Function at 0x415a86
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
mov eax, dword [0x42e0b4]
xor eax, esp
mov dword [esp + 0x598], eax
push ebx
push esi
push edi
mov esi, 0x403600
or dword [esp + 0x4c], 0xffffffff
lea edi, [esp + 0x388]
mov dword [esp + 0x28], ecx
xor eax, eax
mov dword [esp + 0x44], 0xffff
xor ecx, ecx
xor ebx, ebx
movsd dword es:[edi], dword [esi]
inc ebx
push 0x48
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x1f], cl
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x58], ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], ecx
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x74]
mov byte [esp + 0x25], cl
stosd dword es:[edi], eax
pop esi
push esi
push ecx
stosd dword es:[edi], eax
mov dword [esp + 0x64], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x80010
mov dword [esp + 0x80], esi
mov word [esp + 0xb0], bx
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xbc], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xc0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp dword [esp + 0x28], 0
mov dword [esp + 0xc0], eax
je 0x421628
xor eax, eax
mov byte [esp + 0x37c], bl
mov esi, 0x104
mov dword [esp + 0x378], eax
push esi
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0x388], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x17c]
add esp, 0xc
cmp byte [esp + 0x37c], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x416005
mov edi, 0x402734
mov esi, 0x4000
push edi
push esi
call fcn.00416e25
push edi
push esi
mov dword [esp + 0x34], eax
call fcn.00416e25
push edi
push esi
mov dword [esp + 0x4c], eax
call fcn.00416e25
push edi
push 0x4000
mov esi, eax
call fcn.00416e25
mov edi, eax
push 0x402734
push 0x4000
mov dword [esp + 0x80], edi
call fcn.00416e25
push 0x402734
push 0x4000
mov dword [esp + 0x80], eax
call fcn.00416e25
push 0x402734
push 0x4000
mov dword [esp + 0x78], eax
call fcn.00416e25
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x24], 0
mov dword [esp + 0x3c], ecx
je 0x415f9d
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415f9d
test esi, esi
je 0x415f9d
test edi, edi
je 0x415f9d
cmp dword [esp + 0x50], 0
je 0x415f9d
cmp dword [esp + 0x40], 0
je 0x415f9d
test ecx, ecx
je 0x415f9d
xor ecx, ecx
mov dword [esp + 0x64], 5
mov word [edi], cx
mov word [eax], cx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, eax
call fcn.0040ab7f
push 0x22
pop edx
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x421638
lea edx, [esp + 0x14]
push 0x2000
cmp ecx, 0x2f
je 0x416038
push edi
xor ecx, ecx
call fcn.00416162
cmp eax, ebx
je 0x415f9d
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.0040f3a0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x60], eax
xor eax, eax
cmp word [edi], ax
je 0x421aa3
push 0x22
pop eax
cmp word [edi], ax
je 0x415d1a
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x421abc
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f3a0
mov ecx, edi
call fcn.00410060
push eax
mov edx, 0x2000
mov ecx, edi
call fcn.0040f3a0
xor eax, eax
mov edx, edi
mov byte [esp + 0x22], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x14]
push eax
push 0x2d
pop ecx
call fcn.0040ed90
cmp eax, 0xffffffff
jne 0x421b0f
mov ecx, dword [esp + 0x50]
mov edx, 0x2000
push edi
call fcn.0040f3a0
push 0x2000
mov edx, edi
mov dword [esp + 0x14c], edi
lea ecx, [esp + 0x114]
call fcn.0040f410
cmp eax, 3
je 0x421aea
test eax, eax
je 0x421af6
push 5
pop ecx
cmp eax, ecx
je 0x421af6
cmp eax, 2
je 0x421b0f
push dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edx, 0x2000
call fcn.0040f3a0
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push 0x40234c
call fcn.0040fc40
mov eax, dword [esp + 0x60]
test eax, eax
je 0x415de9
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push eax
call fcn.0040fc40
cmp byte [esp + 0x1a], 0
jne 0x421c2f
push 0x44
pop eax
push eax
xor eax, eax
push eax
lea eax, [esp + 0xd0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
cmp byte [esp + 0x13], 0
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x88], eax
jne 0x421c3e
xor ecx, ecx
lea eax, [esp + 0x68]
push eax
