Function at 0x4063f3
Capabilities:
Accept command line arguments
Access peb ldr_data
Check os version
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x27ec
call fcn.0040a210
mov eax, dword [0x40c090]
xor eax, esp
mov dword [esp + 0x27e8], eax
push ebx
push esi
lea eax, [esp + 0xd8]
mov dword [esp + 0xd0], 1
push edi
mov dword [esp + 0xd0], eax
mov edi, ecx
lea eax, [esp + 0xa60]
mov dword [esp + 0xa60], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x406484
push ebx
push 4
lea eax, [esp + 0x50]
mov byte [0x40cd9a], bl
push eax
push 0x1a
mov byte [0x40cab5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x406484
cmp dword [esp + 0x48], ebx
je 0x406484
mov byte [0x40cab5], 1
mov eax, dword [0x40b070]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x40b880]
mov word [eax], cx
lea eax, [esp + 0x1fc]
mov dword [esp + 0x1f4], 0x104
mov dword [esp + 0x1f0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov esi, eax
pop eax
push 0x22
pop edx
mov dword [esp + 0x30], esi
cmp word [esi], dx
jne 0x4064cf
add esi, 2
mov dword [esp + 0x30], esi
jmp 0x4064d1
mov edx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4064fb
cmp cx, dx
je 0x4064eb
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4064d9
mov dword [esp + 0x30], esi
cmp word [esi], bx
je 0x4064fb
add esi, 2
mov dword [esp + 0x30], esi
push 0xfffffffffffffff5
mov dword [0x40cdac], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x40cabc], eax
cmp eax, 0xffffffff
je 0x40651f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x406525
mov dword [0x40cabc], ebx
mov edi, 0x800
mov dword [esp + 0x84], ebx
push edi
lea eax, [esp + 0xdec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x17f0]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x40c914], ebx
push 9
pop ecx
push 0x20
mov dword [esp + 0x8c], ecx
pop edi
movzx eax, word [esi]
cmp ax, di
je 0x406575
cmp ax, cx
jne 0x40657a
add esi, 2
jmp 0x406568
movzx eax, word [esi]
push 0x2d
pop ecx
push 0x2f
pop edx
mov dword [esp + 0x30], esi
cmp ax, dx
je 0x406595
cmp ax, cx
jne 0x4066ce
lea eax, [esi + 2]
test eax, eax
je 0x4066ce
mov ax, word [eax]
or ax, di
cmp ax, 0x60
jne 0x4066ce
add esi, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
call fcn.00405efa
lea eax, [esp + 0xde8]
push 0x400
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
call fcn.00406105
pop ecx
test al, al
je 0x406f9b
mov eax, dword [esp + 0x1f4]
mov edx, 0x401768
add eax, eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c]
push eax
push ecx
push ecx
call fcn.00402f5e
add esp, 0xc
test eax, eax
jne 0x407cb7
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x40668a
mov eax, dword [esp + 0x44]
push ecx
shr eax, 1
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408685
test al, al
jne 0x406664
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4066fd
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1f4]
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0xdf8]
push eax
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407cb7
cmp dword [esp + 0x40], 1
jne 0x407cb7
mov esi, dword [esp + 0x1f0]
push 0x20
pop edx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
cmp di, dx
je 0x4066c9
push 9
pop eax
cmp di, ax
jne 0x406b14
add esi, 2
jmp 0x4066b1
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
mov ecx, esi
call fcn.00402e9c
test eax, eax
js 0x406a9e
mov eax, dword [esp + 0x28]
push ecx
inc eax
lea ecx, [esp + 0x1f4]
push eax
call fcn.00408685
test al, al
jne 0x406705
push 0xe
pop ebx
jmp 0x407cb7
mov eax, dword [esp + 0x1f0]
lea edi, [esp + 0xc2c]
xor ecx, ecx
mov dword [esp + 0xb90], 0x4017f0
mov esi, 0x401964
mov dword [esp + 0xb94], ebx
push 8
mov word [eax], cx
mov edx, 0x7fffffff
mov eax, dword [0x401954]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc18], eax
mov ax, word [0x401958]
mov word [esp + 0xc1c], ax
mov eax, dword [0x40195c]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc10], eax
mov ax, word [0x401960]
pop ecx
movsd dword es:[edi], dword [esi]
mov word [esp + 0xc10], ax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0xb9c], bl
movsw word es:[edi], word [esi]
mov esi, 0x401974
mov dword [esp + 0xba0], 0x401800
lea edi, [esp + 0xc40]
mov dword [esp + 0xba4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401814
mov byte [esp + 0xba8], bl
mov dword [esp + 0xbac], 0x401814
mov dword [esp + 0xbb0], 0x401824
mov byte [esp + 0xbb4], 1
mov dword [esp + 0xbb8], 0x40182c
mov dword [esp + 0xbbc], 0x401838
mov byte [esp + 0xbc0], 1
mov dword [esp + 0xbc4], 0x401840
mov dword [esp + 0xbc8], 0x40184c
mov byte [esp + 0xbcc], 1
mov dword [esp + 0xbd0], 0x401854
mov dword [esp + 0xbd4], 0x401864
mov byte [esp + 0xbd8], 1
mov dword [esp + 0xbdc], 0x401890
mov dword [esp + 0xbe0], 0x4018a4
mov byte [esp + 0xbe4], 1
mov dword [esp + 0xbe8], 0x4018d0
mov dword [esp + 0xbec], 0x4018ec
mov byte [esp + 0xbf0], 1
mov dword [esp + 0xbf4], 0x401908
mov dword [esp + 0xbf8], 0x401924
mov byte [esp + 0xbfc], 1
mov dword [esp + 0xc00], 0x401944
mov dword [esp + 0xc04], 0x40194c
mov byte [esp + 0xc08], 1
mov dword [esp + 0x58], ebx
call fcn.00402ecb
test eax, eax
js 0x406a9e
mov esi, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x406930
movzx eax, word [edi]
test ax, ax
je 0x406947
push 0x2d
pop ecx
cmp ax, cx
je 0x4068d3
push 0x2f
pop ecx
cmp ax, cx
jne 0x406930
mov eax, dword [esp + 0x18]
lea ecx, [eax - 1]
mov dword [esp + 0x48], ecx
cmp ecx, 1
jne 0x406909
push 0xffffffffffffffff
push 0x401994
dec eax
push eax
lea eax, [edi + 2]
push eax
push ecx
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406980
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x48]
cmp dword [esp + 0x54], ecx
jne 0x406930
push dword [esp + 0x54]
dec eax
push 0x401814
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406980
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.004041d9
mov edi, eax
test edi, edi
jne 0x4068b7
lea eax, [esp + 0xc0c]
mov byte [esp + 0xb98], 1
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc14]
mov byte [esp + 0xba4], 1
mov dword [esp + 0xba0], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x406a6c
lea eax, [esp + 0xc2c]
mov byte [esp + 0xb98], bl
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xc3c]
mov byte [esp + 0xba4], bl
jmp 0x40696c
movzx eax, word [esi]
test ax, ax
je 0x406a83
push 0x2d
pop ecx
cmp ax, cx
je 0x4069c1
push 0x2f
pop ecx
cmp ax, cx
jne 0x406a0a
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xb90]
dec ecx
mov dword [esp + 0x50], eax
mov edi, ebx
mov dword [esp + 0x48], ecx
lea edx, [esi + 2]
push 0xffffffffffffffff
push dword [eax]
push ecx
push edx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x406a1f
mov eax, dword [esp + 0x50]
lea edx, [esi + 2]
mov ecx, dword [esp + 0x48]
inc edi
add eax, 0xc
mov dword [esp + 0x50], eax
cmp edi, 0xa
jb 0x4069da
push 1
push dword [esp + 0x1c]
mov dword [esp + 0x200], 0x104
mov edx, esi
jmp 0x406a5a
imul esi, edi, 0xc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1fc], 0x104
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + esi + 0xb98]
call fcn.00402e9c
test eax, eax
js 0x406aa8
movzx eax, byte [esp + esi + 0xb98]
mov edx, dword [esp + esi + 0xb94]
push eax
push dword [esp + 0x30]
lea ecx, [esp + 0x1f8]
call fcn.004042fa
pop ecx
pop ecx
test eax, eax
jne 0x406aad
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.004041d9
mov esi, eax
test esi, esi
jne 0x4069a5
mov esi, dword [esp + 0x1f0]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.00402e9c
test eax, eax
jns 0x406ab4
mov ebx, 0x65b
jmp 0x407cb7
mov eax, 0x65b
mov ebx, eax
jmp 0x407cb7
mov eax, dword [esp + 0x28]
push 0x20
pop edx
test eax, eax
je 0x406aea
dec eax
push 9
pop ebx
lea eax, [esi + eax*2]
movzx ecx, word [eax]
cmp cx, dx
je 0x406ad3
cmp cx, bx
jne 0x406ae8
cmp eax, esi
jb 0x406ae8
xor ecx, ecx
mov word [eax], cx
sub eax, 2
mov esi, dword [esp + 0x1f0]
jmp 0x406ac6
xor ebx, ebx
movzx edi, word [esi]
mov dword [esp + 0xc], esi
test di, di
je 0x406b14
push 9
pop ebx
cmp di, dx
je 0x406b03
cmp di, bx
jne 0x406b12
add esi, 2
mov dword [esp + 0xc], esi
movzx edi, word [esi]
test di, di
jne 0x406af9
xor ebx, ebx
mov dword [esp + 0x20], ebx
test di, di
je 0x406faa
mov eax, dword [0x40c870]
mov dword [esp + 0x48], 0x71
mov dword [esp + 0x18], eax
push 0x2f
pop eax
cmp di, ax
je 0x406be5
push 0x2d
pop eax
cmp di, ax
je 0x406be5
push 0x208
lea eax, [esp + 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x854]
mov esi, 0x104
mov dword [esp + 0x848], eax
lea edx, [esp + 0x848]
mov dword [esp + 0x84c], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x850], esi
call fcn.0040613f
test eax, eax
je 0x406f58
mov esi, dword [esp + 0x848]
test esi, esi
je 0x406bb2
mov ecx, esi
call fcn.00404735
mov esi, dword [esp + 0x848]
lea ecx, [esp + 0xc]
call fcn.00405efa
cmp dword [esp + 0x84c], 0x104
movzx edi, ax
jle 0x406bd6
test esi, esi
je 0x406bd6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406f47
lea ecx, [esi + 2]
xor eax, eax
movzx edi, word [ecx]
or edi, edx
mov dword [esp + 0x2c], ecx
cmp ax, word [ecx]
je 0x406bff
add ecx, 2
mov dword [esp + 0x2c], ecx
push 0x52
pop edx
push 0x20
mov dword [esp + 0x10], ecx
mov ebx, 0x402670
pop ecx
movzx eax, dx
or eax, ecx
movzx esi, dx
cmp eax, edi
je 0x406c29
add ebx, 2
movzx eax, word [ebx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x406c0e
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
push 0
pop ebx
test si, si
je 0x406e7c
movzx eax, word [ecx]
push 0x20
pop edi
cmp ax, di
je 0x406c5e
test ax, ax
je 0x406c5e
push 9
pop ecx
cmp ax, cx
je 0x406c5e
xor edi, edi
inc edi
mov dword [esp + 0x2c], edi
jmp 0x406c64
mov edi, ebx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0xc]
call fcn.00405efa
push 0x63
pop ecx
lea eax, [esp + 0xde8]
mov dword [esp + 0x38], eax
cmp si, cx
jne 0x406c88
test edi, edi
jne 0x406e7c
push 0x50
pop eax
cmp si, ax
jne 0x406ced
push ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
lea ecx, [esp + 0xd4]
push eax
call fcn.004087aa
test al, al
je 0x406f93
mov eax, dword [esp + 0xd0]
lea edx, [esp + 0x8c]
push dword [esp + 0xd4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], eax
call fcn.00406105
pop ecx
test al, al
je 0x406f9b
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406d1d
push 0x71
pop eax
cmp si, ax
je 0x406cfa
cmp si, cx
jne 0x406cfe
test edi, edi
je 0x406d19
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.00406105
pop ecx
test al, al
je 0x406f9b
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0xc]
call fcn.00405efa
