Function at 0x40df60
Capabilities:
Get file version info
Impersonate file version information
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x44ef1f
mov eax, dword fs:[0]
push eax
sub esp, 0x8c0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x8b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x8d4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8e4]
mov dword [esp + 0x24], eax
xor ebx, ebx
mov dword [esp + 0x8dc], ebx
lea eax, [esp + 0x17]
mov dword [esp + 0x54], ebx
mov byte [esp + 0x17], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dfc0
sub eax, edx
mov eax, ebx
setne al
sub eax, 1
jne 0x40dfdd
call fcn.00401350
call fcn.0041a8f0
cmp dword [esp + 0x904], 0x10
mov eax, dword [esp + 0x8f0]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x18], ebx
jae 0x40dffd
lea eax, [esp + 0x8f0]
lea ecx, [esp + 0x54]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
mov dword [esp + 0x50], edi
cmp edi, ebx
je 0x40f0f0
push edi
call fcn.00438c49
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
add esp, 4
mov ebp, eax
push 4
mov dword [esp + 0x24], ebp
call esi
lea edx, [esp + 0x1c]
cmp eax, edx
jle 0x40e043
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
jmp 0x40e04f
push 0xe
call esi
lea ecx, [esp + 0x1c]
cmp eax, ecx
jle 0x40e059
call fcn.00431240
call fcn.00406ed0
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jg 0x40e07e
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x40e083
call fcn.00419d50
cmp dword [esp + 0x904], 0x10
mov eax, dword [esp + 0x8f0]
jae 0x40e09b
lea eax, [esp + 0x8f0]
push ebp
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, ebx
je 0x40f068
call fcn.004065e0
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x904], ebx
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, 0x10
jb 0x40e0eb
mov ecx, dword [edi]
jmp 0x40e0ed
mov ecx, edi
cmp ecx, 0x455518
ja 0x40e128
cmp eax, 0x10
jb 0x40e0fe
mov ecx, dword [edi]
jmp 0x40e100
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455518
jbe 0x40e128
cmp eax, 0x10
jb 0x40e114
mov edi, dword [edi]
push 0x1a
mov eax, 0x455518
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e16b
cmp eax, 0x1a
jae 0x40e13a
mov ecx, dword [esi + 0x14]
push ecx
push 0x1a
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e146
mov eax, dword [edi]
jmp 0x40e148
mov eax, edi
push 0x1a
push 0x455518
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x1a
jb 0x40e168
mov edi, dword [edi]
mov byte [edi + 0x1a], bl
lea ecx, [esp + 0x80]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8e8], 3
call fcn.00401f50
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x40e195
mov eax, dword [eax + 4]
jmp 0x40e198
add eax, 4
mov edx, dword [esp + 0x28]
push eax
push edx
call sub.VERSION.dll_VerQueryValueW
mov edi, eax
cmp dword [esp + 0x40], esi
jb 0x40e1b8
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439c49
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x58]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
mov byte [esp + 0x8dc], bl
call fcn.004037a0
cmp edi, ebx
je 0x40f068
push 0x7fe
lea eax, [esp + 0xd2]
xor edx, edx
push ebx
push eax
mov word [esp + 0xd8], dx
call fcn.00440440
mov eax, dword [esp + 0x54]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
add esp, 0xc
push ecx
push edx
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, 0x10
jb 0x40e239
mov ecx, dword [edi]
jmp 0x40e23b
mov ecx, edi
cmp ecx, str.Stri2
ja 0x40e276
cmp eax, 0x10
jb 0x40e24c
mov ecx, dword [edi]
jmp 0x40e24e
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.Stri2
jbe 0x40e276
cmp eax, 0x10
jb 0x40e262
mov edi, dword [edi]
push 0x1e
mov eax, str.Stri2
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e2b9
cmp eax, 0x1e
jae 0x40e288
mov ecx, dword [esi + 0x14]
push ecx
push 0x1e
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e294
mov eax, dword [edi]
jmp 0x40e296
mov eax, edi
push 0x1e
push str.Stri2
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x1e
jb 0x40e2b6
mov edi, dword [edi]
mov byte [edi + 0x1e], bl
lea ecx, [esp + 0x80]
call fcn.00406330
push eax
mov byte [esp + 0x8ec], 4
call fcn.00402460
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x40e2e2
mov eax, dword [eax + 4]
jmp 0x40e2e5
add eax, 4
push eax
lea edx, [esp + 0xd8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [esp + 0x40], esi
jb 0x40e30a
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439c49
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x58]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
