Function at 0x4049e0
Capabilities:
Accept command line arguments
Access peb ldr_data
Check os version
Create process on windows
Delete directory
Delete file
Delete registry value
Enumerate files on windows
Get common file path
Get hostname
Get number of processors
Get process heap flags
Get process heap force flags
Get session user name
Get system firmware table
Get system information on windows
Make suspicious ntquerysysteminformation call
Move file
Query environment variable
Query or enumerate registry value
Read .ini file
Read file on windows
Resolve dns
Self delete
Set current directory
Set registry value
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xf04
mov eax, dword [ecx]
mov dword [ebp - 0xe88], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xe8c], eax
call fcn.004044f0
mov dword [ebp - 0xe64], 0x40003e
mov dword [ebp - 0xe60], str.KernelObjects__wineboot_event
mov dword [esp + 4], 0x104
mov dword [esp], 0x417240
call dword [sym.imp.kernelbase.dll_GetWindowsDirectoryW]
sub esp, 8
mov dword [esp], 0x417240
call dword [sym.imp.kernelbase.dll_SetCurrentDirectoryW]
sub esp, 4
test eax, eax
jne 0x404a5a
test byte [0x409090], 2
jne 0x405576
mov dword [esp], 0xffffffff
lea eax, [ebp - 0xe7c]
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_IsWow64Process]
sub esp, 8
test eax, eax
je 0x404a85
cmp dword [ebp - 0xe7c], 0
jne 0x405780
cmp dword [ebp - 0xe88], 1
mov dword [ebp - 0xea4], 0
jle 0x404d5b
mov dword [ebp - 0xea0], 0
mov esi, 1
mov dword [ebp - 0xe94], 0
mov dword [ebp - 0xe90], 0
mov dword [ebp - 0xeac], 0
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xe98], 0
jmp 0x404bab
mov ebx, dword [sym.imp.ucrtbase.dll_strcmp]
mov dword [esp + 4], str.__help
mov dword [esp], edi
call ebx
test eax, eax
je 0x40556a
mov dword [esp + 4], str.__end_session
mov dword [esp], edi
call ebx
test eax, eax
je 0x404cd0
mov dword [esp + 4], str.__force
mov dword [esp], edi
call ebx
test eax, eax
je 0x404ce0
mov dword [esp + 4], str.__init
mov dword [esp], edi
call ebx
test eax, eax
je 0x404cef
mov dword [esp + 4], str.__kill
mov dword [esp], edi
call ebx
test eax, eax
je 0x404cfe
mov dword [esp + 4], str.__restart
mov dword [esp], edi
call ebx
test eax, eax
je 0x404d0d
mov dword [esp + 4], str.__shutdown
mov dword [esp], edi
call ebx
test eax, eax
je 0x404d4c
mov dword [esp + 4], str.__update
mov dword [esp], edi
call ebx
test eax, eax
jne case.0x404bee.2
mov dword [ebp - 0xea4], 1
add esi, 1
cmp dword [ebp - 0xe88], esi
je 0x404c27
mov eax, dword [ebp - 0xe8c]
mov edi, dword [eax + esi*4]
cmp byte [edi], 0x2d
jne 0x404ba0
movzx eax, byte [edi + 1]
cmp al, 0x2d
je 0x404ae8
lea edx, [edi + 2]
test al, al
je 0x404ba0
mov ecx, dword [ebp - 0xea0]
mov ebx, dword [ebp - 0xea4]
mov edi, dword [ebp - 0xe98]
nop
sub eax, 0x65
cmp al, 0x10
ja case.0x404bee.2
movzx eax, al
jmp dword [eax*4 + 0x40cae8]
mov ebx, 1
lea esi, [esi]
movzx eax, byte [edx]
add edx, 1
test al, al
jne 0x404be0
mov dword [ebp - 0xea0], ecx
add esi, 1
mov dword [ebp - 0xea4], ebx
mov dword [ebp - 0xe98], edi
cmp dword [ebp - 0xe88], esi
jne 0x404bab
mov ecx, dword [ebp - 0xe98]
test ecx, ecx
je 0x404d1c
mov eax, dword [ebp - 0xe84]
cmp dword [ebp - 0xe90], 0
mov dword [esp], eax
je 0x405553
call fcn.00401c30
test eax, eax
je 0x404d3a
mov eax, dword [ebp - 0xea0]
mov dword [esp], eax
call fcn.00401c90
mov dword [ebp - 0xe90], 1
jmp 0x404d29
mov ecx, 1
jmp 0x404c00
mov dword [ebp - 0xe90], 1
jmp 0x404c00
mov dword [ebp - 0xe94], 1
jmp 0x404c00
mov edi, 1
jmp 0x404c00
mov dword [ebp - 0xe84], 1
jmp 0x404c00
mov dword [ebp - 0xeac], 1
jmp 0x404c00
mov dword [ebp - 0xe98], 1
jmp 0x404ba0
mov dword [ebp - 0xe84], 1
jmp 0x404ba0
mov dword [ebp - 0xeac], 1
jmp 0x404ba0
mov dword [ebp - 0xe90], 1
jmp 0x404ba0
mov dword [ebp - 0xe94], 1
jmp 0x404ba0
cmp dword [ebp - 0xe90], 0
jne 0x404c58
cmp dword [ebp - 0xea0], 0
je 0x404d75
xor edx, edx
mov dword [ebp - 0xe98], edx
mov eax, dword [ebp - 0xe98]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [ebp - 0xea0], 1
jmp 0x404ba0
xor eax, eax
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0xe98], eax
mov dword [ebp - 0xeac], eax
mov dword [ebp - 0xe90], eax
mov dword [ebp - 0xe48], 0x18
lea edi, [ebp - 0xe2c]
xor eax, eax
mov dword [ebp - 0xe44], eax
lea eax, [ebp - 0xe64]
mov dword [ebp - 0xe40], eax
xor eax, eax
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xe3c], 0x82
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xe48]
mov dword [esp + 8], eax
lea eax, [ebp - 0xe80]
mov dword [esp + 4], 0x1f0003
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov eax, dword [ebp - 0xe80]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_ResetEvent]
mov ecx, 5
push eax
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0xe30], 0x18
mov dword [ebp - 0xe68], eax
lea eax, [ebp - 0xe5c]
mov dword [ebp - 0xe28], eax
lea eax, [ebp - 0xe30]
mov dword [ebp - 0xe5c], 0x4e004c
mov dword [ebp - 0xe58], str.KernelObjects__wine_user_shared_data
mov dword [ebp - 0xe24], pe_nt_image_headers32
mov dword [esp + 8], eax
lea eax, [ebp - 0xe6c]
mov dword [esp + 4], 0xf001f
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtOpenSection]
sub esp, 0xc
test eax, eax
je 0x4055ba
test byte [0x409090], 2
jne 0x40707c
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xe88], eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0xe84], eax
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xed0], eax
lea ebx, [ebp - 0xe68]
xor eax, eax
mov edi, dword [sym.imp.kernelbase.dll_GetSystemFirmwareTable]
mov dword [esp], 0x52534d42
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call edi
sub esp, 0x10
mov esi, eax
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0xec8], eax
call eax
mov dword [ebp - 0xeb8], eax
test eax, eax
je 0x4080f1
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0xeb8]
xor edx, edx
xor esi, esi
mov dword [esp + 4], edx
mov dword [esp], 0x52534d42
mov dword [esp + 8], eax
call edi
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xebc], eax
lea eax, [ebp - 0xe74]
sub esp, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], str.HardwareDescriptionSystem
mov dword [esp], 0x80000002
mov dword [ebp - 0xe8c], eax
call eax
sub esp, 0x24
test eax, eax
jne 0x406943
xor eax, eax
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xe70]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.BIOS
mov eax, dword [ebp - 0xe74]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
mov ecx, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0x24
mov dword [ebp - 0xeb4], ecx
test eax, eax
je 0x407102
xor ecx, ecx
mov edi, dword [ebp - 0xe74]
mov dword [ebp - 0xe5c], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
imul esi, dword [eax + 0x64], 0x18
call fcn.00402d00
mov dword [ebp - 0xea0], eax
xor eax, eax
mov dword [ebp - 0xe9c], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov eax, dword [ebp - 0xed0]
mov dword [esp], 1
mov dword [esp + 4], eax
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
mov dword [esp], esi
mov eax, dword [ebp - 0xec8]
call eax
mov dword [ebp - 0xed4], eax
test eax, eax
je 0x408398
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0xed4]
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], 0xb
mov dword [esp + 0xc], eax
call dword [sym.imp.ntdll.dll_NtPowerInformation]
sub esp, 0x14
test eax, eax
jne 0x4070e5
movzx eax, word [ebp - 0xc28]
cmp ax, 5
je 0x40692d
cmp ax, 0xc
je 0x40692d
mov ecx, str.AT_compatible
mov edx, str.Identifier
mov eax, edi
call fcn.004025e0
xor eax, eax
mov dword [esp], edi
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xe5c]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.FloatingPointProcessor
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x4050cd
xor eax, eax
mov dword [ebp - 0xe5c], eax
xor edx, edx
