Function at 0x401ed0
Capabilities:
Acquire debug privileges
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x178
mov eax, dword [0x409004]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x18], edi
cmp esi, 1
jge 0x401f12
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.004041fe
mov esp, ebp
pop ebp
ret
push 0x70
lea eax, [esp + 0x94]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x90]
push 1
push 1
call fcn.004029a0
push ecx
lea ecx, [esp + 0x94]
call fcn.00402df0
test al, al
je 0x40268b
push 0x1b1b1b
push 0
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x2962ff
push 1
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xc853
push 2
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xb8d4
push 3
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xd50000
push 4
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xaa00ff
push 5
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xffd600
push 6
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x616161
push 7
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xeeeeee
push 8
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x448aff
push 9
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x69f0ae
push 0xa
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x18ffff
push 0xb
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xff5252
push 0xc
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xe040fb
push 0xd
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xffff00
push 0xe
lea ecx, [esp + 0x98]
call fcn.00403030
push 0xfafafa
push 0xf
lea ecx, [esp + 0x98]
call fcn.00403030
push 0x406b50
push 0xf
call fcn.00403690
push 8
lea eax, [esp + 0x10c]
xorps xmm0, xmm0
push eax
push 0x10
lea eax, [esp + 0x124]
movaps xmmword [esp + 0x124], xmm0
push eax
push 0
push 0
push 0
movaps xmmword [esp + 0x144], xmm0
movaps xmmword [esp + 0x124], xmm0
push 0
push dword [edi]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x2c
test eax, eax
jne 0x402658
push 0x40
push eax
lea eax, [esp + 0x140]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x114]
push eax
push str._s_s
lea eax, [esp + 0x144]
push 0x20
push eax
call fcn.00401300
add esp, 0x14
cmp eax, 0xffffffff
je 0x402658
cmp esi, 2
jge 0x40212b
lea eax, [esp + 0x138]
push eax
push str.Usage:__s___cvthwl___args__n
jmp 0x402681
xor al, al
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402658
mov edx, str._help
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x402176
test si, si
je 0x402172
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x402176
add ecx, 4
add edx, 4
test si, si
jne 0x402150
xor ecx, ecx
jmp 0x40217b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x402674
mov edx, 0x406d00
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x4021b6
test si, si
je 0x4021b2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4021b6
add ecx, 4
add edx, 4
test si, si
jne 0x402190
xor ecx, ecx
jmp 0x4021bb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4021c6
mov cl, 1
jmp 0x402304
mov edx, str._cv64
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x4021f6
test si, si
je 0x4021f2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4021f6
add ecx, 4
add edx, 4
test si, si
jne 0x4021d0
xor ecx, ecx
jmp 0x4021fb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x402206
mov cl, 2
jmp 0x402304
mov edx, 0x406d14
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x402236
test si, si
je 0x402232
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x402236
add ecx, 4
add edx, 4
test si, si
jne 0x402210
xor ecx, ecx
jmp 0x40223b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x402246
mov cl, 3
jmp 0x402304
mov edx, str._th64
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x402276
test si, si
je 0x402272
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x402276
add ecx, 4
add edx, 4
test si, si
jne 0x402250
xor ecx, ecx
jmp 0x40227b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x402286
mov cl, 4
jmp 0x402304
mov edx, 0x406d28
mov ecx, eax
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x4022b6
test si, si
je 0x4022b2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4022b6
add ecx, 4
add edx, 4
test si, si
jne 0x402290
xor ecx, ecx
jmp 0x4022bb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4022c3
mov cl, 5
jmp 0x402304
mov ecx, str._wl64
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4022ee
test dx, dx
je 0x4022ea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4022ee
add eax, 4
add ecx, 4
test dx, dx
jne 0x4022c8
xor eax, eax
jmp 0x4022f3
sbb eax, eax
or eax, 1
mov ecx, dword [esp + 0x14]
test eax, eax
movzx ecx, cl
mov eax, 6
cmove ecx, eax
inc edi
mov dword [esp + 0x14], ecx
cmp edi, dword [ebp + 8]
jl 0x402133
test cl, cl
jne 0x402335
lea eax, [esp + 0x138]
push eax
push str.Usage:__s___cvcv64thth64wlwl64__n
push 0xe
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402373
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__OpenProcessToken___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
lea eax, [esp + 0x30]
xorps xmm0, xmm0
push eax
push str.SeDebugPrivilege
push 0
movlpd qword [esp + 0x3c], xmm0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4023ba
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__LookupPrivilegeValue___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
push 0
push 0x10
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x50], 1
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x1c]
test eax, eax
jne 0x40241d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__AdjustTokenPrivileges___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
mov dword [esp + 0x48], 0x44
movaps xmmword [esp + 0x20], xmm0
cmp al, 1
jne 0x4024b9
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.Virtualizer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
cmp al, 2
jne 0x402506
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.Virtualizer64.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
cmp al, 3
jne 0x402553
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.Themida.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
cmp al, 4
jne 0x4025a0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.Themida64.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
cmp al, 5
jne 0x4025e9
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.WinLicense.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
cmp al, 6
jne 0x40262f
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push str.WinLicense64.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40262f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__CreateProcess___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
or esi, 0xffffffff
jmp 0x40268d
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00401980
test al, al
jne 0x40265d
push dword [esp + 0x24]
call esi
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x20]
call esi
or esi, 0xffffffff
jmp 0x40268d
call fcn.00401c50
push dword [esp + 0x24]
test al, al
je 0x402644
call esi
push dword [esp + 0x20]
call esi
jmp 0x40268b
lea eax, [esp + 0x138]
push eax
push str.Usage:__s___cvthwl___args__n___cv___Code_Virtualizer_n___th___Themida_n___wl___WinLicense_n___args____Passes_arguments._n
push 0xe
call fcn.00403690
add esp, 0xc
xor esi, esi
lea ecx, [esp + 0x90]
call fcn.00402c50
mov ecx, dword [esp + 0x17c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004041fe
mov esp, ebp
pop ebp
ret