Function at 0x40a7a6
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
sub esp, 0x85c
push ebx
push ebp
push esi
push edi
call fcn.0040ca1a
xor ebx, ebx
cmp eax, 3
jae 0x40a7c9
push str.Global427
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, str.SeDebugPrivilege
push esi
call fcn.0040a716
push esi
call fcn.0040a716
push str.NtQuerySystemInformation
mov esi, str.ntdll.dll
push esi
call fcn.0040abf1
push str.NtDuplicateObject
push esi
mov edi, eax
call fcn.0040abf1
push str.NtQueryObject
push esi
mov dword [esp + 0x50], eax
call fcn.0040abf1
mov dword [esp + 0x4c], eax
mov al, byte [esp + 0x894]
add esp, 0x20
mov ebp, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test al, al
jne 0x40a886
mov esi, 0x10000
call fcn.0040ca1a
cmp eax, 3
jae 0x40a83f
lea eax, [esp + 0x44]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
xor eax, eax
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x40a85e
add esi, esi
push esi
push ebp
xor eax, eax
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
xor eax, eax
push eax
push esi
push ebp
push 0x10
call edi
cmp eax, 0xc0000004
je 0x40a84e
test eax, eax
js 0x40a878
test ebp, ebp
jne 0x40a87f
xor al, al
jmp 0x40ab34
mov al, byte [esp + 0x874]
mov ebx, dword [esp + 0x870]
xor ecx, ecx
mov byte [esp + 0x13], cl
mov esi, ecx
lea edi, [ebp + 4]
test al, al
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov eax, 0xffff
jne 0x40a8ac
mov eax, dword [ebp]
cmp esi, eax
jae 0x40ab23
mov esi, edi
lea edi, [esp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x40], 0x12019f
je 0x40ab09
mov edi, dword [esp + 0x34]
push edi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov si, word [esp + 0x3a]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40a95f
call fcn.0040ca1a
cmp eax, 3
jae 0x40a907
push str.236236
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40a907
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x1000
xor eax, eax
push eax
movzx esi, si
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40a984
xor ecx, ecx
push ecx
push 0x1000
push eax
push 2
push esi
call dword [esp + 0x40]
test eax, eax
jns 0x40a993
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40ab07
xor eax, eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, si
push eax
push dword [esp + 0x2c]
call dword [esp + 0x4c]
test eax, eax
jns 0x40a907
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ab07
push esi
call fcn.0040a4aa
pop ecx
mov ecx, eax
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x40aa38
xor edx, edx
cmp word [ecx], dx
jbe 0x40aa38
mov al, byte [esp + 0x38]
inc dword [ebx + 0x1c]
mov dword [ebx], edi
mov edi, dword [esp + 0x14]
mov dword [ebx + 8], esi
mov esi, dword [esp + 0x18]
mov byte [ebx + 0xc], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], edx
mov dword [ebx + 4], edi
cmp dword [eax], edx
je 0x40aab0
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
cmp eax, 1
je 0x40aa2a
test eax, eax
je 0x40aab0
cmp eax, 2
je 0x40aaab
xor ecx, ecx
mov dword [esp + 0x18], ecx
call fcn.0040ca1a
cmp eax, 3
jae 0x40aa2a
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40aa2a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40a9e1
jmp 0x40aab0
inc dword [ebx + 0x1c]
mov dword [ebx + 8], esi
mov esi, dword [esp + 0x18]
mov dword [ebx], edi
mov dword [ebx + 0x10], esi
call fcn.0040ca1a
cmp eax, 3
jae 0x40aa64
lea eax, [esp + 0x458]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov al, byte [esp + 0x38]
mov edi, dword [esp + 0x14]
xor ecx, ecx
mov byte [ebx + 0xc], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 4], edi
cmp dword [eax], ecx
je 0x40aab0
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
mov ecx, dword [ebx + 0x18]
cmp eax, 1
je 0x40aaa0
test eax, eax
je 0x40aab0
cmp eax, 2
je 0x40aaab
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40aa81
jmp 0x40aab0
mov byte [esp + 0x13], 1
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40aad8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.0040ca1a
cmp eax, 3
jae 0x40aaf9
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40aaf9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
jne 0x40ab21
xor ecx, ecx
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov al, byte [esp + 0x874]
inc esi
add edi, 0x10
jmp 0x40a898
xor ecx, ecx
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x85c
ret