Function at 0x40cbc0
Capabilities:
Check mutex on windows
Read file via mapping
Set current directory

Disassembly:
mov rax, rsp
sub rsp, 0x6f8
mov qword [rsp + 0x3b0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00445028]
mov qword [rsp + 0x6b0], rax
mov qword [rsp + 0x158], rdx
mov dword [rsp + 0x5c], ecx
lea rdx, [0x00436a61]
xor ecx, ecx
call fcn.004247a0
mov edx, 1
lea rcx, [rsp + 0x3d0]
call fcn.00417cf0
nop
lea rcx, [rsp + 0x260]
call fcn.00402880
nop
lea rbx, [section..SHMMESS]
mov qword [rsp + 0xd0], rbx
xor r15d, r15d
mov qword [rsp + 0xc8], r15
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x3d0]
call fcn.00406a00
nop
lea r8, [0x004366a0]
lea r12, [0x00436678]
mov edi, dword [rsp + 0x98]
test edi, edi
je 0x40cdc1
mov ecx, r15d
mov rax, r15
test edi, edi
jle 0x40ccc2
nop
nop
nop
mov rdx, qword [rsp + 0x90]
cmp byte [rdx + rax], 0x5c
jne 0x40ccb9
mov byte [rdx + rax], 0x2e
mov edi, dword [rsp + 0x98]
inc ecx
inc rax
cmp ecx, edi
jl 0x40cca0
lea rsi, str..j2e.mapping
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2d8], r8
mov ebx, r15d
nop
inc ebx
movsxd rax, ebx
cmp byte [rax + rsi], 0
jne 0x40cce0
mov dword [rsp + 0x2e8], ebx
lea edx, [rbx + rdi]
lea rcx, [rsp + 0x88]
mov rax, qword [rsp + 0x88]
call qword [rax + 8]
cmp edi, edi
jge 0x40cd30
movsxd rax, edi
mov r8, qword [rsp + 0x90]
lea rdx, [rax + r8]
movsxd rcx, ebx
add rcx, rax
add rcx, r8
mov eax, edi
sub eax, edi
movsxd r8, eax
call fcn.00421230
movsxd r8, ebx
movsxd rcx, edi
add rcx, qword [rsp + 0x90]
mov rdx, rsi
call fcn.00421230
nop
mov qword [rsp + 0x2d8], r12
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x88]
mov rax, qword [rsp + 0x88]
call qword [rax + 8]
mov r11, qword [rsp + 0x90]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x1000
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0xd0], rax
mov rdx, rbx
lea rcx, [rsp + 0x480]
call fcn.0041d0b0
nop
lea rax, [rsp + 0x3d0]
mov qword [0x00446248], rax
lea rax, [rsp + 0x260]
mov qword [0x00446250], rax
lea rax, [rsp + 0x480]
mov qword [0x00446258], rax
xor eax, eax
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0xe0], 8
lea rcx, [rsp + 0xe0]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x3d0]
call fcn.0041a1b0
nop
lea rbp, [0x004366a8]
cmp dword [rsp + 0x1b0], 0
je 0x40ceb5
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x3d0]
call fcn.004083d0
nop
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.00408e50
nop
mov qword [rsp + 0x200], rbp
mov rcx, qword [rsp + 0x208]
mov qword [rsp + 0x208], r15
mov dword [rsp + 0x210], r15d
mov dword [rsp + 0x218], r15d
test rcx, rcx
je 0x40cea8
call fcn.00421200
mov qword [rsp + 0x200], r12
jmp 0x40cf4f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, 0x64
call qword [sym.imp.USER32.dll_LoadBitmapA]
mov rbx, rax
test rax, rax
je 0x40cf4f
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x3d0]
call fcn.00407350
nop
mov edx, dword [rsp + 0x190]
lea rcx, [rsp + 0x180]
mov r8, qword [rsp + 0x180]
call qword [r8 + 8]