mov byte [esp + 0x8dc], bl
call fcn.004037a0
lea eax, [esp + 0x17]
mov byte [esp + 0x17], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e338
sub eax, edx
je 0x40e348
call fcn.0041a8a0
lea eax, [esp + 0xcc]
lea ecx, [esp + 0xb0]
call fcn.0040f750
lea eax, [esp + 0x17]
mov byte [esp + 0x8dc], 5
mov byte [esp + 0x17], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e370
sub eax, edx
je 0x40e385
call fcn.0041ab40
call fcn.00419d50
mov ebp, dword [esp + 0x8e8]
mov eax, dword [esp + 0x24]
push ebp
call fcn.0040f7b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
add eax, 0x38
push ebx
mov word [ecx + 4], dx
call fcn.00402e20
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x918], 6
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, 0x10
jb 0x40e3eb
mov ecx, dword [edi]
jmp 0x40e3ed
mov ecx, edi
cmp ecx, 0x455554
ja 0x40e428
cmp eax, 0x10
jb 0x40e3fe
mov ecx, dword [edi]
jmp 0x40e400
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455554
jbe 0x40e428
cmp eax, 0x10
jb 0x40e414
mov edi, dword [edi]
push 0xb
mov eax, 0x455554
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e46b
cmp eax, 0xb
jae 0x40e43a
mov ecx, dword [esi + 0x14]
push ecx
push 0xb
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e446
mov eax, dword [edi]
jmp 0x40e448
mov eax, edi
push 0xb
push 0x455554
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0xb
jb 0x40e468
mov edi, dword [edi]
mov byte [edi + 0xb], bl
lea ecx, [esp + 0x94]
call fcn.00406330
push eax
mov byte [esp + 0x900], 7
call fcn.00402460
mov byte [esp + 0x8f8], 8
cmp dword [eax + 0x18], 8
jb 0x40e498
mov eax, dword [eax + 4]
jmp 0x40e49b
add eax, 4
sub esp, 0x1c
lea edx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push edx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0xa
call fcn.0040f140
cmp dword [esp + 0x40], 8
jb 0x40e4db
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439c49
add esp, 4
xor ecx, ecx
mov edi, 7
xor ebx, ebx
lea esi, [esp + 0x58]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
mov byte [esp + 0x8dc], 5
call fcn.004037a0
mov eax, dword [esp + 0x24]
push ebp
call fcn.0040f7b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
add eax, 0x54
push ebx
mov word [ecx + 4], dx
call fcn.00402e20
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x918], 0xb
mov ebp, 0xf
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, 0x10
jb 0x40e55e
mov ecx, dword [edi]
jmp 0x40e560
mov ecx, edi
cmp ecx, 0x455560
ja 0x40e59a
cmp eax, 0x10
jb 0x40e571
mov ecx, dword [edi]
jmp 0x40e573
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455560
jbe 0x40e59a
cmp eax, 0x10
jb 0x40e587
mov edi, dword [edi]
push ebp
mov eax, 0x455560
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e5d6
cmp eax, ebp
jae 0x40e5aa
mov ecx, dword [esi + 0x14]
push ecx
push ebp
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e5b6
mov eax, dword [edi]
jmp 0x40e5b8
mov eax, edi
push ebp
push 0x455560
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], ebp
jb 0x40e5d3
mov edi, dword [edi]
mov byte [edi + 0xf], bl
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0xc
call fcn.00401cb0
mov byte [esp + 0x8f8], 0xd
cmp dword [eax + 0x18], 8
jb 0x40e604
mov eax, dword [eax + 4]
jmp 0x40e607
add eax, 4
sub esp, 0x1c
lea edx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push edx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov ebx, 0xf
mov byte [esp + 0x914], bl
call fcn.0040f140
cmp dword [esp + 0x40], 8
jb 0x40e64b
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439c49
add esp, 4
xor ecx, ecx
mov edi, 7
xor ebp, ebp
lea esi, [esp + 0x58]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], cx
mov byte [esp + 0x8dc], 5
call fcn.004037a0
mov edx, dword [esp + 0x8e8]
mov eax, dword [esp + 0x24]
push edx
call fcn.0040f7b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
add eax, 0xe0
push ebp
mov word [ecx + 4], dx
call fcn.00402e20
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x918], 0x10
mov dword [esi + 0x18], ebx
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, 0x10
jb 0x40e6d3
mov ecx, dword [edi]
jmp 0x40e6d5
mov ecx, edi
cmp ecx, 0x455570
ja 0x40e710
cmp eax, 0x10
jb 0x40e6e6
mov ecx, dword [edi]
jmp 0x40e6e8
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455570
jbe 0x40e710
cmp eax, 0x10
jb 0x40e6fc
mov edi, dword [edi]
push 0xb
mov eax, 0x455570
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e754
