Function at 0x402350
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433a49
mov eax, dword fs:[0]
push eax
sub esp, 0xcd0
mov eax, dword [0x4464d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xc40], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc48], ebx
test ebx, ebx
je 0x402ea0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x402ea0
push ebx
lea ecx, [ebp - 0xc24]
call fcn.00401eb0
lea eax, [ebp - 0xc24]
mov ecx, edi
push eax
call fcn.00403210
mov esi, eax
cmp esi, dword [edi]
je 0x4023e3
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0xc24]
call fcn.00402030
test al, al
jne 0x4023e3
mov dword [ebp - 0xc18], esi
jmp 0x4023eb
mov eax, dword [edi]
mov dword [ebp - 0xc18], eax
lea esi, [ebp - 0xc18]
mov esi, dword [esi]
lea ecx, [ebp - 0xc24]
call fcn.00401f50
cmp esi, dword [edi]
je 0x40246b
cmp dword [esi + 0x1c], 3
jge 0x402ea0
push 0
call fcn.00419862
add esp, 4
sub eax, dword [esi + 0x20]
sbb edx, dword [esi + 0x24]
test edx, edx
jg 0x40246b
jl 0x402427
cmp eax, 5
jae 0x40246b
lea edx, [esi + 0x28]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xc18], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402435
sub ecx, dword [ebp - 0xc18]
sar ecx, 1
je 0x40246b
add esi, 0xaa
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402453
sub esi, ecx
sar esi, 1
je 0x40246b
mov eax, edx
jmp 0x402ea6
mov ecx, ebx
mov dword [ebp - 0xc24], 0
mov dword [ebp - 0xc38], 0
call fcn.0040a8d0
mov esi, eax
lea eax, [ebp - 0x8ac]
push esi
push str.thkim_dwFed___d
push 0x400
push eax
call fcn.00404050
add esp, 0x10
lea eax, [ebp - 0x8ac]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x40293f
mov eax, dword [0x44a670]
test eax, eax
je 0x402c79
push 0
push 0
push 0
lea ecx, [ebp - 0xc18]
mov dword [ebp - 0xc20], 0
push ecx
lea ecx, [ebp - 0xc20]
mov dword [ebp - 0xc18], 0
push ecx
push 0
push ebx
push 0xc9
call eax
add esp, 0x20
test eax, eax
jne 0x402c79
push eax
lea ecx, [ebp - 0xcdc]
call fcn.00412410
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0
call fcn.004152b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8c4]
push dword [ebp - 0xc20]
call fcn.00403ff0
push 1
lea eax, [ebp - 0xcdc]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0xa4]
call fcn.00416dc0
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 1
mov bl, al
call fcn.004040b0
test bl, bl
je 0x402908
lea ecx, [ebp - 0xcdc]
call fcn.00413c30
test al, al
jne 0x402908
push str.policy
lea ecx, [ebp - 0xcdc]
call fcn.00412f30
push eax
lea ecx, [ebp - 0xc64]
call fcn.00412210
lea ecx, [ebp - 0xc64]
mov byte [ebp - 4], 3
call fcn.00413c30
test al, al
jne 0x4028f9
lea ecx, [ebp - 0xc64]
call fcn.00414110
test al, al
je 0x4028f9
lea ecx, [ebp - 0xc64]
call fcn.00414a70
mov ebx, eax
xor esi, esi
mov dword [ebp - 0xc30], ebx
test ebx, ebx
jle 0x4028f9
push esi
lea ecx, [ebp - 0xc64]
call fcn.00412cf0
push eax
lea ecx, [ebp - 0xc7c]
call fcn.00412210
lea ecx, [ebp - 0xc7c]
mov byte [ebp - 4], 4
call fcn.00413c30
test al, al
jne 0x4026a1
push str.type
lea ecx, [ebp - 0xc7c]
call fcn.00412f30
push eax
lea ecx, [ebp - 0xc94]
call fcn.00412210
lea ecx, [ebp - 0xc94]
mov byte [ebp - 4], 5
call fcn.00413c30
test al, al
jne 0x402692
lea ecx, [ebp - 0xc94]
call fcn.00414140
