Function at 0x4015d1
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
xor esi, esi
lea edi, [ebp - 0x12c]
push ebx
sub esp, 0x14c
mov dword [ebp - 0x130], ecx
mov dword [esp + 4], 1
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x13c], eax
mov dword [esp + 4], 1
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [esp + 4], 1
mov dword [esp], 0x104
mov ebx, eax
call sub.msvcrt.dll_calloc
mov dword [0x40f050], eax
mov dword [esp + 4], 1
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [0x40f058], eax
mov dword [esp + 4], 1
mov dword [esp], 0x104
call sub.msvcrt.dll_calloc
mov dword [0x40f04c], eax
mov dword [esp + 4], esi
mov dword [esp], str.SeDebugPrivilege
call fcn.0040213e
xor eax, eax
mov ecx, 0x45
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [esp], eax
call fcn.0040220f
mov eax, dword [ebp - 0x128]
xchg dword [0x40f044], eax
xor edi, edi
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x13c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
je 0x401837
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, dword [0x40f050]
mov esi, dword [ebp - 0x13c]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x40f050]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov edx, dword [sym.imp.msvcrt.dll__strlwr]
push eax
mov eax, dword [0x40f050]
mov dword [esp], eax
mov dword [ebp - 0x140], edx
call edx
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, dword [0x40f058]
mov esi, dword [ebp - 0x13c]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x40f058]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x130]
push edx
mov dword [esp + 4], eax
mov eax, dword [0x40f050]
mov dword [esp], eax
call fcn.00401ee0
mov edx, dword [ebp - 0x140]
test eax, eax
mov eax, dword [ebp - 0x130]
jne 0x401770
test eax, eax
je 0x401774
mov dword [esp], eax
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x40184f
jmp 0x401778
test eax, eax
jne 0x401789
test ebx, ebx
jne 0x40177f
xor esi, esi
jmp 0x401862
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x401778
mov dword [esp], eax
call edx
mov eax, dword [ebp - 0x130]
mov dword [esp + 4], str._s.og
mov dword [esp + 8], eax
mov eax, dword [0x40f04c]
mov dword [esp], eax
call fcn.004015b0
mov eax, dword [0x40f04c]
mov dword [esp + 0xc], eax
mov eax, dword [0x40f058]
mov dword [esp + 4], 0x40c05b
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.004015b0
mov eax, dword [0x40f058]
mov dword [esp], eax
call fcn.00401cd9
mov dword [0x40f054], eax
mov dword [esp + 4], 0x40f048
mov dword [esp], ebx
call fcn.00402ace
test eax, eax
jne 0x401805
mov dword [esp + 4], 0x40f048
mov dword [esp], ebx
call fcn.00402bdc
mov eax, dword [ebp - 0x130]
test eax, eax
jne 0x401824
test ebx, ebx
jne 0x40181a
mov esi, 1
jmp 0x401862
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x401813
mov dword [esp], eax
mov esi, 1
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x401851
jmp 0x401813
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x401849
mov dword [esp], eax
call sub.msvcrt.dll_free
xor esi, esi
test ebx, ebx
je 0x401859
xor esi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_free
cmp dword [ebp - 0x13c], 0
je 0x401870
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret