Function at 0x408040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x439018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push str.kernel32.dll
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4080d0
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4080d0
push 0x800
mov ecx, esi
call dword [0x429174]
call esi
test eax, eax
jne 0x4080d8
lea ecx, [ebp - 0x20]
call fcn.00405660
mov edx, 0x3e8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.00407ec0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
push 0xb
xor eax, eax
mov dword [ebp - 0x38], 0
push 0x435208
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
call fcn.00401bb0
mov byte [ebp - 4], 3
cmp byte [ebp - 0xa8], 0
je 0x40814d
cmp dword [ebp - 0xac], 8
lea eax, [ebp - 0xc0]
push dword [ebp - 0xb0]
cmovae eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0x38]
push eax
call fcn.00401bb0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x110], str._ManufacturerName_
push eax
lea ecx, [ebp - 0x10c]
call fcn.00404170
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040dd10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xf8]
cmp edx, 8
jb 0x4081be
mov ecx, dword [ebp - 0x10c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4081b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096ed
push edx
push ecx
call fcn.0040f194
add esp, 8
push 0x7e
xor eax, eax
mov dword [ebp - 0x70], 0
push str.This__ManufacturerName__product_cannot_be_installed_on_your_device._Click_OK_to_view_details_about_compatibility_requirements.
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00401bb0
mov edx, 0x3e9
lea ecx, [ebp - 0xa4]
call fcn.00407ec0
mov byte [ebp - 4], 6
cmp byte [ebp - 0x8c], 0
je 0x408228
cmp dword [ebp - 0x90], 8
lea eax, [ebp - 0xa4]
push dword [ebp - 0x94]
cmovae eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x70]
push eax
call fcn.00401bb0
push 0x12
xor eax, eax
mov dword [ebp - 0x2bc], 0
push str._ManufacturerName_
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
lea eax, [ebp - 0x2bc]
mov byte [ebp - 4], 7
push eax
call fcn.00409760
lea ecx, [ebp - 0x38]
cmp eax, ecx
je 0x40828b
cmp dword [ebp - 0x24], 8
push dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.00401bb0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x4082cf
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4082c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096a7
push edx
push ecx
call fcn.0040f194
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.00407fb0
call fcn.00407e60
mov word [ebp - 0x3c], ax
test al, al
jne 0x408519
mov eax, dword [ebp - 0x3c]
shr eax, 8
test al, al
jne 0x408519
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
push 0x31
cmovae ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
push ecx
cmovae eax, dword [ebp - 0x70]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4094c6
mov edx, 0x3ea
lea ecx, [ebp - 0xdc]
call fcn.00407ec0
mov byte [ebp - 4], 8
mov al, byte [ebp - 0xc4]
test al, al
je 0x4084ca
xor eax, eax
mov dword [ebp - 0x2bc], 0
push eax
push 0x434c48
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
xor eax, eax
mov byte [ebp - 4], 9
push eax
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2a4]
push 0x434c48
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
mov byte [ebp - 4], 0xa
cmp byte [ebp - 0xc4], 0
je 0x4096ac
sub esp, 8
lea eax, [ebp - 0x2bc]
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0xdc]
push eax
call fcn.00401a90
mov byte [ebp - 4], 9
add esp, 0xc
mov edx, dword [ebp - 0x290]
mov bl, al
cmp edx, 8
jb 0x40842c
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408422
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096b1
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
cmp edx, 8
jb 0x40848d
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408483
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096b1
push edx
push ecx
call fcn.0040f194
add esp, 8
mov al, byte [ebp - 0xc4]
test al, al
je 0x4096b6
test bl, bl
jne 0x4084ca
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xdc]
push 5
cmovae eax, dword [ebp - 0xdc]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [ebp - 0xc4]
mov byte [ebp - 4], 6
test al, al
je 0x4094c6
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x4094c6
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4094bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096bb
jmp 0x4094bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00404080
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
xor ecx, ecx
mov dword [ebp - 0x2bc], 0
mov word [ebp - 0x2bc], cx
lea ecx, [ebp - 0x2bc]
push eax
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
call fcn.00401bb0
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00407cf0
mov esi, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2a4]
push 0xc
xor eax, eax
mov dword [ebp - 0x2a4], 0
push str.bddeploy.exe
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0xe
push eax
mov ecx, esi
call fcn.004036e0
mov byte [ebp - 4], 0xd
mov esi, eax
mov edx, dword [ebp - 0x290]
cmp edx, 8
jb 0x408624
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40861a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096c0
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x294], 0
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00404170
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xc4]
cmp edx, 8