mov rdx, qword [rsp + 0x188]
mov rcx, rbx
call fcn.0041b2f0
nop
mov qword [rsp + 0x180], rbp
mov rcx, qword [rsp + 0x188]
mov qword [rsp + 0x188], r15
mov dword [rsp + 0x190], r15d
mov dword [rsp + 0x198], r15d
test rcx, rcx
je 0x40cf47
call fcn.00421200
mov qword [rsp + 0x180], r12
lea rdx, [rsp + 0x160]
mov rcx, qword [0x00446248]
call fcn.004081b0
nop
mov edx, dword [rsp + 0x170]
test edx, edx
jle 0x40d02c
lea rcx, [rsp + 0x160]
mov rax, qword [rsp + 0x160]
call qword [rax + 8]
mov rdi, qword [rsp + 0x168]
lea rdx, [rsp + 0x220]
mov rcx, qword [0x00446248]
call fcn.004084e0
mov rbx, rax
mov r8, qword [rax]
mov edx, dword [rax + 0x10]
mov rcx, rax
call qword [r8 + 8]
mov r9d, 0x104
lea r8, [rsp + 0x5a0]
mov rdx, rdi
mov rcx, qword [rbx + 8]
call fcn.00405010
mov ebx, eax
mov qword [rsp + 0x220], rbp
mov rcx, qword [rsp + 0x228]
mov qword [rsp + 0x228], r15
mov dword [rsp + 0x230], r15d
mov dword [rsp + 0x238], r15d
test rcx, rcx
je 0x40d000
call fcn.00421200
mov qword [rsp + 0x220], r12
lea eax, [rbx - 1]
cmp eax, 0x102
ja 0x40d020
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, qword [0x00446248]
call fcn.0040f830
lea rdx, [rsp + 0xe8]
mov rcx, qword [0x00446248]
call fcn.00407f90
nop
mov edx, dword [rsp + 0xf8]
test edx, edx
je 0x40d073
lea rcx, [rsp + 0xe8]
mov rax, qword [rsp + 0xe8]
call qword [rax + 8]
mov rdx, qword [rsp + 0xf0]
lea rcx, [0x004462d0]
call fcn.0041caf0
lea rdx, [rsp + 0x138]
mov rcx, qword [0x00446248]
call fcn.00407d70
nop
mov edx, dword [rsp + 0x148]
test edx, edx
je 0x40d0ba
lea rcx, [rsp + 0x138]
mov rax, qword [rsp + 0x138]
call qword [rax + 8]
mov rdx, qword [rsp + 0x140]
lea rcx, [0x004462d0]
call fcn.0041ca20
mov edx, dword [rsp + 0xf8]
lea rcx, [rsp + 0xe8]
mov rax, qword [rsp + 0xe8]
call qword [rax + 8]
mov r11, qword [rsp + 0xf0]
mov qword [rsp + 0x2c8], r11
mov ecx, r15d
mov dword [rsp + 0x2d0], r15d
test r11, r11
je 0x40d113
cmp byte [r11], cl
je 0x40d113
nop
nop
inc ecx
movsxd rax, ecx
cmp byte [rax + r11], 0
jne 0x40d100
mov dword [rsp + 0x2d0], ecx
mov eax, ecx
mov edi, dword [rsp + 0x148]
cmp edi, ecx
cmovl eax, edi
mov r8d, r15d
mov r9, r15
movsxd rbx, eax
mov rsi, qword [rsp + 0x140]
test eax, eax
jle 0x40d15c
mov rdx, rsi
mov r10, r11
sub r10, rsi
nop
movzx eax, byte [r10 + rdx]
cmp byte [rdx], al
jne 0x40d157
inc r8d
inc r9
inc rdx
cmp r9, rbx
jl 0x40d140
test r8d, r8d
js 0x40d16b
cmp r8d, edi
jge 0x40d16b
movsxd rax, r8d
movzx r9d, byte [rax + rsi]
jmp 0x40d16e
xor r9b, r9b
test r8d, r8d
js 0x40d182
cmp r8d, ecx
jge 0x40d182
movsxd rax, r8d
movzx edx, byte [rax + r11]
jmp 0x40d184
xor dl, dl
movsx ecx, r9b
movsx eax, dl
sub ecx, eax
mov qword [rsp + 0x2c0], r12
mov eax, r15d
sete al
mov dword [0x00446240], eax
mov dword [rsp + 0x60], r15d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x3d0]
call fcn.00407bc0
mov rbx, rax
mov r8, qword [rax]
mov edx, dword [rax + 0x10]
mov rcx, rax
call qword [r8 + 8]
lea r8, [rsp + 0x60]
lea rdx, [0x00437254]
mov rcx, qword [rbx + 8]