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], str.CentralProcessor
mov dword [esp], edi
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x405119
xor eax, eax
mov dword [ebp - 0xe68], eax
xor eax, eax
mov dword [esp + 8], 0xf4240
xor edi, edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xea0]
mov edx, dword [ebp - 0xe9c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00404700
mov dword [ebp - 0xedc], ebx
mov dword [ebp - 0xec0], eax
xor eax, eax
mov dword [ebp - 0xecc], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xec4], eax
mov eax, dword [ebp - 0xebc]
mov dword [esp], eax
mov ecx, dword [ebp - 0xeb8]
mov eax, 4
mov edx, dword [ebp - 0xecc]
call fcn.004027f0
mov esi, eax
mov dword [ebp - 0xea0], eax
test eax, eax
je 0x405b4f
mov edx, dword [ebp - 0xeb8]
mov ebx, eax
movzx eax, byte [eax + 1]
mov ecx, dword [ebp - 0xebc]
sub ebx, edx
add ebx, eax
movzx eax, byte [esi + 0x10]
mov dword [esp], ecx
mov ecx, ebx
call fcn.00401f60
mov ecx, dword [ebp - 0xebc]
mov dword [ebp - 0xeb0], eax
movzx eax, byte [esi + 7]
mov dword [esp], ecx
mov edx, dword [ebp - 0xeb8]
mov ecx, ebx
call fcn.00401f60
mov dword [ebp - 0xea8], eax
movzx eax, word [ebp - 0xc28]
cmp ax, 9
je 0x405aac
cmp ax, 0xc
je 0x405a69
cmp ax, 5
jne 0x405a1c
movzx eax, word [ebp - 0xc24]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xc26]
mov dword [esp + 8], str.ARM_Family_7_Model__X_Revision__X
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp], eax
call fcn.00402070
mov dword [ebp - 0xed8], 0x40b974
mov eax, dword [ebp - 0xea0]
cmp word [eax + 0x2e], 0
je 0x40551d
mov ecx, dword [ebp - 0xed4]
lea eax, [edi + edi*2]
xor ebx, ebx
lea esi, [ecx + eax*8 + 4]
lea esi, [esi]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x40bf8a
mov dword [esp + 4], pe_nt_image_headers32
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call fcn.00402070
lea ecx, [ebp - 0xe6c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
jne 0x40549e
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0xe30], eax
test eax, eax
jne 0x4052fa
mov eax, dword [esi]
mov dword [ebp - 0xe30], eax
lea eax, [ebp - 0xc20]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40bf90
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xe6c]
sub esp, 0x18
cmp word [ebp - 0xa20], 0
je 0x4058c9
mov eax, dword [ebp - 0xe88]
add eax, 2
cmp word [eax], 0
jne 0x405350
mov ecx, dword [ebp - 0xe88]
sub eax, ecx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Identifier
mov dword [esp + 0x10], eax
mov dword [esp], edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xea8]
sub esp, 0x18
test eax, eax
je 0x4053f0
cmp word [eax], 0
mov edx, dword [ebp - 0xe6c]
je 0x405b3d
add eax, 2
cmp word [eax], 0
jne 0x4053b0
mov ecx, dword [ebp - 0xea8]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.VendorIdentifier
mov dword [esp], edx
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [ebp - 0xeb0]
test eax, eax
je 0x40544e
cmp word [eax], 0
je 0x405b32
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405408
mov ecx, dword [ebp - 0xeb0]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProcessorNameString
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
lea eax, [ebp - 0xe30]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.MHz
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe6c]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
sub esp, 4
mov eax, dword [ebp - 0xe5c]
test eax, eax
je 0x405502
lea ecx, [ebp - 0xe6c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov ecx, dword [ebp - 0xe84]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x405850
mov eax, dword [ebp - 0xea0]
add ebx, 1
add edi, 1
add esi, 0x18
movzx eax, word [eax + 0x2e]
cmp ebx, eax
jb 0x405260
mov eax, dword [ebp - 0xecc]
test eax, eax
je 0x4058d3
mov eax, dword [ebp - 0xeb0]
mov dword [esp], eax
mov ebx, dword [ebp - 0xec4]
call ebx
mov eax, dword [ebp - 0xea8]
mov dword [esp], eax
call ebx
add dword [ebp - 0xecc], 1
jmp 0x405160
call fcn.00401960
test eax, eax
jne 0x404d29
jmp 0x404d3a
mov eax, 1
call fcn.00402710
xor eax, eax
call fcn.00402710
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, 0x417240
call fcn.004024e0
mov dword [esp + 0xc], str.Cannot_set_the_dir_to__s___ld__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.main
mov dword [esp + 0x14], ebx
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x404a5a
xor ebx, ebx
mov dword [esp + 0x10], 0x710
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 2
mov eax, dword [ebp - 0xe6c]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_MapViewOfFile]
mov esi, eax
mov eax, dword [ebp - 0xe6c]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
push edi
test esi, esi
je 0x407a02
mov dword [ebp - 0x818], 0x11c
lea eax, [ebp - 0x818]
mov dword [ebp - 0xe84], eax
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
xor edx, edx
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push eax
xor eax, eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xa20]
mov dword [esp + 8], 0x2c
mov dword [ebp - 0xe88], eax
mov dword [esp], edx
mov dword [esp + 4], eax
call ebx
lea eax, [ebp - 0xe54]
xor ecx, ecx
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xc
mov dword [esp + 4], eax
mov dword [esp], 1
call ebx
mov dword [esi + 4], 0x1000000
mov dword [esi + 0x244], 0x200000
sub esp, 0x10
movzx eax, byte [ebp - 0x6fe]
movd xmm0, dword [ebp - 0x80c]
mov byte [esi + 0x268], 1
movd xmm7, eax
punpckldq xmm0, xmm7
movq qword [esi + 0x260], xmm0
movzx eax, word [ebp - 0xe54]
mov word [esi + 0x26a], ax
movq xmm7, qword [ebp - 0x814]
movq qword [esi + 0x26c], xmm7
movzx eax, word [ebp - 0x700]
mov dword [esi + 0x2d0], eax
mov eax, dword [ebp - 0xa14]
mov byte [esi + 0x2d5], 2
mov dword [esi + 0x2e8], eax
lea eax, [esi + 0x30]
mov dword [esp + 4], str.C:windows
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
movzx eax, word [ebp - 0xe54]
cmp ax, 9
je 0x40749a
ja 0x407836
test ax, ax
je 0x40749a
cmp ax, 5
jne 0x4075b6
mov eax, dword [ebp - 0xe4c]
lea ebx, [ebp - 0xe68]
movzx edx, al
shr eax, 1
and eax, 1
and dl, 1
mov dh, al
lea eax, [ebp - 0xc28]
mov word [esi + 0x286], dx
mov dword [ebp - 0xed0], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x64]
mov byte [esi + 0x3c4], 1
mov dword [esi + 0x3c0], eax
mov eax, esi
call fcn.00402940
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_UnmapViewOfFile]
push eax
jmp 0x404e95
lea edx, [ebp - 0xa1c]
xor eax, eax
mov ecx, 0x10
lea ebx, [ebp - 0x818]
mov edi, edx
rep stosd dword es:[edi], eax
lea esi, [ebp - 0xa20]
mov dword [ebp - 0xa20], 0x44
mov dword [esp + 4], 0x104
mov dword [ebp - 0xe84], ebx
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_GetSystemDirectoryW]
push eax
push eax
mov dword [esp + 4], str.wineboot.exe
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
lea eax, [ebp - 0xe48]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_Wow64DisableWow64FsRedirection]
push eax
call dword [sym.imp.kernelbase.dll_GetCommandLineW]
lea ecx, [ebp - 0xc28]
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x40834c
test byte [0x409090], 2
jne 0x407414
mov eax, dword [ebp - 0xe48]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_Wow64RevertWow64FsRedirection]
push ebx
jmp 0x404a85
cmp word [ebp - 0xa20], 0
mov edx, dword [ebp - 0xe6c]
mov eax, dword [ebp - 0xe88]
je 0x405879
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405870
mov ecx, dword [ebp - 0xe88]
mov dword [esp], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Identifier
sub eax, ecx
mov dword [esp + 0x10], ecx
add eax, 2
mov dword [esp + 0x14], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe6c]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
sub esp, 4
jmp 0x405502
mov eax, 2
jmp 0x405364
lea eax, [ebp - 0xe54]
mov dword [esp + 4], str.SystemCurrentControlSetControlSession_ManagerEnvironment
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x40552b
mov ecx, dword [ebp - 0xed8]
mov edx, str.PROCESSOR_ARCHITECTURE
mov eax, dword [ebp - 0xe54]
call fcn.004025e0
mov ecx, dword [ebp - 0xea8]
mov eax, str.Unknown
test ecx, ecx
cmovne eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp + 8], str._s___s
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp + 0xc], eax
mov ebx, dword [ebp - 0xe84]
mov dword [esp], ebx
call fcn.00402070
mov eax, dword [ebp - 0xe54]
mov ecx, ebx
mov edx, str.PROCESSOR_IDENTIFIER
call fcn.004025e0
movzx eax, word [ebp - 0xc26]
mov dword [esp], ebx
mov dword [esp + 8], 0x40bf8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp + 0xc], eax
call fcn.00402070
mov eax, dword [ebp - 0xe54]
mov ecx, ebx
mov edx, str.PROCESSOR_LEVEL
call fcn.004025e0
movzx eax, word [ebp - 0xc24]
mov dword [esp], ebx
mov dword [esp + 8], str._04x
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp + 0xc], eax
call fcn.00402070
mov eax, dword [ebp - 0xe54]
mov ecx, ebx
mov edx, str.PROCESSOR_REVISION
call fcn.004025e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x64]
mov dword [esp + 8], 0x40bf8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00402070
mov eax, dword [ebp - 0xe54]
mov ecx, ebx
mov edx, str.NUMBER_OF_PROCESSORS
call fcn.004025e0
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
jmp 0x40552b
movzx eax, word [ebp - 0xc24]
movzx edx, al
movzx eax, ah
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xc26]
mov dword [esp + 8], str.x86_Family__u_Model__u_Stepping__u
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp], eax
call fcn.00402070
mov dword [ebp - 0xed8], 0x40b988
jmp 0x40523c
movzx eax, word [ebp - 0xc24]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xc26]
mov dword [esp + 8], str.ARMv8__64_bit__Family_8_Model__X_Revision__X
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp], eax
call fcn.00402070
mov dword [ebp - 0xed8], str.ARM64
jmp 0x40523c
movzx ebx, word [ebp - 0xc24]
cmp dword [ebp - 0xea8], 0
movzx esi, word [ebp - 0xc26]
movzx edx, bl
movzx ebx, bh
je 0x405b48
mov dword [ebp - 0xed8], edx
mov dword [esp + 4], str.AuthenticAMD
mov eax, dword [ebp - 0xea8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0xed8]
test eax, eax
jne 0x405b48
mov eax, str.AMD64
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_Family__u_Model__u_Stepping__u
mov dword [esp + 4], 0x3c
mov eax, dword [ebp - 0xe88]
mov dword [esp], eax
call fcn.00402070
mov dword [ebp - 0xed8], str.AMD64
jmp 0x40523c
mov eax, dword [ebp - 0xeb0]
jmp 0x405411
mov eax, dword [ebp - 0xea8]
jmp 0x4053b9
mov eax, str.Intel64
jmp 0x405af5
mov eax, dword [ebp - 0xe5c]
mov ebx, dword [ebp - 0xedc]
mov dword [esp], eax
mov edi, dword [ebp - 0xeb4]
call edi
push ecx
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call edi
push esi
mov eax, dword [ebp - 0xed4]
mov dword [esp], eax
mov eax, dword [ebp - 0xec4]
call eax
mov eax, dword [ebp - 0xe74]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push edx
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, dword [ebp - 0xec4]
call eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp + 0x14], 0x20006
mov dword [esp + 4], str.PerfStatsStatData
mov dword [esp], 0x80000006
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x406916
xor esi, esi
xor edi, edi
mov dword [esp + 0x20], esi
mov eax, dword [ebp - 0xe84]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0x20006
mov dword [esp + 4], str.Config_ManagerEnum
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], 0x80000006
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x406a05
mov edi, dword [ebp - 0xe88]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x100
mov esi, dword [ebp - 0xe84]
mov dword [esp], esi
call dword [sym.imp.ws2_32.dll_gethostname]
mov ecx, dword [sym.imp.advapi32.dll_RegOpenKeyW]
push edx
push edx
mov dword [ebp - 0xea8], ecx
test eax, eax
jne 0x405da3
mov dword [ebp - 0xa20], 2
xor eax, eax
mov dword [esp + 0xc], ebx
mov edi, dword [ebp - 0xe88]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 8], edi
call sub.ws2_32.dll_getaddrinfo
sub esp, 0x10
test eax, eax
jne 0x405cd9
mov eax, dword [ebp - 0xe68]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x405cd9
mov dword [esp + 4], str.localhost
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__stricmp]
test eax, eax
je 0x405cd9
mov eax, dword [ebp - 0xe68]
mov esi, dword [eax + 0x14]
jmp 0x405cdf
mov esi, dword [ebp - 0xe84]
mov dword [esp + 4], 0x2e
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strchr]
test eax, eax
je 0x407825
lea edx, [eax + 1]
mov byte [eax], 0
mov edi, dword [sym.imp.kernelbase.dll_SetComputerNameExA]
mov dword [esp + 4], edx
mov dword [esp], 6
call edi
push eax
push eax
mov dword [esp + 4], esi
mov dword [esp], 5
call edi
push eax
push eax
mov eax, dword [ebp - 0xe84]
cmp esi, eax
je 0x405d3b
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call sub.ws2_32.dll_freeaddrinfo
push esi
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyW]
lea eax, [ebp - 0xe5c]
mov dword [esp + 4], str.SystemCurrentControlSetControlComputerName
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
mov dword [ebp - 0xea8], edi
call edi
sub esp, 0xc
test eax, eax
jne 0x405da3
lea esi, [ebp - 0xe54]
mov dword [esp + 4], str.ComputerName
mov dword [esp + 8], esi
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
je 0x407d69
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push esi
mov esi, dword [ebp - 0xe84]
mov edi, 0x400
mov dword [ebp - 0xea0], ebx
jmp 0x405dfd
lea ebx, [edi - 2]
cmp eax, ebx
jb 0x406673
mov eax, dword [ebp - 0xe84]
cmp esi, eax
je 0x405de0
mov dword [esp], esi
mov eax, dword [ebp - 0xec4]
call eax
lea edx, [edi*4]
mov dword [esp], edx
mov eax, dword [ebp - 0xec8]
lea ebx, [edi + edi]
call eax
mov esi, eax
test eax, eax
je 0x405e21
mov edi, ebx
mov dword [esp + 0xc], str.wininit.ini
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.rename
call dword [sym.imp.kernel32.dll_GetPrivateProfileSectionW]
sub esp, 0x10
test eax, eax
jne 0x405dc0
mov ebx, dword [ebp - 0xea0]
mov eax, dword [ebp - 0xe84]
xor edi, edi
mov dword [ebp - 0xa20], edi
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 4], str.SystemCurrentControlSetControlSession_Manager
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x405ebe
mov eax, dword [ebp - 0xe88]
xor esi, esi
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
je 0x40619f
xor edx, edx
mov dword [esp], edx
mov eax, dword [ebp - 0xec4]
call eax
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp], 0x80000002
mov eax, dword [ebp - 0xea8]
call eax
sub esp, 0xc
test eax, eax
je 0x40684e
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
xor eax, eax
mov edi, dword [sym.imp.kernelbase.dll_GetSystemDirectoryW]
mov dword [esp + 4], eax
mov dword [esp], eax
call edi
mov esi, eax
push edx
lea eax, [eax + 0xc]
push edx
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov dword [ebp - 0xea8], eax
mov dword [esp + 4], esi
mov esi, eax
mov dword [esp], eax
call edi
push ecx
push ecx
mov dword [esp], esi
mov dword [esp + 4], 0x40c454
call fcn.00401f20
push esi
push esi
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], eax
mov esi, dword [ebp - 0xea8]
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_FindFirstFileW]
push edi
push edi
cmp word [esi], 0
mov dword [ebp - 0xea0], eax
mov eax, esi
je 0x407b3b
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405f70
cmp dword [ebp - 0xea0], 0xffffffff
mov word [eax - 4], 0
je 0x4062cf
mov edi, dword [sym.imp.ucrtbase.dll_wcscmp]
lea esi, [ebp - 0x7ec]
mov dword [ebp - 0xeb0], ebx
jmp 0x405fc4
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xea0]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x4062c9
mov dword [esp + 4], 0x40c48c
mov dword [esp], esi
call edi
test eax, eax
je 0x405fa0
mov dword [esp + 4], 0x40c490
mov dword [esp], esi
call edi
test eax, eax
je 0x405fa0
mov dword [ebp - 0xe5c], 0x104
lea eax, [ebp - 0xe54]
mov dword [ebp - 0xe54], 0x104
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xe5c]
mov dword [esp + 0x14], eax
mov ebx, dword [ebp - 0xed0]
mov dword [esp + 0xc], 0x417240
mov dword [esp + 8], 0x417240
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_VerFindFileW]
lea eax, [ebp - 0xe5c]
mov dword [ebp - 0xe5c], 0x104
sub esp, 0x20
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xea8]
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
call fcn.00403a94
mov ebx, dword [sym.imp.kernelbase.dll_DeleteFileW]
sub esp, 0x20
test eax, eax
je 0x4060ba
test byte [0x409090], 4
jne 0x406ac4
mov eax, dword [ebp - 0xe88]
mov ebx, dword [sym.imp.kernelbase.dll_DeleteFileW]
mov dword [esp], eax
call ebx
push ecx
mov dword [esp + 8], 0x103
mov eax, dword [ebp - 0xea8]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe30]
mov dword [esp], eax
call fcn.00401ec0
lea eax, [ebp - 0xe30]
sub esp, 0xc
cmp word [ebp - 0xe30], 0
je 0x4060f9
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4060f0
lea ecx, [ebp - 0xe30]
sub eax, ecx
mov edx, eax
lea eax, [ebp + eax - 0xe2e]
sar edx, 1
mov word [ebp + edx*2 - 0xe30], 0x5c
lea ecx, [edx + 1]
mov edx, 0x104
sub edx, ecx
mov dword [ebp - 0xe5c], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00401ec0
lea eax, [ebp - 0xe30]
sub esp, 0xc
mov dword [esp], eax
call ebx
push edx
test eax, eax
jne 0x405fa0
test byte [0x409090], 4
je 0x405fa0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
lea eax, [ebp - 0xe30]
call fcn.004024e0
mov dword [esp + 0xc], str.failed_to_delete__s:_error__lu_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ProcessWindowsFileProtection
mov dword [esp + 0x14], ebx
mov dword [esp + 4], 0x409090
mov dword [esp], 2
call fcn.004027a0
jmp 0x405fa0
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov edx, eax
mov eax, dword [ebp - 0x818]
test edx, edx
je 0x405e9f
mov ecx, dword [ebp - 0xe88]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov dword [ebp - 0xea0], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0xea0]
sub esp, 0x18
test eax, eax
jne 0x405ea1
mov eax, dword [ebp - 0xa20]
cmp eax, 3
jbe 0x405ea1
and eax, 0xfffffffe
cmp word [edx + eax - 2], 0
jne 0x405ea1
cmp word [edx + eax - 4], 0
jne 0x405ea1
mov eax, ebx
mov ebx, edx
mov edi, eax
mov eax, edx
sub eax, ebx
cmp eax, dword [ebp - 0xa20]
jae 0x407f9c
movzx ecx, word [edx]
test cx, cx
je 0x407f9c
mov eax, edx
add eax, 2
cmp word [eax], 0
jne 0x40624a
lea esi, [eax + 2]
cmp cx, 0x5c
je 0x407a61
xor eax, eax
cmp word [esi], 0x21
jne 0x406270
add esi, 2
mov eax, 1
cmp word [esi], 0x5c
je 0x407a38
cmp word [esi], 0
jne 0x40780c
mov dword [esp], edx
mov dword [ebp - 0xea0], edx
call dword [sym.imp.kernelbase.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x4062bb
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x10b
mov edx, dword [ebp - 0xea0]
jne 0x4062bb
jmp 0x4080e2
add esi, 2
cmp word [esi], 0
jne 0x4062b8
lea edx, [esi + 2]
jmp 0x40622c
mov ebx, dword [ebp - 0xeb0]
mov eax, dword [ebp - 0xea0]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_FindClose]
push esi
mov eax, dword [ebp - 0xea8]
mov dword [esp], eax
mov eax, dword [ebp - 0xec4]
call eax
mov eax, str.RunServicesOnce
mov edx, 1
call fcn.00403430
mov eax, dword [ebp - 0xe94]
mov ecx, dword [ebp - 0xe90]
xor eax, 1
and eax, ecx
or eax, dword [ebp - 0xeac]
je 0x4063a2
lea edi, [ebp - 0x814]
xor edx, edx
mov eax, str.RunServices
call fcn.00403430
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x818], 0x44
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 1
mov dword [esp], str.C:windows_system32_services.exe
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x406969
test byte [0x409090], 2
jne 0x407b05
mov eax, dword [ebp - 0xe98]
mov ecx, dword [ebp - 0xe90]
or eax, ecx
or eax, dword [ebp - 0xe94]
je 0x406457
mov dword [esp + 4], 0x104
mov esi, dword [ebp - 0xe84]
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_GetSystemDirectoryW]
push eax
push eax
mov dword [esp + 4], str._reboot.exe
mov dword [esp], esi
call fcn.00401f20
lea edx, [ebp - 0xa1c]
mov ecx, 0x10
push eax
mov edi, edx
push eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0xa20], 0x44
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0xe88]
mov dword [esp + 4], esi
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x4070a9
test byte [0x409090], 2
jne 0x407adc
mov eax, dword [ebp - 0xeac]
or eax, dword [ebp - 0xea4]
jne 0x406b08
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0xed0]
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 4], str.Volatile_Environment
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
jne 0x406651
mov edi, dword [ebp - 0xe84]
xor eax, eax
mov dword [esp + 4], 0x801a
mov dword [esp + 0xc], eax
mov ebx, dword [0x4184c4]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 0x10], edi
call ebx
sub esp, 0x14
test eax, eax
js 0x4064fd
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.APPDATA
call fcn.004025e0
mov eax, dword [ebp - 0xc28]
mov ecx, str.Console
mov edx, str.CLIENTNAME
xor esi, esi
call fcn.004025e0
mov edi, dword [ebp - 0xe84]
xor ecx, ecx
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x8028
mov dword [esp + 0x10], edi
call ebx
sub esp, 0x14
test eax, eax
js 0x40657f
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.USERPROFILE
call fcn.004025e0
mov eax, dword [ebp - 0xc28]
lea ecx, [ebp - 0x814]
mov edx, str.HOMEPATH
call fcn.004025e0
mov eax, dword [ebp - 0xc28]
mov ecx, edi
mov edx, str.HOMEDRIVE
mov word [ebp - 0x814], 0
call fcn.004025e0
mov dword [ebp - 0xe30], 0x104
lea eax, [ebp - 0xe30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetUserNameW]
push edx
push edx
test eax, eax
jne 0x407ac1
mov eax, dword [ebp - 0xc28]
mov ecx, 0x40b1dc
mov edx, str.HOMESHARE
xor edi, edi
call fcn.004025e0
mov esi, dword [ebp - 0xe84]
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x801c
mov dword [esp], eax
mov dword [esp + 0x10], esi
call ebx
sub esp, 0x14
test eax, eax
js 0x4065fd
mov eax, dword [ebp - 0xc28]
mov ecx, esi
mov edx, str.LOCALAPPDATA
call fcn.004025e0
mov dword [ebp - 0xe30], 0x10
lea eax, [ebp - 0xe30]
lea ebx, [ebp - 0xa1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
push esi
push esi
test eax, eax
jne 0x407a8a
mov eax, dword [ebp - 0xc28]
mov ecx, str.Console
mov edx, str.SESSIONNAME
call fcn.004025e0
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push ecx
test byte [0x409090], 8
jne 0x406a50
mov eax, dword [ebp - 0xe80]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_SetEvent]
push edx
jmp 0x404d32
movzx eax, word [esi]
mov edi, esi
mov ebx, dword [ebp - 0xea0]
test ax, ax
je 0x406712
mov dword [ebp - 0xeb0], esi
cmp ax, 0x3b
je 0x4066ec
mov dword [esp + 4], 0x3d
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x4066ec
mov word [eax], 0
lea esi, [eax + 2]
mov dword [esp + 4], edi
mov dword [esp], 0x40c284
call dword [sym.imp.kernelbase.dll_lstrcmpiW]
push ecx
push ecx
test eax, eax
jne 0x4067d3
test byte [0x409090], 8
jne 0x406a1c
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_DeleteFileW]
push edx
test eax, eax
je 0x406792
mov edi, esi
cmp word [edi], 0
mov eax, edi
je 0x406701
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4066f8
lea edi, [eax + 2]
movzx eax, word [edi]
test ax, ax
jne 0x40668d
mov esi, dword [ebp - 0xeb0]
mov eax, dword [ebp - 0xe84]
cmp esi, eax
je 0x406727
mov dword [esp], esi
mov eax, dword [ebp - 0xec4]
call eax
mov dword [esp + 8], 1
mov dword [esp + 4], str.wininit.bak
mov dword [esp], str.wininit.ini
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
jne 0x405e27