jb 0x40868e
mov ecx, dword [ebp - 0xd8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408684
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096c5
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x2a8]
cmp edx, 8
jb 0x4086ef
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4086e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096c5
push edx
push ecx
call fcn.0040f194
add esp, 8
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x88]
mov dword [ebp - 0x40], 0
cmovae edx, dword [ebp - 0x88]
lea ecx, [ebp - 0x1b0]
push eax
mov dword [ebp - 0x3c], 0x439a30
call fcn.004076b0
add esp, 4
cmp dword [ebp - 0x40], 0
jne 0x40907f
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x88]
call fcn.004060c0
test al, al
jne 0x408d62
mov eax, dword [ebp - 0x40]
cmp eax, 0x800b0111
je 0x408760
cmp eax, 0x800b010c
jne 0x40907f
mov edx, 0x3eb
lea ecx, [ebp - 0xdc]
call fcn.00407ec0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xf4]
push 0x67
xor eax, eax
mov dword [ebp - 0xf4], 0
push str.Check_for_Bitdefender_certificates_in_the_Untrusted_Certificates_folder._Click_OK_to_view_more_details.
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 7
mov word [ebp - 0xf4], ax
call fcn.00401bb0
mov byte [ebp - 4], 0x14
cmp byte [ebp - 0xc4], 0
je 0x4087eb
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xdc]
push dword [ebp - 0xcc]
cmovae eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0xf4]
push eax
call fcn.00401bb0
lea ecx, [ebp - 0xf4]
call fcn.00407fb0
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
push 0x31
cmovae ecx, dword [ebp - 0x38]
lea eax, [ebp - 0xf4]
cmp dword [ebp - 0xe0], 8
push ecx
cmovae eax, dword [ebp - 0xf4]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x408a10
mov edx, 0x3ec
lea ecx, [ebp - 0x110]
call fcn.00407ec0
mov byte [ebp - 4], 0x15
mov al, byte [ebp - 0xf8]
test al, al
je 0x4089c8
xor eax, eax
mov dword [ebp - 0x2bc], 0
push eax
push 0x434c48
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00401bb0
xor eax, eax
mov byte [ebp - 4], 0x16
push eax
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2a4]
push 0x434c48
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
call fcn.00401bb0
mov byte [ebp - 4], 0x17
cmp byte [ebp - 0xf8], 0
je 0x4096ca
sub esp, 8
lea eax, [ebp - 0x2bc]
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0x110]
push eax
call fcn.00401a90
mov byte [ebp - 4], 0x16
add esp, 0xc
mov edx, dword [ebp - 0x290]
mov bl, al
cmp edx, 8
jb 0x40892a
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408920
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096cf
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
cmp edx, 8
jb 0x40898b
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408981
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096cf
push edx
push ecx
call fcn.0040f194
add esp, 8
mov al, byte [ebp - 0xf8]
test al, al
je 0x4096d4
test bl, bl
jne 0x4089c8
cmp dword [ebp - 0xfc], 8
lea eax, [ebp - 0x110]
push 5
cmovae eax, dword [ebp - 0x110]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [ebp - 0xf8]
mov byte [ebp - 4], 0x14
test al, al
je 0x408a10
mov edx, dword [ebp - 0xfc]
cmp edx, 8
jb 0x408a10
mov ecx, dword [ebp - 0x110]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a06
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096d9
push edx
push ecx
call fcn.0040f194
add esp, 8
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xe0]
cmp edx, 8
jb 0x408a54
mov ecx, dword [ebp - 0xf4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a4a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 7
mov word [ebp - 0xf4], ax
cmp byte [ebp - 0xc4], al
je 0x408ada
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x408abd
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ab3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x408b2e
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408b24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x408b83
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408b79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
cmp byte [ebp - 0x8c], al
je 0x408c03
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x408be6
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408bdc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x408c41
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408c37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x408c93
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408c89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x408d10
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x408cf3
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ce9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096de
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x408d4a
mov dword [ebp - 4], 0x18
mov eax, dword [edi + 4]
test eax, eax
je 0x408d3c
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x429174]
call esi
add edi, 8
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x408d21
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call fcn.0040a4e0
mov eax, 1
jmp 0x409689
mov byte [ebp - 4], 0x19
lea edx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x250]
cmovae edx, dword [ebp - 0x58]
call fcn.00407ae0
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x220]
cmp dword [ebp - 0x20c], 8
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x170]
cmovae edx, dword [ebp - 0x220]
