Function at 0x401c60
Capabilities:
Create thread
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404f1c
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Russian
push 0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
add esp, 8
mov dword [ebp - 0x24], 0
mov eax, 0x40000000
lea edi, [ebp - 0x30]
xor ecx, ecx
xorps xmm0, xmm0
movq qword [ebp - 0x2c], xmm0
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov ecx, str.Microsoft_Hv
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x14], 0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d06
test dl, dl
je 0x401d02
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d06
add eax, 2
add ecx, 2
test dl, dl
jne 0x401ce6
xor eax, eax
jmp 0x401d0b
sbb eax, eax
or eax, 1
test eax, eax
je 0x402a60
mov ecx, str.VMwareVMware
lea eax, [ebp - 0x20]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d40
test dl, dl
je 0x401d3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d40
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d20
xor eax, eax
jmp 0x401d45
sbb eax, eax
or eax, 1
test eax, eax
je 0x402a60
mov ecx, str.XenVMMXenVMM
lea eax, [ebp - 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d75
test dl, dl
je 0x401d71
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d75
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d55
xor eax, eax
jmp 0x401d7a
sbb eax, eax
or eax, 1
test eax, eax
je 0x402a60
mov ecx, str.prl_hyperv
lea eax, [ebp - 0x20]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401db0
test dl, dl
je 0x401dac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401db0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d90
xor eax, eax
jmp 0x401db5
sbb eax, eax
or eax, 1
test eax, eax
je 0x402a60
mov ecx, str.KVMKVMKVM
lea eax, [ebp - 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401de5
test dl, dl
je 0x401de1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401de5
add eax, 2
add ecx, 2
test dl, dl
jne 0x401dc5
xor eax, eax
jmp 0x401dea
sbb eax, eax
or eax, 1
test eax, eax
je 0x402a60
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x3c], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
mov word [ebp - 0x44], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401e55
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0xc8]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x401e49
mov dword [ebp - 0x3c], eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x3c], 1
je 0x401e65
mov edx, 0x406700
jmp 0x402a65
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0x406760
lea ecx, [ebp - 0x38]
call fcn.00402bc0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x401ed3
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401ec9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
push 0x4067d8
lea ecx, [ebp - 0x38]
call fcn.00402bc0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x401f3d
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401f33
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
push 0x406828
lea ecx, [ebp - 0x38]
call fcn.00402bc0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 2
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x401f9a
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401f90
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
push 0x4068a0
lea ecx, [ebp - 0x38]
call fcn.00402bc0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 3
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x401ff7
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401fed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
push str.Warcraft_III
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40202a
mov edx, str.Window_not_found_
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
jmp 0x402a88
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x402a88
mov edx, str.ntdll.dll
mov ecx, esi
call fcn.00401280
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x40205a
mov edx, str.Failed_to_get_ntdll.dll_base_address_
jmp 0x40200d
mov edx, str.Game.dll
mov ecx, esi
call fcn.00401280
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x402074
mov edx, str.Failed_to_get_game.dll_base_address_
jmp 0x40200d
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x4020b2
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, 0x406a08
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0xbb8
call edi
jmp 0x402a88
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
movq qword [ebp - 0x9c], xmm0
lea ecx, [ebp - 0x9c]
push 0x12
mov dword [ebp - 0x34], 0xebfca4f3
mov dword [ebp - 0x30], 0x8b5590e5
mov dword [ebp - 0x2c], 0x535756ec
mov dword [ebp - 0x28], 0x8b0c758b
mov word [ebp - 0x24], 0x87d
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
call fcn.00403290
mov ebx, dword [ebp - 0x9c]
lea eax, [ebp - 0x34]
push 0x12
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
lea eax, [ebx + 0x12]
add esp, 0xc
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x90]
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
movq qword [ebp - 0x90], xmm0
push 0x12
mov dword [ebp - 0x5c], 0xebfc9090
mov dword [ebp - 0x58], 0x8b5590e5
