Function at 0x407580
Capabilities:
Access peb ldr_data
Check mutex on windows
Create pipe
Create process on windows
Create process suspended
Get common file path
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3ac
mov eax, dword [eax + 8]
mov dword [ebp - 0x37c], edx
mov dword [ebp - 0x378], ecx
add eax, 0x18
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebp - 0x384], eax
call eax
mov ebx, dword [esi + 0x68]
sub esp, 4
test ebx, ebx
je 0x4075ef
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0x102
je 0x408050
mov dword [esi + 0x68], 0
sub dword [ebx + 0x10], 1
mov dword [esp], ebx
call fcn.00406620
mov dword [esi + 0x70], 0
mov ecx, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x36c], ecx
mov dword [esp], eax
call ecx
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
sub esp, 0xc
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebp - 0x370], eax
sub esp, 0xc
test eax, eax
je 0x407fd2
mov dword [esp + 8], ebx
mov ecx, dword [ebp - 0x36c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call ecx
mov eax, dword [esi + 0x78]
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
lea edx, [ebp - 0x220]
sub esp, 0xc
mov dword [ebp - 0x36c], edx
test eax, eax
mov dword [ebp - 0x374], ecx
mov eax, dword [esi + 0x34]
je 0x4076a2
mov edx, eax
and edx, 3
mov dword [ebp - 0x380], edx
je 0x407d10
sub eax, 1
cmp eax, 1
jbe 0x4079d0
lea eax, [ebp - 0x354]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x34c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x36c]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x41f0b8]
mov dword [ebp - 0x34c], 0xffffffff
mov dword [esp], eax
mov dword [ebp - 0x354], 4
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x407711
cmp dword [ebp - 0x220], 4
je 0x407f90
mov eax, dword [0x41f0b8]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x41f070
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [0x41f070]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipe_netNtControlPipe_u
mov dword [esp + 4], 0x27
mov dword [esp], 0x41f020
call fcn.004058f0
mov dword [esp + 8], 0x28
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov dword [ebp - 0x380], eax
mov eax, dword [eax + 0x30]
add dword [0x41f070], 1
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x408070
mov dword [eax + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [ebx + 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x408040
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebx + 0x24], eax
sub esp, 0x10
test eax, eax
je 0x407ed8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x2710
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], 0x41f020
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [ebx + 0x20], eax
sub esp, 0x20
cmp eax, 0xffffffff
je 0x4084f0
lea edx, [ebp - 0x21c]
mov ecx, 0x10
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x220], 0x44
test byte [esi + 0x35], 1
jne 0x40788d
mov dword [ebp - 0x218], str.__wineservice_winstationDefault
mov edi, dword [0x41f0bc]
test edi, edi
je 0x408510
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [esi + 8]
sub esp, 4
lea edx, [eax + 8]
mov dword [ebx + 8], eax
mov dword [ebx], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 4], edx
mov dword [edx], ebx
mov dword [eax + 0xc], ebx
lock add dword [ebx + 0xc], 1
mov edi, dword fs:[0x18]
mov eax, dword [ebp - 0x378]
mov dword [esi + 0x68], ebx
mov dword [eax], 0
mov dword [esi + 0x6c], 0
add dword [ebx + 0x10], 1
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34c]
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x36c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov eax, dword [0x41f0bc]
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x370]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [ebp - 0x370]
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test esi, esi
je 0x408180
mov eax, dword [ebp - 0x344]
xor edi, edi
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x37c]
sub esp, 4
mov dword [eax], ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebp - 0x36c]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, dword [ebp - 0x370]
sub esp, 8
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
cmp word [ebp - 0x220], 0
je 0x408640
mov eax, ebx
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x407a30
sub eax, dword [ebp - 0x36c]
add eax, 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebp - 0x380], eax
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x407ff8
mov ebx, dword [ebp - 0x36c]
xor eax, eax
nop
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x407a80
