Function at 0x405b71
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x594
mov eax, dword [0x4310b4]
xor eax, esp
mov dword [esp + 0x590], eax
push ebx
push esi
push edi
mov esi, 0x403800
or dword [esp + 0x4c], 0xffffffff
lea edi, [esp + 0x380]
mov dword [esp + 0x40], 0xffff
xor eax, eax
mov ebx, ecx
inc eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x58], eax
xor eax, eax
push 0x48
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x29], cl
mov dword [esp + 0x34], ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x30], ecx
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x6c]
mov byte [esp + 0x22], cl
stosd dword es:[edi], eax
pop esi
push esi
push ecx
stosd dword es:[edi], eax
mov byte [esp + 0x2f], cl
mov byte [esp + 0x2c], cl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x80]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x80010
xor eax, eax
mov dword [esp + 0x78], esi
inc eax
mov word [esp + 0xa8], ax
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xb4], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xb8], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov dword [esp + 0xb8], eax
test ebx, ebx
je 0x41d08a
xor eax, eax
mov byte [esp + 0x374], 1
mov esi, 0x104
mov dword [esp + 0x370], eax
push esi
push eax
lea eax, [esp + 0x170]
mov dword [esp + 0x380], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x174]
add esp, 0xc
cmp byte [esp + 0x374], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040d300
test eax, eax
js 0x4060de
mov esi, 0x4027a0
mov edi, 0x4000
push esi
push edi
call fcn.00417ebb
push esi
push edi
mov dword [esp + 0x38], eax
call fcn.00417ebb
push esi
push edi
mov dword [esp + 0x4c], eax
call fcn.00417ebb
mov edi, eax
push esi
push 0x4000
mov dword [esp + 0x80], edi
call fcn.00417ebb
push 0x4027a0
push 0x4000
mov esi, eax
call fcn.00417ebb
push 0x4027a0
push 0x4000
mov dword [esp + 0x80], eax
call fcn.00417ebb
push 0x4027a0
push 0x4000
mov dword [esp + 0x70], eax
call fcn.00417ebb
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x28], 0
mov dword [esp + 0x14], ecx
je 0x406240
mov eax, dword [esp + 0x34]
test eax, eax
je 0x406240
test edi, edi
je 0x406240
test esi, esi
je 0x406240
cmp dword [esp + 0x50], 0
je 0x406240
cmp dword [esp + 0x38], 0
je 0x406240
test ecx, ecx
je 0x406240
xor ecx, ecx
mov word [esi], cx
mov word [eax], cx
xor eax, eax
cmp word [ebx], ax
je 0x41d50a
mov ecx, ebx
call fcn.0040974c
push 0x22
pop edx
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x41d096
cmp ecx, 0x2f
je 0x406113
push 0x2000
push esi
lea edx, [esp + 0x20]
xor ecx, ecx
call fcn.00406261
cmp eax, 1
je 0x40623c
mov eax, dword [esp + 0x18]
xor ebx, ebx
cmp word [eax], bx
je 0x405dd8
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.0040dfe0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x44], eax
cmp word [esi], bx
mov ebx, 0x2000
je 0x41d511
push 0x22
pop eax
cmp word [esi], ax
je 0x405e01
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41d527
mov ecx, dword [esp + 0x14]
mov edx, ebx
push esi
call fcn.0040dfe0
mov ecx, esi
call fcn.0040f070
push eax
mov edx, ebx
mov ecx, esi
call fcn.0040dfe0
xor eax, eax
mov edx, esi
mov bl, al
mov byte [esp + 0x26], al
lea eax, [esp + 0x18]
mov byte [esp + 0x1f], bl
push eax
push 0x2d
pop ecx
call fcn.00409900
cmp eax, 0xffffffff
jne 0x41d55d
mov ecx, dword [esp + 0x50]
mov edx, 0x2000
push esi
call fcn.0040dfe0
push 0x2000
mov edx, esi
mov dword [esp + 0x144], esi
lea ecx, [esp + 0x10c]
call fcn.0040e050
cmp eax, 3
je 0x41d6e1
test eax, eax
je 0x41d546
push 5
pop ecx
cmp eax, ecx
je 0x41d546
cmp eax, 2
je 0x41d55d
push dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
call fcn.0040dfe0
mov ecx, dword [esp + 0x38]
mov edx, 0x2000
push 0x402454
call fcn.0040ebf0
mov eax, dword [esp + 0x44]
test eax, eax
je 0x405ecc
mov ecx, dword [esp + 0x38]
mov edx, 0x2000
push eax
call fcn.0040ebf0
cmp byte [esp + 0x1e], 0
jne 0x41d666
push 0x44
pop eax
push eax
xor eax, eax
push eax
lea eax, [esp + 0xc8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x80], eax
test bl, bl
jne 0x41d676
xor ebx, ebx
lea eax, [esp + 0x5c]
push eax
push ebx
push 2
push ebx
mov byte [esp + 0x2f], bl
mov dword [esp + 0x6c], ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x41d6b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x41d6ed
