Function at 0x413de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x30], 0xd3f3a5c7
jmp 0x413e10
mov dword [esi + 0x30], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x30]
cmp eax, 0x7f2c87d9
jg 0x413e50
cmp eax, 0x70f0acf8
jg 0x413e90
cmp eax, 0x6949ac20
jg 0x413ea7
cmp eax, 0x5c18bff1
jg 0x413ed2
cmp eax, 0x8525d9ec
jg 0x413ef8
cmp eax, 0x84213542
jne 0x413e10
mov dword [esi + 0x30], 0x99eb3ce4
jmp 0x413e10
cmp eax, 0x7f2c87da
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov eax, dword [eax + 0xc]
sub esp, 4
mov dword [esp], eax
call fcn.00418440
add esp, 4
mov ecx, dword [esi + 0x4c]
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 0x4c]
mov eax, 0x77686f2
cmp dword [ecx + 0x14], 0
jne 0x413e03
mov eax, 0xe8ceac33
jmp 0x413e03
cmp eax, 0x70f0acf9
jne 0x413e10
mov dword [esi + 0x30], 0xc853328e
jmp 0x413e10
cmp eax, 0x6949ac21
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov eax, dword [eax + 0x14]
sub esp, 4
mov dword [esp], eax
call fcn.0041704b
add esp, 4
mov dword [esi + 0x30], 0xde43bfe8
jmp 0x413e10
cmp eax, 0x5c18bff2
jne 0x413e10
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x58]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x30], 0xa4ced398
jmp 0x413e10
cmp eax, 0x8ddbaee3
jg 0x413f2a
cmp eax, 0x8525d9ed
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov eax, dword [eax + 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.0041704b
add esp, 4
mov dword [esi + 0x30], 0xd3a8559d
jmp 0x413e10
cmp eax, 0x8fd86570
jg 0x413f55
cmp eax, 0x8ddbaee4
jne 0x413e10
mov al, byte [esi + 0x7f]
test al, al
mov eax, 0x2d73517a
jne 0x413f4d
mov eax, 0x310a2c8
mov dword [esi + 0x30], eax
jmp 0x413e10
cmp eax, 0x99eb3ce3
jg 0x413f76
cmp eax, 0x8fd86571
jne 0x413e10
mov eax, dword [esi + 0x70]
mov dword [esi + 0x30], 0xb49c5578
jmp 0x413e10
cmp eax, 0x9b86dfc6
jg 0x413f94
cmp eax, 0x99eb3ce4
jne 0x413e10
mov dword [esi + 0x30], 0x70f0acf9
jmp 0x413e10
cmp eax, 0x9c970afc
jg 0x413fb2
cmp eax, 0x9b86dfc7
jne 0x413e10
mov dword [esi + 0x30], 0xfb2f280c
jmp 0x413e10
cmp eax, 0x527d597a
jg 0x414033
cmp eax, 0x5200f898
jg 0x414122
cmp eax, 0x4e461b37
jg 0x414139
cmp eax, 0x4210b846
jg 0x414313
cmp eax, 0x3d6a2a33
jg 0x414332
cmp eax, 0x3407cc75
jg 0x414349
cmp eax, 0x337cb317
jg 0x414360
cmp eax, 0x2d735179
jg 0x414381
cmp eax, 0x2b3a24cb
jg 0x414398
cmp eax, 0x9cd3ffa9
jg 0x4143bd
cmp eax, 0x9c970afd
jne 0x413e10
mov dword [esi + 0x30], 0xa4ced398
jmp 0x413e10
cmp eax, 0x527d597b
jne 0x413e10
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
sete al
movzx eax, al
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx]
mov dword [esi + 0x28], eax
mov edx, dword [esi + 0x48]
mov eax, dword [edx]
mov dword [esi + 0x24], eax
mov edi, dword [esi + 0x5c]
mov eax, dword [edi]
mov dword [esi + 0x20], eax
mov ebx, dword [esi + 0x44]
mov ebx, dword [ebx]
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x68]
sub esp, 0x20
mov edi, dword [esi + 0x2c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.00414e70
add esp, 0x20
mov ecx, dword [esi + 0x70]
mov dword [ecx], eax
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x5c]
mov ecx, dword [ecx]
add ecx, 0x22bbd220
sub ecx, dword [eax]
add ecx, 0xdd442de0
mov eax, dword [esi + 0x5c]
mov dword [eax], ecx
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
mov ecx, dword [esi + 0x44]
add eax, dword [ecx]
mov ecx, dword [esi + 0x44]
mov dword [ecx], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x60]
mov ecx, dword [ecx]
add ecx, 0xa7a23d88
sub ecx, dword [eax]
add ecx, 0x585dc278
mov eax, dword [esi + 0x60]
mov dword [eax], ecx
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
mov ecx, dword [esi + 0x48]
add eax, dword [ecx]
mov ecx, dword [esi + 0x48]
mov dword [ecx], eax
mov ecx, dword [esi + 0x60]
mov eax, 0x9c970afd
cmp dword [ecx], 0
je 0x414114
mov eax, 0xd2f20567
mov dword [esi + 0x30], eax
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
jmp 0x413e10
cmp eax, 0x5200f899
jne 0x413e10
mov dword [esi + 0x30], 0x99eb3ce4
jmp 0x413e10
cmp eax, 0x4e461b38
jne 0x413e10
mov eax, 4
call fcn.00417020
mov dword [esi + 0x34], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x38], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x3c], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x40], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x44], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x48], esp
mov eax, 0x8c
call fcn.00417020
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x4c], eax
mov eax, 4
call fcn.00417020
mov dword [esi + 0x50], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x54], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x58], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x5c], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x60], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x64], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x68], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x6c], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x70], esp
mov eax, 0x400
call fcn.00417020
mov dword [esi + 0x74], esp
mov eax, 0x400
call fcn.00417020
mov dword [esi + 0x78], esp
mov eax, 8
call fcn.00417020
mov ebx, edi
mov edi, esp
mov eax, dword [esi + 0x34]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [esi + 0x38]
mov dword [eax], ebx
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [esi + 0x44]
mov dword [eax], 0
mov eax, dword [esi + 0x48]
mov dword [eax], 0
mov eax, dword [esi + 0x50]
mov dword [eax], 0xd
mov eax, dword [esi + 0x54]
mov dword [eax], 0
mov eax, dword [esi + 0x5c]
mov dword [eax], 0
mov eax, dword [esi + 0x60]
mov dword [eax], 0x400
mov eax, dword [esi + 0x6c]
mov dword [eax], 0xffffffff
mov eax, dword [esi + 0x4c]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x8c
mov dword [esp + 4], 0
call fcn.00403e40
add esp, 0xc
mov eax, dword [esi + 0x40]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 5
call fcn.00402cc0
add esp, 0xc
mov eax, dword [esi + 0x4c]
sub esp, 0xc
mov dword [esp + 4], edi
mov edi, ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 8], 5
call fcn.00414c30
add esp, 0xc
test eax, eax
setne byte [esi + 0x7f]
mov dword [esi + 0x30], 0x8ddbaee4
jmp 0x413e10
cmp eax, 0x4210b847
jne 0x413e10
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x48]
mov dword [ecx], eax
mov dword [esi + 0x30], 0xd2f20567
jmp 0x413e10
cmp eax, 0x3d6a2a34
jne 0x413e10
mov dword [esi + 0x30], 0x18e95d39
jmp 0x413e10
cmp eax, 0x3407cc76
jne 0x413e10
mov dword [esi + 0x30], 0xfb2f280c
jmp 0x413e10
cmp eax, 0x337cb318
jne 0x413e10
mov eax, dword [esi + 0x34]
mov eax, dword [eax]
mov ecx, dword [esi + 0x60]
mov dword [ecx], eax
mov dword [esi + 0x30], 0x4210b847
jmp 0x413e10
cmp eax, 0x2d73517a
jne 0x413e10
mov dword [esi + 0x30], 0xdad2c6a1
jmp 0x413e10
cmp eax, 0x2b3a24cc
jne 0x413e10
mov ecx, dword [esi + 0x3c]
