Function at 0x40d9b0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4901d1
mov eax, dword fs:[0]
push eax
sub esp, 0x7f4
mov eax, dword [0x4be4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x7c4], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x7dc]
push eax
call fcn.0040a5a0
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0xac]
add esp, 4
push eax
call fcn.004089d0
push 0xf
xor eax, eax
mov dword [ebp - 4], 0
push str.kprometheus.dll
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00402680
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.00408a00
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x40da8a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40da80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40da80
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp dword [ebp - 0x60], eax
jne 0x40daab
or ebx, 0xffffffff
jmp 0x40e8a4
call fcn.00481580
test al, al
je 0x40dab9
call fcn.00480e90
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x28]
push eax
call fcn.004088b0
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push eax
call fcn.00452070
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x40db16
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40db0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40db0c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x49c45c
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
xor ebx, ebx
mov byte [ebp - 0x7bd], 1
call fcn.0040a610
test eax, eax
jne 0x40db53
mov dword [ebp - 0x7cc], 2
jmp 0x40dbe4
push 0x49b988
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40db70
mov dword [ebp - 0x7cc], 3
jmp 0x40dbe4
push 0x49c464
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40db8d
mov dword [ebp - 0x7cc], 4
jmp 0x40dbe4
push 0x49c46c
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40dbaa
mov dword [ebp - 0x7cc], 5
jmp 0x40dbe4
push str.flow
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40dbc7
mov dword [ebp - 0x7cc], 6
jmp 0x40dbe4
push str.mind
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
mov ecx, 7
cmove ebx, ecx
mov dword [ebp - 0x7cc], ebx
push 0
call fcn.004813f0
movzx ecx, byte [ebp - 0x7bd]
xor edx, edx
test al, al
cmovne ecx, edx
xor esi, esi
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x7f4], esi
mov byte [ebp - 0x7bd], dl
mov dword [ebp - 0x800], esi
mov dword [ebp - 0x7fc], esi
push 0x360
mov byte [ebp - 4], 8
call fcn.0048c917
add esp, 8
mov dword [ebp - 0x7d0], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x40dc43
mov ecx, eax
call fcn.004096b0
mov edi, eax
jmp 0x40dc45
xor edi, edi
mov dword [ebp - 0x7d0], edi
push 0x10
mov byte [ebp - 4], 0xa
call fcn.0048c917
mov ebx, eax
mov dword [ebp - 0x7e0], eax
add esp, 4
test ebx, ebx
je 0x40dc7e
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_struct_KPromeHostStartupInfo_.0
mov dword [ebx + 0xc], edi
jmp 0x40dc86
xor ebx, ebx
mov dword [ebp - 0x7e0], ebx
mov ecx, dword [ebp - 0x7c4]
mov byte [ebp - 4], 8
mov dword [ebp - 0x800], edi
mov dword [ebp - 0x7fc], ebx
call fcn.0040ca90
mov dword [edi + 0x35c], eax
mov eax, dword [ebp - 0x7dc]
mov dword [edi + 0x310], eax
mov eax, dword [ebp - 0x7d8]
mov dword [edi + 0x314], eax
mov byte [edi], 0
push 0
mov dword [edi + 8], 0
call fcn.00481220
add esp, 4
test al, al
je 0x40ddff
push 0x49c45c
lea ecx, [ebp - 0x58]
mov byte [edi], 1
call fcn.0040a610
test eax, eax
jne 0x40dd0a
push 0x1b
lea ecx, [edi + 0x2c]
push str.wpsoffice_wps_starup_object
call fcn.00402680
mov dword [edi + 8], 1
jmp 0x40de0e
push 0x49c464
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40dd36
push 0x1b
lea ecx, [edi + 0x2c]
push str.wpsoffice_wpp_starup_object
call fcn.00402680
mov dword [edi + 8], 3
jmp 0x40de0e
push 0x49b988
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40dd60
push str.wpsoffice_et_starup_object
lea ecx, [edi + 0x2c]
call fcn.00409d80
mov dword [edi + 8], 2
jmp 0x40de0e
push 0x49c46c
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40dd8a
push str.wpsoffice_pdf_starup_object
lea ecx, [edi + 0x2c]
call fcn.00409d80
mov dword [edi + 8], 4
jmp 0x40de0e
push 0x49c63c
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40ddb1
push str.wpsoffice_ofd_starup_object
lea ecx, [edi + 0x2c]
call fcn.00409d80
mov dword [edi + 8], 5
jmp 0x40de0e
push str.flow
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40ddd8
push str.wpsoffice_flow_starup_object
lea ecx, [edi + 0x2c]
call fcn.00409d80
mov dword [edi + 8], 6
jmp 0x40de0e
push str.mind
lea ecx, [ebp - 0x58]
call fcn.0040a610
test eax, eax
jne 0x40de0e
push str.wpsoffice_mind_starup_object
lea ecx, [edi + 0x2c]
call fcn.00409d80
mov dword [edi + 8], 7
jmp 0x40de0e
push 0x17
lea ecx, [edi + 0x2c]
push str.wpsoffice_starup_object
call fcn.00402680
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4c6ea0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4c27fc]
cmp eax, dword [ecx + 4]
jg 0x40e90b
cmp byte [0x4c27f8], 0
je 0x40de46
push 4
lea ecx, [edi + 0x2c]
push str._uwp
call fcn.00402410
lea eax, [ebp - 0x7f0]
push eax
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [eax + 4]
call fcn.004089c0
mov ecx, eax
call fcn.004441b0
mov ecx, eax
call fcn.00446840
push edi
push eax
mov byte [ebp - 4], 0xc
call fcn.0041fc30
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7f0]
call fcn.00407f50
cmp dword [edi + 0x1f4], 4
jne 0x40e111
cmp byte [edi + 1], 0
je 0x40e111
lea eax, [ebp - 0x7f0]
push eax
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [eax + 4]
call fcn.004089c0
mov ecx, eax
call fcn.004441b0
mov ecx, eax
call fcn.00446840
mov ebx, dword [ebp - 0x7f0]
mov byte [ebp - 4], 0xd
cmp ebx, dword [ebp - 0x7ec]
je 0x40df26
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x40dedc
mov eax, dword [ebx]
cmp dword [ebx + 0x10], 7
jne 0x40df0d
mov ecx, str._noltip
mov edx, 7
sub eax, ecx
mov dword [ebp - 0x7d0], eax
mov ax, word [ecx + eax]
cmp ax, word [ecx]
jne 0x40df0d
add ecx, 2
sub edx, 1
je 0x40df1a
mov eax, dword [ebp - 0x7d0]
jmp 0x40def4
add ebx, 0x18
cmp ebx, dword [ebp - 0x7ec]
jne 0x40ded2
jmp 0x40df26
cmp ebx, dword [ebp - 0x7ec]
jne 0x40e08b
call fcn.0040c770
test al, al
je 0x40e08b
cmp dword [edi + 0x10], 1
jne 0x40e08b
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
add eax, 8
push eax
call fcn.004016c0
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 0xe
je 0x40dffe
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40dffe
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
test ecx, ecx
je 0x40dffe
mov eax, edx
lea ebx, [ebx]
cmp word [eax], 0x3a
je 0x40dfa0
add eax, 2
sub ecx, 1
jne 0x40df90
jmp 0x40dffe
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x40dffe
push 0xffffffffffffffff
dec eax
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00407090
push eax
lea ecx, [ebp - 0x28]
call fcn.004037e0
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x40dffe
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40dff4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40dff4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str..pdf
call fcn.0040f260
add esp, 8
test eax, eax
jne 0x40e01f
xor ebx, ebx
jmp 0x40e02b
jle 0x40e028
mov ebx, 1
jmp 0x40e02b
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40e067
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e05d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e05d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x7f0]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00407f50
jmp 0x40e81a
push str._noltip
lea ecx, [ebp - 0x40]
call fcn.004036f0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xf
push eax
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [eax + 4]
call fcn.004089c0
mov ecx, eax
call fcn.004441b0
mov ecx, eax
call fcn.004482f0
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x40e0fc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e0f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e0f2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
lea ecx, [ebp - 0x7f0]
mov byte [ebp - 4], 8
call fcn.00407f50
mov ebx, dword [ebp - 0x7e0]
push 9
push 0x49c740
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00402590
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x10
push eax
call fcn.00414410
mov edx, dword [ebp - 0x14]
add esp, 4
mov byte [ebp - 4], 8
cmp edx, 0x10
jb 0x40e17c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e172
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e172
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
cmp byte [ebp - 0x7e4], 0
je 0x40e20d
push edi
call fcn.004225c0
push ecx
mov dword [ebp - 0x7d0], esp
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test ebx, ebx
je 0x40e1ad
lock inc dword [ebx + 4]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x7c4]
mov byte [ebp - 4], 0x11
mov ecx, dword [eax + 4]
call fcn.004088a0
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.004257d0
push 0xa8
call fcn.0048c917
add esp, 4
mov dword [ebp - 0x7d0], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x40e1fa
push edi
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0042e190
mov esi, eax
jmp 0x40e1fc
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], 8
mov dword [ebp - 0x7f4], esi
call fcn.004338e0
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov ebx, dword [ebp - 0x7e4]
mov byte [ebp - 4], 0x13
test bl, bl
jne 0x40e2ad
mov eax, dword [edi + 8]
dec eax
cmp eax, 4
ja case.default.0x40e238
jmp dword [eax*4 + 0x40e988]
push 0x49c464
lea ecx, [ebp - 0x40]
call fcn.00409d80
jmp 0x40e6e7
push 0x49c45c
lea ecx, [ebp - 0x40]
call fcn.00409d80
jmp 0x40e6e7
push 0x49b988
lea ecx, [ebp - 0x40]
call fcn.00409d80
jmp 0x40e6e7
push 0x49c46c
lea ecx, [ebp - 0x40]
call fcn.00409d80
jmp 0x40e6e7
push 0x49c63c
lea ecx, [ebp - 0x40]
call fcn.00409d80
jmp 0x40e6e7
push 3
push 0x49c45c
lea ecx, [ebp - 0x40]
call fcn.00402680
jmp 0x40e6e7
cmp dword [ebp - 0x7cc], 0
jne 0x40e2bd
mov esi, str.prometheus
jmp 0x40e2c8
cmp dword [ebp - 0x44], 8
lea esi, [ebp - 0x58]
cmovae esi, dword [ebp - 0x58]
lea eax, [edi + 0x32a]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push esi
cmovae eax, dword [ebp - 0xac]
lea ecx, [ebp - 0x7bc]
push 0
push str.SoftwareKingsoftOffice6.0CommonResourceManager
push eax
call fcn.0042a9b0
xor eax, eax
mov byte [ebp - 4], 0x14
cmp byte [0x4c47cc], al
mov dword [ebp - 0x7dc], eax
mov word [ebp - 0x7d8], ax
mov eax, 1
je 0x40e346
mov word [ebp - 0x7dc], ax
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x7da]
push eax
push 0x49b844
push str.PrometheusPreReadImage
push 1
call fcn.004425a0
add esp, 0x14
lea eax, [ebp - 0x7d4]
mov byte [ebp - 4], 0x15
push eax
call fcn.0040cb60
add esp, 4
lea ecx, [ebp - 0x7bc]
call fcn.0042c700
mov bl, al
lea eax, [ebp - 0x7ec]
push eax
mov byte [ebp - 0x7be], bl
call fcn.0040cb60
add esp, 4
mov edx, dword [eax]
sub edx, dword [ebp - 0x7d4]
mov ecx, dword [eax + 4]
sbb ecx, dword [ebp - 0x7d0]
push 0
push 0xf4240
push ecx
push edx
call fcn.0048ce00
mov dword [edi + 0x318], eax
mov dword [edi + 0x31c], edx
cmp byte [0x4c47cc], 0
mov byte [ebp - 4], 0x16
je 0x40e3cd
push dword [ebp - 0x7d8]
push dword [ebp - 0x7da]
push dword [ebp - 0x7dc]
call fcn.00442600
add esp, 0xc
push 0x4c26e0
push 0x4c26e8
push 0x410ce0
push 0x49b6fc
call fcn.00410d50
cmp dword [0x4c270c], 0
je 0x40e408
push 0x49b740
push dword [0x4c26e4]
push dword [0x4c26e0]
call fcn.00410d90
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
cmp dword [edi + 0x10], 1
mov byte [ebp - 4], 0x17
jne 0x40e5b1
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [eax + 4]
call fcn.004089a0
push eax
lea ecx, [ebp - 0x28]
call fcn.004037e0
mov edx, dword [ebp - 0xb0]
cmp edx, 8
jb 0x40e488
mov ecx, dword [ebp - 0xc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e47e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e47e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
mov esi, dword [ebp - 0x18]
cmp esi, 2
jbe 0x40e51e
test esi, esi
je 0x40e981
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ebx, 8
cmovae eax, edx
cmp word [eax], 0x22
jne 0x40e518
lea ecx, [esi - 1]
cmp esi, ecx
jbe 0x40e981
cmp ebx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + ecx*2], 0x22
jne 0x40e518
cmp esi, 1
lea ecx, [ebp - 0x28]
mov eax, 1
cmovb eax, esi
cmp ebx, 8
mov dword [ebp - 0x7d0], eax
cmovae ecx, edx
sub esi, eax
mov dword [ebp - 0x18], esi
lea eax, [esi*2 + 2]
push eax
mov eax, dword [ebp - 0x7d0]
lea eax, [ecx + eax*2]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
add esp, 0xc
dec eax
push 1
push eax
call fcn.00404dc0
mov esi, dword [ebp - 0x18]
mov bl, byte [ebp - 0x7be]
cmp esi, 3
jb 0x40e5af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + 2], 0x3a
jne 0x40e5af
call fcn.0040a6d0
test al, al
je 0x40e5af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e5af
xor eax, eax
lea ecx, [ebp - 0x94]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov esi, dword [ebp - 0x74]
xor eax, eax
cmp esi, 0xa00000
cmova esi, eax
jmp 0x40e5b1
xor esi, esi
test bl, bl
jne 0x40e5bd
test esi, esi
je 0x40e678
push 0x20
call fcn.0048c917