mov ebx, dword [esp + 0x5c]
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push ebx
push 8
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x41d6ed
lea eax, [esp + 0x5c]
push eax
xor eax, eax
push eax
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x41d6c5
xor ecx, ecx
mov dword [esp + 0x64], 1
push ecx
push ecx
push 4
lea eax, [esp + 0x70]
push eax
push 0x60001
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x41d6fa
mov eax, dword [esp + 0x40]
mov dword [esp + 0xbc], ebx
cmp eax, 0xffff
jne 0x41d70e
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
push dword [esp + 0x60]
or eax, 0x400
push eax
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x58]
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x1c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov bl, byte [esp + 0x1f]
cmp byte [esp + 0x1e], 0
jne 0x41d734
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x439820], eax
test bl, bl
jne 0x41d80e
cmp byte [esp + 0x18], bl
je 0x41d7f3
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jne 0x41d743
cmp byte [esp + 0x24], 0
jne 0x41d7e4
push dword [esp + 0x6c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x68]
test eax, eax
je 0x406074
cmp byte [esp + 0x27], 0
jne 0x41d8a9
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x20], eax
push ecx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x406096
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4060a6
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x4060b2
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
je 0x4060be
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4060ce
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4060de
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x370]
xor eax, eax
mov dword [esp + 0x370], eax
test ecx, ecx
je 0x4060fa
push ecx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x59c]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00417b90
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea edx, [esp + 0x18]
push 0x2000
add eax, 2
inc ebx
push edi
mov ecx, ebx
mov dword [esp + 0x20], eax
call fcn.00406261
cmp eax, ebx
je 0x40623c
push 0x402014
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d0fc
push 0x402028
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d203
push 0x402040
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d210
push 0x402058
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d21d
push 0x40205c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d236
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x41d243
push 0x402070
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d2e5
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x41d2f2
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x41d4d0
push 0x40207c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x406254
push 0x402084
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d30a
or dword [esp + 0xa4], ebx
or word [esp + 0xa8], 7
mov ebx, dword [esp + 0x18]
jmp 0x405d6e
mov ecx, dword [esp + 0x14]
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
test ecx, ecx
jne 0x40607e
jmp 0x406086
or dword [esp + 0x10], 0x40
jmp 0x406233
lea ebx, [esp + 0x380]
jmp 0x405c4b
cmp dword [esp + 0x84], 0
jne 0x405d9c
xor ebx, ebx
lea eax, [esp + 0x390]
push 0x104
inc ebx
lea edx, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.00406261
cmp eax, ebx
je 0x40623c
lea ecx, [esp + 0x390]
call fcn.0040f070
push eax
mov edx, 0x104
lea ecx, [esp + 0x394]
call fcn.0040dfe0
lea eax, [esp + 0x390]
mov byte [esp + 0x25], bl
mov dword [esp + 0x84], eax
jmp 0x406233
mov ecx, dword [esp + 0x18]
call fcn.0040974c
push 0x2000
push edi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, ebx
call fcn.00406261
cmp eax, ebx
je 0x41d492
cmp word [edi], 0x30
mov edx, edi
mov dword [esp + 0x20], edx
jne 0x41d143
movzx eax, word [edi + 2]
cmp eax, 0x78
je 0x41d13c
cmp eax, 0x58
jne 0x41d143
lea edx, [edi + 4]
mov dword [esp + 0x20], edx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x2c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x3c]
jne 0x41d14c
sub ecx, dword [esp + 0x2c]
sar ecx, 1
cmp ecx, 8
ja 0x41d45c
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, word [edx]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x24], 2