push ecx
push 2
push ecx
mov byte [esp + 0x23], cl
mov dword [esp + 0x78], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x421c83
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x421adf
push dword [esp + 0x68]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x421c92
lea eax, [esp + 0x68]
push eax
xor eax, eax
push eax
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x421c9f
xor ecx, ecx
mov dword [esp + 0x6c], 1
push ecx
push ecx
push 4
lea eax, [esp + 0x78]
push eax
push 0x60001
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421cca
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc4], ebx
cmp eax, 0xffff
jne 0x421cde
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x50]
mov eax, dword [esp + 0x18]
push dword [esp + 0x60]
or eax, 0x400
push eax
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x60]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x18]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ebx, ebx
inc ebx
cmp byte [esp + 0x1a], 0
jne 0x421d04
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp byte [esp + 0x13], 0
mov dword [0x4367a8], eax
jne 0x421dde
cmp byte [esp + 0x14], 0
je 0x421dc3
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x421d13
cmp byte [esp + 0x21], 0
jne 0x421db4
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x415f99
cmp byte [esp + 0x23], 0
jne 0x421e74
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x415fad
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x415fbd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x415fcd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
je 0x415fd9
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x415fe5
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415ff5
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x416005
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x378]
xor ecx, ecx
mov dword [esp + 0x378], ecx
test eax, eax
je 0x416021
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x5a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b30
mov esp, ebp
pop ebp
ret
add eax, 2
mov ecx, ebx
push esi
mov dword [esp + 0x1c], eax
call fcn.00416162
cmp eax, ebx
je 0x415f9d
push 0x4026f0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42169b
push 0x4026d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217ae
push 0x4026c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217bb
push 0x4026bc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217c8
push 0x4026a8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217e2
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x4217ef
push 0x40269c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x416151
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x421891
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x421a66
push 0x402694
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41615b
push 0x40268c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4218a9
or dword [esp + 0xac], ebx
or word [esp + 0xb0], 7
mov eax, dword [esp + 0x14]
jmp 0x415c8f
or dword [esp + 0xc], 0x80
jmp 0x416148
or dword [esp + 0xc], 0x40
jmp 0x416148
lea eax, [esp + 0x388]
mov dword [esp + 0x28], eax
jmp 0x415b61
cmp dword [esp + 0x8c], 0
jne 0x415cb0
push 0x104
lea eax, [esp + 0x39c]
mov ecx, ebx
push eax
lea edx, [esp + 0x1c]
call fcn.00416162
cmp eax, ebx
je 0x415f9d
lea ecx, [esp + 0x398]
call fcn.00410060
push eax
mov edx, 0x104
lea ecx, [esp + 0x39c]
call fcn.0040f3a0
lea eax, [esp + 0x398]
mov byte [esp + 0x1b], bl
mov dword [esp + 0x8c], eax
jmp 0x416148
mov ecx, dword [esp + 0x14]
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x421a2a
cmp word [esi], 0x30
mov edx, esi
mov dword [esp + 0x28], edx
jne 0x4216e4
movzx ecx, word [esi + 2]
mov eax, edx
cmp ecx, 0x78
je 0x4216dd
cmp ecx, 0x58
jne 0x4216e4
lea edx, [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4216ed
sub ecx, dword [esp + 0x1c]
sar ecx, 1
cmp ecx, 8
ja 0x421949
xor eax, eax
mov dword [esp + 0x30], eax
movzx eax, word [edx]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x421949
mov ecx, dword [esp + 0x1c]
test cx, cx
