Function at 0x70e3fe6e
Capabilities:
Accept command line arguments
Access the windows event log
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Get system information on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70e7678c
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
mov esi, edx
xor eax, eax
lea edx, [ebp - 0x118]
push edx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x74], ecx
push eax
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0xc4]
push edx
mov dword [ebp - 0x90], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x70e4093a
lea eax, [ebp - 0x30]
lea edi, [esi + 0x1c]
push eax
call fcn.70df4c1b
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
cmp dword [ecx], 0
jne 0x70e407a9
lea edx, [ebp - 0x60]
push edx
mov byte [ebp - 4], 1
call fcn.70e1d28e
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
je 0x70e3ff41
add eax, 4
push eax
call ebx
cmp eax, 0xffffffff
jne 0x70e3ffd2
lea eax, [ebp - 0x68]
push eax
call fcn.70e1d362
mov esi, eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp ecx, esi
je 0x70e3ff91
mov edx, dword [ebp - 0x5c]
push edx
call edi
test eax, eax
jne 0x70e3ff7f
mov eax, dword [ebp - 0x5c]
push eax
call fcn.70df3455
mov ecx, dword [ebp - 0x60]
add esp, 4
push ecx
call fcn.70df3455
add esp, 4
mov edx, dword [esi]
mov dword [ebp - 0x60], edx
mov esi, dword [esi + 4]
push esi
mov dword [ebp - 0x5c], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x64]
push eax
call edi
test eax, eax
jne 0x70e3ffb7
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0x68]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
je 0x70e408bb
add eax, 4
push eax
call ebx
cmp eax, 0xffffffff
je 0x70e408b5
mov edi, dword [ebp - 0x90]
lea eax, [ebp - 0x98]
add edi, 0x24
push eax
call fcn.70df4c1b
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x98]
cmp dword [eax], 0
jne 0x70e4002a
lea ecx, [ebp - 0x50]
call fcn.70e1e3ce
mov edi, eax
lea esi, [ebp - 0x98]
mov byte [ebp - 4], 5
call fcn.70e0ec82
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.70df342c
mov eax, dword [ebp - 0x98]
cmp dword [eax], 0
je 0x70e40747
add eax, 4
push eax
call ebx
cmp eax, 0xffffffff
je 0x70e40747
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xc0]
push ecx
push edx
push 0x70e41214
lea esi, [ebp - 0x58]
call fcn.70dfce11
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x70e41208
lea esi, [ebp - 0x44]
call fcn.70dfce11
add esp, 8
mov ebx, eax
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x74]
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x70e40089
or eax, 0xffffffff
jmp 0x70e40099
mov eax, dword [eax]
dec eax
push eax
mov edx, 0x5c
mov ecx, esi
call fcn.70e1751c
lea ecx, [ebp - 0x70]
push ecx
inc eax
mov ecx, esi
call fcn.70e1777b
push 0x70e41204
push eax
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 8
call fcn.70df42c0
mov ecx, eax
mov eax, ebx
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.70e1ec37
push 0x70e41204
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 0xa
call fcn.70df42c0
mov ecx, eax
mov bl, 0xb
mov eax, edi
lea esi, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.70e1ec37
mov edi, eax
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.70e0ec82
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.70df342c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xa
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.70df342c
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 8
call fcn.70df342c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.70df342c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.70df342c
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.70df342c
lea ecx, [ebp - 0x50]
push ecx
mov ecx, esi
call fcn.70e1d5ca
mov edi, eax
mov byte [ebp - 4], 0xd
call fcn.70e0ec82
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.70df342c
mov edx, dword [ebp - 0x30]
xor edi, edi
cmp dword [edx], edi
je 0x70e40747
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x70e401b9
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x1c]
movzx edx, word [ebp - 0x1e]
movzx eax, word [ebp - 0x20]
push ecx
movzx ecx, word [ebp - 0x22]
push edx
movzx edx, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push ecx
push edx
cdq
mov ecx, 0x64
idiv ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x70e41228
lea esi, [ebp - 0xb8]
call fcn.70dfce11
add esp, 0x20
mov esi, eax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x74]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.70e2e0c5
mov ecx, eax
mov eax, esi
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 0xf
call fcn.70e1ec37
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x11
call fcn.70df342c