cmp eax, 0xb
jae 0x40e722
mov ecx, dword [esi + 0x14]
push ecx
push 0xb
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e72e
mov eax, dword [edi]
jmp 0x40e730
mov eax, edi
push 0xb
push 0x455570
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0xb
jb 0x40e750
mov edi, dword [edi]
mov byte [edi + 0xb], 0
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x11
call fcn.004021f0
mov byte [esp + 0x8f8], 0x12
cmp dword [eax + 0x18], 8
jb 0x40e782
mov eax, dword [eax + 4]
jmp 0x40e785
add eax, 4
sub esp, 0x1c
lea edx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push edx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x14
call fcn.0040f140
cmp dword [esp + 0x40], 8
jb 0x40e7c5
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439c49
add esp, 4
xor ecx, ecx
mov edi, 7
xor ebx, ebx
lea esi, [esp + 0x58]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
call fcn.004037a0
call fcn.00417880
lea eax, [esp + 0x17]
mov dword [esp + 0x8dc], 5
mov byte [esp + 0x17], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e800
sub eax, edx
mov eax, 0
setne al
sub eax, 1
jne 0x40e820
call fcn.0041ab40
call fcn.0041a8f0
mov ebp, dword [esp + 0x8e8]
mov eax, dword [esp + 0x24]
push ebp
call fcn.0040f7b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
add eax, 0x70
push ebx
mov word [ecx + 4], dx
call fcn.00402e20
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x918], 0x17
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, 0x10
jb 0x40e882
mov ecx, dword [edi]
jmp 0x40e884
mov ecx, edi
cmp ecx, 0x45557c
ja 0x40e8bf
cmp eax, 0x10
jb 0x40e895
mov ecx, dword [edi]
jmp 0x40e897
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45557c
jbe 0x40e8bf
cmp eax, 0x10
jb 0x40e8ab
mov edi, dword [edi]
push 0xc
mov eax, 0x45557c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x40e902
cmp eax, 0xc
jae 0x40e8d1
mov ecx, dword [esi + 0x14]
push ecx
push 0xc
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x40e8dd
mov eax, dword [edi]
jmp 0x40e8df
mov eax, edi
push 0xc
push 0x45557c
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0xc
jb 0x40e8ff
mov edi, dword [edi]
mov byte [edi + 0xc], bl
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x18
call fcn.004025f0
mov byte [esp + 0x8f8], 0x19
cmp dword [eax + 0x18], 8
jb 0x40e930
mov ebx, dword [eax + 4]
jmp 0x40e933
lea ebx, [eax + 4]
sub esp, 0x1c
lea edx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push edx
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x1b
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
mov edi, dword [esp + 0x24]
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0x8c
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea eax, [esp + 0x44]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x1c
xor eax, eax
push 0xe
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x45558c
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x1d
call fcn.004021f0
mov byte [esp + 0x8f8], 0x1e
cmp dword [eax + 0x18], 8
jb 0x40e9f6
mov eax, dword [eax + 4]
jmp 0x40e9f9
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x20
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0x8c
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x21
xor eax, eax
push 0xf
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x45559c
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x22
call fcn.00401f50
mov byte [esp + 0x8f8], 0x23
cmp dword [eax + 0x18], 8
jb 0x40eaba
mov eax, dword [eax + 4]
jmp 0x40eabd
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x25
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0xa8
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x26
xor eax, eax
push 0x10
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x4555ac
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x27
call fcn.00401cb0
mov byte [esp + 0x8f8], 0x28
cmp dword [eax + 0x18], 8
jb 0x40eb7e
mov eax, dword [eax + 4]
jmp 0x40eb81
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x2a
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
call fcn.004065e0
test eax, eax
je 0x40ebda
call fcn.004069a0
call fcn.00406a30
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0xa8
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x2b
xor eax, eax
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x4555c0
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x2c
call fcn.004021f0
mov byte [esp + 0x8f8], 0x2d
cmp dword [eax + 0x18], 8
jb 0x40ec55