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
cmp eax, 0x46
je 0x406d5f
push 0x71
pop ecx
cmp ax, cx
je 0x406d5f
cmp eax, 0x4a
je 0x406d5f
lea edx, [esp + 0xde8]
mov ecx, eax
mov dword [esp + 0x28], edx
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
cmp eax, 0x6c
jne 0x406dce
cmp dword [esp + 0x2c], 0
lea edx, [esp + 0xde8]
mov dword [esp + 0x28], edx
mov ecx, eax
lea edx, [esp + 0x17f0]
mov dword [esp + 0x24], edx
je 0x406dce
mov ecx, edx
lea edx, [esp + 0xde8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], ecx
mov ecx, eax
mov dword [esp + 0x24], edx
cmp ax, word [esp + 0x48]
je 0x406dce
push 0x400
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x10]
call fcn.00406105
pop ecx
test al, al
je 0x406f9b
lea ecx, [esp + 0xc]
call fcn.00405efa
mov edx, dword [esp + 0x24]
movzx edi, ax
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x406e0d
mov eax, dword [esp + 0x1c]
push dword [esp + 0x28]
sub eax, 0x402670
sar eax, 1
push edx
mov esi, dword [eax*4 + 0x401010]
mov ecx, esi
call dword [0x40d210]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x406e7c
mov esi, dword [0x40c870]
mov dword [esp + 0x18], esi
jmp 0x406f35
push 0x50
test esi, esi
je 0x406ee8
pop edx
push 0x41
pop eax
cmp cx, dx
jne 0x406e5f
cmp word [esi], ax
jne 0x406e5f
lea edx, [esp + 0x1ff0]
mov ecx, eax
call fcn.0040542a
test eax, eax
jne 0x406e7c
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0xc5c]
push 0x1e
push dword [esp + 0x28]
mov dword [esp + 0x20], esi
push 0x1e
pop edx
mov dword [0x40c870], esi
call fcn.00402d39
jmp 0x406f35
cmp word [esi], dx
jne 0x406e7c
cmp cx, ax
jne 0x406e7c
mov edx, dword [esp + 0x28]
mov ecx, eax
call fcn.0040542a
test eax, eax
je 0x406f35
call fcn.00404398
mov eax, 0x667
mov dword [esp + 0x20], eax
call fcn.004063b0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x406ead
cmp dword [0x40c870], eax
jne 0x406ead
call fcn.00404398
mov eax, 0x667
mov dword [esp + 0x20], eax
mov edi, ebx
mov dword [esp + 0x50], edi
test eax, eax
jne 0x407d02
mov ecx, dword [0x40c914]
test ecx, ecx
je 0x407d02
test ecx, ecx
je 0x4070ef
mov esi, dword [0x40b01c]
mov ecx, esi
push ebx
push ebx
call dword [0x40d210]
call esi
jmp 0x407100
mov esi, dword [esp + 0x20]
pop eax
mov dword [esp + 0x18], esi
mov dword [0x40c870], esi
cmp cx, ax
je 0x406f14
mov eax, 0x400
lea ecx, [esp + 0x1ff0]
push eax
push dword [esp + 0x2c]
mov edx, eax
call fcn.00402d39
push 0x1e
push dword [esp + 0x28]
lea ecx, [esp + 0xc64]
push 0x1e
pop edx
call fcn.00402d39
mov eax, dword [esp + 0x1c]
push 0x45
pop edx
cmp word [eax], dx
je 0x406fb3
xor eax, eax
mov word [esp + 0xde8], ax
mov word [esp + 0x17f0], ax
test di, di
je 0x406fb0
mov esi, dword [esp + 0xc]
push 0x20
pop edx
jmp 0x406b32
call fcn.00404398
mov eax, 0x667
mov dword [esp + 0x20], eax
cmp dword [esp + 0x84c], esi
jle 0x406e8a
cmp dword [esp + 0x848], 0
je 0x406e8a
push dword [esp + 0x848]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406e8a
push 0xe
pop eax
jmp 0x406e86
call fcn.00404398
mov ebx, 0x667
jmp 0x407cb7
mov esi, dword [0x40c870]
push 0x45
pop edx
test esi, esi
je 0x406e8a
movzx eax, word [esi]
push 0x59
pop ecx
push 0x5a
pop edi
cmp dx, ax
je 0x406fde
cmp cx, ax
je 0x406fde
cmp di, ax
je 0x406fde
call fcn.004063b0
mov esi, dword [0x40c870]
push 0x50
pop eax
cmp word [esi], ax
mov eax, dword [esp + 0xd0]
je 0x406ff4
lea eax, [esp + 0x1ff0]
sub esi, 0x402670
sar esi, 1
push eax
lea eax, [esp + 0xc60]
push eax
mov esi, dword [esi*4 + 0x401010]
mov ecx, esi
call dword [0x40d210]
call esi
pop ecx
pop ecx
mov ecx, dword [0x40c870]
push 0x59
pop edx
mov dword [esp + 0x20], eax
movzx ecx, word [ecx]
cmp cx, dx
je 0x406aad
cmp cx, di
je 0x406aad
test eax, eax
jne 0x40706d
push 0x45
pop eax
cmp cx, ax
jne 0x40705b
mov edi, ebx
mov dword [0x40c914], 1
mov dword [esp + 0x50], edi
jmp 0x406ed1
mov ecx, dword [0x40c914]
xor edi, edi
inc edi
mov dword [esp + 0x50], edi
jmp 0x406ec9
cmp eax, 0x8000
jne 0x407081
mov dword [0x40c914], ebx
mov eax, ebx
jmp 0x407d02
mov ecx, 0x4eb
cmp eax, ecx
jg 0x4070b7
je 0x406ead
cmp eax, 0xfffffffe
jl 0x4070df
test eax, eax
js 0x406ead
cmp eax, 1
jle 0x4070df
cmp eax, 3
jle 0x4070ac
cmp eax, 0x7b
jne 0x4070df
mov eax, 0x653
mov dword [esp + 0x20], eax
jmp 0x4070df
cmp eax, 0x642
jl 0x4070df
cmp eax, 0x644
jle 0x406ead
cmp eax, 0x669
je 0x406ead
cmp eax, 0xbc2
je 0x406ead
mov ecx, eax
call fcn.00405c94
mov eax, dword [esp + 0x20]
jmp 0x406ead
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x4019a0
call fcn.004090ac
test edi, edi
je 0x40714c
cmp dword [0x40c914], 0
jne 0x407159
mov esi, 0x4025e0
mov edi, ebx
lea eax, [edi + 0x40c6ac]
push eax
push 1
push 4
lea eax, [edi + 0x40b064]
push eax
push esi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x407141
add esi, 0x10
add edi, 4
cmp esi, 0x4025f0
jl 0x407114
jmp 0x40714c
mov dword [esp + 0x84], 1
cmp dword [0x40c914], 0
je 0x407cbb
mov eax, dword fs:[0x30]
lea edi, [esp + 0xc1c]
mov ecx, dword [esp + 0xc]
mov esi, ebx
push 0x20
mov eax, dword [eax + 0x10]
or dword [eax + 8], 0x80000
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
movzx edx, word [ecx]
mov dword [esp + 0x2c], ecx
lea eax, [edx - 0x30]
cmp ax, word [esp + 0x88]
ja 0x4071a1
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x30
jmp 0x4071b6
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x4071f2
mov ecx, esi
and cl, 1
neg cl
sbb cl, cl
sub dl, 0x37
and cl, 0xf1
movzx eax, dl
add cl, 0x10
movzx ecx, cl
imul ecx, eax
cmp esi, edi
jge 0x4071e5
mov eax, esi
test eax, eax
jns 0x4071d2
add eax, 1
sar eax, 1
or byte [esp + eax + 0xc1c], cl
inc esi
mov ecx, dword [esp + 0x2c]
add ecx, 2
jmp 0x40717f
push 0x57
pop edx
mov ecx, 0x4019c0
jmp 0x407cad
cmp esi, edi
je 0x407203
push 0x57
pop edx
mov ecx, 0x401a08
jmp 0x407cad
mov byte [esp + 0x44], bl
mov eax, edx
mov byte [esp + 0x13], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x40], bl
test dx, dx
je 0x407224
add ecx, 2
movzx eax, word [ecx]
cmp ax, 0x43
jne 0x407272
mov byte [esp + 0x44], 1
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x407303
or dword [esp + 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x407303
mov ecx, 0x401b40
jmp 0x407cab
cmp ax, 0x55
jne 0x407284
mov byte [esp + 0x44], 1
mov byte [esp + 0x37], 1
jmp 0x40722f
push 0x41
pop edx
cmp ax, dx
jne 0x407293
mov byte [esp + 0x40], 1
jmp 0x40722f
cmp ax, 0x4d
je 0x4072b0
push 0x52
pop esi
cmp ax, si
je 0x4072b5
push 0x45
pop edx
cmp ax, dx
jne 0x40722f
cmp ax, si
jne 0x4072ba
jmp 0x4072b5
mov byte [esp + 0x13], 1
mov byte [esp + 0x3c], 1
lea eax, [ecx + 4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x407ca0
cmp esi, 0xffffffff
je 0x407ca0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40722f
mov edx, edi
mov ecx, 0x401ad0
jmp 0x407cad
cmp byte [esp + 0x13], 0
jne 0x407310
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [esp + 0x13], 0
je 0x407333
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0x64]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4073e3
lea ecx, [esp + 0x60]
call fcn.004030f2
test eax, eax
jne 0x4073d3
lea eax, [esp + 0x94]
push eax
push 0x50
pop eax
push eax
lea eax, [esp + 0xca0]
push eax
push 1
push dword [esp + 0x74]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4073d3
push dword [esp + 0x60]
push dword [esp + 0xc9c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4073c4
movzx ecx, byte [esp + 0x3c]
xor eax, eax
xor ecx, 1
add ecx, ecx
cmp byte [0x40cd9a], al
setne al
lea edi, [eax + 2]
add edi, ecx
mov dword [esp + 0xc], edi
jmp 0x4073d7
xor eax, eax
cmp byte [0x40cd9a], al
setne al
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407420
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov esi, eax
lea eax, [esp + 0x15ec]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x15e8]
push esi
push 0x401b90
push 0x104
push eax
call fcn.00402e35
mov edi, dword [esp + 0x1c]
add esp, 0x10
cmp byte [esp + 0x37], 0
je 0x407451
cmp edi, 1
jne 0x407437
push 9
pop edx
mov eax, edx
mov dword [esp + 0xc], eax
jmp 0x407458
test edi, edi
jne 0x407444
push 8
pop eax
mov dword [esp + 0xc], eax
jmp 0x407455
push 0x57
pop edx
mov ecx, 0x401bd0
jmp 0x407cad
mov eax, dword [esp + 0xc]
push 9
pop edx
cmp byte [esp + 0x40], 0
je 0x407482
test eax, eax
jne 0x407467
push 6
jmp 0x40746e
cmp eax, 1
jne 0x407475
push 7
pop eax
mov dword [esp + 0xc], eax
jmp 0x407486
push 0x57
pop edx
mov ecx, 0x401c98
jmp 0x407cad
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], 0x100
push 3
pop ecx
test eax, eax
je 0x4074ad
cmp eax, 1
je 0x4074ad
cmp eax, 6
je 0x4074ad
cmp eax, 7
je 0x4074ad
cmp eax, 8
je 0x4074ad
cmp eax, edx
jne 0x4074b0
push 2
pop ecx
push ecx
push ecx
lea edx, [esp + 0x70]
lea ecx, [esp + 0xcf0]
call fcn.004031a9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4074ec
cmp dword [esp + 0x14], 0xffffffff
je 0x4074db
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 0x401d70
call fcn.00405a02
jmp 0x407d04
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0xe0]
push eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
call fcn.00408640
push dword [esp + 0x78]
lea ecx, [esp + 0x40c]
call fcn.00408640
push dword [esp + 0x74]
lea ecx, [esp + 0x73c]
call fcn.00408640
push dword [esp + 0x70]
lea ecx, [esp + 0x62c]
call fcn.00408640
push dword [esp + 0x6c]
lea ecx, [esp + 0x51c]
call fcn.00408640
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x51c]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x634]
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x74c]
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x424]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x104]
lea eax, [esp + 0xd10]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x4075d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x4075c4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401dc0
mov esi, edi
jmp 0x407674
mov esi, dword [0x40b020]
or edi, 0xffffffff
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push edi
push dword [esp + 0x100]
mov ecx, esi
call dword [0x40d210]
call esi
mov esi, eax
test esi, esi
je 0x407616
cmp dword [esp + 0x14], edi
je 0x40760a
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x641
mov ebx, 0x401e08
jmp 0x407674
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x38], eax
test eax, eax
jne 0x407640
cmp dword [esp + 0x14], edi
je 0x407639
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401e68
jmp 0x407667
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x407682
cmp dword [esp + 0x14], edi
je 0x407662
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401ed8
mov edi, 0x641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.00405a02
jmp 0x407ae6
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x4c], ebx
call fcn.004062b8
mov esi, eax
mov edi, 0x641
mov dword [esp + 0x28], edi
test esi, esi
jne 0x4076bd
cmp dword [esp + 0x14], 0xffffffff
je 0x4076b3
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401f60
jmp 0x4078ff
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x7c], ebx
call fcn.00403dfa
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x4076ef
cmp dword [esp + 0x14], 0xffffffff
je 0x4076e5
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x401fc0
jmp 0x4078ff
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40770b
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx]
lea eax, [esp + 0x30]
push eax
push 0x402618
push ecx
mov ecx, dword [edi]
call dword [0x40d210]
call dword [edi]
mov ecx, dword [esp + 0x2c]
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x58], edi
test eax, eax
je 0x407756
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x40d210]
call edi
mov edi, dword [esi]
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x50]
push eax
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0xc2c]
push 0x10
push eax
lea eax, [esp + 0x70]
push eax
push esi
call dword [0x40d210]
call dword [edi + 0x38]
test eax, eax
je 0x4077aa
cmp dword [esp + 0x14], 0xffffffff
je 0x40779c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x28]
mov ebx, 0x402030
jmp 0x4078ff
push dword [esp + 0x5c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x60], eax
test eax, eax
jne 0x4077e7
cmp dword [esp + 0x14], 0xffffffff
je 0x4077d3
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x4020a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x28]
jmp 0x407901
push dword [esp + 0x4c]
mov edi, dword [0x40b028]
mov ecx, edi
call dword [0x40d210]
call edi
test eax, eax
jne 0x40781a
cmp dword [esp + 0x14], 0xffffffff
je 0x407810
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x402110
jmp 0x4078fa
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push ecx
push 0x4026b0
push eax
mov edi, dword [eax]
mov ecx, dword [edi]
call dword [0x40d210]
call dword [edi]
mov eax, dword [esp + 0xc]
mov ecx, ebx
cmp eax, dword [esp + 0x58]
jne 0x40784d
cmp eax, 8
je 0x40784d
push 9
pop edx
cmp eax, edx
jne 0x407851
lea ecx, [esp + 0x58]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xc1c]
push edx
push ecx
push eax
mov edi, dword [eax]
mov edi, dword [edi + 0xa0]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x38]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xa8]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esp + 0x1c]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0xac]
mov ecx, edi
call dword [0x40d210]
call edi
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push dword [esp + 0x80]
push dword [esp + 0x44]
mov edi, dword [eax]
push dword [esp + 0x4c]
push dword [esp + 0x54]
mov edi, dword [edi + 0xa4]
mov ecx, edi
push dword [esp + 0x70]
push eax
call dword [0x40d210]
call edi
cmp dword [esp + 0x14], 0xffffffff
mov edi, eax
je 0x4078f1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x14], 0xffffffff
test edi, edi
je 0x407957
mov ebx, 0x402178
mov edi, 0x641
mov eax, edi
mov edx, eax
mov ecx, ebx
call fcn.00405a02
test esi, esi
je 0x40791e
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x407936
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x407ae6
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
