Function at 0x407320
Capabilities:
Acquire debug privileges
Get keyboard layout

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
mov edi, 1
push ebp
mov dword [esi + 0x34], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
mov ecx, esi
mov dword [0x6f175c], eax
call fcn.00406630
test eax, eax
jne 0x407353
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
push ebp
push section..taihang
call fcn.00472d60
mov eax, dword [0x6d0094]
add esp, 8
cmp eax, ebp
mov dword [0x6030f0], eax
je 0x407398
xor eax, eax
push ebp
mov dword [esp + 0x1c], eax
push edi
lea ecx, [esp + 0x1c]
push edi
mov dword [esp + 0x28], eax
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6f1760], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push 0x50f9cc
push eax
mov dword [esp + 0x1c], ebp
call fcn.00438c30
mov dword [0x6030f4], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebp
jne 0x4073cc
mov ecx, dword [0x6d008c]
mov dword [0x6030f4], ecx
mov ecx, esi
call fcn.00407220
call fcn.00447280
push edi
call fcn.00415700
push 0x6f1544
push 0x50f9bc
push str.Main
call fcn.00408870
push 0x103
push 0x6f1548
push str.Skin
push str.Path
call fcn.004087b0
mov edx, dword [0x6d00d0]
mov eax, dword [0x6069dc]
push str.TheWorld_Default
push edx
push 0x34
push 0x33
push eax
push 0x64
push 0x66
call fcn.00498370
add esp, 0x3c
push 0x16
push str.FavoriteCY
push str.ToolBar
call fcn.004a9990
mov ecx, eax
call fcn.004aa480
lea ecx, [esp + 0xc]
mov dword [0x6f1520], eax
push ecx
push 0x28
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4074a2
lea edx, [esp + 0x24]
push edx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
push ebp
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebp
push 0x1f0fff
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x10], eax
call fcn.00431570
mov edi, eax
call fcn.00472920
mov ebx, eax
call fcn.00469c90
mov ecx, eax
call fcn.00469ce0
call fcn.0041d460
mov ecx, eax
call fcn.0041d720
mov ecx, esi
call fcn.00408330
mov ecx, 0x603870
call fcn.0048b390
cmp edi, ebp
je 0x40750b
mov eax, dword [esp + 0x38]
mov ecx, esi
push eax
call fcn.004075a0
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
call fcn.00411890
cmp eax, ebp
je 0x40751c
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
cmp ebx, ebp
je 0x407528
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ecx, 0x606b00
call fcn.004a1ac0
call fcn.004983c0
call fcn.004731d0
push ebp
call fcn.00415700
add esp, 4
mov ecx, esi
push ebp
call fcn.00406630
mov eax, dword [esi + 0xc]
pop ebx
cmp eax, ebp
je 0x407563
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov dword [esi + 0xc], ebp
jmp 0x407569
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x10]
cmp esi, ebp
je 0x407573
push esi
call edi
mov eax, dword [0x6f1760]
mov dword [0x6f1760], ebp
cmp eax, ebp
je 0x407585
push eax
call edi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 4