call fcn.004233e0
nop
mov qword [rsp + 0x1e0], rbp
mov rcx, qword [rsp + 0x1e8]
mov qword [rsp + 0x1e8], r15
mov dword [rsp + 0x1f0], r15d
mov dword [rsp + 0x1f8], r15d
test rcx, rcx
je 0x40d213
call fcn.00421200
mov qword [rsp + 0x1e0], r12
lea rcx, [rsp + 0x538]
lea r14, [0x00400000]
mov rax, qword [r14 + 0x37238]
mov qword [rcx], rax
mov rax, qword [r14 + 0x37240]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x37248]
mov qword [rcx + 0x10], rax
movzx eax, byte [r14 + 0x37250]
mov byte [rcx + 0x18], al
lea rcx, [rsp + 0x538]
lea r12, [0x00446320]
mov rdx, r12
mov edi, 0x19
mov r8, rdi
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x40d270
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00422860
test rax, rax
je 0x40d2cc
mov rbx, r12
movzx eax, byte [rbx]
test al, al
js 0x40d2a6
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x40d2a6
mov al, 0x2e
jmp 0x40d2a9
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x00436a6c]
call fcn.00423020
inc rbx
dec rdi
jne 0x40d294
lea rcx, [0x00436a68]
call fcn.00423020
cmp byte [0x00446320], 0
je 0x40d38c
mov ecx, dword [rsp + 0x60]
call fcn.0041a6d0
test eax, eax
jne 0x40d38c
lea edx, [rax + 9]
lea rcx, [rsp + 0x350]
call fcn.00409a80
nop
mov edx, 0xa
lea rcx, [rsp + 0x2f0]
call fcn.00409a80
nop
mov edx, dword [rsp + 0x300]
lea rcx, [rsp + 0x2f0]
mov rax, qword [rsp + 0x2f0]
call qword [rax + 8]
mov rbx, qword [rsp + 0x2f8]
mov edx, dword [rsp + 0x360]
lea rcx, [rsp + 0x350]
mov rax, qword [rsp + 0x350]
call qword [rax + 8]
mov rcx, qword [0x004469e8]
call fcn.0041b020
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x358]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x004469e8]
call fcn.0041afc0
mov ecx, 9
call fcn.004239b0
nop
lea rcx, [rsp + 0x520]
mov rax, qword [r14 + 0x37220]
mov qword [rcx], rax
mov rax, qword [r14 + 0x37228]
mov qword [rcx + 8], rax
mov eax, dword [r14 + 0x37230]
mov dword [rcx + 0x10], eax
movzx eax, word [r14 + 0x37234]
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x578]
mov rax, qword [r14 + 0x37200]
mov qword [rcx], rax
mov rax, qword [r14 + 0x37208]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x37210]
mov qword [rcx + 0x10], rax
movzx eax, word [r14 + 0x37218]
mov word [rcx + 0x18], ax
movzx eax, byte [r14 + 0x3721a]
mov byte [rcx + 0x1a], al
lea rcx, [rsp + 0x558]
mov rax, qword [r14 + 0x371e0]
mov qword [rcx], rax
mov rax, qword [r14 + 0x371e8]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x371f0]
mov qword [rcx + 0x10], rax
movzx eax, word [r14 + 0x371f8]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x578]
mov rdx, r12
mov edi, 0x1b
mov r8, rdi
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x40d450
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00422860
test rax, rax
je 0x40d4ac
mov rbx, r12
movzx eax, byte [rbx]
test al, al
js 0x40d486
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x40d486
mov al, 0x2e
jmp 0x40d489
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x00436a6c]
call fcn.00423020
inc rbx
dec rdi
jne 0x40d474
lea rcx, [0x00436a68]
call fcn.00423020
mov rbp, qword [0x00446320]
lea rcx, [rsp + 0x558]
mov rdx, r12
mov edi, 0x1a
mov r8, rdi
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x40d4d0
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00422860
test rax, rax
je 0x40d52c
mov rbx, r12
movzx eax, byte [rbx]
test al, al
js 0x40d506
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x40d506
mov al, 0x2e
jmp 0x40d509
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x00436a6c]
call fcn.00423020
inc rbx
dec rdi
jne 0x40d4f4
lea rcx, [0x00436a68]
call fcn.00423020
mov esi, dword [0x00446320]
lea rdx, [rsp + 0x520]
mov r8, r12
mov edi, 0x16
mov r9, rdi
nop
nop
nop
movzx eax, byte [rdx]
mov byte [r8], al
inc r8
inc rdx
dec r9
jne 0x40d550
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00422860
test rax, rax
je 0x40d5ad
mov rbx, r12
movzx eax, byte [rbx]
test al, al
js 0x40d587
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x40d587
mov al, 0x2e
jmp 0x40d58a
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x00436a6c]
call fcn.00423020
inc rbx
dec rdi
jne 0x40d575
lea rcx, [0x00436a68]
call fcn.00423020
cmp byte [0x00446320], 0
je 0x40d672
mov r8d, esi
mov rdx, rbp
mov rcx, r12
call fcn.00409910
test eax, eax
jne 0x40d672
lea edx, [rax + 0xb]
lea rcx, [rsp + 0x310]
call fcn.00409a80
nop
mov edx, 0xa
lea rcx, [rsp + 0x390]
call fcn.00409a80
nop
mov edx, dword [rsp + 0x3a0]
lea rcx, [rsp + 0x390]
mov rax, qword [rsp + 0x390]
call qword [rax + 8]
mov rbx, qword [rsp + 0x398]
mov edx, dword [rsp + 0x320]
lea rcx, [rsp + 0x310]
mov rax, qword [rsp + 0x310]
call qword [rax + 8]
mov rcx, qword [0x004469e8]
call fcn.0041b020
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x318]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x004469e8]
call fcn.0041afc0
mov ecx, 0xb
call fcn.004239b0
nop
lea rdx, [rsp + 0xa8]
mov rcx, qword [0x00446248]
call fcn.00406ff0
nop
mov esi, r15d
nop
nop
inc esi
movsxd rax, esi
cmp byte [rax + r14 + 0x37090], 0
jne 0x40d690
mov eax, esi
mov edx, dword [rsp + 0xb8]
cmp edx, esi
cmovl eax, edx
mov ebp, r15d
mov rdi, r15
movsxd r13, eax
test eax, eax
jle 0x40d707
nop
nop
movzx ecx, byte [rdi + r14 + 0x37090]
mov rax, qword [rsp + 0xb0]
movzx r12d, byte [rax + rdi]
cmp r12b, cl
je 0x40d6f2
movsx ecx, cl
call fcn.004216b0
mov ebx, eax
movsx ecx, r12b
call fcn.004216b0
cmp eax, ebx
jne 0x40d6fc
inc ebp
inc rdi
cmp rdi, r13
jl 0x40d6c0
test ebp, ebp
js 0x40d71d
mov edx, dword [rsp + 0xb8]
cmp ebp, edx
jge 0x40d724
movsxd rcx, ebp
mov rax, qword [rsp + 0xb0]
movzx r9d, byte [rcx + rax]
jmp 0x40d727
mov edx, dword [rsp + 0xb8]
xor r9b, r9b
test ebp, ebp
js 0x40d73d
cmp ebp, esi
jge 0x40d73d
movsxd rax, ebp
movzx r8d, byte [rax + r14 + 0x37090]
jmp 0x40d740
xor r8b, r8b
movsx ecx, r9b
movsx eax, r8b
sub ecx, eax
mov r14d, r15d
sete r14b
mov ebp, r15d
lea rcx, [0x00400000]
nop
nop
inc ebp
movsxd rax, ebp
cmp byte [rax + rcx + 0x371d0], 0