test al, al
je 0x402692
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0xc94]
call fcn.00413790
cmp dword [eax + 0x14], 0x10
jb 0x40266a
mov eax, dword [eax]
push str.UserInfo
push eax
call fcn.00419a64
add esp, 8
lea ecx, [ebp - 0x8c4]
test eax, eax
sete bl
call fcn.004040b0
test bl, bl
jne 0x4026be
mov ebx, dword [ebp - 0xc30]
lea ecx, [ebp - 0xc94]
mov byte [ebp - 4], 4
call fcn.00412a70
lea ecx, [ebp - 0xc7c]
mov byte [ebp - 4], 3
call fcn.00412a70
inc esi
cmp esi, ebx
jl 0x4025e3
jmp 0x4028f9
push str.content
lea ecx, [ebp - 0xc7c]
call fcn.00412f30
push eax
lea ecx, [ebp - 0x8c4]
call fcn.00412210
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 6
call fcn.00413c30
test al, al
jne 0x4028cc
push str.user
lea ecx, [ebp - 0x8c4]
call fcn.00412f30
push eax
lea ecx, [ebp - 0xcac]
call fcn.00412210
lea ecx, [ebp - 0xcac]
mov byte [ebp - 4], 7
call fcn.00413c30
test al, al
jne 0x4028bd
push 0x43f62c
lea ecx, [ebp - 0xcac]
call fcn.00412f30
push eax
lea ecx, [ebp - 0xcc4]
call fcn.00412210
lea ecx, [ebp - 0xcc4]
mov byte [ebp - 4], 8
call fcn.00413c30
test al, al
jne 0x4027d8
lea ecx, [ebp - 0xcc4]
call fcn.00414140
test al, al
je 0x4027d8
lea eax, [ebp - 0x8dc]
mov dword [ebp - 0xc38], 1
push eax
lea ecx, [ebp - 0xcc4]
call fcn.00413790
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 0x10
jb 0x40278e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xc1c]
call fcn.00401e20
lea ecx, [ebp - 0x8dc]
mov byte [ebp - 4], 8
call fcn.004040b0
mov eax, dword [ebp - 0xc1c]
test eax, eax
je 0x4027b7
mov eax, dword [eax]
jmp 0x4027b9
xor eax, eax
push eax
push 0x43f630
lea eax, [edi + 0x10]
push 0x41
push eax
call fcn.00404050
add esp, 0x10
lea ecx, [ebp - 0xc1c]
call fcn.00401f50
push str.name
lea ecx, [ebp - 0xcac]
call fcn.00412f30
push eax
lea ecx, [ebp - 0x2c]
call fcn.00412210
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
call fcn.00413c30
test al, al
jne 0x4028a2
lea ecx, [ebp - 0x2c]
call fcn.00414140
test al, al
je 0x4028a2
lea eax, [ebp - 0x8dc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00413790
lea ecx, [ebp - 0x8dc]
mov esi, dword [eax + 0x10]
call fcn.004040b0
inc esi
push esi
call fcn.0041835e
add esp, 4
lea ecx, [ebp - 0x2c]
mov ebx, eax
lea eax, [ebp - 0x8dc]
push eax
call fcn.00413790
cmp dword [eax + 0x14], 0x10
jb 0x402855
mov eax, dword [eax]
push eax
push 0x43f640
push esi
push ebx
call fcn.00403b20
add esp, 0x10
lea ecx, [ebp - 0x8dc]
call fcn.004040b0
mov ecx, ebx
call fcn.004012c0
mov esi, eax
lea ecx, [edi + 0x92]
push esi
push 0x43f630
push 0x81
push ecx
call fcn.00404050
push ebx
call fcn.0041971d
add esp, 0x14
push esi
call fcn.0041971d
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.00412a70
lea ecx, [ebp - 0xcc4]
mov byte [ebp - 4], 7
call fcn.00412a70
lea ecx, [ebp - 0xcac]
mov byte [ebp - 4], 6
call fcn.00412a70
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 5
call fcn.00412a70
lea ecx, [ebp - 0xc94]
mov byte [ebp - 4], 4
call fcn.00412a70
lea ecx, [ebp - 0xc7c]
mov byte [ebp - 4], 3
call fcn.00412a70
lea ecx, [ebp - 0xc64]
mov byte [ebp - 4], 1
call fcn.00412a70
push dword [ebp - 0xc20]
call dword [0x44a674]
add esp, 4
lea ecx, [ebp - 0xa4]
call fcn.00402ed0
lea ecx, [ebp - 0xcdc]