test byte [0x409090], 2
je 0x405e27
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_rename_wininit.ini__error__ld_n
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x409090
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004027a0
jmp 0x405e27
test byte [0x409090], 4
je 0x4066ea
mov eax, esi
call fcn.004024e0
mov dword [esp + 0xc], str.Error_deleting_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x409090
mov dword [esp], 2
call fcn.004027a0
jmp 0x4066ea
test byte [0x409090], 8
jne 0x406a79
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
jne 0x4066ea
test byte [0x409090], 4
je 0x4066ea
mov eax, edi
call fcn.004024e0
mov edi, eax
mov eax, esi
call fcn.004024e0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Error_renaming__s_to__s_n
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x409090
mov dword [esp], 2
call fcn.004027a0
jmp 0x4066ea
xor eax, eax
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], str.SFCDllCacheDir
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x405ee4
mov eax, dword [ebp - 0x818]
lea edx, [eax + 2]
add eax, 8
mov dword [ebp - 0x818], edx
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov ecx, dword [ebp - 0xe84]
mov dword [ebp - 0xea8], eax
mov edi, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str.SFCDllCacheDir
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
call esi
sub esp, 0x18
mov dword [esp + 4], 0x40c44e
mov dword [esp], edi
call fcn.00401f20
push eax
push eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
test edi, edi
jne 0x405f40
jmp 0x405ef6
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
jmp 0x405bf5
mov ecx, str.ARM_processor_family
mov edx, str.Identifier
mov eax, edi
call fcn.004025e0
jmp 0x4050cd
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xec4], eax
call eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xeb4], eax
jmp 0x405ba7
mov eax, dword [ebp - 0xa1c]
mov esi, dword [sym.imp.kernelbase.dll_CloseHandle]
mov dword [esp], eax
call esi
xor eax, eax
push edi
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], str.__wine_SvcctlStarted
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CreateEventW]
movd xmm1, dword [ebp - 0xa20]
sub esp, 0x10
movd xmm0, eax
xor eax, eax
punpckldq xmm0, xmm1
movq qword [ebp - 0xc28], xmm0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xed0]
mov dword [esp], 2
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_WaitForMultipleObjects]
sub esp, 0x10
sub eax, 1
je 0x408087
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call esi
push eax
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call esi
push edx
jmp 0x4063a2
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push ecx
jmp 0x405c43
mov eax, esi
call fcn.004024e0
mov dword [esp + 0xc], str.Deleting_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x409090
mov dword [esp], 3
call fcn.004027a0
jmp 0x4066d8
mov dword [esp + 0xc], str.Operation_done_n
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x409090
mov dword [esp], 3
call fcn.004027a0
jmp 0x40665e
mov eax, edi
call fcn.004024e0
mov dword [ebp - 0xea0], eax
mov eax, esi
call fcn.004024e0
mov ecx, dword [ebp - 0xea0]
mov dword [esp + 0xc], str.Renaming_file__s_to__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.wininit
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], ecx
mov dword [esp], 3
call fcn.004027a0
jmp 0x4067e0
mov dword [ebp - 0xeb8], eax
mov eax, esi
call fcn.004024e0
mov edx, dword [ebp - 0xeb8]
mov dword [esp + 0xc], str.WFP:__s_error_0x_lx_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ProcessWindowsFileProtection
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], edx
mov dword [esp], 2
call fcn.004027a0
jmp 0x4060a8
mov esi, dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp], str.WINECONFIGDIR
mov dword [ebp - 0xea8], esi
call esi
mov dword [ebp - 0xe94], eax
mov dword [esp], str.WINEBUILDDIR
call esi
mov edi, eax
test eax, eax
je 0x408030
mov esi, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp], eax
call esi
add eax, 0x11
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov dword [ebp - 0xe90], eax
test eax, eax
je 0x408010
xor eax, eax
movzx edx, word [edi + eax]
mov ecx, dword [ebp - 0xe90]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x406b61
mov dword [esp], ecx
mov dword [esp + 4], str.loader
call fcn.00401f20
push ecx
push ecx
mov dword [esp + 4], str.wine.inf
mov edi, dword [ebp - 0xe90]
mov dword [esp], edi
call fcn.00401f20
xor edx, edx
push eax
push eax
mov eax, dword [sym.imp.ucrtbase.dll__wopen]
mov word [edi + 2], 0x5c
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [ebp - 0xea0], eax
call eax
mov edi, eax
cmp eax, 0xffffffff
je 0x407fc8
mov eax, dword [ebp - 0xed0]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__fstat32]
mov eax, dword [sym.imp.ucrtbase.dll__close]
mov dword [esp], edi
mov dword [ebp - 0xeac], eax
call eax
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xe98], eax
mov eax, dword [ebp - 0xe94]
mov dword [esp], eax
call esi
add eax, 0x13
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov edi, eax
test eax, eax
je 0x406d79
xor eax, eax
mov ecx, dword [ebp - 0xe94]
movzx edx, word [ecx + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x406c1e
mov dword [esp + 4], str..update_timestamp
mov dword [esp], edi
call fcn.00401f20
push eax
push eax
mov dword [esp + 4], 2
mov dword [esp], edi
mov eax, dword [ebp - 0xea0]
call eax
mov esi, eax
cmp eax, 0xffffffff
je 0x4075cd
mov dword [esp + 8], 0x63
mov eax, dword [ebp - 0xe84]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__read]
test eax, eax
js 0x406cda
mov byte [ebp + eax - 0x818], 0
mov dword [esp + 8], 7
mov dword [esp + 4], str.disable
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call sub.ucrtbase.dll_strncmp
test eax, eax
je 0x406d63
xor ecx, ecx
mov dword [esp + 8], 0xa
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strtoul]
cmp dword [ebp - 0xe98], eax
je 0x406d63
xor eax, eax
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__lseek]
xor eax, eax
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
mov eax, dword [ebp - 0xe98]
mov dword [esp + 4], str._lu_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call fcn.00402550
mov dword [esp + 8], eax
mov dword [ebp - 0xe94], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__write]
mov edx, dword [ebp - 0xe94]
cmp edx, eax
je 0x40814b
test byte [0x409090], 4
jne 0x408117
xor edx, edx
mov dword [esp], esi
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll__chsize]
mov dword [esp], esi
mov eax, dword [ebp - 0xeac]
call eax
mov dword [esp], edi
mov eax, dword [ebp - 0xec4]
call eax
cmp dword [ebp - 0xea4], 0
je 0x4077f6
xor eax, eax
mov dword [ebp - 0xe78], eax
mov dword [esp], 0x40c6be
call dword [sym.imp.ucrtbase.dll_getenv]
mov dword [ebp - 0xe94], eax
test eax, eax
je 0x406e0c
mov eax, dword [ebp - 0xe94]
mov esi, str.WINEDLLOVERRIDES
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
add eax, 0x12
mov dword [esp + 8], eax
xor eax, eax
mov edx, dword fs:[0x18]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapAlloc]
mov ecx, 0x11
mov edi, eax
mov dword [ebp - 0xe98], eax
mov eax, dword [ebp - 0xe94]
sub esp, 0xc
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.ucrtbase.dll_strcpy
mov edx, dword [ebp - 0xe98]
mov dword [ebp - 0xe94], edx
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], str.c:_windows_system32_shdocvw.dll
call dword [sym.imp.kernelbase.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x406eaf
xor eax, eax
mov dword [esp + 8], 0x54
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernelbase.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x406ea5
lea eax, [ebp - 0x7d8]
mov dword [esp + 8], 0x14
mov dword [esp + 4], str.Wine_placeholder_DLL
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strncmp]
test eax, eax
je 0x406ea5
mov byte [0x409048], 0x64
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_CloseHandle]
push edi
test byte [0x409090], 8
jne 0x407f6b
mov eax, dword [sym.imp.ucrtbase.dll__putenv]
mov dword [esp], str.WINEDLLOVERRIDESshdocvwb_iexplore.exeb_advpackb_atlb_oleaut32b_rpcrt4b
xor esi, esi
mov dword [ebp - 0xea0], eax
call eax
xor ecx, ecx
mov dword [esp + 4], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 2
mov eax, dword [ebp - 0xe90]
mov dword [esp], eax
call dword [0x4184b4]
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x407f19
xor edx, edx
mov dword [esp], edx
call dword [0x4184a8]
mov edi, eax
push ecx
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov eax, dword [0x418490]
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 4
mov dword [esp + 8], str.DefaultInstall
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [0x4184ac]
sub esp, 0x2c
mov dword [esp], edi
call dword [0x4184b8]
push eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.DefaultInstall.Services
mov dword [esp], esi
call dword [0x4184b0]
sub esp, 0xc
mov dword [esp], esi
call dword [0x41848c]
push edx
lea edi, [ebp - 0xe78]
xor eax, eax
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], 0xb5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
sub esp, 0x18
test eax, eax
je 0x406fca
mov word [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe90]
mov ecx, 1
mov edx, str.PreInstall
xor esi, esi
call fcn.00403180
mov dword [ebp - 0xe78], eax
test eax, eax
je 0x40762b
cmp dword [ebp - 0xe78], 0
je 0x40703a
xor eax, eax
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 1
call dword [0x4185c4]
sub esp, 0x14
test eax, eax
jne 0x407469
mov eax, dword [ebp - 0xe78]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
push eax
movzx eax, word [ebp + esi*4 - 0xe30]
test ax, ax
je 0x40761f
test byte [ebp + esi*4 - 0xe2e], 4
je 0x407607
mov eax, dword [ebp - 0xe90]
mov ecx, 1
mov edx, str.DefaultInstall
call fcn.00403180
mov dword [ebp - 0xe78], eax
add esi, 1
jmp 0x406fef
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.cannot_open___wine_user_shared_data:__lx_n
mov dword [esp + 8], str.create_user_shared_data
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x404e6b
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_WaitForSingleObject]
push ebx
push ebx
mov eax, dword [ebp - 0xc28]
mov ebx, dword [sym.imp.kernelbase.dll_CloseHandle]
mov dword [esp], eax
call ebx
push esi
mov eax, dword [ebp - 0xc24]
mov dword [esp], eax
call ebx
push edi
jmp 0x406651
xor eax, eax
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xed4]
mov dword [esp], eax
call sub.ucrtbase.dll_memset
jmp 0x40504f
mov eax, dword [ebp - 0xe70]
xor edx, edx
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0xebc]
mov dword [esp], eax
mov edi, dword [ebp - 0xeb8]
mov eax, 2
mov ecx, edi
call fcn.004027f0
mov esi, eax
test eax, eax
je 0x4071c7
mov ecx, eax
movzx eax, byte [eax + 1]
mov dword [ebp - 0xeb8], edi
mov edx, dword [ebp - 0xebc]
sub ecx, edi
lea edi, [ecx + eax]
movzx ecx, byte [esi + 4]
mov dword [esp + 8], edx
mov edx, str.BaseBoardManufacturer
mov dword [esp + 4], edi
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 5]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.BaseBoardProduct
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 6]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov edi, dword [ebp - 0xeb8]
mov edx, str.BaseBoardVersion
mov dword [esp], edi
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov eax, dword [ebp - 0xebc]
xor edx, edx
mov edi, dword [ebp - 0xe70]
mov dword [esp], eax
mov ecx, dword [ebp - 0xeb8]
xor eax, eax
call fcn.004027f0
mov esi, eax
test eax, eax
je 0x4072d3
mov ecx, eax
mov eax, dword [ebp - 0xeb8]
mov edx, dword [ebp - 0xebc]
sub ecx, eax
movzx eax, byte [esi + 1]
lea ecx, [ecx + eax]
mov eax, ecx
movzx ecx, byte [esi + 4]
mov dword [esp + 8], edx
mov edx, str.BIOSVendor
mov dword [ebp - 0xea0], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, edi
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 5]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xea0]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.BIOSVersion
mov dword [esp], eax
mov eax, edi
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 8]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xea0]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.BIOSReleaseDate
mov dword [esp], eax
mov eax, edi
call fcn.00402640
cmp byte [esi + 1], 0x17
jbe 0x407e7f
movzx ecx, byte [esi + 0x14]
mov edx, str.BiosMajorRelease
mov eax, edi
call fcn.004025a0
movzx ecx, byte [esi + 0x15]
mov edx, str.BiosMinorRelease
mov eax, edi
call fcn.004025a0
movzx ecx, byte [esi + 0x16]
mov edx, str.ECFirmwareMajorVersion
mov eax, edi
call fcn.004025a0
movzx ecx, byte [esi + 0x17]
mov edx, str.ECFirmwareMinorVersion
mov eax, edi
call fcn.004025a0
mov eax, dword [ebp - 0xe70]
xor edx, edx
mov ecx, dword [ebp - 0xebc]
mov dword [ebp - 0xea0], eax
mov eax, 1
mov dword [esp], ecx
mov edi, dword [ebp - 0xeb8]
mov ecx, edi
call fcn.004027f0
mov esi, eax
test eax, eax
je 0x4073f8
mov ecx, eax
movzx eax, byte [eax + 1]
mov dword [ebp - 0xeb8], edi
mov edx, dword [ebp - 0xebc]
sub ecx, edi
lea edi, [ecx + eax]
movzx ecx, byte [esi + 4]
mov dword [esp + 8], edx
mov edx, str.SystemManufacturer
mov dword [esp + 4], edi
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 5]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.SystemProductName
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 6]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.SystemVersion
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
cmp byte [esi + 1], 0x1a
jbe 0x407ec8
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 0x19]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.SystemSKU
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov edx, dword [ebp - 0xebc]
movzx ecx, byte [esi + 0x1a]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xeb8]
mov edx, str.SystemFamily
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xeb4], eax
call eax
push eax
jmp 0x404fb2
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, dword [ebp - 0xe84]
call fcn.004024e0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_restart_64_bit__s__err__ld_n
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x405834
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call dword [0x4185a0]
push eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], eax
call dword [0x4185cc]
sub esp, 0x14
test eax, eax
jne 0x407459
jmp 0x406fef
mov eax, dword [ebp - 0xe4c]
mov byte [esi + 0x28b], 1
mov edx, eax
shr dl, 7
mov byte [esi + 0x276], dl
mov edx, eax
shr edx, 8
and edx, 1
mov byte [esi + 0x277], dl
mov edx, eax
shr edx, 0xd
and edx, 1
mov byte [esi + 0x27a], dl
mov edx, eax
shr edx, 0xe
and edx, 1
mov byte [esi + 0x27b], dl
mov edx, eax
shr edx, 1
and edx, 1
mov byte [esi + 0x27c], dl
mov edx, eax
shr edx, 0x15
and edx, 1
mov byte [esi + 0x27d], dl
mov edx, eax
shr edx, 0x10
and edx, 1
mov byte [esi + 0x27e], dl
mov edx, eax
shr edx, 0x13
and edx, 1
mov byte [esi + 0x281], dl
mov edx, eax
shr edx, 0xf
and edx, 1
mov byte [esi + 0x298], dl
mov edx, eax
shr edx, 0x17
and edx, 1
mov byte [esi + 0x285], dl
mov edx, eax
shr edx, 0x14
and edx, 1
mov byte [esi + 0x282], dl
mov edx, eax
shr edx, 0x16
and edx, 1
mov byte [esi + 0x27f], dl
mov edx, eax
shr edx, 0x1d
and edx, 1
mov byte [esi + 0x280], dl
mov edx, eax
shr edx, 0x1a
and edx, 1
mov byte [esi + 0x288], dl
mov edx, eax
shr edx, 0x1b
and edx, 1
mov byte [esi + 0x289], dl
mov edx, eax
shr edx, 0x1c
and edx, 1
mov byte [esi + 0x28a], dl
mov edx, eax
shr edx, 0x18
and edx, 1
mov byte [esi + 0x299], dl
mov edx, eax
shr edx, 0x19
and edx, 1
mov byte [esi + 0x29a], dl
mov edx, eax
shr eax, 0x1f
shr edx, 0x1e
mov byte [esi + 0x29c], al
and edx, 1
mov byte [esi + 0x29b], dl
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xed0], eax
lea ebx, [ebp - 0xe68]
jmp 0x405751
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 2
jne 0x406d6e
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x301
mov dword [esp], edi
mov eax, dword [ebp - 0xea0]
call eax
mov esi, eax
cmp eax, 0xffffffff
jne 0x406cfc
jmp 0x406d6e
movzx ecx, ax
mov eax, dword [ebp - 0xe90]
mov edx, str.Wow64Install
call fcn.00403180
jmp 0x40706e
xor ecx, ecx
mov dword [esp], ecx
call dword [0x41859c]
push esi
lea edi, [ebp - 0x814]
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x818], 0x1c
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [0x41849c]
push edx
push edx
cmp eax, 0xffffffff
je 0x408309
mov esi, 0x40cbb4
mov edi, eax
mov dword [ebp - 0xea4], ebx
mov eax, dword [ebp - 0xe84]
mov ebx, dword [esi]
mov dword [esp + 8], 0x4136a8
mov dword [esp], edi
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
call dword [0x418498]
sub esp, 0x1c
test eax, eax
jne 0x407b46
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xe0000207
je 0x4076c1
test byte [0x409090], 2
jne 0x4083e0
add esi, 0xc
cmp esi, str.install_root_pnp_devices
jne 0x40766b
mov ebx, dword [ebp - 0xea4]
mov dword [esp], edi
call dword [0x4184a0]
push edi
lea eax, [ebp - 0xe74]
mov dword [esp + 4], 0x20008
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.advapi32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x4077c9
lea eax, [ebp - 0xe6c]
xor esi, esi
mov dword [ebp - 0xe6c], 0x50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50
mov eax, dword [ebp - 0xe88]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe74]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetTokenInformation]
mov eax, dword [ebp - 0xe74]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
push eax
lea eax, [ebp - 0xe70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_ConvertSidToStringSidW]
xor ecx, ecx
push edx
push edx
mov dword [esp + 0x1c], ebx
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
mov dword [esp], 0x80000002
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x40818d
mov eax, dword [ebp - 0xe70]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_LocalFree]
push edx
test byte [0x409090], 8
jne 0x407be9
mov ebx, dword [ebp - 0xe94]
test ebx, ebx
je 0x4077f6
mov dword [esp], ebx
mov eax, dword [ebp - 0xea0]
call eax
mov dword [esp], ebx
mov eax, dword [ebp - 0xec4]
call eax
mov eax, dword [ebp - 0xe90]
mov dword [esp], eax
mov eax, dword [ebp - 0xec4]
call eax
jmp 0x406469
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call dword [sym.imp.kernelbase.dll_MoveFileExW]
sub esp, 0xc
jmp 0x4062bb
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
lea edx, [esi + eax]
jmp 0x405cfe
cmp ax, 0xc
jne 0x4075b6
mov byte [esi + 0x291], 1
mov eax, dword [ebp - 0xe4c]
pxor xmm2, xmm2
lea ebx, [ebp - 0xe68]
movdqa xmm1, xmmword [0x40cd60]
mov byte [esi + 0x276], 1
movdqa xmm4, xmmword [0x40cd80]
mov byte [esi + 0x280], 1
movdqa xmm3, xmmword [0x40cd90]
mov byte [esi + 0x28b], 1
movdqa xmm5, xmmword [0x40cd70]
movd xmm6, eax
mov edx, eax
pshufd xmm0, xmm6, 0
shr edx, 2
pand xmm1, xmm0
pand xmm4, xmm0
pand xmm3, xmm0
pcmpeqd xmm1, xmm2
and edx, 1
pand xmm0, xmmword [0x40cda0]
pcmpeqd xmm0, xmm2
mov byte [esi + 0x293], dl
mov edx, eax
movdqa xmm6, xmmword [0x40cdb0]
pcmpeqd xmm4, xmm2
shr edx, 3
pcmpeqd xmm3, xmm2
pandn xmm1, xmm5
and edx, 1
movdqa xmm2, xmm0
mov byte [esi + 0x292], dl
movdqa xmm0, xmm1
mov edx, eax
pandn xmm4, xmm5
pandn xmm2, xmm5
shr eax, 0x15
shr edx, 4
pandn xmm3, xmm5
movdqa xmm1, xmm3
and eax, 1
movdqa xmm5, xmmword [0x40cdc0]
pshufb xmm1, xmm6
mov byte [esi + 0x2af], al
and edx, 1
xor eax, eax
pshufb xmm2, xmm5
por xmm1, xmm2
mov byte [esi + 0x296], dl
movdqa xmm2, xmmword [0x40cdd0]
pshufb xmm0, xmm6
pshufb xmm4, xmm5
por xmm0, xmm4
pand xmm0, xmm2
pand xmm2, xmm1
packuswb xmm0, xmm2
movups xmmword [esi + 0x29f], xmm0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc28]
mov dword [esp + 0x10], 0x20
mov dword [ebp - 0xed0], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], ebx
mov dword [esp], 0xb5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
sub esp, 0x18
test eax, eax
jne 0x405751
movzx ecx, word [0x40cde0]
xor eax, eax
jmp 0x4079b0
cmp dx, 0x1c4
jne 0x4079ad
mov word [esi + 0x286], cx
add eax, 1
movzx edx, word [ebp + eax*4 - 0xc28]
test dx, dx
je 0x405751
cmp dx, 0x14c
jne 0x40799f
mov byte [esi + 0x277], 1
mov byte [esi + 0x27a], 1
mov byte [esi + 0x27c], 1
mov byte [esi + 0x27e], 1
mov byte [esi + 0x281], 1
mov byte [esi + 0x294], 1
mov word [esi + 0x298], cx
mov byte [esi + 0x29a], 1
jmp 0x4079ad
test byte [0x409090], 2
je 0x404e6b
mov dword [esp + 0xc], str.cannot_map___wine_user_shared_data_n
mov dword [esp + 8], str.create_user_shared_data
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x404e6b
cmp word [esi + 2], 0x3f
jne 0x40780c
cmp word [esi + 4], 0x3f
jne 0x40780c
cmp word [esi + 6], 0x5c
jne 0x40780c
add esi, 8
jmp 0x40627a
cmp word [edx + 2], 0x3f
jne 0x406260
cmp word [edx + 4], 0x3f
jne 0x406260
cmp word [edx + 6], 0x5c
jne 0x406260
add edx, 8
jmp 0x406260
mov eax, dword [ebp - 0xc28]
mov ecx, ebx
mov edx, str.USERDOMAIN
call fcn.004025e0
mov ecx, dword [ebp - 0xe88]
mov edx, str.LOGONSERVER
mov dword [ebp - 0xa20], 0x5c005c
mov eax, dword [ebp - 0xc28]
call fcn.004025e0
jmp 0x40662a
mov ecx, dword [ebp - 0xe84]
mov edx, str.USERNAME
mov eax, dword [ebp - 0xc28]
call fcn.004025e0
jmp 0x4065ac
mov dword [esp + 0xc], str.Failed_to_start_reboot_n
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x406457
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_start_services.exe:_error__lu_n
mov dword [esp + 8], str.start_services_process
mov dword [esp + 4], 0x409090
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004027a0
jmp 0x4063a2
mov eax, dword [ebp - 0xea8]
jmp 0x405f79
mov eax, dword [esi + 4]
mov dword [ebp - 0xe98], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
add eax, 2
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [0x4184a4]
sub esp, 0x14
test eax, eax
jne 0x407cc9
test byte [0x409090], 2
je 0x4076c1
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, ebx
mov dword [ebp - 0xe98], edx
call fcn.004022e0
mov edx, dword [ebp - 0xe98]
mov dword [esp + 0xc], str.Failed_to_set_hardware_id_for__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.004027a0
jmp 0x4076c1
mov dword [esp], str.WINECONFIGDIR
mov eax, dword [ebp - 0xea8]
call eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov ebx, eax
mov dword [esp], 0x417020
call fcn.00401ec0
mov eax, ebx
sub esp, 0xc
jmp 0x407c1c
add eax, 2
cmp word [eax], 0
jne 0x407c19
sub eax, ebx
cmp eax, 0x206
jbe 0x407c43
xor eax, eax
movzx edx, word [eax + 0x40c96a]
add eax, 2
mov word [eax + 0x41721e], dx
test dx, dx
jne 0x407c2d
mov ebx, dword [sym.imp.ucrtbase.dll_wcsncmp]
mov dword [esp + 8], 9
mov dword [esp + 4], str.__unix_
mov dword [esp], 0x417020
call ebx
mov edx, eax
mov eax, 0x417032
test edx, edx
je 0x407d57
mov dword [esp + 8], 7
mov dword [esp + 4], str.__Z:_
mov dword [esp], 0x417020
call ebx
test eax, eax
je 0x408166
mov eax, 0x417028
call fcn.004024e0
mov dword [esp + 0xc], str.wine:_configuration_in__s_has_been_updated._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_wineprefix
mov dword [esp + 4], 0x409090
mov dword [esp], 3
call fcn.004027a0
jmp 0x4077d6
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], edi
mov dword [esp], 0x19
mov dword [esp + 8], eax
call dword [0x418494]
sub esp, 0xc
test eax, eax
jne 0x4081f6
test byte [0x409090], 2
je 0x4076c1
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, ebx
mov dword [ebp - 0xe98], edx
call fcn.004022e0
mov edx, dword [ebp - 0xe98]
mov dword [esp + 0xc], str.Failed_to_register_device__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.004027a0
jmp 0x4076c1
cmp dx, 0x5c
jne 0x407d54
mov word [eax], 0x2f
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x407d49
mov eax, 0x417032
jmp 0x407c97
mov eax, dword [ebp - 0xed0]
xor ecx, ecx
mov dword [ebp - 0xc28], 0x100
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp + 8], ecx
mov dword [esp + 4], str.ComputerName
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xe30]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x407dbd
xor edx, edx
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
cmp dword [ebp - 0xc28], 0
je 0x405d91
xor eax, eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.ActiveComputerName
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
jne 0x405d91
mov eax, dword [ebp - 0xc28]
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xe84]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xe30]
mov dword [esp + 8], edi
mov dword [esp + 4], str.ComputerName
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe54]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe54]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push eax
jmp 0x405d91
mov eax, edi
mov ecx, 0xff
mov edx, str.BiosMajorRelease
call fcn.004025a0
mov eax, edi
mov ecx, 0xff
mov edx, str.BiosMinorRelease
call fcn.004025a0
mov eax, edi
mov ecx, 0xff
mov edx, str.ECFirmwareMajorVersion
call fcn.004025a0
mov ecx, 0xff
mov edx, str.ECFirmwareMinorVersion
mov eax, edi
call fcn.004025a0
jmp 0x4072d3
mov esi, dword [ebp - 0xebc]
mov dword [esp + 4], edi
xor ecx, ecx
mov edx, str.SystemSKU
mov dword [esp + 8], esi
mov eax, dword [ebp - 0xeb8]
mov dword [esp], eax
mov eax, dword [ebp - 0xea0]
call fcn.00402640
mov dword [esp + 8], esi
mov edx, str.SystemFamily
mov dword [esp + 4], edi
mov ecx, dword [ebp - 0xeb8]
mov dword [esp], ecx
mov eax, dword [ebp - 0xea0]
xor ecx, ecx
call fcn.00402640
jmp 0x4073f8
test byte [0x409090], 2
je 0x406f83
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
mov eax, dword [ebp - 0xe90]
call fcn.004024e0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_open__s__error__lu_n
mov dword [esp + 8], str.update_wineprefix
mov dword [esp + 4], 0x409090
mov dword [esp], 1
call fcn.004027a0
jmp 0x406f83
mov dword [esp + 0x10], str.WINEDLLOVERRIDESshdocvwb_iexplore.exeb_advpackb_atlb_oleaut32b_rpcrt4b
mov dword [esp + 0xc], str.for_rundll32:__s_n
mov dword [esp + 8], str.setup_dll_overrides
mov dword [esp + 4], 0x409090
mov dword [esp], 3
call fcn.004027a0
jmp 0x406ebc
mov dword [ebp - 0xea0], ebx
mov ebx, edi
mov dword [esp + 4], str.PendingFileRenameOperations
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
push ecx
push ecx
mov edx, dword [ebp - 0xea0]
jmp 0x405ea1
call dword [sym.imp.ucrtbase.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strerror]
mov ebx, eax
mov eax, dword [ebp - 0xe90]
call fcn.004024e0
mov esi, eax
mov eax, dword [ebp - 0xe94]
call fcn.004024e0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.wine:_failed_to_update__s_with__s:__s_n
call fcn.004026f0
jmp 0x4077f6
mov eax, dword [ebp - 0xe94]
call fcn.004024e0
mov dword [esp], str.wine:_failed_to_update__s__wine.inf_not_found_n
mov dword [esp + 4], eax
call fcn.004026f0
jmp 0x406469
mov dword [esp], str.WINEDATADIR
mov eax, dword [ebp - 0xea8]
call eax
mov edi, eax
test eax, eax
je 0x408010
mov esi, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp], eax
call esi
add eax, 0xa
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0xec8]
call eax
mov dword [ebp - 0xe90], eax
test eax, eax
je 0x408010
xor eax, eax
movzx edx, word [edi + eax]
mov ecx, dword [ebp - 0xe90]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x40806c
jmp 0x406b89
lea eax, [ebp - 0xe30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa20]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_GetExitCodeProcess]
push ecx
push ecx
test byte [0x409090], 2
je 0x4069e8
mov eax, dword [ebp - 0xe30]
mov dword [esp + 0xc], str.Unexpected_termination_of_services.exe___exit_code__ld_n
mov dword [esp + 8], str.start_services_process
mov dword [esp + 4], 0x409090
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004027a0
jmp 0x4069e8
mov dword [esp], edx
call dword [sym.imp.kernelbase.dll_DeleteFileW]
push eax
jmp 0x4062bb
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov dword [ebp - 0xe8c], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xec4], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0xeb4], eax
jmp 0x405ba7
mov eax, edi
call fcn.004024e0
mov dword [esp + 0xc], str.failed_to_update_timestamp_in__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_timestamp
mov dword [esp + 4], 0x409090
mov dword [esp], 2
call fcn.004027a0
jmp 0x406d54
mov dword [esp], esi
mov eax, dword [ebp - 0xeac]
call eax
mov dword [esp], edi
mov eax, dword [ebp - 0xec4]
call eax
jmp 0x406d86
mov eax, 0x41702c
jmp 0x40817b
cmp dx, 0x5c
jne 0x408178
mov word [eax], 0x2f
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x40816d
mov eax, 0x41702c
jmp 0x407c97
xor eax, eax
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xe5c]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xe8c]
call eax
sub esp, 0x24
test eax, eax
je 0x408280
mov eax, dword [ebp - 0xe68]
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push ecx
jmp 0x4077b9
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe98]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call fcn.00403ad8
sub esp, 0x14
test eax, eax
jne 0x4076c1
test byte [0x409090], 2
je 0x4076c1
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, ebx
mov dword [ebp - 0xe98], edx
call fcn.004022e0
mov edx, dword [ebp - 0xe98]
mov dword [esp + 0xc], str.Failed_to_install_drivers_for__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.004027a0
jmp 0x4076c1
xor edi, edi
mov dword [ebp - 0xe54], edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x28
mov eax, dword [ebp - 0xe84]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [0x4184c8]
sub esp, 0x10
test eax, eax
jne 0x408427
lea eax, [ebp - 0xe54]
xor ebx, ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Flags
mov eax, dword [ebp - 0xe5c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xe5c]
sub esp, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0xeb4]
call eax
push esi
jmp 0x4081df
test byte [0x409090], 2
je 0x4076dc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_create_device_info_list__error__lx._n
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x409090
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004027a0
jmp 0x4076dc
test byte [0x409090], 8
jne 0x4083a8
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_WaitForSingleObject]
lea eax, [ebp - 0xe30]
push esi
push esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_GetExitCodeProcess]
push edi
push edi
mov eax, dword [ebp - 0xe30]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_ExitProcess]
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0xec4], eax
jmp 0x405b84
mov eax, dword [ebp - 0xe84]
call fcn.004024e0
mov dword [esp + 0xc], str.restarting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.main
mov dword [esp + 4], 0x409090
mov dword [esp], 3
call fcn.004027a0
jmp 0x408355
mov edx, dword [eax + 0x34]
mov eax, ebx
mov dword [ebp - 0xe98], edx
call fcn.004022e0
mov edx, dword [ebp - 0xe98]
mov dword [esp + 0xc], str.Failed_to_create_device__s__error__lx._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.install_root_pnp_devices
mov dword [esp + 4], 0x409090
mov dword [esp + 0x14], edx
mov dword [esp], 1
call fcn.004027a0
jmp 0x4076c1
mov ecx, dword [ebp - 0xe84]
mov edx, str.ProfileImagePath
mov eax, dword [ebp - 0xe5c]
call fcn.004025e0
jmp 0x4082b8