Function at 0x427bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x52bd60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0xc0], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0x19c], edi
mov dword [ebp - 4], 0
and dword [ebp - 0x20], 0xfffffe00
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
call fcn.004461e0
xor al, al
lea edx, [ebp + 8]
lea ecx, [ebp - 0x40]
mov byte [ebp - 0xb2], al
mov byte [ebp - 4], 4
call fcn.00431ab0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
call fcn.00401410
cmp dword [ebp - 0x74], 0x10
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x88]
cmovae ecx, dword [ebp - 0x88]
push ecx
lea edx, [ebp - 0x28]
add eax, ecx
push edx
push eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.004462f0
test al, al
jne 0x427dd9
push str.parse_error
lea ecx, [ebp - 0x18]
call fcn.00403790
push str.h_nd1eJSReque_t
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 6
call fcn.004036e0
mov byte [ebp - 4], 7
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0xb8], esi
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 8
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x427d37
push 2
push edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xbc]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x427d5d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427d7a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xc0]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427d9d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427dbd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
cmp dword [ebp - 0x2c], 0x10
jb 0x427dce
push dword [ebp - 0x40]
call fcn.004b458c
add esp, 4
mov eax, dword [ebp - 0xd0]
jmp 0x42984f
mov eax, dword [ebp - 0x20]
test al, al
jne 0x427eb0
push str.root_NULL
lea ecx, [ebp - 0x18]
call fcn.00403790
push str.h_ndleJ_Request
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xa
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_ConvertDefaultLocale
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0xb8], esi
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], reloc.kernel32.dll_AssignProcessToJobObject
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x427e64
push 2
push edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_AssignProcessToJobObject
mov edx, dword [ebp - 0xbc]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x427e8a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_ConvertDefaultLocale
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x427ea7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 0xa
jmp 0x427d7e
cmp al, 7
je 0x427ece
push 0x42b
push str...CrossRiderGeneralJsonjson_value.cpp
push str.type___nullValue__type___objectValue
call fcn.004b708c
mov eax, dword [ebp - 0x20]
add esp, 0xc
test al, al
je 0x429699
mov dword [ebp - 0xc8], 0x513b68
mov dword [ebp - 0xc4], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0xc8]
push eax
mov ecx, esi
call fcn.0044b6a0
mov ecx, dword [esi]
cmp eax, ecx
je 0x427f66
mov esi, dword [eax + 0x10]
mov edx, reloc.kernel32.dll_lstrlenW
lea esp, [esp]
mov bl, byte [edx]
cmp bl, byte [esi]
mov byte [ebp - 0xb1], bl
mov ebx, dword [ebp - 0xc0]
jne 0x427f52
cmp byte [ebp - 0xb1], 0
je 0x427f4e
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
mov byte [ebp - 0xb1], bl
mov ebx, dword [ebp - 0xc0]
jne 0x427f52
add edx, 2
add esi, 2
cmp byte [ebp - 0xb1], 0
jne 0x427f10
xor edx, edx
jmp 0x427f57
sbb edx, edx
or edx, 1
test edx, edx
sets dl
mov dword [ebp - 0xb8], eax
test dl, dl
je 0x427f6c
mov dword [ebp - 0xb8], ecx
lea eax, [ebp - 0xb8]
mov eax, dword [eax]
mov byte [ebp - 4], 5
cmp eax, ecx
je 0x429699
add eax, 0x18
cmp eax, 0x530a10
je 0x429699
push ecx
push reloc.kernel32.dll_lstrlenW
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov ecx, eax
call fcn.0044a210
mov dword [ebp - 0xbc], eax
xor al, al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
test al, al
je 0x428099
cmp al, 7
je 0x427fd7
push 0x42b
push str...CrossRiderGeneralJsonjson_value.cpp
push str.type___nullValue__type___objectValue
call fcn.004b708c
mov eax, dword [ebp - 0x20]
add esp, 0xc
test al, al
je 0x428099
mov dword [ebp - 0xc8], str.params
mov dword [ebp - 0xc4], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0xc8]
push eax
mov ecx, esi
call fcn.0044b6a0
mov ecx, dword [esi]
cmp eax, ecx
je 0x428068
mov esi, dword [eax + 0x10]
mov edx, str.params
mov bl, byte [edx]
cmp bl, byte [esi]
mov byte [ebp - 0xb1], bl
mov ebx, dword [ebp - 0xc0]
jne 0x428054
cmp byte [ebp - 0xb1], 0
je 0x428050
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
mov byte [ebp - 0xb1], bl
mov ebx, dword [ebp - 0xc0]
jne 0x428054
add edx, 2
add esi, 2
cmp byte [ebp - 0xb1], 0
jne 0x428012
xor edx, edx
jmp 0x428059
sbb edx, edx
or edx, 1
test edx, edx
sets dl
mov dword [ebp - 0xb8], eax
test dl, dl
je 0x42806e
mov dword [ebp - 0xb8], ecx
lea eax, [ebp - 0xb8]
mov eax, dword [eax]
mov byte [ebp - 4], 5
cmp eax, ecx
mov ecx, dword [ebp - 0x18]
je 0x42809c
add eax, 0x18
movzx ecx, cl
mov edx, 1
cmp eax, 0x530a10
cmovne ecx, edx
mov dword [ebp - 0x18], ecx
jmp 0x42809c
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0xbc]
lea eax, [esi - 1]
cmp eax, 0x1f
ja case.default.0x4280ae
jmp dword [eax*4 + 0x4298bc]
mov ecx, dword [0x530408]
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
mov ecx, reloc.kernel32.dll_SetConsoleCursorPosition
idiv ecx
cmp edx, 9
jne 0x428120
mov eax, dword [str.x3PnSBE]
mov dword [ebp - 0xc8], eax
mov eax, dword [0x514a8c]
lea edx, [ebp - 0xc8]
mov dword [ebp - 0xc4], eax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4280f3
sub edx, ecx
xor ecx, ecx
mov eax, edx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b3d60
add esp, 4
push eax
call fcn.004b4e1b
add esp, 4
mov eax, dword [ebp - 0x18]
test al, al
jne 0x428220
push str.no_p_rams_for_readReg
lea ecx, [ebp - 0xf8]
call fcn.00403790
push str.hand1eJ_Reque_t
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0xf8]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryA
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4281ab
push 2
push edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
