Function at 0x410690
Capabilities:
Create process on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x4706a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x8a8]
push ecx
sub eax, 0x10
mov dword [ebp - 0x48], esp
mov ebx, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x20]
add esp, 4
push eax
call fcn.00403700
add esp, 8
push 0x46121c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00404700
push 0x46121c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00404700
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00403e00
add esp, 0xc
push 0x46102c
push eax
lea ecx, [ebp - 0x24]
push ecx
mov byte [ebp - 4], 4
call fcn.00403ec0
add esp, 0xc
lea ebx, [esi + 0x89c]
push ebx
push eax
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 5
call fcn.00403e00
add esp, 0xc
push 0x46102c
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.00403ec0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.004047c0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41079b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4107be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4107e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410804
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xc
push str.MANUINFO.XML
lea ecx, [ebp - 0x10]
call fcn.00404310
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x48], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x461a40
call fcn.00404700
lea ecx, [ebp - 0x30]
push ecx
mov byte [ebp - 4], 3
call fcn.00411950
mov edi, eax
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], 9
call fcn.00403e00
add esp, 0xc
push 0x46102c
push eax
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0xa
call fcn.00403ec0
add esp, 0xc
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xb
call fcn.00403e00
add esp, 0xc
push 0x46102c
push eax
lea ecx, [ebp - 0x24]
push ecx
mov byte [ebp - 4], 0xc
call fcn.00403ec0
add esp, 0xc
push edi
push eax
lea edx, [ebp - 0x28]
push edx
mov byte [ebp - 4], 0xd
call fcn.00403e00
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
call fcn.004047c0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4108e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410907
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41092a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41094d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410970
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410993
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x3c
lea ecx, [ebp - 0x8c]
push 0
push ecx
call fcn.0043aae0
mov edx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x8c], 0x3c
mov dword [ebp - 0x80], str.open
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x88], 0x4440
call edi
test eax, eax
je 0x4109f1
mov ecx, dword [ebp - 0x54]
push ecx
jmp 0x411310
mov eax, dword [ebp - 0x6c]
cmp eax, 0x1f
je 0x4112f5
cmp eax, 0x1b
je 0x4112f5
push 0x46121c
lea ecx, [ebp - 0x14]
call fcn.00404700
mov byte [ebp - 4], 0xf
mov edx, dword [ebp + 8]
push str.navg
push edx
call fcn.004398a8
add esp, 8
test eax, eax
jne 0x410c3e
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp + 0xc], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x48], esp
push str.Option
call fcn.00404700
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 4], 0xf
call fcn.00411950
push str.http:__support.epson.net_sec_pubs_redirect3.php
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.00404c80
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x48], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x12
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Language
call fcn.00404700
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x11
call fcn.00411950
push eax
lea ecx, [ebp + 0xc]
push str._LG2
push ecx
mov byte [ebp - 4], 0x13
call fcn.004085f0
add esp, 0xc
mov byte [ebp - 4], 0x14
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00404310
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410aed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410b10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.OSCWS
lea ecx, [ebp - 0x14]
call fcn.00403960
lea ecx, [ebp - 0x18]
push 0x461b54
push ecx
call fcn.00414780
add esp, 8
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x48], esp
push edx
test al, al
je 0x410ba8
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.DeviceID
call fcn.00404700
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 0x11
call fcn.00411950
push 0x461b58
push 0x46101c
lea ecx, [ebp + 0xc]
push ecx
mov byte [ebp - 4], 0x16
call fcn.004039b0
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x30]
push 0x461b60
push eax
call fcn.004085f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x17
call fcn.004085a0
lea ecx, [ebp - 0x30]
call fcn.00404d20
lea ecx, [ebp + 0xc]
jmp 0x410bfc
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x18
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.MarketName
call fcn.00404700
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x11
call fcn.00411950
push eax
lea ecx, [ebp + 0xc]
push str.MKN
push ecx
mov byte [ebp - 4], 0x19
call fcn.004085f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1a
call fcn.004085a0
lea ecx, [ebp + 0xc]
call fcn.00404d20
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x11
call fcn.00404d20
push str.PINFsupport
lea ecx, [ebp - 0x14]
call fcn.00403960
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4112a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4112a5
mov ecx, dword [ebp + 8]
push str.useghtml
push ecx
call fcn.004398a8
add esp, 8
test eax, eax
jne 0x410e14
lea ecx, [ebp - 0x18]
call fcn.00404d40
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 0x1b
mov ecx, dword [esi + 0x79c]
push edx
call fcn.004252cf
push str.http:__support.epson.net_sec_pubs_redirect5.php
lea ecx, [ebp - 0x14]
call fcn.00404c80
push ecx
mov dword [ebp - 0x48], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x1b
call fcn.00411950
lea edi, [ebp - 0x2c]
call fcn.00401f40
add esp, 4
push eax
lea ecx, [ebp - 0x30]
push str._model
push ecx
mov byte [ebp - 4], 0x1d
call fcn.004085f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1e
call fcn.004085a0
lea ecx, [ebp - 0x30]
call fcn.00404d20
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.00404d20
push str.typeuseg
lea ecx, [ebp - 0x14]
call fcn.00403960
push ecx
mov dword [ebp - 0x48], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x48], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Language
call fcn.00404700
push edi
mov byte [ebp - 4], 0x1b
call fcn.00411950
lea edi, [ebp - 0x2c]
call fcn.00401f40
add esp, 4
push eax
mov byte [ebp - 4], 0x20
push str.lang
lea eax, [ebp - 0x30]
push eax
call fcn.004085f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x21
call fcn.004085a0
lea ecx, [ebp - 0x30]
call fcn.00404d20
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.00404d20
cmp dword [ebp + 0xc], 0
je 0x410df2
mov ecx, dword [ebp - 0x18]
cmp dword [ecx - 0xc], 0
je 0x410df2
push ecx
lea edx, [ebp - 0x18]
mov ecx, esp
mov dword [ebp + 0xc], esp
push edx
call fcn.004048c0
lea ecx, [ebp + 0xc]
call fcn.004142e0
push str.filenameresult.htm
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x22
call fcn.00403960
push str.EXEEPSMLAN
lea ecx, [ebp - 0x14]
call fcn.00403960
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
push 0x461c98
push ecx
call fcn.004085f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x23
call fcn.004085a0
lea ecx, [ebp - 0x30]
call fcn.00404d20
lea ecx, [ebp + 0xc]
call fcn.00404d20
lea ecx, [ebp - 0x18]
jmp 0x4112a0
push str.filenameindex.htm
lea ecx, [ebp - 0x14]
call fcn.00403960
push str.EXEEPSMLAN
lea ecx, [ebp - 0x14]
call fcn.00403960
lea ecx, [ebp - 0x18]
jmp 0x4112a0
lea edx, [ebp + 8]
push edx
mov ecx, str.cp_online
call fcn.004085c0
test eax, eax
je 0x4110c0
lea eax, [ebp + 8]
push eax
mov ecx, str.cp_opeg
call fcn.004085c0
test eax, eax
je 0x4110c0
lea ecx, [ebp + 8]
push ecx
mov ecx, str.cp_ginfo
call fcn.004085c0
test eax, eax
je 0x4110c0
lea edx, [ebp + 8]
push edx
mov ecx, str.cp_useg
call fcn.004085c0
test eax, eax
je 0x4110c0
lea eax, [ebp + 8]
push eax
mov ecx, str.cp_useg2
call fcn.004085c0
test eax, eax
je 0x4110c0
lea ecx, [ebp + 8]
push ecx
mov ecx, str.cp_netg
call fcn.004085c0
test eax, eax
je 0x4110c0
push str.http:__support.epson.net_sec_pubs_redirect2.php
lea ecx, [ebp - 0x14]
call fcn.00404c80
push ecx
mov edi, esp
mov dword [ebp + 0xc], esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x32
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x461a40
call fcn.00404700
push edi
mov byte [ebp - 4], 0xf
call fcn.00411950
lea edi, [ebp - 0x44]
call fcn.00401f40
add esp, 4
push eax
push str.filename
push ecx
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x34
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.Language
call fcn.00404700
push edi
mov byte [ebp - 4], 0x33
call fcn.00411950
lea edi, [ebp - 0x40]
call fcn.00401f40
add esp, 4
push eax
push str.lang
push ecx
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x36
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ManualType
call fcn.00404700
push edi
mov byte [ebp - 4], 0x35
call fcn.00411950
lea edi, [ebp - 0x3c]
call fcn.00401f40
add esp, 4
push eax
mov byte [ebp - 4], 0x37
push str.type
push ecx
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x38
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x37
