Function at 0x407380
Capabilities:
Acquire debug privileges
Get keyboard layout

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
mov edi, 1
push ebp
mov dword [esi + 0x34], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
mov ecx, esi
mov dword [0x5e375c], eax
call fcn.004067c0
test eax, eax
jne 0x4073b3
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
push ebp
push section..taihang
call fcn.0046faf0
mov eax, dword [0x5c2094]
add esp, 8
cmp eax, ebp
mov dword [0x5bc8b8], eax
je 0x4073f8
xor eax, eax
push ebp
mov dword [esp + 0x1c], eax
push edi
lea ecx, [esp + 0x1c]
push edi
mov dword [esp + 0x28], eax
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x5e3760], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push 0x4ce940
push eax
mov dword [esp + 0x1c], ebp
call fcn.00437820
mov dword [0x5bc8bc], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebp
jne 0x40742c
mov ecx, dword [0x5c208c]
mov dword [0x5bc8bc], ecx
mov ecx, esi
call fcn.00407280
call fcn.00443f30
push edi
call fcn.00416240
push 0x5e3544
push 0x4ce930
push str.Main
call fcn.00408b20
push 0x103
push 0x5e3548
push str.Skin
push str.Path
call fcn.004089d0
mov edx, dword [0x5c20d0]
mov eax, dword [0x5c01a4]
push str.TheWorld_Default
push edx
push 0x34
push 0x33
push eax
push 0x64
push 0x66
call fcn.00495a10
add esp, 0x3c
push 0x16
push str.FavoriteCY
push str.ToolBar
call fcn.004a6fb0
mov ecx, eax
call fcn.004a7aa0
lea ecx, [esp + 0xc]
mov dword [0x5e3520], eax
push ecx
push 0x28
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407502
lea edx, [esp + 0x24]
push edx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
push ebp
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebp
push 0x1f0fff
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x10], eax
call fcn.004302b0
mov edi, eax
call fcn.0046f5d0
mov ebx, eax
call fcn.004668d0
mov ecx, eax
call fcn.00466920
call fcn.0041dfb0
mov ecx, eax
call fcn.0041e290
call fcn.004731e0
mov ecx, esi
call fcn.00408400
mov ecx, 0x5bd038
call fcn.004887f0
mov eax, dword [0x5bc1d0]
cmp eax, ebp
je 0x40757c
mov ecx, dword [0x5bc1c8]
mov edx, dword [0x5bc1cc]
push ecx
push edx
push eax
call fcn.0041dfb0
mov ecx, eax
call fcn.00424270
cmp edi, ebp
je 0x407594
mov eax, dword [esp + 0x38]
mov ecx, esi
push eax
call fcn.00407620
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
call fcn.00411be0
cmp eax, ebp
je 0x4075a5
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
cmp ebx, ebp
je 0x4075b1
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ecx, 0x5c02c8
call fcn.0049f0e0
call fcn.00495a60
call fcn.0046ff60
push ebp
call fcn.00416240
add esp, 4
mov ecx, esi
push ebp
call fcn.004067c0
mov eax, dword [esi + 0xc]
pop ebx
cmp eax, ebp
je 0x4075ec
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov dword [esi + 0xc], ebp
jmp 0x4075f2
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x10]
cmp esi, ebp
je 0x4075fc
push esi
call edi
mov eax, dword [0x5e3760]
mov dword [0x5e3760], ebp
cmp eax, ebp
je 0x40760e
push eax
call edi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 4