je 0x421795
mov edx, dword [esp + 0x30]
lea eax, [ecx - 0x30]
shl edx, 4
cmp ax, 9
ja 0x421754
add edx, 0xffffffd0
jmp 0x421765
lea eax, [ecx - 0x61]
cmp ax, word [esp + 0x64]
ja 0x421949
add edx, 0xffffffa9
movzx eax, cx
add edx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], edx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x421736
cmp dword [esp + 0x30], 0
je 0x421949
or dword [esp + 0xc], 4
mov byte [esp + 0x21], bl
jmp 0x416148
or dword [esp + 0xc], 0x8000
jmp 0x416148
or dword [esp + 0xc], 0x4000
jmp 0x416148
mov ecx, dword [esp + 0xc]
and ecx, 0xffffffef
mov byte [esp + 0x1a], bl
or ecx, 0x200
mov dword [esp + 0xc], ecx
jmp 0x416148
mov dword [esp + 0x5c], 2
jmp 0x416148
lea edx, [esi + 2]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4217fb
sub ecx, dword [esp + 0x1c]
sar ecx, 1
jne 0x421838
mov ecx, dword [esp + 0x14]
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x415f9d
mov edx, esi
mov ecx, edx
call fcn.00410060
push eax
lea ecx, [esp + 0x174]
call fcn.0040a641
mov eax, dword [esp + 0x378]
mov dword [esp + 0x48], eax
test eax, eax
jne 0x421866
lea eax, [esp + 0x170]
mov dword [esp + 0x48], eax
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x42186b
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7fe7
jbe 0x416148
push dword [esp + 0x48]
jmp 0x42194a
mov eax, dword [0x432590]
test eax, eax
je 0x416148
mov eax, dword [eax]
mov dword [esp + 0x54], eax
jmp 0x416148
push 0x404000
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4218d2
or dword [esp + 0xac], ebx
push 3
pop eax
or word [esp + 0xb0], ax
jmp 0x416148
push 0x404008
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421955
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x421a2a
push 0xa
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x44], eax
test eax, eax
jne 0x421930
mov ecx, dword [esp + 0x1c]
cmp word [ecx], ax
jne 0x421949
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0x2c]
jbe 0x416148
push esi
push ebx
push 0x2362
jmp 0x421a1d
push 0x404014
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421971
or dword [esp + 0xc], 0x20
jmp 0x416148
push 0x404024
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421990
or dword [esp + 0xc], 0x100
jmp 0x416148
push 0x404038
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4219af
or dword [esp + 0xc], 0x800
jmp 0x416148
push 0x40404c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4219ce
or dword [esp + 0xc], 0x1000
jmp 0x416148
push 0x40405c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4219f2
push 0x404068
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421a2a
mov byte [esp + 0x23], bl
jmp 0x416148
sub edx, 2
xor ecx, ecx
mov word [edx], cx
mov edx, 0x2000
push esi
mov ecx, eax
call fcn.0040fc40
push dword [esp + 0x24]
xor ebx, ebx
inc ebx
push ebx
push 0x2375
call fcn.004078e4
add esp, 0xc
jmp 0x415f9d
mov eax, dword [esp + 0x24]
mov ecx, 0x4037e0
sub ecx, eax
mov ebx, 0x2000
mov edx, eax
mov edi, ecx
lea ecx, [ebx + 0x7fffdffe]
test ecx, ecx
je 0x421a5c
movzx ecx, word [edx + edi]
test cx, cx
je 0x421a5c
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x421a3e
mov edi, dword [esp + 0x58]
test ebx, ebx
jne 0x4219fe
jmp 0x4219fb
call fcn.00429a0e
xor eax, eax
push eax
push 0x40002397
call fcn.004063bd
cmp byte [0x436755], 0
pop ecx
pop ecx
je 0x421a92
xor eax, eax
push eax
push 0x400023bf
call fcn.004063bd
pop ecx
pop ecx
xor eax, eax
mov byte [0x44905b], al
mov dword [0x44950c], eax
jmp 0x415f9d
lea eax, [esp + 0x388]
mov edx, 0x2000
push eax
mov ecx, edi
call fcn.0040f3a0
jmp 0x415cff
mov ecx, edi
call fcn.00410060
push eax
push 0x40406c
push 0x2000
push dword [esp + 0x48]
call fcn.00409abf
add esp, 0x10
jmp 0x415d3d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4367a8], eax
mov ecx, edi
call fcn.00425c54
jmp 0x415f9d
push dword [esp + 0x50]
mov edx, 0x2000
mov ecx, edi
call fcn.0040f3a0
mov byte [esp + 0x13], bl
jmp 0x415dad
mov ecx, 0x4024d0
call fcn.0040ec2e
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x421b33
push eax
push 0x400023d2
call fcn.004078e4
pop ecx
pop ecx
