Function at 0x407b10
Capabilities:
Access peb ldr_data
Check mutex on windows
Create pipe
Create process on windows
Create process suspended
Get common file path
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3ac
mov dword [ebp - 0x380], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x37c], ecx
add eax, 0x18
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebp - 0x384], eax
call eax
mov esi, dword [ebx + 0x68]
sub esp, 4
test esi, esi
je 0x407b7c
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0x102
je 0x408600
mov dword [ebx + 0x68], 0
dec dword [esi + 0x10]
mov dword [esp], esi
call fcn.00406bd0
mov dword [ebx + 0x70], 0
xor eax, eax
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call edi
mov esi, eax
sub esp, 0xc
lea edx, [esi + esi]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x378], eax
call eax
mov dword [ebp - 0x370], eax
sub esp, 0xc
test eax, eax
je 0x408587
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call edi
mov eax, dword [ebx + 0x78]
sub esp, 0xc
test eax, eax
mov eax, dword [ebx + 0x34]
jne 0x407f38
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x36c], ecx
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x374], ecx
dec eax
cmp eax, 1
jbe 0x408120
mov eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x354]
xor esi, esi
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x34c]
mov edx, 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x36c]
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [ebp - 0x354], edx
mov dword [esp + 0xc], eax
mov eax, dword [0x4200b8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x407c80
cmp dword [ebp - 0x220], 4
je 0x408430
mov eax, 4
mov edx, 0x420070
mov dword [esp + 0x14], eax
mov eax, dword [0x4200b8]
mov ecx, 4
mov dword [esp + 0x10], edx
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [0x420070]
mov edi, dword fs:[0x18]
sub esp, 0x18
mov dword [esp + 0xc], eax
mov eax, str..pipe_netNtControlPipe_u
mov dword [esp + 8], eax
mov eax, 0x27
mov dword [esp + 4], eax
mov dword [esp], 0x420020
call fcn.00405e80
mov eax, 0x28
mov dword [esp + 8], eax
mov eax, 8
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
inc dword [0x420070]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x378]
call eax
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x408620
mov dword [eax + 0xc], 1
xor eax, eax
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x4085f8
mov dword [esp], 0
xor eax, eax
xor ecx, ecx
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x24], eax
sub esp, 0x10
test eax, eax
je 0x408380
mov eax, 0x2710
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, 0x100
mov edx, 0x40000003
mov dword [esp + 0x14], eax
mov eax, 0x100
mov dword [esp + 0x10], eax
mov eax, 1
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x420020
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x20], eax
sub esp, 0x20
inc eax
je 0x408a70
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x21c], edx
mov dword [ebp + eax - 0x218], edx
add eax, 8
cmp eax, 0x40
jb 0x407dd3
test byte [ebx + 0x35], 1
mov edx, 0x44
mov dword [ebp - 0x220], edx
je 0x408450
mov eax, dword [0x4200bc]
test eax, eax
je 0x408a88
mov dword [ebx + 0x18], 2
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
lea edx, [eax + 8]
mov dword [esi], edx
mov edx, dword [eax + 0xc]
sub esp, 4
mov dword [esi + 4], edx
mov dword [edx], esi
mov dword [eax + 0xc], esi
lock inc dword [esi + 0xc]
xor edi, edi
mov eax, dword [ebp - 0x37c]
mov dword [ebx + 0x68], esi
mov dword [eax], 0
mov dword [ebx + 0x6c], 0
inc dword [esi + 0x10]
mov eax, dword [ebx + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34c]
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x36c]
mov dword [esp + 0x1c], edi
mov dword [esp], 0
mov edi, dword fs:[0x18]
mov dword [esp + 0x20], eax
mov eax, dword [0x4200bc]
mov dword [esp + 0x18], eax
mov eax, 0x400
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x370]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov ebx, eax
mov eax, dword [ebp - 0x370]
sub esp, 0x28
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test ebx, ebx
je 0x408720
mov eax, dword [ebp - 0x344]
xor edi, edi
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x34c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x380]
mov dword [eax], esi
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
and edi, 3
jne 0x407bfd
lea esi, [ebp - 0x220]
mov eax, 0x104
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x36c], esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
cmp word [ebp - 0x220], 0
je 0x408c40
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
add ecx, 2
cmp word [ecx], 0
jne 0x407f80
mov esi, dword [ebp - 0x36c]
sub ecx, esi
mov dword [ebp - 0x374], ecx
mov eax, ecx
sar eax, 1
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x370]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
test eax, eax
mov esi, eax
jne 0x408740
mov edx, dword [ebp - 0x36c]
mov eax, 0x104
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
mov eax, dword [ebp - 0x370]
sub esp, 8
cmp word [eax], 0
je 0x408003
mov esi, eax
nop
lea esi, [esi]
add esi, 2
cmp word [esi], 0
jne 0x407ff0
mov ecx, dword [ebp - 0x370]
sub esi, ecx
sar esi, 1
cmp word [ebp - 0x220], 0
je 0x408035
mov eax, dword [ebp - 0x36c]
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x408020
mov edx, dword [ebp - 0x36c]
sub eax, edx
sar eax, 1
add esi, eax
add esi, esi
xor eax, eax
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x388], edx
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x378]
call eax
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0x388]
mov esi, eax
sub esp, 0xc
xor eax, eax
test esi, esi
je 0x408565
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [esi + eax], dx
add eax, 2
test edx, edx
jne 0x408080
mov eax, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x374]
add ecx, eax
mov eax, esi
cmp word [esi], 0
je 0x4080c0
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x4080b0
lea esi, [esi]
movzx edx, word [ecx + edi]
mov word [eax + edi], dx
add edi, 2
test edx, edx
jne 0x4080c0
mov edx, dword [ebp - 0x370]
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x374], eax
call eax
sub esp, 0xc
test byte [0x419090], 8
jne 0x4087c0
mov dword [ebp - 0x370], esi
mov eax, dword [ebx + 0x34]
jmp 0x407c15
mov edi, dword [ebp - 0x36c]
mov esi, 0x104
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp - 0x370]
xor edx, edx
mov eax, dword fs:[0x18]
sub esp, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
cmp word [ebp - 0x220], 0
je 0x408ba0
mov eax, edi
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x408180
mov ecx, dword [ebp - 0x36c]
sub eax, ecx
add eax, 0x20
mov dword [esp + 8], eax
xor edx, edx
mov dword [esp + 4], edx
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x378]
call eax
mov dword [ebp - 0x370], eax
sub esp, 0xc
test eax, eax
mov ecx, eax
je 0x4085b0
mov esi, dword [ebp - 0x36c]
xor eax, eax
jmp 0x4081e0
movzx edx, word [esi + eax]
mov word [ecx + eax], dx
add eax, 2
test edx, edx
jne 0x4081e0
mov edx, dword [ebp - 0x370]
cmp word [edx], 0
je 0x408bb0
nop
add edx, 2
cmp word [edx], 0
jne 0x408200
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [eax + str.winedevice.exe]
mov word [edx + eax], cx
add eax, 2
test ecx, ecx
jne 0x408210
mov eax, dword [ebx + 0x44]
mov ecx, dword [ebx + 8]
test eax, eax
mov dword [ebp - 0x378], ecx
lea esi, [ecx + 0x10]
je 0x408485
mov edi, dword [ecx + 0x10]
cmp esi, edi
je 0x408485
mov esi, dword [ebp - 0x370]
lea esi, [esi]
mov eax, dword [edi + 0x18]
sub eax, 2
and eax, 0xfffffffd
jne 0x408470
mov eax, dword [edi + 0x68]
test eax, eax
je 0x408470
mov eax, dword [edi + 0x78]
test eax, eax
jne 0x408470
mov eax, dword [edi + 0x40]
test eax, eax
je 0x408470
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x408460
mov eax, dword [edi + 0x44]
test eax, eax
je 0x408460
mov edx, dword [ebx + 0x44]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x408460
mov esi, dword [edi + 0x68]
test esi, esi
je 0x408758
lea edi, [esi + 0xc]
lock inc dword [edi]
mov eax, dword fs:[0x18]
mov edx, dword [ebp - 0x370]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebp - 0x370], eax
sub esp, 0xc
mov dword [ebx + 0x18], 2
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResetEvent]
sub esp, 4
lock inc dword [edi]
mov eax, dword [ebp - 0x37c]
mov dword [ebx + 0x68], esi
mov dword [eax], 1
mov dword [ebx + 0x6c], 1
inc dword [esi + 0x10]
mov eax, dword [ebx + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x370]
call eax
mov ecx, 0x7530
sub esp, 4
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edi, eax
jne 0x4088a0
mov eax, dword [ebp - 0x380]
mov dword [eax], esi
jmp 0x40841e
mov eax, dword [esi + 0x1c]
mov edi, dword [edi + 0x34]
test eax, eax
je 0x4083a9
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4083a9
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], esi
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test edi, edi
je 0x407dcf
test byte [0x419090], 2
jne 0x408630
mov eax, dword [ebx + 8]
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x370]
mov eax, dword fs:[0x18]
sub esp, 4
mov dword [esp + 8], ecx
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x34c]
mov edx, dword [0x420070]
inc eax
cmp eax, edx
cmovb eax, edx
mov dword [0x420070], eax
jmp 0x407c80
mov eax, str.__wineservice_winstationDefault
mov dword [ebp - 0x218], eax
jmp 0x407dfe
mov ecx, dword [ebx + 8]
lea esi, [esi]
lea edi, [edi]
mov edi, dword [edi]
lea eax, [ecx + 0x10]
cmp edi, eax
jne 0x408250
mov dword [ebp - 0x378], ecx
mov esi, eax
mov dword [ebp - 0x388], ebx
mov edi, dword [ebp - 0x378]
jmp 0x4084a0
mov dword [esp], 0x420080
mov eax, dword [0x4200b0]
mov ebx, str.Winedevice_u
mov dword [esp + 8], ebx
inc eax
mov dword [0x4200b0], eax
mov dword [esp + 0xc], eax
mov eax, 0x17
mov dword [esp + 4], eax
call fcn.00405e80
mov ebx, dword [edi + 0x10]
cmp ebx, esi
je 0x4084fe
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebx + 0x10]
mov dword [esp], 0x420080
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4084a0
mov ebx, dword [ebx]
cmp esi, ebx
jne 0x4084e0
mov dword [esp], 0x420080
lea eax, [ebp - 0x34c]
mov ebx, dword [ebp - 0x388]
mov dword [esp + 4], eax
call fcn.004063f0
test eax, eax
mov edi, eax
je 0x4088b8
mov edx, dword [ebp - 0x370]
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [ebx + 8]
add eax, 0x18
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x40841e
mov eax, dword [ebp - 0x370]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [ebx + 8]
mov edi, 0x46a
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 8]
mov edi, 0x46a
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [edi + 0x34]
jmp 0x408396
mov eax, dword [ebx + 8]
mov edi, 0x420
add eax, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x40841e
mov edi, 0x46a
jmp 0x4083d5
mov edx, dword [ebx + 0x10]
test edx, edx
je 0x408c60
mov eax, edx
shr eax, 0x10
je 0x408770
mov dword [esp], edx
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [ebp - 0x378], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x408c50
mov edx, dword [ebp - 0x378]
cmp word [edx], 0
je 0x408c6a
lea esi, [esi]
mov ecx, eax
cmp word [edx + ecx*2 + 2], 0
lea eax, [eax + 1]
jne 0x408680
mov dword [ebp - 0x378], edi
mov esi, 0x224c
mov word [ebp - 0x220], si
lea esi, [ebp - 0x21e]
mov dword [ebp - 0x37c], ebx
jmp 0x4086eb
cmp eax, 9
je 0x408b18
cmp eax, 0xa
jne 0x408b32
mov word [esi], 0x6e5c
add esi, 2
lea esi, [esi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x408bc0
lea ecx, [ebp - 0xfe]
cmp esi, ecx
ja 0x408bc0
mov ecx, eax
movzx eax, word [edx]
add edx, 2
cmp eax, 0xd
je 0x408b90
jbe 0x4086b0
cmp eax, 0x22
je 0x408b80
cmp eax, 0x5c
jne 0x408b25
mov word [esi], 0x5c5c
add esi, 2
jmp 0x4086d0
mov edi, dword [edi + 0x34]
mov dword [esp], esi
call fcn.00407a80
mov dword [esp], esi
call fcn.00406bd0
jmp 0x40841e
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x374], edx
jmp 0x407c15
mov eax, dword [ebx + 8]
mov dword [ebp - 0x378], eax
lea esi, [eax + 0x10]
jmp 0x408485
mov dword [esp], 0x41ac00
movzx eax, dx
mov dword [esp + 4], eax
call fcn.004060c0
mov dword [esp + 0x10], eax
mov eax, str.service_start_process
mov esi, str.failed_to_create_process_object_for__s__error___u_n
mov dword [esp + 8], eax
mov eax, 0x419090
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00406030
jmp 0x4083e2
mov eax, esi
shr eax, 0x10
je 0x408d7a
mov dword [esp], esi
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x408e26
cmp word [esi], 0
je 0x408e30
lea esi, [esi]
lea edi, [edi]
mov ecx, eax
cmp word [esi + ecx*2 + 2], 0
lea eax, [eax + 1]
jne 0x408800
mov eax, 0x224c
mov edx, esi
mov word [ebp - 0x34c], ax
lea edi, [ebp - 0x34a]
mov dword [ebp - 0x370], esi
mov dword [ebp - 0x388], ebx
jmp 0x40886b
cmp eax, 9
je 0x408d08
cmp eax, 0xa
jne 0x408c98
mov word [edi], 0x6e5c
add edi, 2
lea esi, [esi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x408d15
lea ecx, [ebp - 0x22a]
cmp edi, ecx
ja 0x408d15
mov ecx, eax
movzx eax, word [edx]
add edx, 2
cmp eax, 0xd
je 0x408cf5
jbe 0x408830
cmp eax, 0x22
je 0x408ce8
cmp eax, 0x5c
jne 0x408c8b
mov word [edi], 0x5c5c
add edi, 2
jmp 0x408850
mov dword [esp], esi
mov edi, 0x41d
call fcn.00406bd0
jmp 0x40841e
mov edi, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x370]
mov dword [edi + 0x78], 0
mov dword [edi + 0x34], 0x10
mov dword [edi + 0x38], 3
mov dword [edi + 0x14], 0x10
mov dword [esp], eax
call fcn.00409850
mov dword [edi + 0x40], eax
test eax, eax
je 0x408c18
mov dword [esp], str.LocalSystem
mov edi, dword [ebp - 0x34c]
call fcn.00409850
mov dword [edi + 0x50], eax
test eax, eax
je 0x408c18
mov dword [esp], 0x420080
mov edi, dword [ebp - 0x34c]
call fcn.00409850
mov dword [edi + 0x54], eax
test eax, eax
je 0x408c18
mov eax, dword [ebx + 0x44]
mov edi, dword [ebp - 0x34c]
test eax, eax
je 0x408953
mov dword [esp], eax
call fcn.00409850
mov dword [edi + 0x44], eax
test eax, eax
je 0x408c18
mov edi, dword [ebp - 0x34c]
mov dword [edi], esi
mov ecx, dword [ebp - 0x378]
mov esi, dword fs:[0x18]
mov dword [edi + 8], ecx
mov eax, dword [ecx + 0x14]
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 0x14], edi
xor edi, edi
mov eax, dword [ebp - 0x34c]
mov dword [eax + 0x74], 1
mov eax, dword [ebp - 0x370]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
mov eax, dword [ebp - 0x34c]
mov eax, dword [eax + 0x44]
sub esp, 0xc
mov dword [esp], eax
call fcn.00409850
mov edx, dword [ebx + 8]
mov dword [ebp - 0x220], eax
lea eax, [edx + 0x18]
mov edx, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [esp], eax
mov dword [ebp - 0x370], edx
call edx
mov edx, dword [ebp - 0x220]
xor eax, eax
mov ecx, dword [ebp - 0x36c]
sub esp, 4
test edx, edx
mov dword [esp + 8], ecx
setne al
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.00408e50
xor ecx, ecx
mov dword [esp + 4], ecx
mov edi, eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x374]
call eax
sub esp, 0xc
test edi, edi
jne 0x408c00
mov eax, dword [ebx + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x384]
call eax
mov eax, dword [ebp - 0x34c]
mov esi, dword [eax + 0x68]
sub esp, 4
test esi, esi
je 0x408e00
lea edi, [esi + 0xc]
lock inc dword [edi]
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.00406e20
jmp 0x408304
mov eax, dword [esi + 0x1c]
mov edi, dword [edi + 0x34]
test eax, eax
jne 0x40838a
nop
jmp 0x408396
mov dword [esp], 0xffffffff
lea eax, [ebp - 0x360]
mov dword [esp + 8], eax
mov eax, 0xa
mov dword [esp + 4], eax
call sub.advapi32.dll_OpenProcessToken
sub esp, 0xc
test eax, eax
