx
mov dword [esp], 3
call fcn.00402b80
jmp 0x4062fd
mov eax, ebx
call fcn.004027f0
mov dword [esp + 0xc], str.Deleting_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x40622f
xor eax, eax
xor edx, edx
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 0x14], eax
mov dword [esp + 4], str.SFCDllCacheDir
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x405a94
mov eax, dword [ebp - 0x818]
lea edx, [eax + 2]
add eax, 8
mov dword [ebp - 0x818], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov esi, eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 4], str.SFCDllCacheDir
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call ebx
sub esp, 0x18
mov dword [esp + 4], 0x40a1be
mov dword [esp], esi
call fcn.00401f60
push eax
push eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
test esi, esi
jne 0x405aea
jmp 0x405aa6
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
jmp 0x405654
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push edx
jmp 0x405606
movzx eax, word [ebp - 0xe50]
movzx edx, al
movzx eax, ah
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xe52]
mov dword [esp + 8], str.ARM_Family__u_Model__u_Revision__u
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call fcn.00401fa0
jmp 0x4049f9
mov dword [esp + 4], str.AuthenticAMD
mov eax, dword [ebp - 0xe90]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, str.Intel64
test eax, eax
mov eax, str.AMD64
cmove edx, eax
mov eax, dword [ebp - 0xe98]
call fcn.004022d0
jmp 0x4049f9
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xec0]
mov dword [esp], eax
call sub.ucrtbase.dll_memset
jmp 0x4049c4
movzx eax, word [ebp - 0xc24]
movzx edx, al
movzx eax, ah
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xc26]
mov dword [esp + 8], str.ARM_Family__u_Model__u_Revision__u
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call fcn.00401fa0
jmp 0x405768
mov eax, ebx
mov dword [ebp - 0xec0], edx
call fcn.004027f0
mov edx, dword [ebp - 0xec0]
mov dword [esp + 0xc], str.WFP:__s_error_0x_lx_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ProcessWindowsFileProtection
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 2
call fcn.00402b80
jmp 0x405c57
mov ecx, dword [ebp - 0xe98]
mov edx, str.USERNAME
mov eax, dword [ebp - 0xc28]
call fcn.004028f0
jmp 0x4060ad
mov eax, dword [ebp - 0xc28]
mov ecx, ebx
mov edx, str.USERDOMAIN
call fcn.004028f0
mov ecx, dword [ebp - 0xe9c]
mov edx, str.LOGONSERVER
mov dword [ebp - 0xa20], 0x5c005c
mov eax, dword [ebp - 0xc28]
call fcn.004028f0
jmp 0x40612b
mov eax, dword [ebp - 0xec0]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xeb0], eax
call eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xea4], eax
jmp 0x4055b8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.cannot_open___wine_user_shared_data:__lx_n
mov dword [esp + 8], str.create_user_shared_data
mov dword [esp + 4], 0x408010
mov dword [esp], 1
call fcn.00402b80
jmp 0x4048bd
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, dword [ebp - 0xe98]
call fcn.004027f0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_restart_64_bit__s__err__ld_n
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x408010
mov dword [esp], 1
call fcn.00402b80
jmp 0x4051f4
mov dword [esp + 8], esi
mov edi, dword [ebp - 0xec4]
xor ecx, ecx
mov edx, str.SystemSKU
mov dword [esp], ebx
mov dword [esp + 4], edi
mov eax, dword [ebp - 0xeb0]
call fcn.00402950
mov dword [esp + 8], esi
xor ecx, ecx
mov edx, str.SystemFamily
mov dword [esp + 4], edi
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call fcn.00402950
jmp 0x40555b
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call dword [0x416568]
push eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], eax
call dword [0x416598]
sub esp, 0x14
test eax, eax
jne 0x406dc0
jmp 0x4066b3
mov edi, dword [ebp - 0xeb0]
mov ecx, 0xff
mov edx, str.BiosMajorRelease
mov eax, edi
call fcn.004028b0
mov eax, edi
mov ecx, 0xff
mov edx, str.BiosMinorRelease
call fcn.004028b0
mov eax, edi
mov ecx, 0xff
mov edx, str.ECFirmwareMajorVersion
call fcn.004028b0
mov ecx, 0xff
mov edx, str.ECFirmwareMinorVersion
mov eax, edi
call fcn.004028b0
jmp 0x405467
mov eax, dword [ebp - 0xe4c]
mov byte [edi + 0x28b], 1
mov edx, eax
shr dl, 7
mov byte [edi + 0x276], dl
mov edx, eax
shr edx, 8
and edx, 1
mov byte [edi + 0x277], dl
mov edx, eax
shr edx, 0xd
and edx, 1
mov byte [edi + 0x27a], dl
mov edx, eax
shr edx, 0xe
and edx, 1
mov byte [edi + 0x27b], dl
mov edx, eax
shr edx, 1
and edx, 1
mov byte [edi + 0x27c], dl
mov edx, eax
shr edx, 0x15
and edx, 1
mov byte [edi + 0x27d], dl
mov edx, eax
shr edx, 0x10
and edx, 1
mov byte [edi + 0x27e], dl
mov edx, eax
shr edx, 0x13
and edx, 1
mov byte [edi + 0x281], dl
mov edx, eax
shr edx, 0xf
and edx, 1
mov byte [edi + 0x298], dl
mov edx, eax
shr edx, 0x17
and edx, 1
mov byte [edi + 0x285], dl
mov edx, eax
shr edx, 0x14
and edx, 1
mov byte [edi + 0x282], dl
mov edx, eax
shr edx, 0x16
and edx, 1
mov byte [edi + 0x27f], dl
mov edx, eax
shr edx, 0x1d
and edx, 1
mov byte [edi + 0x280], dl
mov edx, eax
shr edx, 0x1a
and edx, 1
mov byte [edi + 0x288], dl
mov edx, eax
shr edx, 0x1b
and edx, 1
mov byte [edi + 0x289], dl
mov edx, eax
shr edx, 0x1c
and edx, 1
mov byte [edi + 0x28a], dl
mov edx, eax
shr edx, 0x18
and edx, 1
mov byte [edi + 0x299], dl
mov edx, eax
shr edx, 0x19
and edx, 1
mov byte [edi + 0x29a], dl
mov edx, eax
shr eax, 0x1f
shr edx, 0x1e
mov byte [edi + 0x29c], al
and edx, 1
mov byte [edi + 0x29b], dl
jmp 0x405012
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 2
jne 0x4065dc
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x301
mov dword [esp], ebx
mov eax, dword [ebp - 0xec4]
call eax
mov edi, eax
cmp eax, 0xffffffff
jne 0x40656a
jmp 0x4065dc
test byte [0x408010], 8
jne 0x407d13
mov eax, dword [ebp - 0xc28]
test eax, eax
je 0x406fcb
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push esi
mov eax, dword [ebp - 0xe68]
test eax, eax
je 0x406fde
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push ebx
mov eax, dword [ebp - 0xe5c]
test eax, eax
je 0x40617f
mov dword [esp], eax
call dword [0x416480]
push ecx
jmp 0x40617f
movzx ecx, ax
mov edx, str.Wow64Install
mov eax, esi
call fcn.00402d10
jmp 0x406729
mov eax, dword [ebp - 0xe8c]
mov dword [esp], eax
call dword [0x416564]
push eax
xor eax, eax
mov ecx, 6
xor ebx, ebx
lea edi, [ebp - 0x814]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x818], 0x1c
mov dword [esp + 4], ebx
mov dword [esp], ebx
call fcn.00403758
mov ebx, eax
push edi
push edi
cmp eax, 0xffffffff
je 0x407bed
mov eax, dword fs:[0x18]
mov edi, 0x40a994
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0xebc], esi
mov esi, dword [edi]
xor ecx, ecx
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x411368
mov dword [esp + 0x18], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00403750
sub esp, 0x1c
test eax, eax
jne 0x407210
mov eax, dword [ebp - 0xe94]
cmp dword [eax + 0x34], 0xe0000207
je 0x4070bf
test byte [0x408010], 2
jne 0x407a2f
add edi, 0xc
mov eax, str.install_root_pnp_devices
cmp eax, edi
jne 0x40706a
mov esi, dword [ebp - 0xebc]
mov dword [esp], ebx
call fcn.00403760
push eax
lea eax, [ebp - 0xe74]
mov dword [esp + 4], 0x20008
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.advapi32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x4071cd
mov dword [ebp - 0xe6c], 0x50
lea eax, [ebp - 0xe6c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50
mov eax, dword [ebp - 0xe9c]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe74]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetTokenInformation]
mov eax, dword [ebp - 0xe74]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
lea eax, [ebp - 0xe70]
push ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_ConvertSidToStringSidW]
xor eax, eax