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x12
call fcn.70df342c
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x60]
add eax, 4
push eax
add ecx, 4
push ecx
add edx, 4
push edx
add esi, 4
push esi
push 0x70e41278
lea esi, [ebp - 0x70]
call fcn.70dfce11
add esp, 0x14
push 0x44
lea ecx, [ebp - 0x174]
push edi
push ecx
call fcn.70df8b33
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x174], 0x44
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xb0], 0x70e0970c
mov dword [ebp - 0xac], edi
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], edi
push 1
lea esi, [ebp - 0xb0]
call fcn.70e41b9b
mov byte [ebp - 4], 0x15
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov ebx, eax
cmp word [ebx], 0
je 0x70e4040e
lea edx, [ebp - 0x44]
push edx
mov edi, ebx
call fcn.70e1078b
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0x16
jl 0x70e40329
push 0x16
push 0x70e412bc
push 0x16
add eax, 4
push eax
push 1
push 0x400
call esi
cmp eax, 2
sete al
test al, al
jne 0x70e403f4
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0x17
jl 0x70e40355
push 0x17
push 0x70e412ec
push 0x17
add eax, 4
push eax
push 1
push 0x400
call esi
cmp eax, 2
sete al
test al, al
jne 0x70e403f4
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0x15
jl 0x70e4037d
push 0x15
push 0x70e4131c
push 0x15
add eax, 4
push eax
push 1
push 0x400
call esi
cmp eax, 2
sete al
test al, al
jne 0x70e403f4
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0xc
jl 0x70e403a5
push 0xc
push 0x70e41348
push 0xc
add eax, 4
push eax
push 1
push 0x400
call esi
cmp eax, 2
sete al
test al, al
jne 0x70e403f4
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0x1a
jl 0x70e403cd
push 0x1a
push 0x70e41364
push 0x1a
add eax, 4
push eax
push 1
push 0x400
call esi
cmp eax, 2
sete al
test al, al
jne 0x70e403f4
mov eax, dword [ebp - 0x44]
mov edi, dword [eax]
add eax, 4
push eax
lea ecx, [ebp - 0xb0]
call fcn.70e41868
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x3c], 0
call fcn.70e41836
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
lea ecx, [ebp - 0x44]
lea ebx, [ebx + eax*2 + 2]
mov byte [ebp - 4], 0x15
call fcn.70df342c
jmp 0x70e402e1
mov eax, dword [ebp - 0xa4]
inc eax
cmp eax, dword [ebp - 0xa8]
jl 0x70e40429
push eax
lea esi, [ebp - 0xb0]
call fcn.70e41b9b
mov ecx, dword [ebp - 0xa4]
mov eax, ecx
inc ecx
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xac]
xor edx, edx
mov word [ecx + eax*2], dx
lea edx, [ebp - 0xf4]
push edx
call fcn.70e2741c
push 0x70e4139c
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x17
push ecx
mov byte [ebp - 0xcc], 1
call fcn.70df42c0
push 0x70e413b0
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0x18
call fcn.70df42c0
sub esp, 8
mov byte [ebp - 4], 0x19
mov ecx, esp
mov dword [ebp - 0x40], esp
push ecx
lea edi, [ebp - 0x88]
call fcn.70df4c1b
push 1
push 1
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0xf4]
call fcn.70df4039
mov esi, dword [eax]
mov ebx, esi
mov dword [eax], 0
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0x1a
call fcn.70df3871
test esi, esi
jne 0x70e40509
sub esp, 8
mov eax, esp
mov dword [ebp - 0x40], esp
push eax
call fcn.70df4c1b
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, 0x100002
lea edi, [ebp - 0x34]
call fcn.70df5631
lea edi, [ebp - 0x3c]
call fcn.70df3850
lea eax, [ebp - 0x34]
call fcn.70df3871
mov ebx, dword [ebp - 0x3c]
sub esp, 8
mov edx, esp
mov dword [ebp - 0x40], esp
push edx
lea edi, [ebp - 0x80]
call fcn.70df4c1b
push 1
push 1
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0xf4]
call fcn.70df4039
mov edi, dword [eax]
mov esi, edi
mov dword [eax], 0
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x1b
call fcn.70df3871
test edi, edi
jne 0x70e40582
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x40], esp
push ecx
lea edi, [ebp - 0x80]
call fcn.70df4c1b
lea edx, [ebp - 0xf4]
push edx
mov ecx, 0x100002
lea edi, [ebp - 0x40]
call fcn.70df5631
lea edi, [ebp - 0x34]
call fcn.70df3850
lea eax, [ebp - 0x40]
call fcn.70df3871
mov esi, dword [ebp - 0x34]
test ebx, ebx
je 0x70e407e4
test esi, esi
je 0x70e407e4
mov eax, dword [ebp - 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp - 0xac]
lea edx, [ebp - 0x174]
push edx
push 0
push ecx
push 0x5000608
push 0
push 0
push 0
add eax, 4
push eax
push 0
call edi
test eax, eax
jne 0x70e40614
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
push edx
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x174]
push ecx
push 0
push edx
push 0x4000608
push 0
push 0
push 0
add eax, 4
push eax
push 0
call edi
test eax, eax
jne 0x70e40614
push eax
mov eax, dword [ebp - 0x70]
push 1
add eax, 4
push 0xc4560035
xor ecx, ecx
call fcn.70e18ca2
jmp 0x70e40814