je 0x407e0b
mov dword [esp], 0x4200bc
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x360]
mov dword [esp + 4], eax
call sub.userenv.dll_CreateEnvironmentBlock
mov eax, 0x10
sub esp, 0xc
mov dword [esp + 8], eax
lea eax, [ebp - 0x34c]
mov dword [esp + 4], eax
mov dword [esp], str.WINEBOOTSTRAPMODE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x408d97
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x407e0b
mov word [esi], 0x745c
add esi, 2
jmp 0x4086d0
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x408c30
mov byte [esi], 0x5c
mov edi, eax
add esi, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [esi - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdefvalidate_service_config]
mov byte [esi - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefvalidate_service_config]
mov byte [esi - 1], al
mov byte [esi - 2], bl
jmp 0x4086d0
mov word [esi], 0x225c
add esi, 2
jmp 0x4086d0
mov word [esi], 0x725c
add esi, 2
jmp 0x4086d0
mov eax, 0x20
jmp 0x408194
mov edx, dword [ebp - 0x370]
jmp 0x408209
test eax, eax
mov edi, dword [ebp - 0x378]
mov byte [esi], 0x22
mov ebx, dword [ebp - 0x37c]
jle 0x408c83
mov word [esi + 1], 0x2e2e
lea eax, [esi + 4]
mov byte [esi + 3], 0x2e
mov byte [eax], 0
mov eax, dword [ebp - 0x36c]
mov dword [esp], eax
call fcn.00417b60
jmp 0x408783
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call fcn.00406e20
jmp 0x40841e
mov eax, dword [ebp - 0x34c]
mov edi, 0x46a
mov dword [esp], eax
call fcn.00406c90
jmp 0x408524
mov byte [esi], al
inc esi
jmp 0x4086d0
xor edx, edx
xor eax, eax
mov dword [ebp - 0x374], edx
jmp 0x407f9b
mov eax, 0x41ac0d
jmp 0x408783
mov eax, 0x41ac06
jmp 0x408783
mov byte [ebp - 0x21e], 0x22
lea esi, [ebp - 0x21e]
mov edx, 0x224c
mov word [ebp - 0x220], dx
lea eax, [esi + 1]
jmp 0x408be4
lea esi, [eax - 0x20]
cmp si, 0x5e
jbe 0x408d8f
mov byte [edi], 0x5c
mov esi, eax
add edi, 5
shr esi, 0xc
movzx ebx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov esi, eax
shr esi, 8
and esi, 0xf
mov byte [edi - 4], bl
movzx ebx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov esi, eax
shr esi, 4
and eax, 0xf
and esi, 0xf
movzx eax, byte [eax + str.0123456789abcdefvalidate_service_config]
mov byte [edi - 3], bl
movzx ebx, byte [esi + str.0123456789abcdefvalidate_service_config]
mov byte [edi - 1], al
mov byte [edi - 2], bl
jmp 0x408850
mov word [edi], 0x225c
add edi, 2
jmp 0x408850
mov word [edi], 0x725c
add edi, 2
jmp 0x408850
mov word [edi], 0x745c
add edi, 2
jmp 0x408850
test eax, eax
mov esi, dword [ebp - 0x370]
mov byte [edi], 0x22
mov ebx, dword [ebp - 0x388]
jle 0x408e46
mov word [edi + 1], 0x2e2e
lea eax, [edi + 4]
mov byte [edi + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call fcn.00417b60
mov dword [esp + 0x10], eax
mov ecx, str.redirected_to__s_n
mov edi, str.get_service_binary_path
mov dword [esp + 0xc], ecx
mov eax, 0x419090
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.00406030
jmp 0x40810b
mov dword [esp], 0x41ac00
movzx eax, si
mov dword [esp + 4], eax
call fcn.004060c0
jmp 0x408d4a
mov byte [edi], al
inc edi
jmp 0x408850
mov eax, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, str.WINEBOOTSTRAPMODE
mov dword [esp + 4], edi
lea edi, [ebp - 0x35c]
mov dword [esp], edi
mov dword [ebp - 0x378], eax
call eax
lea eax, [ebp - 0x34c]
sub esp, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [ebp - 0x378]
call eax
lea eax, [ebp - 0x354]
sub esp, 8
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x4200bc
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
sub esp, 0xc
jmp 0x408afc
mov dword [esp], eax
mov edi, 0x41d
call fcn.00406e20
mov eax, dword [ebx + 8]
add eax, 0x18
mov dword [esp], eax
mov eax, dword [ebp - 0x370]
call eax
sub esp, 4
jmp 0x40841e
mov eax, 0x41ac0d
jmp 0x408d4a
mov word [ebp - 0x34c], 0x224c
lea edi, [ebp - 0x34a]
mov byte [ebp - 0x34a], 0x22
lea eax, [edi + 1]
jmp 0x408d39