jne 0x40d760
mov eax, ebp
cmp edx, ebp
cmovl eax, edx
mov esi, r15d
mov rdi, r15
movsxd r13, eax
test eax, eax
jle 0x40d7d0
movzx r12d, byte [rdi + rcx + 0x371d0]
mov rax, qword [rsp + 0xb0]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x40d7b4
movsx ecx, cl
call fcn.004216b0
mov ebx, eax
movsx ecx, r12b
call fcn.004216b0
cmp ebx, eax
jne 0x40d7c5
inc esi
inc rdi
cmp rdi, r13
lea rcx, [0x00400000]
jl 0x40d783
test esi, esi
js 0x40d7e6
mov edx, dword [rsp + 0xb8]
cmp esi, edx
jge 0x40d7e6
movsxd rcx, esi
mov rax, qword [rsp + 0xb0]
movzx r8d, byte [rcx + rax]
jmp 0x40d7e9
xor r8b, r8b
test esi, esi
js 0x40d806
cmp esi, ebp
jge 0x40d806
movsxd rax, esi
lea r12, [0x00400000]
movzx edx, byte [rax + r12 + 0x371d0]
jmp 0x40d80f
xor dl, dl
lea r12, [0x00400000]
movsx ecx, r8b
movsx eax, dl
sub ecx, eax
mov eax, r15d
sete al
mov dword [rsp + 0x30], eax
test r14d, r14d
jne 0x40d851
test eax, eax
jne 0x40d851
lea rdx, str.custom
lea rcx, [rsp + 0xa8]
call fcn.004022c0
test eax, eax
jne 0x40db3a
call fcn.0041dbd0
jmp 0x40db3d
lea rdx, [rsp + 0x38]
mov rcx, qword [0x00446248]
call fcn.00406a00
nop
mov ebx, dword [rsp + 0x48]
test ebx, ebx
jne 0x40d92c
lea rdx, [rsp + 0x240]
mov rcx, qword [0x00446248]
call fcn.004083d0
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
call qword [r8 + 8]
movsxd rdi, dword [rbx + 0x10]
mov rsi, qword [rbx + 8]
movsxd rbx, dword [rsp + 0x48]
lea edx, [rbx + rdi]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
cmp ebx, ebx
jge 0x40d8d3
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rbx]
lea rcx, [rax + rdi]
add rcx, rbx
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.00421230
mov r8, rdi
mov rcx, rbx
add rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.00421230
nop
lea rbp, [0x004366a8]
mov qword [rsp + 0x240], rbp
mov rcx, qword [rsp + 0x248]
xor edi, edi
mov qword [rsp + 0x248], rdi
mov dword [rsp + 0x250], edi
mov dword [rsp + 0x258], edi
test rcx, rcx
je 0x40d926
call fcn.00421200
mov ebx, dword [rsp + 0x48]
jmp 0x40d935
mov ebx, dword [rsp + 0x48]
jmp 0x40d935
xor edi, edi
lea rbp, [0x004366a8]
mov ecx, edi
mov rax, rdi
test ebx, ebx
jle 0x40d95c
nop
mov rdx, qword [rsp + 0x40]
cmp byte [rdx + rax], 0x3a
jne 0x40d953
mov byte [rdx + rax], 0x2e
mov ebx, dword [rsp + 0x48]
inc ecx
inc rax
cmp ecx, ebx
jl 0x40d940
mov ecx, edi
mov rax, rdi
test ebx, ebx
jle 0x40d981
mov rdx, qword [rsp + 0x40]
cmp byte [rdx + rax], 0x5c
jne 0x40d978
mov byte [rdx + rax], 0x2e
mov ebx, dword [rsp + 0x48]
inc ecx
inc rax
cmp ecx, ebx
jl 0x40d965
lea rsi, str..j2e.mutex
mov qword [rsp + 0x3c0], rsi
lea rax, [0x004366a0]
mov qword [rsp + 0x3b8], rax
nop
inc edi
movsxd rax, edi
cmp byte [rax + rsi], 0
jne 0x40d9a0
mov dword [rsp + 0x3c8], edi
lea edx, [rdi + rbx]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
cmp ebx, ebx
jge 0x40d9e7
movsxd r8, ebx
mov rax, qword [rsp + 0x40]
lea rdx, [rax + r8]
movsxd rcx, edi
add rcx, rax
add rcx, r8
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.00421230