mov ecx, dword [ebp - 0x104]
mov dword [ebp - 0x38], ecx
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], ebx
call fcn.70e41c5f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x100]
xor edi, edi
push eax
mov dword [ebp - 0x38], edi
call esi
mov ecx, dword [ebp - 0x104]
push ecx
call esi
cmp dword [ebp - 0x78], 2
je 0x70e406cd
mov eax, dword [ebp - 0x70]
push 4
push 1
add eax, 4
push 0xc4560036
lea ecx, [ebp - 0x78]
call fcn.70e18ca2
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x70e4067b
push eax
call esi
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1a
call fcn.70df3871
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x19
call fcn.70df3871
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x18
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x17
call fcn.70df342c
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x15
call fcn.70df3678
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xac]
push edx
jmp 0x70e40861
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x70e406da
push eax
call esi
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1a
call fcn.70df3871
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x19
call fcn.70df3871
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x18
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x17
call fcn.70df342c
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x15
call fcn.70df3678
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0xac]
push eax
call fcn.70df3455
add esp, 4
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x12
call fcn.70df342c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.70df342c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ecx
call esi
test eax, eax
jne 0x70e4077c
mov edx, dword [ebp - 0x94]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x98]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x5c]
push ecx
call esi
test eax, eax
jne 0x70e407a2
mov edx, dword [ebp - 0x5c]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x60]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
je 0x70e411b4
push 0x30
mov byte [ebp - 4], 0x1e
call fcn.70df39ac
mov ecx, eax
add esp, 4
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 0x1f
test ecx, ecx
je 0x70e40951
lea edx, [ebp - 0x30]
push edx
call fcn.70df8fee
mov esi, eax
jmp 0x70e40953
mov edx, dword [0x70e7fd40]
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0
push 1
push 0
push 0xc4560034
push 0
push 1
push edx
mov dword [ebp - 0x44], 0x70e7fd44
mov dword [ebp - 0x40], 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1a
call fcn.70df3871
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x19
call fcn.70df3871
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x18
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x17
call fcn.70df342c
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x15
call fcn.70df3678
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0xac]
push eax
call fcn.70df3455
add esp, 4
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x12
call fcn.70df342c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.70df342c
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.70df342c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.70df342c
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.70df342c
mov eax, 0x80004005
jmp 0x70e411e6
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [0x70e7fd40]
push 0
lea ecx, [ebp - 0x50]
push ecx
push 0
push 1
push 0
push 0xc4560033
push 0
push 1
push edx
mov dword [ebp - 0x50], 0x70e7fd44
mov dword [ebp - 0x4c], 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x5c]
push eax
call edi
test eax, eax
jne 0x70e40911
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0x60]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
push eax
call edi
test eax, eax
jne 0x70e4093a
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0x30]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov eax, 0x80004005
jmp 0x70e411e6
xor esi, esi
mov ebx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebx + 4]
cmp ecx, esi
je 0x70e40971
test ecx, ecx
je 0x70e40971
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov eax, esi
mov dword [ebx + 4], esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
push 0x20
call fcn.70df39ac
mov esi, eax
add esp, 4
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 0x20
test esi, esi
je 0x70e409ba
sub esp, 8
mov eax, esp
mov dword [ebp - 0x54], esp
push 0x70e413c4
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.70df42c0
mov eax, dword [ebx + 4]
push eax
push esi
call fcn.70e42840
mov edi, eax
jmp 0x70e409bc
xor edi, edi
mov byte [ebp - 4], 0x1e
mov esi, dword [ebx + 0x48]
cmp esi, edi
je 0x70e409da
test esi, esi
je 0x70e409da
push esi
call fcn.70e26933
push esi
call fcn.70df3455
add esp, 4
push 0x44
mov dword [ebx + 0x48], edi
call fcn.70df39ac
mov esi, eax
add esp, 4
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 0x21
test esi, esi
je 0x70e40a13
sub esp, 8
mov edx, esp
mov dword [ebp - 0x54], esp
push edx
lea edi, [ebp - 0x30]
call fcn.70df4c1b
mov eax, dword [ebx + 4]
push eax
push esi
call fcn.70e41fee
mov esi, eax
jmp 0x70e40a15
xor esi, esi
mov dword [ebp - 0x40], esi
push 0x24
mov byte [ebp - 4], 0x22
call fcn.70df39ac
add esp, 4
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0x23
test eax, eax
je 0x70e40a40
mov ecx, dword [ebx + 4]
push ecx
push esi
push eax
call fcn.70e41edc
mov edi, eax
jmp 0x70e40a42
xor edi, edi
mov byte [ebp - 4], 0x22
mov esi, dword [ebx + 0x64]
cmp esi, edi
je 0x70e40a60
test esi, esi
je 0x70e40a60
push esi
call fcn.70e263b5
push esi
call fcn.70df3455
add esp, 4
lea esi, [ebx + 0x9c]
lea eax, [ebp - 0x30]
mov dword [ebx + 0x64], edi
mov dword [ebp - 0x40], 0
cmp esi, eax
je 0x70e40aae
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e40a9c
mov eax, dword [esi + 4]
push eax
call fcn.70df3455
mov eax, dword [esi]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
push eax
mov dword [esi], ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x48], 0
je 0x70e410e7
mov byte [ebp - 4], 0x25
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
call esi
lea edx, [ebp - 0xe0]
push edx
mov dword [ebp - 0xec], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xd8], ecx
mov edx, dword [eax]
mov dword [ebp - 0xdc], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x68]
push ecx
mov edi, eax
call fcn.70e1078b
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc0]
lea edx, [eax + 4]
mov dword [ebp - 0xc8], edx
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe4], ecx
mov ecx, dword [0x70e89a24]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd0], ecx
call esi
lea edx, [ebp - 0x154]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x154]
movzx ecx, ax
xor bl, bl
mov dword [ebp - 0x54], ecx
cmp ax, 9
jne 0x70e40bf3
push 0x70e09de4
push 0x70dff55c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0
push 0x400
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x70e40bdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x70e40bf3
lea edx, [ebp - 0x40]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x40], 1
jne 0x70e40bf3
mov bl, 1
cmp dword [ebp - 0x54], 9
jne 0x70e40c07
mov dword [ebp - 0xd4], 0x40
test bl, bl
je 0x70e40c11
mov dword [ebp - 0xd4], 0x20
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xec]
push ecx
push 0x6a
mov eax, 0x70e82b20
mov dword [ebp - 0x40], 0x70df9424
call fcn.70dff40a
mov edi, eax
mov dword [ebp - 0x74], edi
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x54]
push eax
push 0x70e82b20
mov eax, edi
mov byte [ebp - 4], 0x27
call fcn.70df8aa5
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x8c]
mov ecx, dword [esi + 0x48]
push edx
call fcn.70e266e4
xor ebx, ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x29
mov ecx, dword [esi + 0x48]
push eax
call fcn.70e26493
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0x70e82b20
call fcn.70df8aa5
cmp word [ebp - 0x38], 0x7b
je 0x70e40d1b
mov edx, dword [0x70e7fd40]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
push ecx
push 4
push 1
push ebx
push 0xc4560038
push ebx
push 1
push edx
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x70], 0x70e7fd44
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0xbc], ebx
je 0x70e40d02
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
push edi
mov byte [ebp - 4], 0x26
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x68]
jmp 0x70e40897
push 0x70e413dc
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.70df42c0
push 0x70e413fc
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x2a
call fcn.70df42c0
push 0x70e41428
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 0x2b
call fcn.70df42c0
sub esp, 8
mov byte [ebp - 4], 0x2c
mov eax, esp
mov dword [ebp - 0x54], esp
push eax
lea edi, [ebp - 0x80]
call fcn.70df4c1b
mov esi, dword [esi + 4]
push esi
lea ecx, [ebp - 0x54]
push ecx
call fcn.70df5841
mov ebx, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x2d
call fcn.70df3841
sub esp, 8
mov edx, esp
mov dword [ebp - 0x9c], esp
push edx
lea edi, [ebp - 0x88]
call fcn.70df4c1b
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 4]
push eax
mov ecx, 0x100002
lea edi, [ebp - 0x9c]
call fcn.70df5631
mov esi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x3c], esi
mov eax, edi
mov byte [ebp - 4], 0x2e
call fcn.70df3871
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x78], esp