mov eax, 0x9cd3ffaa
cmp dword [ecx], 0
jne 0x4143b5
mov eax, 0x527d597b
mov dword [esi + 0x30], eax
jmp 0x413e10
cmp eax, 0xa4ced397
jg 0x4143f6
cmp eax, 0x9cd3ffaa
jne 0x413e10
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
mov edx, dword [esi + 0x3c]
mov eax, 0xa58d2faa
cmp ecx, dword [edx]
ja 0x4143ee
mov eax, 0x18e95d39
mov dword [esi + 0x30], eax
jmp 0x413e10
cmp eax, 0xa54d985b
jg 0x414430
cmp eax, 0xa4ced398
jne 0x413e10
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x34]
cmp dword [ecx], eax
setb al
mov byte [esi + 0x81], al
mov dword [esi + 0x30], 0x224c2ade
jmp 0x413e10
cmp eax, 0xa58d2fa9
jg 0x41444e
cmp eax, 0xa54d985c
jne 0x413e10
mov dword [esi + 0x30], 0x1fca0b16
jmp 0x413e10
cmp eax, 0xab144c13
jg 0x41446c
cmp eax, 0xa58d2faa
jne 0x413e10
mov dword [esi + 0x30], 0xc323c8e2
jmp 0x413e10
cmp eax, 0xade5bdb1
jg 0x41448a
cmp eax, 0xab144c14
jne 0x413e10
mov dword [esi + 0x30], 0xfb2f280c
jmp 0x413e10
cmp eax, 0xb024f2bc
jg 0x4144b2
cmp eax, 0xade5bdb2
jne 0x413e10
mov eax, dword [esi + 0x34]
mov eax, dword [eax]
mov ecx, dword [esi + 0x58]
mov dword [ecx], eax
mov dword [esi + 0x30], 0x19ef4c06
jmp 0x413e10
cmp eax, 0xb09849ca
jg 0x4144e1
cmp eax, 0xb024f2bd
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x4c]
cmp dword [eax + 0x10], 0
setne byte [esi + 0x83]
mov dword [esi + 0x30], 0xbf381007
jmp 0x413e10
cmp eax, 0xb49c5577
jg 0x41450c
cmp eax, 0xb09849cb
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x14], 0
mov dword [esi + 0x30], 0x27fad226
jmp 0x413e10
cmp eax, 0xbf381006
jg 0x41453a
cmp eax, 0xb49c5578
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x70]
cmp dword [eax], 0
setne byte [esi + 0x82]
mov dword [esi + 0x30], 0xe3b06130
jmp 0x413e10
cmp eax, 0xc323c8e1
jg 0x41456f
cmp eax, 0xbf381007
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov ecx, ebx
mov al, byte [esi + 0x83]
test al, al
mov eax, 0x8525d9ed
jne 0x414565
mov eax, 0xd3a8559d
mov dword [esi + 0x30], eax
mov ebx, ecx
jmp 0x413e10
cmp eax, 0xc853328d
jg 0x41459a
cmp eax, 0xc323c8e2
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x58]
mov dword [ecx], eax
mov dword [esi + 0x30], 0x3d6a2a34
jmp 0x413e10
cmp eax, 0xcc48f0ba
jg 0x4145cd
cmp eax, 0xc853328e
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov edx, ebx
mov ecx, dword [esi + 0x60]
mov eax, 0xa54d985c
cmp dword [ecx], 0
jne 0x4145c3
mov eax, 0xfd010dd8
mov dword [esi + 0x30], eax
mov ebx, edx
jmp 0x413e10
cmp eax, 0xd2f20566
jg 0x414601
cmp eax, 0xcc48f0bb
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov ecx, ebx
mov al, byte [esi + 0x80]
test al, al
mov eax, 0x2b3a24cc
jne 0x414565
mov eax, 0x527d597b
jmp 0x414565
cmp eax, 0xd3a8559c
jg 0x414622
cmp eax, 0xd2f20567
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov dword [esi + 0x30], 0xb49c5578
jmp 0x413e10
cmp eax, 0xd3f3a5c6
jg 0x41463c
cmp eax, 0xd3a8559d
mov edi, dword [ebp + 0x10]
jne 0x413e10
jmp 0x414c17
cmp eax, 0xdad2c6a0
jg 0x41465d
cmp eax, 0xd3f3a5c7
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov dword [esi + 0x30], 0x4e461b38
jmp 0x413e10
cmp eax, 0xde43bfe7
jg 0x41468a
cmp eax, 0xdad2c6a1
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, edi
mov ecx, dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov edi, dword [ecx]
mov edi, eax
mov dword [esi + 0x30], 0x9b86dfc7
jmp 0x413e10
cmp eax, 0xe3b0612f
jg 0x4146ab
cmp eax, 0xde43bfe8
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov dword [esi + 0x30], 0xb024f2bd