mov eax, dword [eax + 4]
jmp 0x40ec58
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x2f
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
call fcn.00406640
sub eax, 1
jne 0x40ecb2
call fcn.00406e10
call fcn.00406b00
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0xc4
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x30
xor eax, eax
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x4555d0
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x31
call fcn.00401f50
mov byte [esp + 0x8f8], 0x32
cmp dword [eax + 0x18], 8
jb 0x40ed2d
mov eax, dword [eax + 4]
jmp 0x40ed30
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x34
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0xe0
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x35
xor eax, eax
push 0xe
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x4555dc
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8fc], 0x36
call fcn.004025f0
mov byte [esp + 0x8f8], 0x37
cmp dword [eax + 0x18], 8
jb 0x40edf1
mov eax, dword [eax + 4]
jmp 0x40edf4
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x39
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
push ebp
mov eax, edi
call fcn.0040f7b0
sub esp, 0x1c
add eax, 0xe0
mov esi, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402b30
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
mov byte [esp + 0x918], 0x3a
xor eax, eax
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x4555ec
mov byte [ecx + 4], al
call fcn.00402f50
lea ecx, [esp + 0x94]
call fcn.00406330
push eax
mov byte [esp + 0x900], 0x3b
call fcn.00402460
mov byte [esp + 0x8f8], 0x3c
cmp dword [eax + 0x18], 8
jb 0x40eeb4
mov eax, dword [eax + 4]
jmp 0x40eeb7
add eax, 4
sub esp, 0x1c
lea ecx, [esp + 0xe8]
mov esi, esp
mov dword [esp + 0x50], esp
push ecx
mov ebx, eax
call fcn.004107b0
add esp, 4
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x914], 0x3e
call fcn.0040f140
lea esi, [esp + 0x28]
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
call fcn.00406590
test eax, eax
je 0x40ef0b
call fcn.00401350
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x4555fc
mov byte [ecx + 4], 0
call fcn.00402f50
lea ecx, [esp + 0x80]
call fcn.00406330
mov ecx, eax
mov byte [esp + 0x8e8], 0x3f
call fcn.004021f0
cmp dword [eax + 0x18], 8
jb 0x40ef67
mov eax, dword [eax + 4]
jmp 0x40ef6a
add eax, 4
mov ebx, dword [esp + 0x28]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
lea esi, [esp + 0x28]
mov edi, eax
call fcn.00402b60
lea esi, [esp + 0x58]
mov byte [esp + 0x8dc], 5
call fcn.004037a0
test edi, edi
je 0x40effb
mov esi, dword [esp + 0x24]
push ebp
mov eax, esi
call fcn.0040f7b0
mov edx, dword [eax + 0xfc]
mov eax, dword [esp + 0x44]
mov dword [eax + 8], edx
push ebp
mov eax, esi
call fcn.0040f7b0
mov ecx, dword [eax + 0x100]
mov edx, dword [esp + 0x44]
mov dword [edx + 0xc], ecx
call fcn.00430f00
test eax, eax
je 0x40efd1
call fcn.00406bb0
push ebp
mov eax, esi
call fcn.0040f7b0
mov eax, dword [eax + 0xfc]
mov ecx, dword [esp + 0x44]
mov dword [ecx + 0x10], eax
push ebp
mov eax, esi
call fcn.0040f7b0
mov edx, dword [eax + 0x100]
mov eax, dword [esp + 0x44]
mov dword [eax + 0x14], edx
cmp dword [esp + 0x904], 0x10
mov eax, dword [esp + 0x8f0]
jae 0x40f013
lea eax, [esp + 0x8f0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x40f052
call fcn.00436780
test eax, eax
je 0x40f039
call fcn.00406c20
call fcn.00431550
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
movzx eax, word [edx]
push ecx
push ebx
push eax
push 1
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
lea esi, [esp + 0xb0]
mov byte [esp + 0x8dc], 0
call fcn.00402b60
xor ebx, ebx
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, ebx
je 0x40f0b0
push eax
call fcn.0043b2ae
add esp, 4
call fcn.00430df0
mov ecx, eax
mov eax, 0x6f74ae27
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x24c
jle 0x40f0b0
push 0x24c
call esi
call fcn.00401350
call fcn.00406c90
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40f0f0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
call fcn.00436690
mov ecx, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xd8
jle 0x40f0f0
push 0xd8
call esi
call fcn.00401350
call fcn.0041ab40
cmp dword [esp + 0x904], 0x10
jb 0x40f10a
mov ecx, dword [esp + 0x8f0]
push ecx
call fcn.00439c49
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x8d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8b8]
xor ecx, esp
call fcn.00439641
add esp, 0x8cc
ret 0x24