mov edx, dword [ebp - 0x164]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4281d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4281ee
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
mov edx, dword [ebp - 0xc0]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428211
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xf8]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0040f8e0
mov ecx, dword [0x530408]
mov esi, 6
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
cmp edx, 5
jne 0x429562
dec ecx
mov dword [0x530408], ecx
jmp 0x429562
test cl, cl
jne 0x42835d
push str.no_p_r_m__for_writeReg
lea ecx, [ebp - 0xe4]
call fcn.00403790
push str.h_ndleJ_Reque_t
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], reloc.kernel32.dll_IsProcessInJob
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0xe4]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4282e8
push 2
push edi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
mov edx, dword [ebp - 0x184]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42830e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42832b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_IsProcessInJob
mov edx, dword [ebp - 0xdc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42834e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xe4]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00411300
jmp 0x429562
test cl, cl
jne 0x428476
push str.no_p_r_ms_for_enumRegKeys
lea ecx, [ebp - 0x150]
call fcn.00403790
push str.h_nd1eJ_Request
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_lstrcpynW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_ReadProcessMemory
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428401
push 2
push edi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0x18c]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428427
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_lstrcpynW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428444
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionA
mov edx, dword [ebp - 0x148]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428467
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x150]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00412790
jmp 0x429562
test cl, cl
jne 0x42858f
push str.no_par_ms_for_enumRegVa1ue_
lea ecx, [ebp - 0x160]
call fcn.00403790
push str.handleJSReque_t
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x160]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42851a
push 2
push edi
lea eax, [ebp - 0x158]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
mov edx, dword [ebp - 0x1a4]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428540
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessA
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42855d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
mov edx, dword [ebp - 0x158]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428580
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x160]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00413820
jmp 0x429562
test cl, cl
jne 0x4286a8
push str.no_par_ms_for_re_dFile
lea ecx, [ebp - 0x128]
call fcn.00403790
push str.h_nd1eJSRequest
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428633
push 2
push edi
lea eax, [ebp - 0x144]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
mov edx, dword [ebp - 0x1ac]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428659
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428676
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
mov edx, dword [ebp - 0x144]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428699
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x128]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00414c70
jmp 0x429562
test cl, cl
jne 0x4287c1
push str.no_par_m__for_writeFi1e
lea ecx, [ebp - 0x130]
call fcn.00403790
push str.hand1eJ_Reque_t
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SetFileAttributesW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_LocalReAlloc
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42874c
push 2
push edi
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428772
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SetFileAttributesW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42878f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
mov edx, dword [ebp - 0xe0]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4287b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x130]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.004157b0
jmp 0x429562
test cl, cl
jne 0x4288da
push str.no_p_rams_for_enumFolders
lea ecx, [ebp - 0x138]
call fcn.00403790
push str.handleJ_Request
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x138]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_GetTimeFormatW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428865
push 2
push edi
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
mov edx, dword [ebp - 0x190]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42888b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4288a8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
mov edx, dword [ebp - 0xe8]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4288cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x138]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00415fa0
jmp 0x429562
test cl, cl
jne 0x4289f3
push str.no_p_ram__for_deleteFile_y_temE1m
lea ecx, [ebp - 0xf4]
call fcn.00403790
push str.h_ndleJSReque_t
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetDriveTypeW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0xf4]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42897e
push 2
push edi
lea eax, [ebp - 0x140]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
mov edx, dword [ebp - 0x170]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4289a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetDriveTypeW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4289c1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
mov edx, dword [ebp - 0x140]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4289e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xf4]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00416a50