cmp dword [ebp - 0x16c], 8
cmovae ecx, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x210]
jne 0x4091cd
push eax
call fcn.00404750
add esp, 4
test eax, eax
jne 0x4091cd
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x58]
call fcn.00406570
lea ecx, [ebp - 0x208]
test al, al
jne 0x40906f
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x408e4d
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408e43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x408ea2
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408e98
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
cmp byte [ebp - 0x8c], al
je 0x408f22
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x408f05
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408efb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x408f60
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408f56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x408fb2
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408fa8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x40902f
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x409012
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409008
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
nop dword [eax]
cmp edi, ebx
je 0x408d4a
mov dword [ebp - 4], 0x1c
mov eax, dword [edi + 4]
test eax, eax
je 0x409063
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x429174]
call esi
mov dword [ebp - 4], 0xffffffff
add edi, 8
jmp 0x409040
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x268], xmm0
cmovae eax, dword [ebp - 0x58]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x28c]
push eax
movlpd qword [ebp - 0x260], xmm0
movlpd qword [ebp - 0x258], xmm0
mov dword [ebp - 0x28c], 0x3c
mov dword [ebp - 0x288], 0x40
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], str.runas
mov dword [ebp - 0x278], 0x434c48
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x26c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x409121
push 0xffffffffffffffff
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x409175
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40916b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e3
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x4094c6
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4094bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e3
jmp 0x4094bc
lea ecx, [ebp - 0x208]
call fcn.004066b0
lea ecx, [ebp - 0x250]
call fcn.004066b0
lea ecx, [ebp - 0x168]
call fcn.004066b0
lea ecx, [ebp - 0x1b0]
call fcn.004066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x409237
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40922d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x40928c
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409282
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
cmp byte [ebp - 0x8c], al
je 0x40930c
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x4092ef
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4092e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x40934a
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409340
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x40939c
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409392
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x409419
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x4093fc
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4093f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096e8
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x408d4a
mov dword [ebp - 4], 0x1b
mov eax, dword [edi + 4]
test eax, eax
je 0x409449
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x429174]
call esi
mov dword [ebp - 4], 0xffffffff
add edi, 8
jmp 0x409426
push edx
push ecx
call fcn.0040f194
add esp, 8
mov byte [ebp - 4], 5
cmp byte [ebp - 0x8c], 0
je 0x409530
mov edx, dword [ebp - 0x90]
cmp edx, 8
jb 0x409513
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409509
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096ed
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x40956e
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409564
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096ed
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x4095c0
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4095b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096ed
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
cmp byte [ebp - 0xa8], al
je 0x40963d
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x409620
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409616
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4096ed
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp edi, ebx
je 0x409679
nop
mov dword [ebp - 4], 0x1e
mov eax, dword [edi + 4]
test eax, eax
je 0x40966b
mov esi, dword [edi]
mov ecx, esi
push eax
call dword [0x429174]
call esi
add edi, 8
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x409650
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call fcn.0040a4e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ef0a
mov esp, ebp
pop ebp
ret 0x10
call fcn.004134aa
call fcn.00401d70
call fcn.004134aa
call fcn.00401d70
call fcn.004134aa
call fcn.004134aa
call fcn.004134aa
call fcn.00401d70
call fcn.004134aa
call fcn.00401d70
call fcn.004134aa
call fcn.004134aa
call fcn.004134aa
call fcn.004134aa
call fcn.004134aa
int3