mov dword [ebp - 0x54], 0x535756ec
mov dword [ebp - 0x50], 0x8b0c758b
mov word [ebp - 0x4c], 0x87d
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
call fcn.00403290
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x5c]
push 0x12
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + 0x12]
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x84]
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
movq qword [ebp - 0x84], xmm0
push 2
mov word [ebp - 0xe4], 0xca23
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
call fcn.00403290
mov ecx, dword [ebp - 0x84]
movzx eax, word [ebp - 0xe4]
mov word [ecx], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
movq qword [ebp - 0x58], xmm0
push 2
mov word [ebp - 0xd8], 0x9090
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
call fcn.00403290
mov ecx, dword [ebp - 0x58]
movzx eax, word [ebp - 0xd8]
mov word [ecx], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x78]
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
movq qword [ebp - 0x78], xmm0
push 1
mov byte [ebp - 0xdd], 1
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
call fcn.00403290
mov ecx, dword [ebp - 0x78]
movzx eax, byte [ebp - 0xdd]
mov byte [ecx], al
lea eax, [ecx + 1]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
movq qword [ebp - 0x6c], xmm0
push 1
mov byte [ebp - 0xe1], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
call fcn.00403290
mov ecx, dword [ebp - 0x6c]
movzx eax, byte [ebp - 0xe1]
mov byte [ecx], al
lea eax, [ecx + 1]
mov dword [ebp - 0x68], eax
push 0xc
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 9
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov eax, dword [ebp - 0xd4]
xor esi, esi
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xd8], eax
xor eax, eax
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x24], eax
test ecx, ecx
je 0x40236c
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403290
mov eax, dword [ebp - 0xdc]
mov esi, dword [ebp - 0x2c]
push eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x40]
push eax
push ecx
push esi
push dword [ebp - 0xd8]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4028c0
mov eax, dword [ebp - 0x40]
lea ecx, [ebx + 0x12]
sub eax, ecx
xor edx, edx
add eax, ebx
je 0x4028c0
sub ecx, ebx
mov dword [ebp - 0xdc], ecx
mov ecx, edx
je 0x4023bf
lea eax, [esi + ecx]
mov al, byte [eax + edx]
cmp al, byte [ecx + ebx]
jne 0x402740
inc ecx
cmp ecx, dword [ebp - 0xdc]
jb 0x4023a7
mov eax, dword [ebp - 0xd8]
add eax, edx
mov dword [ebp - 0xd8], eax
test esi, esi
je 0x402407
mov ecx, dword [ebp - 0xc8]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4023f7
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4028e6
push ecx
push esi
call fcn.00403ead
mov eax, dword [ebp - 0xd8]
add esp, 8
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4028fd
mov ecx, dword [ebp - 0x60]
xorps xmm0, xmm0
movq qword [ebp - 0x2c], xmm0
movaps xmm0, xmmword [0x406b40]
movups xmmword [ebp - 0x104], xmm0
lea eax, [ecx + 0x3a159b]
mov dword [ebp - 0x24], 0
movaps xmm0, xmmword [0x406b50]
mov dword [ebp - 0xdc], eax
lea eax, [ecx + 0x36143c]
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xc8], eax
movups xmmword [ebp - 0xf4], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00403200
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x104]
push 0x20
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
lea esi, [ebx + 0x20]
mov dword [ebp - 0x28], esi
push 4
mov byte [ebp - 4], 0xa
call fcn.00403e7d
mov dword [ebp - 0x60], eax
mov dword [eax], 0x401420
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xb
push ecx
push 0
push eax
push 0x4039b0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x28
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x4028ae
push 0x14
mov byte [ebp - 4], 0xc
call fcn.00403e7d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 0xd
sub esi, dword [ebp - 0x2c]
mov eax, esi
mov dword [ebx], 0
sar eax, 2
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 0x60], esi
mov dword [ebp - 0xe4], eax
test eax, eax
je 0x402536
push eax
mov ecx, ebx
call fcn.00403200
push dword [ebp - 0x60]
mov esi, dword [ebx]
push dword [ebp - 0x2c]
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0xe4]
add esp, 0xc
lea eax, [esi + eax*4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x401480
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0xe
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
push eax
push 0
push ebx
push 0x403a10
push 0
push 0
call esi
add esp, 0x18
mov dword [ebp - 0xbc], eax
test eax, eax
je 0x40289c
push 4
mov byte [ebp - 4], 0xf
call fcn.00403e7d
mov dword [ebp - 0x48], eax
mov dword [eax], 0x401800
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x10
push ecx
push 0
push eax
push 0x4039b0
push 0
push 0
call esi
add esp, 0x1c
mov dword [ebp - 0xac], eax
test eax, eax
je 0x40288a
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x402882
mov ebx, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x402882
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x78]
movlpd qword [ebp - 0xac], xmm0