jmp 0x407ae6
mov eax, dword [esp + 0x1c]
push dword [esp + 0x4c]
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x9c]
mov ecx, edi
call dword [0x40d210]
call edi
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40799a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4079b2
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x13], bl
mov dword [esp + 0xb84], edi
mov dword [esp + 0xb88], esi
mov dword [esp + 0xb8c], eax
jmp 0x407a91
cmp eax, 1
je 0x407b98
cmp eax, 2
jne 0x407a3d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], ebx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
mov ecx, esi
call dword [0x40d210]
call esi
push dword [esp + 0x80]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407abe
mov dword [esp + 0xb84], edi
jmp 0x407a91
cmp eax, 3
jne 0x407ba2
jmp 0x407a6e
cmp dword [esp + 0x9c], 0x12
je 0x407ab6
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x407a48
mov al, byte [esp + 0x13]
test al, al
jne 0x407ba2
push 0x1cff
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb90]
push eax
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x4079dc
jmp 0x407ba2
mov al, 1
mov byte [esp + 0x13], al
jmp 0x407a89
cmp dword [esp + 0x14], 0xffffffff
je 0x407acf
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x4020a0
call fcn.00405a02
mov edi, 0x641
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407b0b
cmp dword [esp + 0x518], 0
je 0x407b0b
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407b2b
cmp dword [esp + 0x628], 0
je 0x407b2b
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x407b4b
cmp dword [esp + 0x738], 0
je 0x407b4b
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x407b6b
cmp dword [esp + 0x408], 0
je 0x407b6b
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407d04
cmp dword [esp + 0xe0], 0
je 0x407d04
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x407d04
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d210]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [esp + 0x51c], ebx
jle 0x407be2
cmp dword [esp + 0x518], 0
je 0x407be2
push dword [esp + 0x518]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x62c], ebx
jle 0x407c02
cmp dword [esp + 0x628], 0
je 0x407c02
push dword [esp + 0x628]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x73c], ebx
jle 0x407c22
cmp dword [esp + 0x738], 0
je 0x407c22
push dword [esp + 0x738]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x40c], ebx
jle 0x407c42
cmp dword [esp + 0x408], 0
je 0x407c42
push dword [esp + 0x408]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0xe4], ebx
jle 0x407c62
cmp dword [esp + 0xe0], 0
je 0x407c62
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x50], 0
je 0x407c82
cmp dword [0x40c914], 0
jne 0x407c82
mov eax, dword [0x40c6ac]
test eax, eax
je 0x407c82
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x84], 0
je 0x407cfe
mov edi, 0x641
mov ecx, edi
call fcn.00405c94
jmp 0x407d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x401a68
mov edx, eax
call fcn.00405a02
mov ebx, 0x641
mov edi, ebx
jmp 0x407d04
push ebx
push ebx
push ebx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x407ce0
cmp dword [0x40cb80], eax
je 0x407c62
cmp dword [0x40c910], eax
je 0x407c62
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x407cbb
mov eax, dword [esp + 0x20]
mov edi, eax
lea ecx, [esp + 0x1f0]
call fcn.004086d2
lea ecx, [esp + 0xd0]
call fcn.004087f4
mov ecx, dword [esp + 0x27f4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409600
mov esp, ebp
pop ebp
ret