mov edx, dword [ebp - 0x380]
cmp word [edx], 0
je 0x408650
add edx, 2
cmp word [edx], 0
jne 0x407aa0
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [eax + str.winedevice.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x407ab0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x370], ecx
lea ebx, [ecx + 0x10]
test eax, eax
je 0x407c48
mov edi, dword [ecx + 0x10]
cmp ebx, edi
je 0x407c48
lea esi, [esi]
mov eax, dword [edi + 0x18]
sub eax, 2
and eax, 0xfffffffd
jne 0x407c30
mov eax, dword [edi + 0x68]
test eax, eax
je 0x407c30
mov ebx, dword [edi + 0x78]
test ebx, ebx
jne 0x407c30
mov eax, dword [edi + 0x40]
test eax, eax
je 0x407c30
mov ecx, dword [ebp - 0x380]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x407c28
mov eax, dword [edi + 0x44]
test eax, eax
je 0x407c28
mov edx, dword [esi + 0x44]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x407c28
mov ebx, dword [edi + 0x68]
test ebx, ebx
je 0x4081b8
lea edi, [ebx + 0xc]
lock add dword [edi], 1
mov eax, dword fs:[0x18]
mov edx, dword [ebp - 0x380]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 0xc
mov dword [ebp - 0x370], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], 2
mov dword [esi + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
sub esp, 4
lock add dword [edi], 1
mov eax, dword [ebp - 0x378]
mov dword [esi + 0x68], ebx
mov dword [eax], 1
mov dword [esi + 0x6c], 1
add dword [ebx + 0x10], 1
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x370]
call eax
sub esp, 4
mov dword [esp + 4], 0x7530
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov edi, eax
test eax, eax
jne 0x408320
mov eax, dword [ebp - 0x37c]
mov dword [eax], ebx
jmp 0x4079c3
mov ecx, dword [esi + 8]
nop
lea esi, [esi]
mov edi, dword [edi]
lea ebx, [ecx + 0x10]
cmp edi, ebx
jne 0x407ae8
mov dword [ebp - 0x370], ecx
nop
lea esi, [esi]
mov eax, dword [0x41f0b0]
mov dword [esp + 8], str.Winedevice_u
mov dword [esp + 4], 0x17
add eax, 1
mov dword [esp], 0x41f080
mov dword [esp + 0xc], eax
mov dword [0x41f0b0], eax
call fcn.004058f0
mov eax, dword [ebp - 0x370]
mov edi, dword [eax + 0x10]
cmp edi, ebx
je 0x407ca6
lea esi, [esi]
mov eax, dword [edi + 0x10]
mov dword [esp], 0x41f080
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x407c48
mov edi, dword [edi]
cmp ebx, edi
jne 0x407c88
lea eax, [ebp - 0x34c]
mov dword [esp], 0x41f080
mov dword [esp + 4], eax
call fcn.00405e50
mov edi, eax
test eax, eax
je 0x408338
mov edx, dword [ebp - 0x380]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [esi + 8]
sub esp, 0xc
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4079c3
mov ebx, dword [ebp - 0x36c]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
cmp word [ebp - 0x220], 0
je 0x408748
mov ecx, ebx
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x407d40
sub ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x374], ecx
mov eax, ecx
sar eax, 1
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x370]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov ebx, eax
test eax, eax
jne 0x4081a0
mov edx, dword [ebp - 0x36c]
mov dword [esp + 4], 0x104
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
mov eax, dword [ebp - 0x370]
sub esp, 8
cmp word [eax], 0
je 0x407dc1
mov ebx, eax
nop
lea esi, [esi]
add ebx, 2
cmp word [ebx], 0
jne 0x407db0
sub ebx, dword [ebp - 0x370]
sar ebx, 1
cmp word [ebp - 0x220], 0
je 0x407deb
mov eax, dword [ebp - 0x36c]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x407dd8
sub eax, dword [ebp - 0x36c]
sar eax, 1
add ebx, eax
add ebx, ebx
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], ebx
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x388], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0x388]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x407fae
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x407e30
mov ecx, dword [ebp - 0x374]
add ecx, dword [ebp - 0x370]
mov eax, ebx
cmp word [ebx], 0
je 0x407e61
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x407e58
mov dword [ebp - 0x374], ebx
mov edx, dword [ebp - 0x380]
lea esi, [esi]
movzx ebx, word [ecx + edx]
mov word [eax + edx], bx
add edx, 2
test bx, bx
jne 0x407e70
mov edx, dword [ebp - 0x370]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp - 0x374]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x374], eax
call eax
sub esp, 0xc
test byte [0x418070], 8
jne 0x408220
mov dword [ebp - 0x370], ebx
mov eax, dword [esi + 0x34]
jmp 0x4076a2
mov eax, dword [ebp - 0x380]
mov edi, dword [eax + 0x34]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x407f07
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x407f07