push edi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xeb4]
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
mov dword [esp], 0x80000002
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x407b88
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_LocalFree]
push ebx
call fcn.00401ff0
call fcn.004027f0
mov dword [esp], str.wine:_configuration_in__s_has_been_updated._n
mov dword [esp + 4], eax
call fcn.00402ad0
mov dword [esp], esi
mov eax, dword [ebp - 0xeb0]
call eax
jmp 0x405f6a
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
jmp 0x405e63
mov eax, dword [edi + 4]
mov dword [ebp - 0xe8c], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
add eax, 2
add eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe8c]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00403768
sub esp, 0x14
test eax, eax
jne 0x40775e
test byte [0x408010], 2
je 0x4070bf
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, esi
mov dword [ebp - 0xe8c], edx
call fcn.004025f0
mov edx, dword [ebp - 0xe8c]
mov dword [esp + 0xc], str.Failed_to_set_hardware_id_for__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.00402b80
jmp 0x4070bf
test byte [0x408010], 2
je 0x406fb8
mov dword [esp + 0xc], str.Couldnt_get_desktop_folder._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 1
call fcn.00402b80
jmp 0x406fb8
mov dword [esp], str.WINEDATADIR
call ebx
test eax, eax
je 0x407827
mov dword [esp], eax
mov ebx, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [ebp - 0xebc], eax
call ebx
add eax, 0xa
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov esi, eax
test eax, eax
je 0x407827
mov edx, dword [ebp - 0xebc]
xor eax, eax
movzx ecx, word [edx + eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x40732e
jmp 0x4063fd
mov dword [esp + 0xc], str.Unable_to_get_display_name_of_enumeration_item._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x406916
cmp word [esi + 2], 0x3f
jne 0x405e1a
cmp word [esi + 4], 0x3f
jne 0x405e1a
cmp word [esi + 6], 0x5c
jne 0x405e1a
add esi, 8
jmp 0x405e1a
cmp word [ebx + 2], 0x3f
jne 0x4071f7
cmp word [ebx + 4], 0x3f
jne 0x4071f7
cmp word [ebx + 6], 0x5c
jne 0x4071f7
add ebx, 8
jmp 0x405e34
mov dword [esp + 4], str.AuthenticAMD
mov eax, dword [ebp - 0xe9c]
mov ebx, str.Intel64
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
mov eax, str.AMD64
cmove ebx, eax
mov ecx, eax
jmp 0x405708
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
lea edx, [ebx + eax]
jmp 0x4058bd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_start_services.exe:_error__lu_n
mov dword [esp + 8], str.start_services_process
mov dword [esp + 4], 0x408010
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.00402b80
jmp 0x405f58
xor eax, eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call ebx
sub esp, 0x18
mov edi, eax
cmp eax, 0x20
ja 0x406916
test byte [0x408010], 4
je 0x406916
mov eax, dword [ebp - 0xe98]
call fcn.004027f0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__p_executing_command__s._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 2
call fcn.00402b80
jmp 0x406916
mov eax, ebx
call fcn.004027f0
mov dword [esp + 0xc], str.Error_deleting_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x408010
mov dword [esp], 2
call fcn.00402b80
jmp 0x40624a
cmp ax, 0xc
jne 0x405012
mov byte [edi + 0x291], 1
mov eax, dword [ebp - 0xe4c]
xor ecx, ecx
lea ebx, [ebp - 0xc28]
mov byte [edi + 0x276], 1
mov byte [edi + 0x280], 1
mov byte [edi + 0x28b], 1
mov edx, eax
shr eax, 3
and eax, 1
shr edx, 2
mov byte [edi + 0x292], al
lea eax, [ebp - 0xe68]
and edx, 1
mov byte [edi + 0x293], dl
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x20
mov dword [ebp - 0xe90], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 4
mov dword [ebp - 0xeb4], eax
mov dword [esp + 4], eax
mov dword [esp], 0xb5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
sub esp, 0x18
test eax, eax