movsxd r8, edi
movsxd rcx, ebx
add rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.00421230
nop
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
jne 0x40da3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateMutex_error:__d_n
call fcn.00423020
lea r15d, [rbx + 1]
jmp 0x40da65
mov edx, 0x64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40db12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r15d, 1
test r14d, r14d
je 0x40db12
mov edx, 0xd
lea rcx, [rsp + 0x370]
call fcn.00409a80
nop
mov edx, 0xa
lea rcx, [rsp + 0x330]
call fcn.00409a80
nop
mov edx, dword [rsp + 0x340]
lea rcx, [rsp + 0x330]
mov rax, qword [rsp + 0x330]
call qword [rax + 8]
mov rbx, qword [rsp + 0x338]
mov edx, dword [rsp + 0x380]
lea rcx, [rsp + 0x370]
mov rax, qword [rsp + 0x370]
call qword [rax + 8]
mov rcx, qword [0x004469e8]
call fcn.0041b020
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x378]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x004469e8]
call fcn.0041afc0
mov ecx, 0xd
call fcn.004239b0
nop
mov qword [rsp + 0x38], rbp
mov rcx, qword [rsp + 0x40]
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x50], r14d
test rcx, rcx
je 0x40db3d
call fcn.00421200
jmp 0x40db3d
xor r14d, r14d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x3d0]
call fcn.00406e40
nop
mov esi, r14d
nop
nop
nop
nop
inc esi
movsxd rax, esi
cmp byte [rax + r12 + 0x37090], 0
jne 0x40db60
mov eax, esi
mov edx, dword [rsp + 0x78]
cmp edx, esi
cmovl eax, edx
mov ebp, r14d
mov rdi, r14
movsxd r13, eax
test eax, eax
jle 0x40dbd7
nop
nop
movzx r12d, byte [rdi + r12 + 0x37090]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x40dbbe
movsx ecx, cl
call fcn.004216b0
mov ebx, eax
movsx ecx, r12b
call fcn.004216b0
cmp ebx, eax
jne 0x40dbcf
inc ebp
inc rdi
cmp rdi, r13
lea r12, [0x00400000]
jl 0x40db90
test ebp, ebp
js 0x40dbea
mov edx, dword [rsp + 0x78]
cmp ebp, edx
jge 0x40dbee
movsxd rcx, ebp
mov rax, qword [rsp + 0x70]
movzx r9d, byte [rcx + rax]
jmp 0x40dbf1
mov edx, dword [rsp + 0x78]
xor r9b, r9b
test ebp, ebp
js 0x40dc0e
cmp ebp, esi
jge 0x40dc0e
movsxd rax, ebp
lea r10, [0x00400000]
movzx r8d, byte [rax + r10 + 0x37090]
jmp 0x40dc18
xor r8b, r8b
lea r10, [0x00400000]
movsx ecx, r9b
movsx eax, r8b
lea r8, [0x00437198]
sub ecx, eax
je 0x40dd2a
mov ebp, r14d
nop
nop
nop
nop
inc ebp
movsxd rax, ebp
cmp byte [rax + r10 + 0x37190], 0
jne 0x40dc40
mov eax, ebp
cmp edx, ebp
cmovl eax, edx
mov esi, r14d
mov rdi, r14
movsxd r13, eax
test eax, eax
jle 0x40dcb7
nop
nop
nop
movzx r12d, byte [rdi + r10 + 0x37190]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x40dca5
movsx ecx, cl
call fcn.004216b0
mov ebx, eax
movsx ecx, r12b
call fcn.004216b0
cmp ebx, eax
jne 0x40dcaf
lea r10, [0x00400000]
inc esi
inc rdi
cmp rdi, r13
jl 0x40dc70
test esi, esi
js 0x40dcca
mov edx, dword [rsp + 0x78]
cmp esi, edx
jge 0x40dcce
movsxd rcx, esi
mov rax, qword [rsp + 0x70]
movzx r9d, byte [rcx + rax]
jmp 0x40dcd1
mov edx, dword [rsp + 0x78]
xor r9b, r9b