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test edi, edi
je 0x407862
test byte [0x418070], 2
jne 0x408080
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x370]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x34c]
mov edx, dword [0x41f070]
add eax, 1
cmp eax, edx
cmovb eax, edx
mov dword [0x41f070], eax
jmp 0x407711
mov eax, dword [ebp - 0x370]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esi + 8]
mov edi, 0x46a
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 8]
mov edi, 0x46a
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x380]
mov edi, dword [eax + 0x34]
jmp 0x407ef4
mov eax, dword [esi + 8]
mov edi, 0x420
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4079c3
mov edi, 0x46a
jmp 0x407f35
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x408760
mov eax, ebx
shr eax, 0x10
je 0x4081d0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, 0x419c2d
sub esp, 8
test eax, eax
jne 0x4081e5
cmp word [ebx], 0
je 0x40876a
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x4080c8
mov ecx, 0x224c
mov dword [ebp - 0x378], ebx
mov word [ebp - 0x220], cx
lea ecx, [ebp - 0x21e]
mov dword [ebp - 0x37c], edi
jmp 0x40813b
cmp ax, 9
je 0x408628
cmp ax, 0xa
jne 0x4085be
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
nop
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x408660
lea edi, [ebp - 0xfe]
cmp ecx, edi
ja 0x408660
mov edx, eax
add dword [ebp - 0x378], 2
mov eax, dword [ebp - 0x378]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x4085a0
jbe 0x4080f8
cmp ax, 0x22
je 0x408610
cmp ax, 0x5c
jne 0x4085b1
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x408120
mov edi, dword [edi + 0x34]
mov dword [esp], ebx
call fcn.004074f0
mov dword [esp], ebx
call fcn.00406620
jmp 0x4079c3
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x374], edx
jmp 0x4076a2
mov eax, dword [esi + 8]
mov dword [ebp - 0x370], eax
lea ebx, [eax + 0x10]
jmp 0x407c48
movzx ebx, bx
mov dword [esp], 0x419c20
mov dword [esp + 4], ebx
call fcn.00405b30
mov edx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.failed_to_create_process_object_for__s__error___u_n
mov dword [esp + 8], str.service_start_process
mov dword [esp + 4], 0x418070
mov dword [esp], 1
call fcn.00405aa0
jmp 0x407f42
mov eax, ebx
shr eax, 0x10
je 0x408821
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, 0x419c2d
sub esp, 8
test eax, eax
jne 0x408716
cmp word [ebx], 0
je 0x4088ce
lea esi, [esi]
lea edi, [edi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x408260
mov eax, 0x224c
mov dword [ebp - 0x370], ebx
mov word [ebp - 0x34c], ax
lea eax, [ebp - 0x34a]
mov dword [ebp - 0x380], ebx
mov ebx, eax
mov dword [ebp - 0x388], esi
jmp 0x4082db
cmp ax, 9
je 0x408790
cmp ax, 0xa
jne 0x4087bf
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
nop
lea esi, [esi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x4086da
lea esi, [ebp - 0x22a]
cmp ebx, esi
ja 0x4086da
mov ecx, eax
add dword [ebp - 0x370], 2
mov eax, dword [ebp - 0x370]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x4087a1
jbe 0x408298
cmp ax, 0x22
je 0x408810
cmp ax, 0x5c
jne 0x4087b2
mov esi, 0x5c5c
add ebx, 2
mov word [ebx - 2], si
jmp 0x4082c0
mov dword [esp], ebx
mov edi, 0x41d
call fcn.00406620
jmp 0x4079c3
mov edi, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x380]
mov dword [edi + 0x78], 0
mov dword [edi + 0x34], 0x10
mov dword [edi + 0x38], 3
mov dword [edi + 0x14], 0x10
mov dword [esp], eax
call fcn.004092e0
mov dword [edi + 0x40], eax
test eax, eax
je 0x4086b8
mov dword [esp], str.LocalSystem
mov edi, dword [ebp - 0x34c]
call fcn.004092e0
mov dword [edi + 0x50], eax
test eax, eax
je 0x4086b8
mov dword [esp], 0x41f080
mov edi, dword [ebp - 0x34c]
call fcn.004092e0
mov dword [edi + 0x54], eax
test eax, eax
je 0x4086b8
mov eax, dword [esi + 0x44]
mov edi, dword [ebp - 0x34c]
test eax, eax
je 0x4083d3
mov dword [esp], eax
call fcn.004092e0
mov dword [edi + 0x44], eax
test eax, eax
je 0x4086b8
mov edi, dword [ebp - 0x34c]
mov ecx, dword [ebp - 0x370]
mov dword [edi], ebx
mov ebx, dword fs:[0x18]
mov dword [edi + 8], ecx
mov eax, dword [ecx + 0x14]
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 0x14], edi
mov eax, dword [ebp - 0x34c]
mov dword [eax + 0x74], 1
mov eax, dword [ebp - 0x380]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [ebp - 0x34c]
sub esp, 0xc
mov eax, dword [eax + 0x44]
mov dword [esp], eax
call fcn.004092e0
mov edi, dword [esi + 8]
mov dword [ebp - 0x220], eax
lea eax, [edi + 0x18]
mov edi, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [esp], eax
