Function at 0x407c28
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov dword [ebp - 0xc], 0
call fcn.0047dac0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp + 0x10]
mov dword [esp], eax
call fcn.0047df30
sub esp, 8
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x158], 0
cmp dword [ebp + 8], 0
jne 0x407db4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], str.0419
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
jne 0x407cee
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x6c27d4
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
je 0x407cf8
jmp 0x407cef
nop
mov dword [ebp - 0x10], 1
jmp 0x407cf9
nop
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
jne 0x407d2b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x6c27cc
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
je 0x407d35
jmp 0x407d2c
nop
mov dword [ebp - 0x14], 1
jmp 0x407d36
nop
cmp dword [ebp - 0x14], 0
je 0x407d57
mov dword [esp + 4], 0x6cd7e0
lea eax, [ebp - 0x154]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
jmp 0x407d71
nop
mov dword [esp + 4], str.Disabling_Defender_in_this_version_of_the_program_requires_a_system_restart._Perform_Defender_Switch__
lea eax, [ebp - 0x154]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x34
mov dword [esp + 4], eax
mov dword [esp], str.Defender_Tools
call fcn.004057e6
sub esp, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
jne 0x407db7
mov dword [ebp - 0xc], 0
jmp 0x408871
nop
jmp 0x407db8
nop
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp + 4], eax
mov dword [esp], 0xc8
call fcn.0047bc50
sub esp, 8
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x158]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp + 4], eax
mov dword [esp], 0xc8
call fcn.0047bc50
sub esp, 8
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x148]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x3c], eax
mov edx, str.PROCESSOR_ARCHITECTURE
mov dword [esp + 8], 0xc8
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x44], eax
mov edx, str.PROCESSOR_ARCHITEW6432
mov dword [esp + 8], 0xc8
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], str.AMD64
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
jne 0x407edb
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], str.AMD64
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
je 0x407ee5
jmp 0x407edc
nop
mov dword [ebp - 0x18], 1
jmp 0x407ee6
nop
cmp dword [ebp - 0x18], 0
je 0x407f07
mov dword [esp + 4], 0x6c9ec0
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
jmp 0x407f21
nop
mov dword [esp + 4], 0x6ccb4c
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
call fcn.00413c71
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x407f65
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp], eax
call fcn.0046796f
sub esp, 4
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
jmp 0x407fc3
nop
call fcn.0047db20
call fcn.0047db20
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp], eax
call fcn.0045bbe4
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x60], eax
call fcn.0047db70
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call fcn.004673dc
sub esp, 8
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x68], eax
call fcn.0047dbd0
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Disable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x6c], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x70], eax
call fcn.0047dbd0
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Enable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x74], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x78], eax
call fcn.0047dbd0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 0x6c9ec0
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.0047de10
test eax, eax
je 0x4081a1
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0x88], eax
call fcn.0047dbd0
cmp dword [ebp - 0x88], 0
je 0x40819b
mov dword [ebp - 0x8c], 0x4def8a
mov dword [ebp - 0x90], 0x27600
mov eax, dword [ebp - 0x90]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0x94], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0x98], eax
jmp 0x40825e
nop
jmp 0x40825e
nop
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0xa0], eax
call fcn.0047dbd0
cmp dword [ebp - 0xa0], 0
je 0x40825d
mov dword [ebp - 0xa4], 0x4bf38a
mov dword [ebp - 0xa8], 0x1fc00
mov eax, dword [ebp - 0xa8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa4]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0xac], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0xb0], eax
jmp 0x40825e
nop
cmp dword [ebp + 8], 0
jne 0x408477
mov eax, dword [0x6d7064]
test eax, eax
jne 0x408352
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Disable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0xb8], eax
call fcn.0047dbd0
cmp dword [ebp - 0xb8], 0
je 0x40834c
mov dword [ebp - 0xbc], str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov dword [ebp - 0xc0], 0x46a
mov eax, dword [ebp - 0xc0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0xc4], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0xc8], eax
mov dword [esp + 4], str._U:T__P:E__ShowWindowMode:Hide__Wait_Disable.cmd
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
jmp 0x408472
nop
jmp 0x408472
nop
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Disable.ps1
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0xd0], eax
call fcn.0047dbd0
cmp dword [ebp - 0xd0], 0
je 0x408471
mov dword [ebp - 0xd4], 0x50725c
mov dword [ebp - 0xd8], 0x3f1
mov eax, dword [ebp - 0xd8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xd4]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0xdc], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0xe0], eax
call fcn.0047db20
mov dword [esp], str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
call fcn.0047dcf0
sub esp, 4
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp], eax
call fcn.0046796f
sub esp, 4
call fcn.0047db70
mov dword [esp], str.Disable.ps1_
call fcn.0047dcf0
sub esp, 4
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
jmp 0x40867f
nop
jmp 0x40867f
nop
mov eax, dword [0x6d7064]
test eax, eax
jne 0x408562
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Enable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0xe8], eax
call fcn.0047dbd0
cmp dword [ebp - 0xe8], 0
je 0x40855c
mov dword [ebp - 0xec], 0x5069f4
mov dword [ebp - 0xf0], 0x426
mov eax, dword [ebp - 0xf0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xec]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0xf4], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0xf8], eax
mov dword [esp + 4], str._U:T__P:E__ShowWindowMode:Hide__Wait_Enable.cmd
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.0047de80
sub esp, 8
jmp 0x40867f
nop
jmp 0x40867f
nop
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Enable.ps1
call fcn.0047dcf0
sub esp, 4
call fcn.0047dde0
call fcn.0047dc70
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468020
sub esp, 8
mov dword [ebp - 0x100], eax
call fcn.0047dbd0
cmp dword [ebp - 0x100], 0
je 0x40867e
mov dword [ebp - 0x104], 0x50725c
mov dword [ebp - 0x108], 0x3f1
mov eax, dword [ebp - 0x108]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 4], eax
mov dword [esp], 0x6f
call fcn.00468290
sub esp, 0xc
mov dword [ebp - 0x10c], eax
mov dword [esp], 0x6f
call fcn.00468300
sub esp, 4
mov dword [ebp - 0x110], eax
call fcn.0047db20
mov dword [esp], str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
call fcn.0047dcf0
sub esp, 4
call fcn.0047db20
call fcn.0047db20
call fcn.0047db70
mov dword [esp], eax
call fcn.0046796f
sub esp, 4
call fcn.0047db70
mov dword [esp], str.Enable.ps1_
call fcn.0047dcf0
sub esp, 4
call fcn.0047db70
mov dword [esp + 4], eax
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.0047dd50
sub esp, 8
jmp 0x40867f
nop
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
call fcn.0046745b
sub esp, 4
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edx
call fcn.0047dbd0
mov edx, 0
mov eax, 0
cmp edx, dword [ebp - 0x120]
sbb eax, dword [ebp - 0x11c]
jge 0x40875d
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x150]
mov dword [esp + 0xc], 3
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call fcn.0045bc83
sub esp, 0x10
mov dword [ebp - 0x128], eax
call fcn.0047dbd0
jmp 0x40875e
nop
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.loader.exe
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x12c], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x130], eax
call fcn.0047dbd0
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Disable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x134], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x138], eax
call fcn.0047dbd0
call fcn.0047db20
call fcn.0047db20
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047dcf0
sub esp, 4
mov dword [esp], str.Enable.cmd
call fcn.0047dcf0
sub esp, 4
call fcn.0047dc70
mov dword [ebp - 0x13c], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
call fcn.004679d2
sub esp, 8
mov dword [ebp - 0x140], eax
call fcn.0047dbd0
mov dword [ebp - 0xc], 1
nop
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x148]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.0047de50
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret 0xc