Function at 0x4168b0
Capabilities:
Acquire debug privileges
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea718
mov eax, dword fs:[0]
push eax
sub esp, 0x868
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0xf4], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0xff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x80c]
call fcn.005964f3
call fcn.00524cc0
push 0x629620
mov ecx, 0x663cf4
call fcn.0040be10
push eax
call fcn.005b24e5
add esp, 8
test eax, eax
jne 0x416937
push 0x60b0ed
mov ecx, 0x663cf4
call fcn.0040bdc0
push 1
push 2
lea ecx, [ebp - 0x194]
call fcn.0040b040
mov dword [ebp - 4], 0
mov ecx, 0x663cf4
call fcn.0040be10
push eax
push str._change:
push 0x629630
lea ecx, [ebp - 0x194]
push ecx
call fcn.00409b60
add esp, 8
push eax
call fcn.00409b60
add esp, 8
push eax
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x6b0]
push edx
lea ecx, [ebp - 0x194]
call fcn.004094f0
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x814]
call fcn.0040be10
push eax
push 0x62964c
push 0x74
push 0x629668
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6b0]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.00409dd0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416ad5
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x629678
lea edx, [ebp - 0x214]
push edx
call fcn.005b1b4c
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x294]
call fcn.0040b040
mov dword [ebp - 4], 2
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x294]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x6cc]
push edx
lea ecx, [ebp - 0x294]
call fcn.004094f0
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x81c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x81c]
call fcn.0040be10
push eax
push 0x629694
push 0x81
push 0x6296b0
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6cc]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.00409dd0
xor eax, eax
jmp 0x41722b
push 0
push 2
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jge 0x416bc3
mov ecx, dword [ebp - 0xf0]
push ecx
push 0x6296c0
lea edx, [ebp - 0x314]
push edx
call fcn.005b1b4c
add esp, 0xc
push 1
push 2
lea ecx, [ebp - 0x394]
call fcn.0040b040
mov dword [ebp - 4], 4
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x394]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x6e8]
push edx
lea ecx, [ebp - 0x394]
call fcn.004094f0
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x824], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x824]
call fcn.0040be10
push eax
push 0x6296e4
push 0x8f
push 0x629700
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6e8]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.00409dd0
xor eax, eax
jmp 0x41722b
push 0
call fcn.00599817
add esp, 4
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
push 1
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
call fcn.00404970
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x704]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0040cb00
mov dword [ebp - 0x828], eax
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x82c]
call fcn.0040be10
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x663c34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call fcn.0040bf30
cmp dword [0x663c34], 0
je 0x416c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416d2f
push 1
push 2
lea ecx, [ebp - 0x414]
call fcn.0040b040
mov dword [ebp - 4], 7
push 0x629710
lea ecx, [ebp - 0x414]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x720]
push edx
lea ecx, [ebp - 0x414]
call fcn.004094f0
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x834]
call fcn.0040be10
push eax
push 0x629720
push 0xb0
push 0x62973c
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x720]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00409dd0
xor eax, eax
jmp 0x41722b
push 1
lea ecx, [ebp - 0x73c]
push ecx
call fcn.00501110
add esp, 8
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x838]
mov dword [ebp - 0x83c], edx
mov dword [ebp - 4], 9
push 0x629760
mov eax, dword [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x758]
push ecx
call fcn.00404a60
add esp, 0xc
mov dword [ebp - 0x840], eax
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x844], edx
mov byte [ebp - 4], 0xa
push 0x629754
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x774]
push ecx
call fcn.00404a60
add esp, 0xc
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 0xb
push str..lck
mov eax, dword [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404a60
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x774]
call fcn.0040bf30
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x758]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x73c]
call fcn.0040bf30
push 0
push 0x4000080
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.0040be10
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x416efc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x416efc
push 1
push 2
lea ecx, [ebp - 0x494]
call fcn.0040b040
mov byte [ebp - 4], 0x10
push 0x629764
lea edx, [ebp - 0x494]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x494]
call fcn.004094f0
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x854], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x854]
call fcn.0040be10
push eax
push 0x629774
push 0xbd
push 0x629790
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x790]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x494]
call fcn.00409dd0
mov dword [ebp - 0x794], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040bf30
mov eax, dword [ebp - 0x794]
jmp 0x41722b
push 1
push 0x6297a0
call fcn.004ffba0
add esp, 8
test eax, eax
jne 0x416fac
push 1
push 2
lea ecx, [ebp - 0x514]
call fcn.0040b040
mov byte [ebp - 4], 0x12
push str.SeDebugPrivilege
lea edx, [ebp - 0x514]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0x514]
call fcn.004094f0
mov dword [ebp - 0x858], eax
mov ecx, dword [ebp - 0x858]
mov dword [ebp - 0x85c], ecx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x85c]
call fcn.0040be10
push eax
push 0x6297c8
push 0xd0
push 0x6297e4
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7b0]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x514]
call fcn.00409dd0
push 1
push 0x6297f4
call fcn.004ffba0
add esp, 8
test eax, eax
jne 0x41705c
push 1
push 2
lea ecx, [ebp - 0x594]
call fcn.0040b040
mov byte [ebp - 4], 0x14
push str.SeBackupPrivilege
lea edx, [ebp - 0x594]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x594]
call fcn.004094f0
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x864], ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x864]
call fcn.0040be10
push eax
push 0x62981c
push 0xd5
push 0x629838
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7cc]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x594]
call fcn.00409dd0
push 1
push 0x629848
call fcn.004ffba0
add esp, 8
test eax, eax
jne 0x41710c
push 1
push 2
lea ecx, [ebp - 0x614]
call fcn.0040b040
mov byte [ebp - 4], 0x16
push str.SeSecurityPrivilege
lea edx, [ebp - 0x614]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x614]
call fcn.004094f0
mov dword [ebp - 0x868], eax
mov ecx, dword [ebp - 0x868]
mov dword [ebp - 0x86c], ecx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x86c]
call fcn.0040be10
push eax
push 0x629870
push 0xda
push 0x62988c
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x7e8]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x614]
call fcn.00409dd0
push 1
push 0x62989c
call fcn.004ffba0
add esp, 8
test eax, eax
jne 0x4171bc
push 1
push 2
lea ecx, [ebp - 0x694]
call fcn.0040b040
mov byte [ebp - 4], 0x18
push str.SeSystemtimePrivilege
lea edx, [ebp - 0x694]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x694]
call fcn.004094f0
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x870]
mov dword [ebp - 0x874], ecx
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x874]
call fcn.0040be10
push eax
push str.CEDSClientApp::InitInstance
push 0xdf
push str..EDSClient.cpp
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x804]
call fcn.0040bf30
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x694]
call fcn.00409dd0
push 0x416420
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00507ca0
push 0
lea ecx, [ebp - 0xec]
call fcn.00417c10
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x80c]
lea eax, [ebp - 0xec]
mov dword [edx + 0x20], eax
lea ecx, [ebp - 0xec]
call fcn.005975e1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x808], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xec]
call fcn.00417250
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040bf30
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xf4]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret