Function at 0x40341a
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x407010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x83c], ebx
call fcn.004052d0
cmp dword [ebp + 8], 8
jge 0x403456
push 0x401260
jmp 0x403853
xor eax, eax
inc eax
mov ecx, dword [edi + eax*4]
test ecx, ecx
je 0x40384e
cmp word [ecx], bx
je 0x40384e
inc eax
cmp eax, 8
jl 0x403459
mov esi, 0x20a
lea eax, [ebp - 0x41c]
push esi
push ebx
push eax
call sub.MSVCR120_CLR0400.dll_memset
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCR120_CLR0400.dll_memset
push esi
lea eax, [ebp - 0x628]
push ebx
push eax
call sub.MSVCR120_CLR0400.dll_memset
push esi
lea eax, [ebp - 0x834]
push ebx
push eax
call sub.MSVCR120_CLR0400.dll_memset
mov eax, dword [edi + 0x18]
add esp, 0x30
cmp word [eax], 0x30
je 0x403507
push 0xa
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x83c], ebx
push ecx
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll_wcstoul]
add esp, 0xc
test eax, eax
je 0x403507
cmp eax, 0xffffffff
je 0x403507
push 0xa
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x83c], ebx
push eax
push dword [edi + 0x18]
call dword [sym.imp.MSVCR120_CLR0400.dll_wcstoul]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 5
pop ebx
push 0
push 0
mov dword [0x407084], 1
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
je 0x403583
push 0
call sub.webengine4.dll_InitializeLibrary
mov edi, dword [ebp - 0x838]
mov eax, dword [0x407090]
test eax, eax
je 0x403541
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x407094]
test eax, eax
je 0x403551
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00401b6d
push esi
call fcn.00402b85
cmp edi, 1
jne 0x403567
call sub.webengine4.dll_UnInitializeManagedCode
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
je 0x40384a
push esi
push ebx
call fcn.00403392
mov eax, esi
jmp 0x40385d
push 6
pop ebx
xor esi, esi
lea eax, [ebp - 0x83c]
push esi
push 0x40
push esi
push 0xa
push eax
push dword [edi + 0x14]
mov dword [ebp - 0x83c], esi
call dword [sym.imp.MSVCR120_CLR0400.dll_wcstoul]
add esp, 0xc
push eax
push 0xa
lea eax, [ebp - 0x83c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.MSVCR120_CLR0400.dll_wcstoul]
add esp, 0xc
push eax
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jne 0x403524
push 7
pop ebx
push eax
call sub.webengine4.dll_InitializeLibrary
mov esi, eax
test esi, esi
jne 0x40352b
call fcn.004032da
call sub.webengine4.dll_PerfCounterInitialize
call sub.webengine4.dll_EtwTraceAspNetRegister
push dword [edi + 8]
lea eax, [ebp - 0x210]
xor ebx, ebx
push dword [edi + 4]
inc ebx
push 0x4012e0
push dword [edi + 0x1c]
push 0x4012f8
push 0x104
push eax
call fcn.004032f0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x40352b
lea eax, [ebp - 0x210]
push eax
push esi
push 0x100003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x407094], eax
test eax, eax
jne 0x403651
call fcn.00404f2a
mov esi, eax
jmp 0x40352b
push dword [edi + 8]
lea eax, [ebp - 0x41c]
push dword [edi + 4]
push 0x4012e0
push dword [edi + 0x1c]
push 0x401330
push 0x104
push eax
call fcn.004032f0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x40352b
lea eax, [ebp - 0x41c]
push eax
push esi
push 0x100003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x407090], eax
test eax, eax
je 0x403645
push 2
pop ebx
push dword [edi + 8]
lea eax, [ebp - 0x628]
push dword [edi + 4]
push 0x4012e0
push dword [edi + 0x1c]
push 0x401370
push 0x104
push eax
call fcn.004032f0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x40352b
lea eax, [ebp - 0x628]
push eax
call fcn.00401e24
mov esi, eax
test esi, esi
jne 0x40352b
push 3
pop ebx
push dword [edi + 8]
lea eax, [ebp - 0x834]
push dword [edi + 4]
push 0x4012e0
push dword [edi + 0x1c]
push 0x4013c0
push 0x104
push eax
call fcn.004032f0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x40352b
push dword [edi + 0xc]
call dword [sym.imp.MSVCR120_CLR0400.dll__wtoi]
pop ecx
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.00402f1b
mov esi, eax
test esi, esi
jne 0x40352b
push 4
pop ebx
call sub.webengine4.dll_InitializeManagedCode
mov esi, eax
test esi, esi
jne 0x40352b
push 8
pop ebx
push eax
xor edi, edi
push eax
inc edi
push 0x4031e0
mov dword [ebp - 0x838], edi
call dword [sym.imp.MSVCR120_CLR0400.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40377c
call fcn.00404f2a
mov esi, eax
jmp 0x403531
push dword [0x407094]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x4070a0
call fcn.004038b9
xor edi, edi
cmp dword [0x407078], ebx
jne 0x4037d6
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x407078]
test eax, eax
jne 0x4037d1
cmp edi, 9
jle 0x4037d1
xor edi, edi
call fcn.00403355
mov eax, dword [0x407078]
test eax, eax
jne 0x4037d1
call fcn.004031a4
mov eax, dword [0x407078]
inc edi
test eax, eax
je 0x40379e
mov eax, dword [0x40708c]
xor edi, edi
mov dword [0x407088], edi
test eax, eax
je 0x4037ec
push 4
mov esi, eax
pop ebx
push esi
call fcn.00401b6d
push edi
push edi
push 0x403220
call dword [sym.imp.MSVCR120_CLR0400.dll__beginthread]
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, edi
cmp dword [0x407088], edi
jne 0x403825
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x12c
jl 0x40380c
call sub.webengine4.dll_ReleaseWmiEventManager
call sub.webengine4.dll_EtwTraceAspNetUnregister
mov esi, edi
call fcn.0040540b
cmp dword [0x407088], esi
jne 0x40352b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
jmp 0x40385d
push 0x4012c8
call dword [sym.imp.MSVCR120_CLR0400.dll_printf]
xor eax, eax
inc eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046d0
mov esp, ebp
pop ebp
ret