jne 0x40502a
mov eax, ebx
movzx ebx, word [0x40aabe]
jmp 0x407595
cmp ecx, 0x1c4
jne 0x407592
mov word [edi + 0x286], bx
add eax, 4
mov edx, dword [eax]
test edx, edx
je 0x40502a
movzx ecx, dx
cmp dx, 0x14c
jne 0x407583
mov byte [edi + 0x277], 1
mov byte [edi + 0x27a], 1
mov byte [edi + 0x27c], 1
mov byte [edi + 0x27e], 1
mov byte [edi + 0x281], 1
mov byte [edi + 0x294], 1
mov word [edi + 0x298], bx
mov byte [edi + 0x29a], 1
jmp 0x407592
test byte [0x408010], 2
je 0x4048bd
mov dword [esp + 0xc], str.cannot_map___wine_user_shared_data_n
mov dword [esp + 8], str.create_user_shared_data
mov dword [esp + 4], 0x408010
mov dword [esp], 1
call fcn.00402b80
jmp 0x4048bd
mov dword [esp + 0xc], str.Processing_items_in_the_StartUp_folder._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x40684f
mov eax, dword [ebp - 0xe90]
xor edx, edx
mov dword [ebp - 0xc28], 0x100
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 8], edx
mov dword [esp + 4], str.ComputerName
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x407696
xor eax, eax
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
cmp dword [ebp - 0xc28], 0
je 0x405950
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xeb8]
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 4], str.ActiveComputerName
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
jne 0x405950
mov eax, dword [ebp - 0xc28]
xor esi, esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe30]
mov dword [esp + 8], esi
mov dword [esp + 4], str.ComputerName
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe54]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push edi
jmp 0x405950
mov eax, dword [ebp - 0xe98]
mov dword [esp + 4], ebx
mov dword [esp], 0x19
mov dword [esp + 8], eax
call fcn.00403748
sub esp, 0xc
test eax, eax
jne 0x407ac6
test byte [0x408010], 2
je 0x4070bf
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, esi
mov dword [ebp - 0xe8c], edx
call fcn.004025f0
mov edx, dword [ebp - 0xe8c]
mov dword [esp + 0xc], str.Failed_to_register_device__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.00402b80
jmp 0x4070bf
call dword [sym.imp.ucrtbase.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strerror]
mov ebx, eax
mov eax, esi
call fcn.004027f0
mov dword [ebp - 0xe8c], eax
mov eax, edi
call fcn.004027f0
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0xe8c]
mov dword [esp + 4], eax
mov dword [esp], str.wine:_failed_to_update__s_with__s:__s_n
mov dword [esp + 8], ecx
call fcn.00402ad0
jmp 0x4071e7
mov eax, edi
call fcn.004027f0
mov dword [esp], str.wine:_failed_to_update__s__wine.inf_not_found_n
mov dword [esp + 4], eax
call fcn.00402ad0
jmp 0x405f6a
mov dword [esp], edi
mov eax, dword [ebp - 0xec0]
call eax
mov dword [esp], ebx
mov eax, dword [ebp - 0xeb0]
call eax
jmp 0x4065f4
lea eax, [ebp - 0xe30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_GetExitCodeProcess]
push edx
push edx
test byte [0x408010], 2
je 0x4067b6
mov eax, dword [ebp - 0xe30]
mov dword [esp + 0xc], str.Unexpected_termination_of_services.exe___exit_code__ld_n
mov dword [esp + 8], str.start_services_process
mov dword [esp + 4], 0x408010
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.00402b80
jmp 0x4067b6
mov dword [esp + 4], str.PendingFileRenameOperations
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
push ebx
push ebx
jmp 0x405a4b
test byte [0x408010], 8
je 0x406fb8
mov dword [esp + 0xc], str.Couldnt_bind_IShellFolder_to_StartUp_folder._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x406fb8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Max_cpuid_level__x._n
mov dword [esp + 8], str.initialize_xstate_features
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
cmp esi, 0xc
jle 0x405131
mov eax, 1
xor ecx, ecx
cpuid
mov esi, ecx
test byte [0x408010], 8
je 0x405077
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.CPU_features__x___x___x___x._n