push ecx
lea edi, [ebp - 0x50]
call fcn.70df4c1b
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + 4]
push eax
mov ecx, 0x100002
lea edi, [ebp - 0x38]
call fcn.70df5631
mov edi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x78], edi
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x2f
call fcn.70df3871
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, ebx
call fcn.70e274ad
mov esi, eax
push esi
call fcn.70df9a41
mov ecx, dword [ebp - 0x90]
add esp, 4
mov dword [ecx + 0x30], eax
mov ebx, dword [ebx + 4]
push esi
push ebx
push esi
push eax
call fcn.70e605e1
add esp, 0x10
test eax, eax
je 0x70e40f18
mov ecx, dword [0x70e7fd40]
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x70]
push eax
push 4
push 1
push 0
push 0xc4560038
push 0
push 1
push ecx
mov dword [ebp - 0x90], 2
mov dword [ebp - 0x70], 0x70e7fd44
mov dword [ebp - 0x6c], 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2e
call fcn.70df3871
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x2d
call fcn.70df3871
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x2c
call fcn.70df3841
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x2b
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x2a
call fcn.70df342c
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x29
call fcn.70df342c
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0xbc], 0
je 0x70e40efc
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x74]
push ecx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x68]
jmp 0x70e40897
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x70e40f2a
call fcn.70e25921
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2e
call fcn.70df3871
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x2d
call fcn.70df3871
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x2c
call fcn.70df3841
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x2b
call fcn.70df342c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x2a
call fcn.70df342c
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x29
call fcn.70df342c
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0xbc], 0
je 0x70e40f8f
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov esi, dword [ebp - 0x90]
mov eax, dword [esi + 0x30]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov edi, 0x70e87ec4
mov dword [ebp - 0x54], 0x70df9424
call fcn.70df8f7b
cmp byte [eax + 0xb4], 0
jne 0x70e40fd3
cmp byte [eax + 0x88], 0
jne 0x70e40fd3
cmp byte [eax + 0x71], 0
jne 0x70e40fd3
cmp byte [eax + 0xcb], 0
jne 0x70e40fd3
xor ecx, ecx
jmp 0x70e40fd8
mov ecx, 1
mov ebx, dword [ebp - 0x8c]
mov byte [ebx + 0x24], cl
mov edx, dword [eax + 0x72]
mov dword [ebx + 0x28], edx
mov dword [esi + 0x34], eax
mov edx, dword [eax + 0x32]
mov ecx, dword [ebx + 0x64]
mov dword [ecx + 0x10], edx
mov edx, dword [eax + 0x36]
mov dword [ecx + 0x14], edx
mov edx, dword [eax + 0x3a]
mov dword [ecx + 0x18], edx
mov edx, dword [eax + 0x3e]
mov dword [ecx + 0x1c], edx
cmp byte [eax + 0x30], 0
je 0x70e410cb
cmp byte [eax + 0xb4], 0
jne 0x70e4111b
cmp byte [eax + 0x71], 0
jne 0x70e4111b
cmp byte [eax + 0xcb], 0
jne 0x70e4111b
mov eax, dword [ebx + 0x48]
push 1
push eax
call fcn.70e26d66
lea eax, [ebx + 0x30]
push eax
xor esi, esi
call fcn.70e42c00
push 0x70e41458
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.70df42c0
sub esp, 8
mov byte [ebp - 4], 0x30
mov eax, esp
mov dword [ebp - 0x54], esp
push eax
lea edi, [ebp - 0x50]
call fcn.70df4c1b
mov ebx, dword [ebx + 4]
push ebx
mov ecx, 0x100002
lea edi, [ebp - 0x54]
call fcn.70df5631
mov esi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x9c], esi
mov eax, edi
mov byte [ebp - 4], 0x31
call fcn.70df3871
test esi, esi
je 0x70e410b0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x70e410b0
call fcn.70e25921
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0x30
call fcn.70df3871
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x27
call fcn.70df342c
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x74]
push eax
call fcn.70df3455
add esp, 4
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x25
call fcn.70df342c
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e41114
mov edx, dword [ebp - 0x2c]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0x30]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
xor eax, eax
jmp 0x70e411e6
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x74]
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x68]
jmp 0x70e40897
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e411e1
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0x30]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.70df25ed
mov esp, ebp
pop ebp
ret 4