call fcn.00411950
lea edi, [ebp - 0x38]
call fcn.00401f40
add esp, 4
push eax
lea ecx, [ebp - 0x34]
push str._model
push ecx
mov byte [ebp - 4], 0x39
call fcn.004085f0
add esp, 0xc
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x3a
call fcn.00403ec0
add esp, 0xc
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x3b
call fcn.00403e00
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp - 4], 0x3c
call fcn.00403ec0
add esp, 0xc
push eax
lea edx, [ebp - 0x2c]
push edx
mov byte [ebp - 4], 0x3d
call fcn.00403e00
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x3e
call fcn.00403ec0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
push ecx
mov byte [ebp - 4], 0x3f
call fcn.00403e00
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x40
call fcn.004085a0
lea ecx, [ebp + 0xc]
call fcn.00404d20
lea ecx, [ebp - 0x30]
call fcn.00404d20
lea ecx, [ebp - 0x2c]
call fcn.00404d20
lea ecx, [ebp - 0x28]
call fcn.00404d20
lea ecx, [ebp - 0x24]
call fcn.00404d20
lea ecx, [ebp - 0x18]
call fcn.00404d20
lea ecx, [ebp - 0x34]
call fcn.00404d20
mov ecx, edi
call fcn.00404d20
lea ecx, [ebp - 0x3c]
call fcn.00404d20
lea ecx, [ebp - 0x40]
call fcn.00404d20
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xf
call fcn.00404d20
lea edx, [ebp - 0x48]
push edx
call fcn.00402a10
add esp, 4
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x41
call fcn.004085a0
lea ecx, [ebp - 0x48]
jmp 0x4112a0
push str.http:__download2.ebz.epson.net_sec_cp_pubs_
lea ecx, [ebp - 0x14]
call fcn.00404c80
push ecx
mov edi, esp
mov dword [ebp + 0xc], esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x24
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x461a40
call fcn.00404700
push edi
mov byte [ebp - 4], 0xf
call fcn.00411950
lea edi, [ebp - 0x28]
call fcn.00401f40
add esp, 4
push eax
push 0x461028
push ecx
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.Language
call fcn.00404700
push edi
mov byte [ebp - 4], 0x25
call fcn.00411950
lea edi, [ebp - 0x2c]
call fcn.00401f40
add esp, 4
push eax
push 0x461028
push ecx
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x28
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ManualType
call fcn.00404700
push edi
mov byte [ebp - 4], 0x27
call fcn.00411950
lea edi, [ebp - 0x30]
call fcn.00401f40
add esp, 4
push eax
mov byte [ebp - 4], 0x29
push 0x461028
push ecx
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x2a
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x29
call fcn.00411950
lea edi, [ebp - 0x34]
call fcn.00401f40
add esp, 4
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00403ec0
add esp, 0xc
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov byte [ebp - 4], 0x2c
call fcn.00403e00
add esp, 0xc
push eax
lea edx, [ebp - 0x40]
push edx
mov byte [ebp - 4], 0x2d
call fcn.00403ec0
add esp, 0xc
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00403e00
add esp, 0xc
push eax
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 0x2f
call fcn.00403ec0
add esp, 0xc
push eax
lea edx, [ebp + 0xc]
push edx
mov byte [ebp - 4], 0x30
call fcn.00403e00
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x31
call fcn.004085a0
lea ecx, [ebp + 0xc]
call fcn.00404d20
lea ecx, [ebp - 0x48]
call fcn.00404d20
lea ecx, [ebp - 0x44]
call fcn.00404d20
lea ecx, [ebp - 0x40]
call fcn.00404d20
lea ecx, [ebp - 0x3c]
call fcn.00404d20
lea ecx, [ebp - 0x38]
call fcn.00404d20
mov ecx, edi
call fcn.00404d20
lea ecx, [ebp - 0x30]
call fcn.00404d20
lea ecx, [ebp - 0x2c]
call fcn.00404d20
lea ecx, [ebp - 0x28]
call fcn.00404d20
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x8c]
push ecx
mov dword [ebp - 0x88], 0x4040
mov dword [ebp - 0x7c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4112d0
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411316
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x411316
lea ecx, [ebp - 0x8c]
push ecx
mov dword [ebp - 0x88], 0x4040
call edi
test eax, eax
je 0x411316
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x8a4], 1
jne 0x4114bc
mov eax, dword [esi + 0x8a0]
push str.DESKTOP
push eax
call fcn.004398a8
add esp, 8
test eax, eax
jne 0x411399
mov eax, dword [ebx]
push ecx
sub eax, 0x10
mov dword [ebp - 0x50], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], esp
mov edi, esp
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x4c], esp
mov dword [ebp + 0xc], esp
push eax
call fcn.00404850
mov ecx, dword [ebp + 0xc]
add eax, 0x10
mov dword [ecx], eax
mov byte [ebp - 4], 0x43
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x42
call fcn.00411950
push 9
jmp 0x4114ac
mov eax, dword [esi + 0x8a0]
push str.STARTMENU
push eax
call fcn.004398a8
add esp, 8
test eax, eax
jne 0x41140f
mov eax, dword [ebx]