mov dword [ebp - 0x370], edi
call edi
mov edx, dword [ebp - 0x220]
xor eax, eax
mov edi, dword [ebp - 0x36c]
sub esp, 4
test edx, edx
mov dword [esp + 8], edi
setne al
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.004088f0
mov dword [esp + 4], 0
mov edi, eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test edi, edi
jne 0x4086a0
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x384]
call eax
mov eax, dword [ebp - 0x34c]
sub esp, 4
mov ebx, dword [eax + 0x68]
test ebx, ebx
je 0x4088a8
lea edi, [ebx + 0xc]
lock add dword [edi], 1
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.00406890
jmp 0x407ba5
mov eax, dword [ebp - 0x380]
mov edi, dword [eax + 0x34]
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x407ee8
jmp 0x407ef4
lea eax, [ebp - 0x360]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call sub.advapi32.dll_OpenProcessToken
sub esp, 0xc
test eax, eax
je 0x40789b
mov eax, dword [ebp - 0x360]
mov dword [esp + 8], 0
mov dword [esp], 0x41f0bc
mov dword [esp + 4], eax
call sub.userenv.dll_CreateEnvironmentBlock
lea eax, [ebp - 0x34c]
sub esp, 0xc
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], str.WINEBOOTSTRAPMODE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x408845
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x40789b
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x408120
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4086d0
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefvalidate_service_config]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x408120
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x408120
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x408120
mov eax, 0x20
jmp 0x407a42
mov edx, dword [ebp - 0x380]
jmp 0x407aa9
mov byte [ecx], 0x22
mov edi, dword [ebp - 0x37c]
test eax, eax
jle 0x408783
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
mov eax, dword [ebp - 0x36c]
mov dword [esp], eax
call fcn.00416940
mov edx, eax
jmp 0x4081e5
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.00406890
jmp 0x4079c3
mov eax, dword [ebp - 0x34c]
mov edi, 0x46a
mov dword [esp], eax
call fcn.004066e0
jmp 0x407cc6
mov byte [ecx], al
add ecx, 1
jmp 0x408120
mov edx, ebx
mov esi, dword [ebp - 0x388]
mov ebx, dword [ebp - 0x380]
mov byte [edx], 0x22
test eax, eax
jle 0x4088e6
mov ecx, 0x2e2e
mov byte [edx + 3], 0x2e
lea eax, [edx + 4]
mov word [edx + 1], cx
mov byte [eax], 0
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call fcn.00416940
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.redirected_to__s_n
mov dword [esp + 8], str.get_service_binary_path
mov dword [esp + 4], 0x418070
mov dword [esp], 3
call fcn.00405aa0
jmp 0x407ec4
mov dword [ebp - 0x374], 0
xor eax, eax
jmp 0x407d59
mov edx, 0x419c26
jmp 0x4081e5
mov edx, 0x224c
mov byte [ebp - 0x21e], 0x22
lea ecx, [ebp - 0x21e]
mov word [ebp - 0x220], dx
lea eax, [ecx + 1]
jmp 0x408681
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x4082c0
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x4082c0
lea esi, [eax - 0x20]
cmp si, 0x5e
jbe 0x40883b
mov esi, eax
mov byte [ebx], 0x5c
add ebx, 5
shr si, 0xc
movzx esi, si
movzx edx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov esi, eax
shr si, 8
and esi, 0xf
mov byte [ebx - 4], dl
movzx edx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov esi, eax
and eax, 0xf
shr si, 4
movzx eax, byte [eax + str.0123456789abcdefvalidate_service_config]
and esi, 0xf
mov byte [ebx - 3], dl
movzx edx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov byte [ebx - 1], al
mov byte [ebx - 2], dl
jmp 0x4082c0
mov eax, 0x225c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x4082c0
movzx eax, bx
mov dword [esp], 0x419c20
mov dword [esp + 4], eax
call fcn.00405b30
mov edx, eax
jmp 0x408716
mov byte [ebx], al
add ebx, 1
jmp 0x4082c0
lea eax, [ebp - 0x35c]
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [esp + 4], str.WINEBOOTSTRAPMODE
mov dword [esp], eax
call edi
lea eax, [ebp - 0x34c]
sub esp, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x354]
mov dword [esp], eax
call edi
lea eax, [ebp - 0x354]
sub esp, 8
mov dword [esp + 8], eax
lea eax, [ebp - 0x35c]
mov dword [esp + 4], eax
mov dword [esp], 0x41f0bc
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
sub esp, 0xc
jmp 0x408584
mov dword [esp], eax
mov edi, 0x41d
call fcn.00406890
mov eax, dword [esi + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x370]
call eax
sub esp, 4
jmp 0x4079c3
mov word [ebp - 0x34c], 0x224c
lea eax, [ebp - 0x34a]
mov byte [ebp - 0x34a], 0x22
mov edx, eax
mov eax, edx
add eax, 1
jmp 0x408703