test esi, esi
js 0x40dcee
cmp esi, ebp
jge 0x40dcee
movsxd rax, esi
lea rcx, [0x00400000]
movzx r8d, byte [rax + rcx + 0x37190]
jmp 0x40dcf1
xor r8b, r8b
movsx ecx, r9b
movsx eax, r8b
sub ecx, eax
je 0x40dd23
lea rdx, [0x00437198]
lea rcx, [rsp + 0x68]
call fcn.004022c0
test eax, eax
jne 0x40de22
mov edx, dword [rsp + 0x78]
lea r8, [0x00437198]
jmp 0x40dd2a
lea r8, [0x00437198]
mov esi, r14d
nop
inc esi
movsxd rax, esi
cmp byte [rax + r8], 0
jne 0x40dd30
mov eax, esi
cmp edx, esi
cmovl eax, edx
mov ebp, r14d
mov rdi, r14
movsxd r13, eax
test eax, eax
jle 0x40dd93
movzx r12d, byte [rdi + r8]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x40dd81
movsx ecx, cl
call fcn.004216b0
mov ebx, eax
movsx ecx, r12b
call fcn.004216b0
cmp ebx, eax
jne 0x40dd8b
lea r8, [0x00437198]
inc ebp
inc rdi
cmp rdi, r13
jl 0x40dd50
test ebp, ebp
js 0x40dda6
mov edx, dword [rsp + 0x78]
cmp ebp, edx
jge 0x40dda6
movsxd rcx, ebp
mov rax, qword [rsp + 0x70]
movzx r8d, byte [rcx + rax]
jmp 0x40dda9
xor r8b, r8b
test ebp, ebp
js 0x40ddc1
cmp ebp, esi
jge 0x40ddc1
movsxd rax, ebp
lea rcx, [0x00437198]
movzx edx, byte [rax + rcx]
jmp 0x40ddc3
xor dl, dl
movsx ecx, r8b
movsx eax, dl
sub ecx, eax
neg ecx
sbb r9d, r9d
add r9d, 2
mov r8, qword [rsp + 0x158]
mov edx, dword [rsp + 0x5c]
lea rcx, [0x00446280]
call fcn.00420870
lea rdx, section..data
lea rcx, [0x00446280]
call fcn.0041fe50
mov ebx, dword [0x00445010]
mov edx, ebx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 8]
mov rdi, qword [0x00445008]
jmp 0x40de2e
mov ebx, dword [rsp + 0x5c]
mov rdi, qword [rsp + 0x158]
lea rsi, [0x004366a8]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x78], r14d
mov dword [rsp + 0x80], r14d
test rcx, rcx
je 0x40de5b
call fcn.00421200
lea rbp, [0x00436678]
mov qword [rsp + 0x68], rbp
cmp dword [rsp + 0x30], 0
je 0x40deb3
call fcn.0041dbd0
test r15d, r15d
je 0x40deb3
lea rdx, [rdi + 8]
lea ecx, [rbx - 1]
call fcn.0041e820
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x40dea8
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xd
call fcn.004239b0
int3
xor eax, eax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
lea eax, [rbx - 1]
mov dword [rsp + 0x108], eax
lea rax, [rdi + 8]
mov qword [rsp + 0x110], rax
lea rax, [0x004056f0]
mov qword [rsp + 0x118], rax
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x3d0]
call fcn.00405cb0
nop
cmp dword [rsp + 0x1d0], 0
jne 0x40e002
mov dword [rsp + 0x30], r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0x108]
lea r8, [0x0040cb40]
xor edx, edx
xor ecx, ecx
call fcn.004231f0
mov rbx, rax
test rax, rax
jne 0x40df8c
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x108]
lea r8, [0x0040cb40]
xor edx, edx
xor ecx, ecx
call fcn.004231f0
mov rbx, rax
test rax, rax
je 0x40dfba
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x30]
jmp 0x40e048
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x120]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov ecx, dword [rsp + 0x108]
call fcn.0040a720