pop ecx
movzx ebx, ax
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x41d459
test bx, bx
je 0x41d1e9
mov ecx, dword [esp + 0x2c]
lea eax, [ebx - 0x30]
shl ecx, 4
cmp ax, 9
ja 0x41d1ab
add ecx, 0xffffffd0
jmp 0x41d1bd
push 5
lea eax, [ebx - 0x61]
pop edx
cmp ax, dx
ja 0x41d459
add ecx, 0xffffffa9
movzx eax, bx
add ecx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x24], 2
pop ecx
movzx ebx, ax
push ebx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x41d191
cmp dword [esp + 0x2c], 0
je 0x41d459
or dword [esp + 0x10], 4
mov byte [esp + 0x24], 1
jmp 0x406233
or dword [esp + 0x10], 0x8000
jmp 0x406233
or dword [esp + 0x10], 0x4000
jmp 0x406233
mov eax, dword [esp + 0x10]
and eax, 0xffffffef
mov byte [esp + 0x1e], bl
or eax, 0x200
mov dword [esp + 0x10], eax
jmp 0x406233
mov dword [esp + 0x58], 2
jmp 0x406233
lea edx, [edi + 2]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x30], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x3c]
jne 0x41d24f
sub ecx, dword [esp + 0x30]
sar ecx, 1
jne 0x41d28c
mov ecx, dword [esp + 0x18]
call fcn.0040974c
push 0x2000
push edi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, ebx
call fcn.00406261
cmp eax, ebx
je 0x40623c
mov edx, edi
mov ecx, edx
call fcn.0040f070
push eax
lea ecx, [esp + 0x16c]
call fcn.0040f229
mov eax, dword [esp + 0x370]
mov dword [esp + 0x30], eax
test eax, eax
jne 0x41d2ba
lea eax, [esp + 0x168]
mov dword [esp + 0x30], eax
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x3c]
jne 0x41d2bf
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7fe7
jbe 0x406233
push dword [esp + 0x30]
jmp 0x41d45d
or dword [esp + 0x10], 0x80
jmp 0x406233
mov eax, dword [0x435608]
test eax, eax
je 0x406233
mov eax, dword [eax]
mov dword [esp + 0x54], eax
jmp 0x406233
push 0x404338
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d333
or dword [esp + 0xa4], ebx
push 3
pop eax
or word [esp + 0xa8], ax
jmp 0x406233
push 0x404340
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d3b3
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.0040974c
push 0x2000
push edi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, ebx
call fcn.00406261
cmp eax, ebx
je 0x41d492
push 0xa
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x40], eax
test eax, eax
jne 0x41d395
mov ecx, dword [esp + 0x20]
cmp word [ecx], ax
jne 0x41d45c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x48]
ja 0x41d45c
jmp 0x406233
push 0x40434c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d3cf
or dword [esp + 0x10], 0x20
jmp 0x406233
push 0x40435c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d3ee
or dword [esp + 0x10], 0x100
jmp 0x406233
push 0x404370
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d40d
or dword [esp + 0x10], 0x800
jmp 0x406233
push 0x404384
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d42c
or dword [esp + 0x10], 0x1000
jmp 0x406233
push 0x404394
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d450
push 0x4043a0
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d492
mov byte [esp + 0x27], bl
jmp 0x406233
xor ebx, ebx
inc ebx
push edi
push ebx
push 0x2362
jmp 0x41d485
sub edx, 2
xor ecx, ecx
mov word [edx], cx
mov edx, 0x2000
push edi
mov ecx, eax
call fcn.0040ebf0
push dword [esp + 0x28]
push 1
push 0x2375
call fcn.004128ff
add esp, 0xc
jmp 0x40623c
mov eax, dword [esp + 0x28]
mov ecx, 0x403b98
sub ecx, eax
mov ebx, 0x2000
mov edx, eax
mov dword [esp + 0x48], ecx
lea ecx, [ebx + 0x7fffdffe]
test ecx, ecx
je 0x41d468
mov ecx, dword [esp + 0x48]
movzx ecx, word [edx + ecx]
test cx, cx
je 0x41d4ca
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x41d4a8
test ebx, ebx
jne 0x41d468
jmp 0x41d465
call fcn.0042cf6e
xor ebx, ebx
push ebx
push 0x40002397
call fcn.004156ed
pop ecx
pop ecx
cmp byte [0x4397cd], bl
je 0x41d4f9
push ebx
push 0x400023bf
call fcn.004156ed
pop ecx
pop ecx
mov byte [0x44c133], bl
mov dword [0x44c5dc], ebx
jmp 0x40623c
xor ebx, ebx
jmp 0x405dd8
lea eax, [esp + 0x380]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0040dfe0
jmp 0x405de6
mov ecx, esi
call fcn.0040f070
push eax
push 0x4043a4
push ebx
push dword [esp + 0x20]
call fcn.00409041
add esp, 0x10
jmp 0x405e1e
push dword [esp + 0x50]
mov edx, 0x2000