push ecx
sub eax, 0x10
mov dword [ebp - 0x50], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], esp
mov edi, esp
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x4c], esp
mov dword [ebp + 0xc], esp
push eax
call fcn.00404850
mov edx, dword [ebp + 0xc]
add eax, 0x10
mov dword [edx], eax
mov byte [ebp - 4], 0x45
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x44
call fcn.00411950
push 0xa
jmp 0x4114ac
mov eax, dword [esi + 0x8a0]
push 0x461dcc
push eax
call fcn.004398a8
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
test eax, eax
jne 0x41146e
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x46
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x47
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x46
call fcn.00411950
push 0x10
jmp 0x4114ac
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x48
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x49
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], 0x48
call fcn.00411950
push 0xb
mov byte [ebp - 4], 3
call fcn.00413830
mov byte [esi + 0x8a4], 0
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp + 0xc], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004132c0
cmp eax, 0x1f4
jg 0x4116ec
je 0x411692
cmp eax, 0xca
jg 0x4115ee
je 0x4115a4
cmp eax, 0x64
je 0x41155a
add eax, 0xffffff38
cmp eax, 1
ja 0x4118ad
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x4e
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x4f
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 6
jmp 0x4118a4
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x4a
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x4b
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 5
jmp 0x4118a4
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x4c
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x4d
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 0xf
jmp 0x4118a4
sub eax, 0x12c
je 0x411648
sub eax, 0x64
jne 0x4118ad
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x52
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x53
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 8
jmp 0x4118a4
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x50
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x51
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 7
jmp 0x4118a4
mov ebx, dword [ebx]
push ecx
sub ebx, 0x10
mov dword [ebp + 0xc], esp
mov edi, esp
push ebx
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x54
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], esp
mov ebx, esp
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x50], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x55
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push ebx
mov byte [ebp - 4], 0x54
call fcn.00411950
push 0xd
jmp 0x4118a4
cmp eax, 0x320
jg 0x4117fb
je 0x4117a1
sub eax, 0x258
je 0x411757
sub eax, 0x64
jne 0x4118ad
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x58
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x59
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 0x15
jmp 0x4118a4
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x56
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x57
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 0x14
jmp 0x4118a4
mov ebx, dword [ebx]
push ecx
sub ebx, 0x10
mov dword [ebp + 0xc], esp
mov edi, esp
push ebx
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x5a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], esp
mov ebx, esp
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x50], esp
mov edi, esp
push eax
call fcn.00404850
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x5b
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push ebx
mov byte [ebp - 4], 0x5a
call fcn.00411950
push 0x16
jmp 0x4118a4
cmp eax, 0x384
jl 0x4118ad
cmp eax, 0x385
jle 0x41185f
cmp eax, 0x3e8
jne 0x4118ad
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x5e
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x5f
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 0x1a
jmp 0x4118a4
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push ebx
call fcn.004048c0
push ecx
mov bl, 0x5c
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004048c0
push ecx
mov byte [ebp - 4], 0x5d
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.DeviceID
call fcn.00404700
push edi
mov byte [ebp - 4], bl
call fcn.00411950
push 0x19
mov byte [ebp - 4], 3
call fcn.00413830
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4118d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4118f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411916
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41193c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8