mov ebx, eax
add esp, 4
mov dword [ebp - 0x7d8], ebx
test ebx, ebx
je 0x40e632
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 7
mov word [ebx + 4], dx
mov eax, dword [ebp - 0x7cc]
mov byte [ebp - 4], 0x19
mov dword [ebx], eax
test ecx, ecx
je 0x40e62d
mov edx, ecx
lea eax, [edx + 2]
mov dword [ebp - 0x7d0], eax
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40e610
sub edx, dword [ebp - 0x7d0]
sar edx, 1
push edx
push ecx
lea ecx, [ebx + 4]
call fcn.00402680
mov dword [ebx + 0x1c], esi
jmp 0x40e634
xor ebx, ebx
mov esi, dword [ebp - 0x7c4]
cmp byte [esi + 0x14], 0
jne 0x40e671
cmp dword [esi + 0xc], 0xffffffff
jne 0x40e671
lea eax, [esi + 0x10]
push eax
push 0
push ebx
push 0x40a140
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
mov byte [esi + 0x14], 1
setne byte [ebp - 0x7bd]
jmp 0x40e678
mov byte [ebp - 0x7bd], 0
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x14
cmp ebx, 8
jb 0x40e6b8
mov edx, dword [ebp - 0x28]
lea ebx, [ebx*2 + 2]
mov eax, edx
cmp ebx, 0x1000
jb 0x40e6ae
mov edx, dword [edx - 4]
add ebx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e6ae
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebx
push edx
call fcn.0048c947
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x7bc]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x13
call fcn.0042ac50
mov esi, dword [ebp - 0x7f4]
mov ebx, dword [ebp - 0x7e4]
cmp byte [edi + 1], 0
je 0x40e706
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [eax + 4]
call fcn.004088a0
mov ecx, eax
call fcn.00425460
mov edx, dword [ebp - 0x2c]
test bl, bl
jne 0x40e747
cmp edx, 8
jb 0x40e740
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e736
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e774
push edx
push ecx
call fcn.0048c947
add esp, 8
xor ebx, ebx
jmp 0x40e81a
mov byte [ebp - 4], 8
cmp edx, 8
jb 0x40e784
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e77a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e77a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
lea ecx, [ebp - 0x7c5]
call fcn.0043bf00
lea ecx, [ebp - 0x7c5]
call fcn.00426420
lea eax, [edi + 0x33a]
or ebx, 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x7c4]
mov dword [ecx + 8], eax
lea eax, [edi + 0x34a]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, dword [ebp - 0x7c4]
mov eax, dword [edi + 8]
test eax, eax
je 0x40e809
push str.xmain
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e800
push esi
push dword [ebp - 0x7f8]
push dword [ebp + 8]
call eax
add esp, 0xc
mov ebx, eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x7bd], 0
je 0x40e81a
lea ecx, [edi + 0xc]
call fcn.0040ca50
mov ecx, dword [ebp - 0x7e0]
test ecx, ecx
je 0x40e847
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x40e847
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x7e0]
lock xadd dword [ecx + 8], edi
dec edi
jne 0x40e847
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x40e854
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x1c]
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x40e890
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e886
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e886
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c947
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x40e8b9
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.0040a690
mov ecx, dword [ebp - 0x98]
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp ecx, 8
jb 0x40e8eb
inc ecx
push ecx
push dword [ebp - 0xac]
lea ecx, [ebp - 0xac]
call fcn.0040a690
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048cbb4
mov esp, ebp
pop ebp
ret 8
push 0x4c27fc
call fcn.0048cd1b
add esp, 4
cmp dword [0x4c27fc], 0xffffffff
jne 0x40de2e
push str.GetCurrentPackageFamilyName
push str.kernel32
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e962
push 0
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 0x7d0], 0
push ecx
call eax
cmp eax, 0x7a
jne 0x40e962
mov al, 1
jmp 0x40e966
xor al, al
jmp 0x40e966
push 0x4c27fc
mov byte [0x4c27f8], al
mov byte [ebp - 4], 8
call fcn.0048ccd1
add esp, 4
jmp 0x40de2e
call fcn.004049d0
mov edi, edi
push ecx
loop 4254155
add byte [ebx - 0x1e], ah
inc eax
add byte [edi], bh
loop 0x40e9d3
add byte [ebp - 0x1e], dh
inc eax
add byte [edi - 0x33ffbf1e], al
int3
add byte [eax], al
add byte [ebx + 0x6c9d89d9], cl
invalid