mov ebx, eax
mov dword [rsp + 0x130], eax
mov rcx, qword [0x00446250]
call fcn.004010f0
jmp 0x40e048
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x120]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov ecx, dword [rsp + 0x108]
call fcn.0040a720
mov ebx, eax
mov dword [rsp + 0x130], eax
mov rcx, qword [0x00446250]
call fcn.004010f0
mov qword [0x00446248], r14
mov qword [0x00446250], r14
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x40e07b
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rsp + 0x1c0], rsi
mov rcx, qword [rsp + 0x1c8]
mov qword [rsp + 0x1c8], r14
mov dword [rsp + 0x1d0], r14d
mov dword [rsp + 0x1d8], r14d
test rcx, rcx
je 0x40e0ad
call fcn.00421200
mov qword [rsp + 0x1c0], rbp
mov qword [rsp + 0xa8], rsi
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], r14
mov dword [rsp + 0xb8], r14d
mov dword [rsp + 0xc0], r14d
test rcx, rcx
je 0x40e0e7
call fcn.00421200
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x138], rsi
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], r14
mov dword [rsp + 0x148], r14d
mov dword [rsp + 0x150], r14d
test rcx, rcx
je 0x40e121
call fcn.00421200
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0xe8], rsi
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0xf0], r14
mov dword [rsp + 0xf8], r14d
mov dword [rsp + 0x100], r14d
test rcx, rcx
je 0x40e15b
call fcn.00421200
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0x160], rsi
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], r14
mov dword [rsp + 0x170], r14d
mov dword [rsp + 0x178], r14d
test rcx, rcx
je 0x40e195
call fcn.00421200
mov qword [rsp + 0x160], rbp
mov qword [rsp + 0x1a0], rsi
mov rcx, qword [rsp + 0x1a8]
mov qword [rsp + 0x1a8], r14
mov dword [rsp + 0x1b0], r14d
mov dword [rsp + 0x1b8], r14d
test rcx, rcx
je 0x40e1cf
call fcn.00421200
mov qword [rsp + 0x1a0], rbp
lea rcx, [rsp + 0x480]
call fcn.0041d010
nop
mov qword [rsp + 0x88], rsi
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x98], r14d
mov dword [rsp + 0xa0], r14d
test rcx, rcx
je 0x40e217
call fcn.00421200
mov qword [rsp + 0x88], rbp
lea rcx, [rsp + 0x260]
call fcn.004010f0
nop
mov qword [rsp + 0x280], rsi
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x288], r14
mov dword [rsp + 0x290], r14d
mov dword [rsp + 0x298], r14d
test rcx, rcx
je 0x40e25f
call fcn.00421200
mov qword [rsp + 0x280], rbp
lea rax, [0x004366b8]
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x268]
mov qword [rsp + 0x268], r14
mov dword [rsp + 0x270], r14d
mov dword [rsp + 0x278], r14d
test rcx, rcx
je 0x40e2a0
call fcn.00421200
lea rax, [0x00436680]
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x3d0]
call fcn.0040eda0
mov eax, ebx
mov rcx, qword [rsp + 0x6b0]
call fcn.00435170
mov rbx, qword [rsp + 0x710]
mov rbp, qword [rsp + 0x718]
mov rsi, qword [rsp + 0x6f0]
mov rdi, qword [rsp + 0x6e8]
mov r12, qword [rsp + 0x6e0]
mov r13, qword [rsp + 0x6d8]
mov r14, qword [rsp + 0x6d0]
mov r15, qword [rsp + 0x6c8]
add rsp, 0x6f8
ret