jmp 0x429562
test cl, cl
jne 0x428b0c
push str.no_param__for_deleteRegElement
lea ecx, [ebp - 0xfc]
call fcn.00403790
push str.h_nd1eJ_Reque_t
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0xfc]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], reloc.kernel32.dll_CreateActCtxW
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428a97
push 2
push edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_CreateActCtxW
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428abd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428ada
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428afd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xfc]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00417520
jmp 0x429562
test cl, cl
jne 0x428c25
push str.no_p_ram__for_we6Request
lea ecx, [ebp - 0x104]
call fcn.00403790
push str.h_ndleJSRequest
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_HeapSetInformation
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428bb0
push 2
push edi
lea eax, [ebp - 0x154]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
mov edx, dword [ebp - 0x178]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428bd6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_HeapSetInformation
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428bf3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
mov edx, dword [ebp - 0x154]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428c16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x104]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.004188e0
jmp 0x429562
mov ecx, edi
call fcn.004198c0
jmp 0x429562
mov ecx, edi
call fcn.0041a5a0
jmp 0x429562
mov ecx, edi
call fcn.0041a9a0
jmp 0x429562
mov eax, dword [0x530518]
push 0
push 0
push 0x410
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x429562
test cl, cl
jne 0x428d7e
push str.no_p_rams_for_writeLog
lea ecx, [ebp - 0x10c]
call fcn.00403790
push str.handleJ_Reque_t
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToTzSpecificLocalTime
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_VerifyVersionInfoW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x10c]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], reloc.kernel32.dll_DosDateTimeToFileTime
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_ResumeThread
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428d09
push 2
push edi
lea eax, [ebp - 0x134]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_DosDateTimeToFileTime
mov edx, dword [ebp - 0x198]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428d2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_VerifyVersionInfoW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428d4c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToTzSpecificLocalTime
mov edx, dword [ebp - 0x134]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428d6f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x10c]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov ecx, eax
call fcn.0041ada0
jmp 0x429562
test cl, cl
jne 0x428e95
push str.no_p_r_m__for_killProce_s
lea ecx, [ebp - 0x114]
call fcn.00403790
push str.h_nd1eJSRequest
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SetEvent
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x114]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileTime
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileW
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428e20
push 2
push edi
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_SetFileTime
mov edx, dword [ebp - 0x180]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428e46
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SetEvent
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428e63
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryW
mov edx, dword [ebp - 0x14c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428e86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x114]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0041b0b0
jmp 0x429562
mov ecx, edi
call fcn.0041b8c0
jmp 0x429562
test cl, cl
jne 0x428fba
push str.no_p_r_m__for_enumModule_
lea ecx, [ebp - 0x11c]
call fcn.00403790
push str.h_nd1eJ_Reque_t
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SuspendThread
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x428f45
push 2
push edi
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428f6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428f88
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
mov edx, dword [ebp - 0x13c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428fab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x11c]
jmp 0x427da4
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0041c9c0
jmp 0x429562
test cl, cl
jne 0x42908f
push str.no_par_ms_for_execFile
lea ecx, [ebp - 0x124]
call fcn.00403790
push str.handleJ_Request
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFile
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x124]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_GetFinalPathNameByHandleW
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42905e
push 2
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x188]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0x15c]
call fcn.00403820
lea ecx, [ebp - 0x124]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0041e430
jmp 0x429562
test cl, cl
jne 0x429164
push str.no_p_rams_for_fi1eExist
lea ecx, [ebp - 0xf0]
call fcn.00403790
push str.handleJSReque_t
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFileEx
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xf0]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], reloc.kernel32.dll_FlushViewOfFile
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToFileTime
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x429133
push 2
push esi
lea eax, [ebp - 0xec]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x1a0]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0xec]
call fcn.00403820
lea ecx, [ebp - 0xf0]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0041ec10
jmp 0x429562
test cl, cl
jne 0x429239
push str.no_p_ram__for_fo1derExi_t
lea ecx, [ebp - 0x100]