jmp 0x415f9d
push dword [esp + 0x3c]
push 0x404078
push 0x2000
push dword [esp + 0x30]
call fcn.00409abf
add esp, 0x10
mov edx, 0x2000
mov ecx, edi
push dword [esp + 0x2c]
call fcn.0040f3a0
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f3a0
push 0x404088
push dword [esp + 0x28]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421c1e
mov ecx, dword [esp + 0x34]
xor eax, eax
cmp word [ecx], ax
je 0x421c1e
mov edx, ecx
lea eax, [edx + 2]
mov dword [esp + 0x2c], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x38]
jne 0x421b9d
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, eax
sar edx, 1
mov dword [esp + 0x1c], edx
lea edx, [edi + 2]
mov dword [esp + 0x64], edx
mov dx, word [edi]
add edi, 2
cmp dx, word [esp + 0x38]
jne 0x421bc1
mov edx, edi
mov dword [esp + 0x2c], edi
sub edx, dword [esp + 0x64]
mov edi, dword [esp + 0x58]
sar edx, 1
add edx, dword [esp + 0x1c]
cmp edx, 0x2000
jae 0x421c0f
push 0x40234c
mov edx, 0x2000
mov ecx, eax
call fcn.0040fc40
push dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov edx, 0x2000
call fcn.0040fc40
jmp 0x421c1e
push ecx
push ebx
push 0x2363
call fcn.004078e4
add esp, 0xc
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov byte [esp + 0x22], bl
jmp 0x415dad
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415df4
cmp dword [esp + 0x5c], 2
je 0x415e3c
cmp dword [esp + 0x30], 0
jne 0x415e3c
cmp dword [esp + 0x44], 0xffff
jne 0x415e3c
cmp dword [esp + 0x54], 0
jne 0x415e3c
call fcn.004173e8
test al, al
je 0x415e3c
mov byte [esp + 0x13], bl
jmp 0x415f32
mov dword [0x4367a8], 0x54f
jmp 0x421aea
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4367a8], eax
jmp 0x421cbb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4367a8], eax
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, edi
call fcn.00425c54
xor ebx, ebx
inc ebx
jmp 0x415f9d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov dword [0x4367a8], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
jmp 0x421caa
xor ecx, ecx
mov word [esp + 0x14], ax
push ecx
push ecx
push 2
lea eax, [esp + 0x20]
push eax
push 0x20004
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421cca
jmp 0x415ee0
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415f3d
xor eax, eax
lea edi, [esp + 0x164]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x164]
push eax
push dword [esp + 0x78]
call dword [sym.imp.api_ms_win_core_processtopology_l1_1_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x421d40
mov eax, dword [esp + 0x164]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x44]
cmp ecx, 0xffff
je 0x421d96
xor eax, eax
lea edi, [esp + 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x421d92
mov eax, dword [esp + 0x158]
and eax, dword [esp + 0x4c]
je 0x421d92
mov dword [esp + 0x4c], eax
xor eax, eax
push eax
push dword [esp + 0x15c]
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl ebx, cl
jmp 0x421d96
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x4c]
and ebx, eax
je 0x421da0
mov eax, ebx
push eax
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
mov edi, dword [esp + 0x58]
jmp 0x415f6a
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
jmp 0x415f75
cmp byte [0x436755], 0
je 0x421dd3
cmp eax, 0xc1
je 0x421dde
cmp eax, 0x2e4
jne 0x421aea
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x421de3
sub ecx, edx
push 5
sar ecx, 1
pop eax
cmp ecx, eax
jb 0x421e1b
add ecx, 0xfffffffc
push eax
push 0x404108
lea eax, [edi + ecx*2]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
neg eax
sbb al, al
and al, byte [esp + 0x1b]
jmp 0x421e1f
mov al, byte [esp + 0x1b]
and dword [esp + 0xc], 0xfffffffb
lea ecx, [esp + 0x398]
movzx eax, al
neg eax
sbb eax, eax
and eax, ecx
cmp byte [esp + 0x22], 0
mov ecx, dword [esp + 0x24]
jne 0x421e43
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x74]
push edx
push eax
push dword [esp + 0x68]
movzx eax, word [esp + 0xc0]
mov edx, edi
push eax
push dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0042b701
test eax, eax
je 0x421aea
jmp 0x415f7f
mov ecx, eax
call fcn.004081ec
mov dword [0x4365dc], eax
jmp 0x415f99