mov dword [ebp - 4], 0xffffffff
call fcn.00412a70
mov ebx, dword [ebp - 0xc48]
jmp 0x402c79
push 0
push 0
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc1c], 0
push eax
push 0
push ebx
push 1
push 0xc9
call dword [0x448554]
add esp, 0x1c
test eax, eax
je 0x402c55
push 0
push 0
push 0
push 0
push 0xc9
push ebx
call dword [0x448584]
add esp, 0x18
test eax, eax
je 0x402c1c
mov dword [ebp - 0xc3c], 0
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xc34], 0
mov byte [ebp - 4], 0xc
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0xac], ax
lea eax, [ebp - 0xaa]
push eax
mov dword [ebp - 0x2c], 0x74668516
mov dword [ebp - 0x28], 0xb906ddb3
mov dword [ebp - 0x24], 0x4540a86
mov dword [ebp - 0x20], 0x540bbfb7
mov dword [ebp - 0x1c], 0x38219a4c
mov word [ebp - 0x18], 0xf36
call fcn.0041bd20
add esp, 0xc
lea eax, [ebp - 0xac]
push 0x40
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040aeb0
add esp, 0xc
lea ecx, [ebp - 0xc18]
push dword [ebp - 0xc1c]
call fcn.00409d50
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0xc18]
call fcn.0040a780
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xc20]
test eax, eax
sete cl
test cl, cl
sete cl
test cl, cl
je 0x402be0
push ecx
mov ecx, esp
mov dword [ebp - 0xc28], esp
push 0x43f644
call fcn.00401eb0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0xc20]
test ecx, ecx
jne 0x402a7b
push 0x80004003
call fcn.00433550
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0xe
push eax
call fcn.004021f0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xc30]
test ecx, ecx
sete al
test al, al
sete al
test al, al
je 0x402b02
mov dword [ebp - 0xc38], 1
test ecx, ecx
jne 0x402abb
push 0x80004003
call fcn.00433550
lea eax, [ebp - 0xc28]
push eax
call fcn.00402140
push eax
lea ecx, [ebp - 0xc3c]
call fcn.00401fb0
lea ecx, [ebp - 0xc28]
call fcn.00401f50
mov eax, dword [ebp - 0xc3c]
test eax, eax
je 0x402aec
mov eax, dword [eax]
jmp 0x402aee
xor eax, eax
push eax
push 0x43f630
lea eax, [edi + 0x10]
push 0x41
push eax
call fcn.00404050
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0xc28], esp
push str.NAME
call fcn.00401eb0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xc20]
test ecx, ecx
jne 0x402b2d
push 0x80004003
call fcn.00433550
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 0x10
push eax
call fcn.004021f0
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0xc44]
test eax, eax
sete cl
test cl, cl
sete cl
test cl, cl
je 0x402bb8
test eax, eax
jne 0x402b63
push 0x80004003
call fcn.00433550
lea ecx, [ebp - 0xc28]
push ecx
mov ecx, eax
call fcn.00402140
push eax
lea ecx, [ebp - 0xc34]
call fcn.00401fb0
lea ecx, [ebp - 0xc28]
call fcn.00401f50
mov eax, dword [ebp - 0xc34]
test eax, eax
je 0x402b96
mov eax, dword [eax]
jmp 0x402b98
xor eax, eax
push eax
push 0x43f630
lea eax, [edi + 0x92]
push 0x81
push eax
call fcn.00404050
mov eax, dword [ebp - 0xc44]
add esp, 0x10
mov byte [ebp - 4], 0x10
test eax, eax
je 0x402bc6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xc30]
test eax, eax
je 0x402bda
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc20]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x402bee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0xc
call fcn.00409dd0
lea ecx, [ebp - 0xc34]
call fcn.00401f50
lea ecx, [ebp - 0xc3c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401f50
jmp 0x402c40
push ebx
push 0x17e
push str.CUserInfo::GetLoginUser
push str.hGFiANThGOhJF5Y_hvG0eBoazxha822UxuHUJGXbtfkLA
push 0
mov dword [ebp - 0xc24], 1
call fcn.0040c810
add esp, 0x14
push 0x8000
push 0
push dword [ebp - 0xc1c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x402c79
push ebx
push 0x188
push str.CUserInfo::GetLoginUser
push str.V5DS4GbBjn3uixrNyMV3F2B59LpiLBox5JjsWn2gqZTaT_Yb
push 0
mov dword [ebp - 0xc24], 1
call fcn.0040c810
add esp, 0x14
push 0
call fcn.00419862
add esp, 4
mov dword [edi + 8], eax
lea ecx, [ebp - 0xc1c]
mov dword [edi + 0xc], edx
push ebx
call fcn.00401eb0
lea eax, [ebp - 0xc1c]
mov ecx, edi
push eax
call fcn.00403210
mov esi, eax
cmp esi, dword [edi]
je 0x402cc4
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0xc1c]
call fcn.00402030
test al, al
jne 0x402cc4
mov dword [ebp - 0xc28], esi
jmp 0x402ccc
mov eax, dword [edi]
mov dword [ebp - 0xc28], eax
lea esi, [ebp - 0xc28]
mov esi, dword [esi]
lea ecx, [ebp - 0xc1c]
call fcn.00401f50
lea ebx, [edi + 0x10]
mov eax, dword [ebp - 0xc24]
mov ecx, ebx
lea edx, [ecx + 2]
cmp esi, dword [edi]
jne 0x402dd6
mov dword [ebp - 0xa70], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0xa6c], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xa74], 0
mov dword [ebp - 0xa68], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402d17
sub ecx, edx
sar ecx, 1
je 0x402d72
add edi, 0x92
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402d33
sub ecx, edx
sar ecx, 1
je 0x402d72
push ebx
push 0x43f630
lea eax, [ebp - 0xa64]
push 0x41
push eax
call fcn.00404050
push edi
push 0x43f630
lea eax, [ebp - 0x9e2]
push 0x81
push eax
call fcn.00404050
add esp, 0x20
push dword [ebp - 0xc48]
lea ecx, [ebp - 0xc14]
call fcn.00401eb0
mov ecx, 0x66
lea esi, [ebp - 0xa74]
lea edi, [ebp - 0xc0c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 0x13
movzx eax, byte [0x44aef8]
push eax
lea eax, [ebp - 0xc14]
push eax
push ecx
mov ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc2c]
push eax
call fcn.004036a0
lea ecx, [ebp - 0xc14]
mov dword [ebp - 4], 0xffffffff
call fcn.00401f50
jmp 0x402e71
mov dword [esi + 0x18], 0
add dword [esi + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x24], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402df0
sub ecx, edx
sar ecx, 1
je 0x402e71
add edi, 0x92
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e10
sub ecx, edx
sar ecx, 1
je 0x402e71
lea eax, [esi + 0x28]
push ebx
push eax
call fcn.00419c07
add esp, 8
test eax, eax
jne 0x402e46
lea eax, [esi + 0xaa]
push edi
push eax
call fcn.00419c07
add esp, 8
test eax, eax
je 0x402e71
push ebx
push 0x43f630
lea eax, [esi + 0x28]
push 0x41
push eax
call fcn.00404050
push edi
push 0x43f630
push 0x81
add esi, 0xaa
push esi
call fcn.00404050
add esp, 0x20
cmp dword [ebp - 0xc38], 0
jne 0x402ea4
push 0x1b7
push str.CUserInfo::GetLoginUser
push str.JoSGT2mZFZbNWLAOwUU7a25WxGnkzqG4likIQ
push 0
call fcn.0040c810
push 0x184
push 0
push ebx
call fcn.0041bd20
add esp, 0x1c
xor eax, eax
jmp 0x402ea6
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418fae
mov esp, ebp
pop ebp
ret 4