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push ecx
lea ecx, [ebp - 0xb4]
call fcn.00403490
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x402882
push eax
push dword [ebp - 0xb4]
call ebx
add esp, 8
test eax, eax
jne 0x402882
xorps xmm0, xmm0
push 8
movlpd qword [ebp - 0xb4], xmm0
call fcn.00403e7d
mov dword [ebp - 0x48], eax
mov dword [eax], str.war3.exe
mov dword [eax + 4], 0x401b50
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x13
push ecx
push 0
push eax
push 0x403b50
push 0
push 0
call esi
add esp, 0x1c
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x402870
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x402882
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x402882
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
movlpd qword [ebp - 0xa4], xmm0
mov esi, 0x409440
mov al, byte [0x409440]
test al, al
je 0x40284d
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x3c]
sub eax, ecx
push 0
push eax
push ecx
push dword [ebp - 0xd8]
push esi
call ebx
test eax, eax
je 0x40275a
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push 0
sub eax, ecx
push eax
push ecx
push dword [ebp - 0xdc]
push esi
call ebx
test eax, eax
je 0x40275a
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
push 0
sub eax, ecx
push eax
push ecx
push dword [ebp - 0xc8]
push esi
call ebx
test eax, eax
je 0x40275a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x406a78
jmp 0x402765
mov eax, dword [ebp - 0x40]
lea ecx, [ebx + 0x12]
sub eax, ecx
inc edx
add eax, ebx
cmp edx, eax
jae 0x4028c0
xor ecx, ecx
jmp 0x4023a7
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, 0x406a98
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
xor esi, esi
nop dword [eax]
mov al, byte [0x409441]
test al, al
jne 0x402796
push 0x3e8
call edi
inc esi
cmp esi, 0x5f
jl 0x402780
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
mov esi, dword [ebp - 0x3c]
sub eax, ecx
push 0
push eax
push ecx
push dword [ebp - 0xd8]
push esi
call ebx
test eax, eax
je 0x4027fa
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
push 0
sub eax, ecx
push eax
push ecx
push dword [ebp - 0xdc]
push esi
call ebx
test eax, eax
je 0x4027fa
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x74]
push 0
sub eax, ecx
push eax
push ecx
push dword [ebp - 0xc8]
push esi
call ebx
test eax, eax
je 0x4027fa
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x406ac8
jmp 0x402805
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.Failed_to_restore_memory_
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov al, byte [0x409443]
test al, al
jne 0x402836
mov al, byte [0x409441]
test al, al
jne 0x402836
push 0x64
call edi
mov al, byte [0x409443]
test al, al
je 0x402820
push 0x1388
call edi
xor al, al
mov ecx, 0x409443
xchg byte [ecx], al
mov esi, 0x409440
jmp 0x402851
push 0x64
call edi
mov al, byte [0x409441]
test al, al
je 0x4026d2
xor al, al
xchg byte [esi], al
xor al, al
mov ecx, 0x409441
xchg byte [ecx], al
jmp 0x4026d2
push 6
mov dword [ebp - 0xa0], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0xa8], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0xb8], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0xc0], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
test esi, esi
je 0x4028f6
mov ecx, dword [ebp - 0xc8]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4028ec
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4028ec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.00403ead
add esp, 8
mov dword [ebp - 0x40], 0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.Pattern_not_found_
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x6c]
test edx, edx
je 0x402957
mov ecx, dword [ebp - 0x64]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x40294d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
mov edx, dword [ebp - 0x78]
test edx, edx
je 0x40298b
mov ecx, dword [ebp - 0x70]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x402981
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
mov edx, dword [ebp - 0x58]
test edx, edx
je 0x4029bf
mov ecx, dword [ebp - 0x50]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4029b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
mov edx, dword [ebp - 0x84]
test edx, edx
je 0x4029f2
mov ecx, dword [ebp - 0x7c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4029e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
mov edx, dword [ebp - 0x90]
test edx, edx
je 0x402a28
mov ecx, dword [ebp - 0x88]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x402a1e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a4e
push ecx
push edx
call fcn.00403ead
add esp, 8
test ebx, ebx
je 0x402a88
mov ecx, dword [ebp - 0x94]
mov eax, ebx
sub ecx, ebx
cmp ecx, 0x1000
jb 0x402a54
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402a54
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.00403ead
add esp, 8
jmp 0x402a88
mov edx, 0x4066a8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
push 0x403140
call fcn.00402ce0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403d4c
mov esp, ebp
pop ebp
ret