jmp 0x413e10
cmp eax, 0xe8ceac32
jg 0x4146df
cmp eax, 0xe3b06130
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov ecx, ebx
mov al, byte [esi + 0x82]
test al, al
mov eax, 0xab144c14
jne 0x414565
mov eax, 0x5200f899
jmp 0x414565
cmp eax, 0xeeb24ac0
jg 0x414700
cmp eax, 0xe8ceac33
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov dword [esi + 0x30], 0xfb2f280c
jmp 0x413e10
cmp eax, 0xf5e5692b
jg 0x414738
cmp eax, 0xeeb24ac1
mov edi, dword [ebp + 0x10]
jne 0x413e10
call fcn.0040e6d0
mov ecx, dword [esi + 0x4c]
mov eax, 0x7f2c87da
cmp dword [ecx + 0xc], 0
jne 0x41472d
mov eax, 0xb09849cb
mov dword [esi + 0x30], eax
mov ebx, dword [ebp + 0xc]
jmp 0x413e10
cmp eax, 0xfb2f280b
jg 0x414763
cmp eax, 0xf5e5692c
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x58]
mov dword [ecx], eax
mov dword [esi + 0x30], 0xc323c8e2
jmp 0x413e10
cmp eax, 0xfd010dd7
jg 0x414796
cmp eax, 0xfb2f280c
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov edx, ebx
mov ecx, dword [esi + 0x4c]
mov eax, 0x6949ac21
cmp dword [ecx + 0x14], 0
jne 0x4145c3
mov eax, 0xde43bfe8
jmp 0x4145c3
cmp eax, 0x310a2c7
jg 0x4147c0
cmp eax, 0xfd010dd8
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x6c]
mov dword [eax], 0
mov dword [esi + 0x30], 0xfb2f280c
jmp 0x413e10
cmp eax, 0x77686f1
jg 0x414822
cmp eax, 0x310a2c8
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax]
mov eax, dword [esi + 0x4c]
mov eax, dword [eax + 4]
neg eax
sub ecx, eax
mov eax, 0x300
shl eax, cl
lea eax, [eax + eax + 0xe6c]
sub esp, 4
mov dword [esp], eax
call fcn.00418440
add esp, 4
mov ecx, dword [esi + 0x4c]
mov dword [ecx + 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, 0xeeb24ac1
cmp dword [ecx + 0x10], 0
jne 0x41472d
mov eax, 0x3407cc76
jmp 0x41472d
cmp eax, 0xb468217
jg 0x414843
cmp eax, 0x77686f2
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov dword [esi + 0x30], 0x27fad226
jmp 0x413e10
cmp eax, 0x18e95d38
jg 0x414867
cmp eax, 0xb468218
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x30], 0x1fca0b16
jmp 0x413e10
cmp eax, 0x1949c16a
jg 0x4148ec
cmp eax, 0x18e95d39
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x50]
mov edx, dword [edx]
add edx, dword [ecx]
mov ecx, dword [esi + 0x74]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00402cc0
add esp, 0xc
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x50]
add eax, dword [ecx]
mov ecx, dword [esi + 0x50]
mov dword [ecx], eax
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx]
add ecx, 0xd50044ec
sub ecx, dword [eax]
add ecx, 0x2affbb14
mov eax, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x5c]
mov dword [ecx], eax
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x44]
mov dword [ecx], eax
mov dword [esi + 0x30], 0x527d597b
jmp 0x413e10
cmp eax, 0x19ef4c05
jg 0x414ab6
cmp eax, 0x1949c16b
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, 4
call fcn.00417020
mov dword [esi + 0x28], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x24], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x20], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x2c], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x1c], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x18], esp
mov eax, 0x8c
call fcn.00417020
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 4], eax
mov esp, eax
mov edx, eax
mov eax, 4
call fcn.00417020
