Function at 0x4ac160
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f684
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1b4], 0
call fcn.00517a38
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1ac], eax
push 0x1c
call dword [0x554868]
add esp, 4
mov esi, eax
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4ac1ef
push 0x4365f0
push 0x4340f0
push 0
mov ecx, esi
call dword [0x554860]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 0x517a40
mov byte [ebp - 4], 0
jmp 0x4ac1f1
xor esi, esi
mov dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x1a0]
call dword [0x554880]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 4], 0x432890
mov dword [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x28]
call dword [0x554884]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a0]
call dword [0x55488c]
mov dword [ebp - 4], 0xa
push 1
lea ecx, [ebp - 0x20]
call dword [0x555b50]
mov byte [ebp - 4], 0xb
call fcn.005168e4
test al, al
je 0x4ad2b1
push 0
push 0
push 0
call fcn.00516866
push 0x55cb7c
call fcn.005168f6
call fcn.005168f0
push 0x55b07d
push str.17.0
push 0x56d7e8
push 0
push 0
push 0x13d6312
push str.17.0.0
push 0x56d7e8
push 1
call fcn.005168ae
add esp, 0x34
push 0
push 4
push 0
push 2
call dword [0x5546e4]
add esp, 4
push eax
call dword [0x5546dc]
add esp, 0x10
mov dword [ebp - 0x154], 0xa
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x144]
call dword [0x55535c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x11c]
call dword [0x55535c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xfc]
call dword [0x55535c]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdc]
call dword [0x555244]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd8]
call dword [0x55535c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb8]
call dword [0x55535c]
mov byte [ebp - 4], 0x12
mov byte [ebp - 0x98], 1
mov dword [ebp - 0x94], 0
lea ecx, [ebp - 0x90]
call dword [0x55535c]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x70]
call dword [0x55535c]
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x50], 0x1010000
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 0x15
call dword [0x5546c0]
mov esi, dword [eax]
call dword [0x5546b8]
lea ecx, [ebp - 0x154]
push ecx
push 1
push esi
push dword [eax]
call fcn.004aace0
add esp, 0x10
sub eax, 1
je 0x4ad1e9
sub eax, 1
je 0x4ad137
mov eax, dword [ebp - 0x94]
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x4ac404
jmp dword [eax*4 + 0x4ad2c8]
push 0x56d7fc
push 0x56d7e8
push str._s__s_n
call fcn.005168fc
add esp, 0xc
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x28
jmp 0x4ad25a
push str.Please_instead_use:_vmware_vmx___query_license
call fcn.004a8ad0
add esp, 4
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x31
jmp 0x4ad1a8
push str.Please_instead_use:_vmware_vmx___can_run
call fcn.004a8ad0
add esp, 4
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x3a
jmp 0x4ad1a8
push str.Please_instead_use:_vmware_vmx___new_sn_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
call fcn.004a8ad0
add esp, 4
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x43
jmp 0x4ad1a8
push 1
push 0x42f
lea eax, [ebp - 0x174]
push eax
call dword [0x554a98]
mov dword [ebp - 4], 0x4d
mov dword [ebp - 0x1b4], 2
push 1
push eax
call dword [0x556028]
add esp, 0x14
mov dword [ebp - 4], 0x4c
mov eax, 2
mov dword [ebp - 0x1b4], eax
and eax, 0xfffffffd
mov dword [ebp - 0x1b4], eax
lea ecx, [ebp - 0x174]
call dword [0x555348]
mov dword [ebp - 4], 0x55
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x4e
jmp 0x4ad25a
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1ac], eax
mov ecx, eax
call dword [0x55487c]
mov byte [ebp - 4], 0x5a
push dword [0x5d33ec]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov byte [ebp - 0x1a2], 0
test esi, esi
je 0x4ac7fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ac74e
cmp byte [ebp - 0x50], 0
jne 0x4ac752
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete al
jmp 0x4ac758
mov al, 1
jmp 0x4ac758
mov al, byte [ebp - 0x1a2]
mov dword [ebp - 0x198], 0x4a8ca0
mov dword [ebp - 0x194], esi
mov byte [ebp - 0x190], al
sub esp, 8
mov dword [ebp - 0x1ac], esp
mov edi, esp
mov dword [ebp - 0x1b0], edi
push 0x24
call dword [0x554868]
add esp, 4
mov esi, eax
mov dword [ebp - 0x19c], esi
mov byte [ebp - 4], 0x5b
test esi, esi
je 0x4ac7ce
push 0x44fec0
push 0x4340f0
push 0
mov ecx, esi
call dword [0x554860]
mov byte [ebp - 4], 0x5c
movq xmm0, qword [ebp - 0x198]
movq qword [esi + 0x18], xmm0
mov eax, dword [ebp - 0x190]
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 0x5b
jmp 0x4ac7d0
xor esi, esi
mov byte [ebp - 4], 0x5a
push esi
mov ecx, edi
call dword [0x554880]
mov byte [ebp - 4], 0x5d
mov eax, dword [edi]
mov dword [eax + 4], 0x4ac0b0
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x3c]
call fcn.004aa390
xorps xmm0, xmm0
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
call dword [0x5546c0]
mov esi, dword [eax]
add esi, 4
call dword [0x5546b8]
mov eax, dword [eax]
dec eax
push esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.005056a0
add esp, 0xc
mov byte [ebp - 4], 0x60
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
je 0x4aca3a
xorps xmm0, xmm0
movlpd qword [ebp - 0x194], xmm0
push 0
push 0x55bfa0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x4aca3a
mov edi, dword [ebp - 0x190]
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a8], eax
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x198], 0x1310857
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
sub ecx, eax
and ecx, 0xfffffffe
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x1388
push 3
lea eax, [ebp - 0x198]
push eax
push 0
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4ac8dc
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1a8]
jbe 0x4ac8dc
mov dword [ebp - 0x1a8], eax
mov edi, esi
push 0
push 0x55bfa0
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x4ac880
test edi, edi
je 0x4aca3a
cmp byte [ebp - 0x50], al
jne 0x4aca3a
mov dword [ebp - 0x198], 0x1310858
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub eax, ecx
and eax, 0xfffffffe
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x18]
push eax
push 0x1388
push 3
lea eax, [ebp - 0x198]
push eax
push esi
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4aca03
cmp dword [ebp - 0x18], esi
je 0x4aca03
cmp byte [ebp - 0x4d], 0
je 0x4ac975
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4ac96e
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x34]
call fcn.00431480
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
call fcn.0040fc80
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x61
jmp 0x4ad25a
lea eax, [ebp - 0x19c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x19c]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4aca3a
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4aca26
cmp byte [ebp - 0x4f], 0
jne 0x4ad0a9
cmp byte [ebp - 0x4c], 0
jne 0x4ad0a9
call fcn.005168a2
xorps xmm0, xmm0
movlpd qword [ebp - 0x194], xmm0
call fcn.00516884
mov esi, eax
mov dword [ebp - 0x1ac], esi
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x19c], 0x516890
mov dword [ebp - 0x1c0], esi
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x1bc], eax
mov byte [ebp - 0x1b8], 1
mov byte [ebp - 4], 0x73
push 0x14
call fcn.00514bd0
add esp, 4
mov ecx, eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1b0], ecx
mov byte [ebp - 4], 0x74
test ecx, ecx
je 0x4acaf5
mov eax, dword [ebp - 0x19c]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 4], 1
mov dword [ecx + 8], 1
mov dword [ecx], vtable.std::_Ref_count_resource_struct_Dictionary___void____cdecl___struct_Dictionary___.0
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], esi
jmp 0x4acafd
xor ecx, ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0x73
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x190], ecx
mov byte [ebp - 0x1b8], 0
mov byte [ebp - 4], 0x75
push str.log.config
push str.ui.log.fileName
push esi
call fcn.00516896
push str.log.suffix
push 0x56d98c
push esi
call fcn.00516896
push str.log.keepOld
push 5
push esi
call fcn.0051689c
call fcn.005168c6
mov dword [ebp - 0x1b0], eax
call fcn.005168ba
mov dword [ebp - 0x19c], eax
call fcn.005168b4
mov edi, eax
call fcn.005168c0
mov esi, eax
call fcn.005167ef
push dword [ebp - 0x19c]
push edi
push esi
push eax
call fcn.005168cc
push 1
push dword [ebp - 0x1b0]
push dword [ebp - 0x1ac]
push 0x56d98c
call fcn.005168d2
add esp, 0x44
test eax, eax
je 0x4acf83
push eax
call fcn.005168de
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
push str.PID:__u__log_output:__s_n
call fcn.005168fc
push 1
call dword [0x5546e4]
push eax
call dword [0x5546e8]
call dword [0x555b4c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x18c], xmm0
movq qword [ebp - 0x17c], xmm0
call fcn.00516878
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x18c]
push eax
call fcn.0051687e
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
call dword [0x555b68]
mov byte [ebp - 4], 0x80
call dword [0x555b64]
push 0
push 0
push 0
call fcn.005168a8
push str.VMware.Workstation.vmui
call dword [0x555b48]
add esp, 0x2c
movups xmm0, xmmword [0x56cc44]
movups xmmword [0x5dba60], xmm0
mov dword [0x5dd2a0], 0
mov edi, dword [0x5d33cc]
mov eax, dword [0x5d33d0]
cmp edi, eax
jae 0x4acc79
mov esi, dword [edi]
test esi, esi
je 0x4acc72
mov esi, dword [esi + 0x1c]
push 1
mov ecx, esi
call dword [0x55604c]
call esi
mov eax, dword [0x5d33d0]
add edi, 4
cmp edi, eax
jb 0x4acc58
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x20]
call dword [0x555b58]
test al, al
jne 0x4acca5
lea ecx, [ebp - 0x20]
call dword [0x555b5c]
push eax
push str.GdiplusStartup_failed__error:__d_n
call fcn.005167ad
add esp, 8
push str.TaskbarButtonCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
test eax, eax
je 0x4accbd
push 1
push eax
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
push 1
push 0x323
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
push 1
push 0x326
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
call fcn.005168ea
mov byte [ebp - 0x1a1], 0
mov byte [ebp - 4], 0x81
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x154], eax
push 0x5a0
call fcn.00514bd0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1ac], esi
mov byte [ebp - 4], 0x82
test esi, esi
je 0x4acd2d
push 0x5a0
push 0
push esi
call fcn.00515fd2
add esp, 0xc
lea eax, [ebp - 0x154]
push eax
mov ecx, esi
call fcn.00408c40
jmp 0x4acd2f
xor eax, eax
mov byte [ebp - 4], 0x81
mov dword [0x5dd1d0], eax
mov ecx, eax
call fcn.00416b30
mov byte [ebp - 0x1a2], al
push 1
lea ecx, [ebp - 0x3c]
call fcn.004a8a10
cmp byte [ebp - 0x1a2], 0
je 0x4acd63
mov ecx, dword [0x5dd1d0]
call 0x42a2c0
mov ecx, dword [0x5dd1d0]
test ecx, ecx
je 0x4acd74
push 1
call fcn.004a7cf0
mov dword [0x5dd1d0], 0
mov byte [ebp - 0x1a1], 1
mov dword [ebp - 4], 0x80
mov edi, dword [ebp - 0x1a8]
jmp 0x4acdb0
cmp dword [0x5dd1d0], 0
je 0x4ace11
push str.Exception_caught__trying_to_exit_app._n
call fcn.005167ad
add esp, 4
mov byte [ebp - 4], 0x84
mov ecx, dword [0x5dd1d0]
test ecx, ecx
je 0x4acddb
push 1
call fcn.004a7cf0
mov dword [0x5dd1d0], 0
mov dword [ebp - 4], 0x80
jmp 0x4ace11
call dword [0x5548ec]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, str.normally
mov ecx, str.abnormally
cmp byte [ebp - 0x1a1], 0
cmove eax, ecx
push eax
push str.Exited__s._n
call fcn.005167a7
add esp, 8
call fcn.005168d8
xor eax, eax
cmp byte [ebp - 0x1a1], al
setne al
dec eax
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 4], 0x75
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x4ace7a
mov eax, dword [esi]
mov edi, dword [eax + 4]
push 1
mov ecx, edi
call dword [0x55604c]
mov ecx, esi
call edi
mov edi, dword [ebp - 0x1a8]
mov byte [ebp - 4], 0x60
test edi, edi
je 0x4aceb8
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x4aceb8
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x55604c]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4aceb8
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55604c]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x34]
call fcn.00431480
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
call fcn.0040fc80
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0x144]
call dword [0x555348]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x150]
call fcn.004313d0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call dword [0x555b54]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040fc80
mov eax, dword [ebp - 0x1ac]
jmp 0x4ad293
push str.Could_not_initialize_logging.
lea ecx, [ebp - 0x174]
call dword [0x555358]
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x174]
call dword [0x555340]
push eax
push 0x55cce4
call fcn.005167ad
add esp, 8
lea ecx, [ebp - 0x174]
call dword [0x55533c]
push eax
call fcn.004a8ad0
add esp, 4
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x174]
call dword [0x555348]
mov byte [ebp - 4], 0x60
mov edi, dword [ebp - 0x1a8]
test edi, edi
je 0x4ad01b
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x4ad01b
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x55604c]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4ad01b
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55604c]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x34]
call fcn.00431480
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
call fcn.0040fc80
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x77
jmp 0x4ad1a8
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x34]
call fcn.00431480
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
call fcn.0040fc80
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x6a
jmp 0x4ad25a
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x144]
call dword [0x555348]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x150]
call fcn.004313d0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call dword [0x555b54]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040fc80
mov eax, 1
jmp 0x4ad293
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x70]
call dword [0x555348]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x90]
call dword [0x555348]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xb8]
call dword [0x555348]
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xd8]
call dword [0x555348]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xdc]
call dword [0x555228]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xfc]
call dword [0x555348]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x11c]
call dword [0x555348]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x144]
call dword [0x555348]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x150]
call fcn.004313d0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call dword [0x555b54]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040fc80
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret 0x10
push 0x22d
push str.bora_apps_vmuiWin32_vmui.cpp
push str.NOT_IMPLEMENTED__s:_d_n
call fcn.005167b3
nop dword [eax]
or eax, esp
dec edx
add byte [eax + 0x1b004ac4], bl
lds ecx, [edx]
sahf
lds ecx, [edx]
and esi, eax
dec edx
add ah, cl
int3