mov ecx, esi
call fcn.0040dfe0
mov bl, 1
jmp 0x405e90
mov ecx, 0x402568
call fcn.0040d89b
mov ebx, eax
test ebx, ebx
jne 0x41d57f
push eax
push 0x400023d2
call fcn.004128ff
pop ecx
pop ecx
jmp 0x40623c
push dword [esp + 0x14]
push 0x4043b0
push 0x2000
push dword [esp + 0x34]
call fcn.00409041
add esp, 0x10
mov ecx, esi
push ebx
mov ebx, 0x2000
mov edx, ebx
call fcn.0040dfe0
mov ecx, dword [esp + 0x14]
mov edx, ebx
push esi
call fcn.0040dfe0
push 0x4043c0
push dword [esp + 0x2c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41d650
mov ecx, dword [esp + 0x34]
xor eax, eax
cmp word [ecx], ax
je 0x41d650
mov edx, ecx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x3c]
jne 0x41d5dd
mov eax, dword [esp + 0x28]
sub edx, ebx
mov ebx, eax
sar edx, 1
mov dword [esp + 0x44], edx
lea edx, [ebx + 2]
mov dword [esp + 0x48], edx
mov dx, word [ebx]
add ebx, 2
cmp dx, word [esp + 0x3c]
jne 0x41d5ff
sub ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
sar ebx, 1
add edx, ebx
mov ebx, 0x2000
cmp edx, ebx
jae 0x41d640
push 0x402454
mov edx, ebx
mov ecx, eax
call fcn.0040ebf0
push dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, ebx
call fcn.0040ebf0
jmp 0x41d650
push ecx
push 1
push 0x2363
call fcn.004128ff
add esp, 0xc
mov eax, dword [esp + 0x28]
mov bl, byte [esp + 0x1f]
mov dword [esp + 0x44], eax
mov byte [esp + 0x26], 1
jmp 0x405e90
push 1
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x405ed7
cmp dword [esp + 0x58], 2
je 0x405f1c
cmp dword [esp + 0x2c], 0
jne 0x405f1c
cmp dword [esp + 0x40], 0xffff
jne 0x405f1c
cmp dword [esp + 0x54], 0
jne 0x405f1c
call fcn.00418517
test al, al
je 0x405f1c
mov bl, 1
jmp 0x406011
mov dword [0x439820], 0x54f
jmp 0x41d6e1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x439820], eax
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, esi
call fcn.004291ec
jmp 0x40623c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x439820], eax
jmp 0x41d6e1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov dword [0x439820], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
jmp 0x41d6d0
xor ecx, ecx
mov word [esp + 0x18], ax
push ecx
push ecx
push 2
lea eax, [esp + 0x24]
push eax
push 0x20004
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x41d6fa
jmp 0x405fc1
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x40601c
xor eax, eax
lea edi, [esp + 0x15c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x70]
call dword [sym.imp.api_ms_win_core_processtopology_l1_1_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x41d770
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x40]
cmp ecx, 0xffff
je 0x41d7c6
xor eax, eax
lea edi, [esp + 0x150]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x150]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x41d7c2
mov eax, dword [esp + 0x150]
and eax, dword [esp + 0x4c]
je 0x41d7c2
mov dword [esp + 0x4c], eax
xor eax, eax
push eax
push dword [esp + 0x154]
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl ebx, cl
jmp 0x41d7c6
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x4c]
and ebx, eax
je 0x41d7d0
mov eax, ebx
push eax
push dword [esp + 0x6c]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
mov edi, dword [esp + 0x60]
jmp 0x406045
push dword [esp + 0x6c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
jmp 0x406050
cmp byte [0x4397cd], 0
je 0x41d803
cmp eax, 0xc1
je 0x41d80e
cmp eax, 0x2e4
jne 0x41d6e1
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41d815
sub ecx, edx
push 5
sar ecx, 1
pop eax
cmp ecx, eax
jb 0x41d892
add ecx, 0xfffffffc
push eax
push 0x404440
lea eax, [esi + ecx*2]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x41d892
mov ebx, dword [esp + 0x10]
and ebx, 0xfffffffb
xor eax, eax
mov ecx, eax
cmp byte [esp + 0x26], 0
movzx edx, word [esp + 0xa8]
mov eax, dword [esp + 0x28]
jne 0x41d867
mov eax, dword [esp + 0x34]
push ecx
lea edi, [esp + 0x6c]
push edi
push ecx
push dword [esp + 0x64]
mov ecx, ebx
push edx
push dword [esp + 0x44]
mov edx, esi
push eax
call fcn.0042ed37
mov edi, dword [esp + 0x60]
test eax, eax
je 0x41d6e1
jmp 0x40605a
mov ebx, dword [esp + 0x10]
and ebx, 0xfffffffb
cmp byte [esp + 0x25], 0
je 0x41d84c
lea ecx, [esp + 0x390]
jmp 0x41d850
mov ecx, eax
call fcn.00407568
mov dword [0x439654], eax
jmp 0x406074