mov dword [esp + 8], str.initialize_xstate_features
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
and esi, 0x8000000
je 0x405131
mov eax, 0xd
xor ecx, ecx
cpuid
mov esi, eax
test byte [0x408010], 8
je 0x40508e
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.XSAVE_details__x___x___x___x._n
mov dword [esp + 8], str.initialize_xstate_features
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x40508e
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.XSAVE_feature_2__x___x___x___x._n
mov dword [esp + 8], str.initialize_xstate_features
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x405131
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_DeleteFileW]
push esi
jmp 0x405e63
mov edx, dword [eax + 0x34]
mov eax, esi
mov dword [ebp - 0xe8c], edx
call fcn.004025f0
mov edx, dword [ebp - 0xe8c]
mov dword [esp + 0xc], str.Failed_to_create_device__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.00402b80
jmp 0x4070bf
test byte [0x408010], 8
jne 0x407b50
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0xe30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_GetExitCodeProcess]
push eax
push eax
mov eax, dword [ebp - 0xe30]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_ExitProcess]
xor eax, eax
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe8c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00403784
sub esp, 0x14
test eax, eax
jne 0x4070bf
test byte [0x408010], 2
je 0x4070bf
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, esi
mov dword [ebp - 0xe8c], edx
call fcn.004025f0
mov edx, dword [ebp - 0xe8c]
mov dword [esp + 0xc], str.Failed_to_install_drivers_for__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x408010
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.00402b80
jmp 0x4070bf
mov eax, dword [ebp - 0xe98]
call fcn.004027f0
mov dword [esp + 0xc], str.restarting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x407a83
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xe5c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0xe70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call eax
sub esp, 0x24
test eax, eax
je 0x407c30
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push edi
jmp 0x4071bd
test byte [0x408010], 2
je 0x4070da
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_create_device_info_list__error__lx._n
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x408010
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.00402b80
jmp 0x4070da
xor eax, eax
mov dword [ebp - 0xe54], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x28
mov eax, dword [ebp - 0xe98]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [0x416490]
sub esp, 0x10
test eax, eax
jne 0x407d72
mov dword [esp + 0x14], 4
mov eax, dword [ebp - 0xeb8]
mov dword [esp + 0xc], 4
mov dword [esp + 4], str.Flags
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe5c]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xea4]
call eax
push eax
jmp 0x407bd6
mov eax, ebx
call fcn.004027f0
mov dword [esp + 0xc], str.failed_to_update_timestamp_in__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_timestamp
mov dword [esp + 4], 0x408010
mov dword [esp], 2
call fcn.00402b80
jmp 0x4065c2
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [ebp - 0xea0], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xeb0], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xea4], eax
jmp 0x4055b8
mov dword [esp + 0xc], str.Couldnt_get_StartUp_folder_location._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x406fb8
test byte [0x408010], 8
je 0x406fb8
mov dword [esp + 0xc], str.Unable_to_enumerate_StartUp_objects._n
mov dword [esp + 8], str.ProcessStartupItems
mov dword [esp + 4], 0x408010
mov dword [esp], 3
call fcn.00402b80
jmp 0x406fb8
mov ecx, dword [ebp - 0xe98]
mov edx, str.ProfileImagePath
mov eax, dword [ebp - 0xe5c]
call fcn.004028f0
jmp 0x407c68