call fcn.00403790
push str.h_nd1eJSReque_t
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSRWLockExclusive
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetEnvironmentStrings
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x100]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], reloc.kernel32.dll_EnumSystemLocalesA
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolTimer
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x429208
push 2
push esi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x168]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0xd4]
call fcn.00403820
lea ecx, [ebp - 0x100]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00422290
jmp 0x429562
test cl, cl
jne 0x42930e
push str.no_params_for_fi1e_ize
lea ecx, [ebp - 0x110]
call fcn.00403790
push str.handleJSReque_t
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetLocaleInfoA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryA
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetFileApisToOEM
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4292dd
push 2
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x16c]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0x108]
call fcn.00403820
lea ecx, [ebp - 0x110]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.0041f1b0
jmp 0x429562
mov ecx, edi
call fcn.0041f990
jmp 0x429562
mov ecx, edi
call fcn.004201a0
jmp 0x429562
mov ecx, edi
call fcn.00421560
jmp 0x429562
test cl, cl
jne 0x429407
push str.no_p_ram__for_de1ete_T__k
lea ecx, [ebp - 0x120]
call fcn.00403790
push str.handleJSReque_t
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], reloc.kernel32.dll_FileTimeToSystemTime
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_DebugBreak
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultUILanguage
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_WriteConsoleA
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4293d6
push 2
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x174]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0x118]
call fcn.00403820
lea ecx, [ebp - 0x120]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00421cb0
mov eax, dword [0x530408]
mov ecx, eax
imul ecx, eax
imul eax, ecx
cdq
mov ecx, reloc.kernel32.dll_OpenSemaphoreW
idiv ecx
cmp edx, 2
jne 0x429562
push 4
call fcn.004b45a0
add esp, 4
mov esi, eax
call fcn.004b597b
push esi
mov dword [esi], eax
mov dword [0x530408], eax
call fcn.004b458c
add esp, 4
jmp 0x429562
mov ecx, edi
call fcn.00422750
jmp 0x429562
test cl, cl
jne 0x429527
push str.no_par_ms_for__pecia1Fo1derReg
lea ecx, [ebp - 0xbc]
call fcn.00403790
push str.handleJ_Reque_t
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_InitializeCriticalSectionEx
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], reloc.kernel32.dll_GetPriorityClass
call fcn.00431c80
add esp, 4
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_GetModuleFileNameA
mov ecx, dword [ebx + 4]
push esi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4294f6
push 2
push esi
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
lea ecx, [ebp - 0x17c]
call fcn.00403820
lea ecx, [ebp - 0x18]
call fcn.00403820
lea ecx, [ebp - 0xd8]
call fcn.00403820
lea ecx, [ebp - 0xbc]
call fcn.00403820
or edi, 0xffffffff
jmp 0x427dbd
push ecx
push str.params
lea ecx, [ebp - 0x28]
call fcn.0044aa00
mov edx, edi
mov ecx, eax
call fcn.00422e70
jmp 0x429562
mov ecx, edi
call fcn.004243e0
jmp 0x429562
mov ecx, edi
call fcn.00425300
jmp 0x429562
mov ecx, edi
call fcn.004257d0
jmp 0x429562
mov ecx, edi
call fcn.004265c0
cmp dword [ebp - 0x2c], 0x10
jb 0x429573
push dword [ebp - 0x40]
call fcn.004b458c
add esp, 4
mov dword [ebp - 4], 3
mov bl, 1
or edi, 0xffffffff
jmp 0x429861
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
mov dword [ebp - 0x18], 0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x18]
push str.handleJSRequest_unknown_id__d
push eax
mov byte [ebp - 4], reloc.kernel32.dll_SetHandleCount
call fcn.00404c00
add esp, 0xc
lea ecx, [ebp - 0xb8]
push str.h_ndleJ_Request
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_DeleteFileW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0xcc], esi
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetNamedPipeHandleState
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x429623
push 2
push edi
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
mov edx, dword [ebp - 0xc4]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x429649
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_DeleteFileW
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429666
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetHandleCount
mov edx, dword [ebp - 0xb8]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429689
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call dword [eax + reloc.kernel32.dll_SetDllDirectoryA]
jmp 0x427d9d
push str.id_not_member
lea ecx, [ebp - 0xbc]
call fcn.00403790
push str.handleJ_Request
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0xc4], esi
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0xc4]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
call fcn.00431c80
add esp, 4
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetSystemTime
mov ecx, dword [ebx + 4]
push edi
call fcn.00403840
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42971f
push 2
push edi
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
mov edx, dword [ebp - 0xcc]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x429745
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429762
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
mov edx, dword [ebp - 0xb8]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429785
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xbc]
jmp 0x427da4
mov bl, byte [ebp - 0xb2]
mov ecx, 1
test eax, eax
je 0x429861
mov word [eax], cx
lea ecx, [ebp - 0xb0]
call fcn.00429940
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00449f60
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x429899
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + reloc.kernel32.dll_IsBadStringPtrA]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b4591
mov esp, ebp
pop ebp
ret 8