mov dword [esi + 0x14], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 0x10], esp
mov eax, 4
call fcn.00417020
mov eax, 4
call fcn.00417020
mov dword [esi + 0xc], esp
mov eax, 4
call fcn.00417020
mov dword [esi + 8], esp
mov eax, 4
call fcn.00417020
mov eax, 4
call fcn.00417020
mov eax, 4
call fcn.00417020
mov ecx, esp
mov eax, 4
call fcn.00417020
mov eax, 0x400
call fcn.00417020
mov eax, 0x400
call fcn.00417020
mov eax, 8
call fcn.00417020
mov ebx, esp
mov eax, dword [ebp + 0x14]
mov edi, dword [esi + 0x28]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [esi + 0x24]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [esi + 0x20]
mov dword [edi], eax
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x18]
mov dword [eax], 0
mov eax, dword [esi + 0x14]
mov dword [eax], 0xd
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 8]
mov dword [eax], 0x400
mov dword [ecx], 0xffffffff
mov eax, dword [ebp + 8]
mov edi, dword [esi + 0x2c]
mov dword [edi], eax
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 8], 0x8c
mov dword [esp + 4], 0
call fcn.00403e40
add esp, 0xc
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], 5
call fcn.00402cc0
add esp, 0xc
sub esp, 0xc
mov dword [esp + 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov dword [esp], eax
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], 5
call fcn.00414c30
add esp, 0xc
mov dword [esi + 0x30], 0x4e461b38
jmp 0x413e10
cmp eax, 0x1fca0b15
jg 0x414b39
cmp eax, 0x19ef4c06
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x38]
mov edi, dword [esi + 0x54]
mov edi, dword [edi]
add edi, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
call fcn.00402cc0
add esp, 0xc
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x54]
add eax, dword [ecx]
mov ecx, dword [esi + 0x54]
mov dword [ecx], eax
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x34]
mov ecx, dword [ecx]
sub ecx, dword [eax]
mov eax, dword [esi + 0x34]
mov dword [eax], ecx
mov eax, dword [esi + 0x60]
mov dword [eax], 0x400
mov eax, dword [esi + 0x60]
mov ecx, dword [eax]
mov edx, dword [esi + 0x34]
mov eax, 0x337cb318
cmp ecx, dword [edx]
ja 0x414114
mov eax, 0x4210b847
jmp 0x414114
cmp eax, 0x224c2add
jg 0x414b67
cmp eax, 0x1fca0b16
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x5c]
cmp dword [eax], 0
sete byte [esi + 0x80]
mov dword [esi + 0x30], 0xcc48f0bb
jmp 0x413e10
cmp eax, 0x27fad225
jg 0x414b9b
cmp eax, 0x224c2ade
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov ecx, ebx
mov al, byte [esi + 0x81]
test al, al
mov eax, 0xade5bdb2
jne 0x414565
mov eax, 0x19ef4c06
jmp 0x414565
cmp eax, 0x27fad226
je 0x414bbf
cmp eax, 0x2a960ac9
jne 0x414bfa
mov eax, dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov edi, dword [eax]
mov dword [esi + 0x30], 0xdad2c6a1
mov edi, dword [ebp + 0x10]
jmp 0x413e10
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x48]
mov dword [ecx], eax
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
add eax, 0xfffffff3
mov ecx, dword [esi + 0x3c]
mov dword [ecx], eax
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x84], 0xfffffffe
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x58], 0
mov dword [esi + 0x30], 0xa54d985c
mov edi, dword [ebp + 0x10]
jmp 0x413e10
cmp eax, 0x2abb609b
mov edi, dword [ebp + 0x10]
jne 0x413e10
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x30], 0xb024f2bd
jmp 0x413e10
mov eax, dword [esi + 0x6c]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret