Function at 0x40fbdb
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov ecx, eax
call fcn.00402393
mov dword [0x4260f8], eax
jmp 0x410029
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1c51c
call fcn.004049c8
mov eax, dword [0x4261d4]
xor eax, esp
mov dword [esp + 0x1c518], eax
push ebx
push esi
push edi
mov esi, 0x410040
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x100]
mov dword [esp + 0x2c], 0xffff
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x44], ebx
movsd dword es:[edi], dword [esi]
push 0x48
push ebx
mov dword [esp + 0x2c], ebx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], ebx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x3c], ebx
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x50]
or esi, 0xffffffff
stosd dword es:[edi], eax
mov dword [esp + 0x28], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x60]
push eax
mov edi, 0x80010
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x64], 0x48
add esp, 0xc
mov dword [esp + 0x5c], ebx
inc eax
mov dword [esp + 0x60], ebx
mov word [esp + 0x88], ax
xor eax, eax
mov dword [esp + 0x64], ebx
push 0xfffffffffffffff6
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x88], ebx
mov word [esp + 0x8e], ax
mov dword [esp + 0x90], ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0x94], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0x98], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetStdHandle]
mov dword [esp + 0x98], eax
xor eax, eax
mov word [esp + 0x4520], ax
mov word [esp + 0x14520], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], ebx
test eax, eax
je 0x4164ab
cmp word [eax], bx
je 0x417c15
mov ecx, eax
call fcn.004024cb
push 0x22
pop edx
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x4177f1
lea edx, [esp + 0x14]
mov esi, 0x2000
push esi
cmp ecx, 0x2f
je 0x4100cf
lea eax, [esp + 0x4524]
xor ecx, ecx
push eax
call fcn.00410055
cmp eax, 1
je 0x417b2e
mov eax, dword [esp + 0x14]
cmp word [eax], bx
je 0x40fd60
push eax
mov edx, esi
lea ecx, [esp + 0x14524]
call fcn.00401da3
lea eax, [esp + 0x14520]
mov dword [esp + 0x24], eax
mov ax, word [esp + 0x4520]
or esi, 0xffffffff
test ax, ax
je 0x417c15
push 0x22
pop ecx
cmp ax, cx
je 0x40fd96
lea eax, [esp + 0x4520]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x417c3b
lea eax, [esp + 0x4520]
mov edx, 0x2000
push eax
lea ecx, [esp + 0x8524]
call fcn.00401da3
lea ecx, [esp + 0x4520]
call fcn.0040220d
push eax
mov edx, 0x2000
lea ecx, [esp + 0x4524]
call fcn.00401da3
lea eax, [esp + 0x14]
mov byte [esp + 0x13], bl
push eax
push 0x2d
lea edx, [esp + 0x4528]
pop ecx
call fcn.00405bc7
cmp eax, esi
jne 0x414e09
lea eax, [esp + 0x4520]
mov esi, 0x2000
push eax
mov edx, esi
lea ecx, [esp + 0x18524]
call fcn.00401da3
lea eax, [esp + 0x4520]
push esi
mov edx, eax
mov dword [esp + 0xdc], eax
lea ecx, [esp + 0xa4]
call fcn.00403112
push 3
pop ecx
cmp eax, ecx
je 0x417c81
test eax, eax
je 0x4151c9
cmp eax, 2
je 0x414e09
push 5
pop ecx
cmp eax, ecx
je 0x4164b7
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x8520]
mov edx, 0x2000
push eax
lea ecx, [esp + 0x10524]
call fcn.00401da3
push 0x40223c
mov edx, 0x2000
lea ecx, [esp + 0x10524]
call fcn.00402c8a
test esi, esi
je 0x40fe95
push esi
mov edx, 0x2000
lea ecx, [esp + 0x10524]
call fcn.00402c8a
lea eax, [esp + 0x10520]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x38], ebx
jne 0x417cae
push 0x40
lea eax, [esp + 0xa8]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], eax
cmp byte [esp + 0x13], bl
jne 0x415199
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push eax
push ebx
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x417cbc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x7a
jne 0x417cc8
push dword [esp + 0x3c]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x417cc8
lea eax, [esp + 0x3c]
push eax
push ebx
push 2
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x417c67
push ebx
push ebx
push 4
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 1
push eax
push 0x60001
push ebx
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x417cd5
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x9c], esi
cmp eax, 0xffff
jne 0x417ce9
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x30]
mov eax, edi
push dword [esp + 0x4c]
or eax, 0x400
push eax
push 1
push ebx
push ebx
push dword [esp + 0x44]
lea eax, [esp + 0x4544]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessW]
push esi
mov dword [esp + 0x34], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_DeleteProcThreadAttributeList]
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov esi, dword [esp + 0x30]
cmp dword [esp + 0x38], ebx
jne 0x417d0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x4260a4], eax
test esi, esi
je 0x415149
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x417d1b
push dword [esp + 0x48]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ResumeThread]
push dword [esp + 0x48]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x410029
cmp dword [esp + 0x34], 0
jne 0x4097f0
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x1c524]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401200
mov esp, ebp
pop ebp
ret
add eax, 2
xor ecx, ecx
mov dword [esp + 0x18], eax
inc ecx
lea eax, [esp + 0x524]
push eax
call fcn.00410055
cmp eax, 1
je 0x417b2e
lea eax, [esp + 0x520]
push 0x41023c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41784b
lea eax, [esp + 0x520]
push 0x410250
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4151a0
lea eax, [esp + 0x520]
push 0x410268
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4151ab
lea eax, [esp + 0x520]
push 0x410280
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41795d
push dword [esp + 0x520]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x417977
lea eax, [esp + 0x520]
push 0x410284
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4151b6
push dword [esp + 0x520]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x417a1b
push dword [esp + 0x520]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x417bdd
lea eax, [esp + 0x520]
push 0x410290
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4151c1
lea eax, [esp + 0x520]
push 0x410298
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x414f27
mov ax, word [esp + 0x88]
mov ecx, 0xfffe
or dword [esp + 0x84], 1
and ax, cx
or ax, 7
mov word [esp + 0x88], ax
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x40fcf8
jmp 0x40fd60
mov ecx, 0x409c8c
call fcn.00401e96
mov esi, eax
test esi, esi
je 0x417b21
lea eax, [esp + 0x8520]
push eax
push 0x414ea0
lea eax, [esp + 0xc528]
push 0x2000
push eax
call fcn.004026f3
add esp, 0x10
lea ecx, [esp + 0x4520]
push esi
mov esi, 0x2000
mov edx, esi
call fcn.00401da3
lea eax, [esp + 0x4520]
mov edx, esi
push eax
lea ecx, [esp + 0x8524]
call fcn.00401da3
lea eax, [esp + 0xc520]
push 0x414eb0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x414f1b
cmp word [esp + 0x14520], bx
je 0x414f1b
lea edx, [esp + 0x14520]
lea ecx, [edx + 2]
jmp 0x414eba
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x414eba
sub edx, ecx
lea ecx, [esp + 0xc520]
sar edx, 1
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x414ed3
sub ecx, esi
mov esi, 0x2000
sar ecx, 1
lea eax, [ecx + edx]
cmp eax, esi
jae 0x417c92
push 0x40223c
mov edx, esi
lea ecx, [esp + 0xc524]
call fcn.00402c8a
lea eax, [esp + 0x14520]
mov edx, esi
push eax
lea ecx, [esp + 0xc524]
call fcn.00402c8a
lea esi, [esp + 0xc520]
jmp 0x40fe50
lea eax, [esp + 0x520]
push 0x415000
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417a33
lea eax, [esp + 0x520]
push 0x415008
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417a56
lea eax, [esp + 0x520]
push 0x415014
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417ad9
lea eax, [esp + 0x520]
push 0x415024
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417ae1
lea eax, [esp + 0x520]
push 0x415038
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417aec
lea eax, [esp + 0x520]
push 0x41504c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x417af7
lea eax, [esp + 0x520]
push 0x41505c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x417b02
mov dword [esp + 0x34], 1
jmp 0x410228
cmp byte [esp + 0x13], bl
je 0x415259
call fcn.00406c17
test al, al
je 0x41518c
push 0x4260a4
lea eax, [esp + 0x48]
push eax
movzx eax, word [esp + 0x90]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x14530]
push eax
lea eax, [esp + 0x4534]
push eax
push edi
call dword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_ShellExecuteWorker]
mov ebx, eax
test ebx, ebx
jne 0x41000f
jmp 0x417c81
mov esi, ebx
jmp 0x40ffd2
or edi, 0x8000
jmp 0x410228
or edi, 0x4000
jmp 0x410228
or edi, 0x80
jmp 0x410228
or edi, 0x40
jmp 0x410228
lea eax, [esp + 0x18520]
mov byte [esp + 0x13], 1
push eax
mov edx, esi
lea ecx, [esp + 0x4524]
call fcn.00401da3
jmp 0x40fea0
cmp byte [0x426004], bl
je 0x417db4
cmp eax, 0xc1
je 0x415153
jmp 0x417db4
lea eax, [esp + 0x100]
jmp 0x40fcef
mov byte [esp + 0x13], 1
jmp 0x40fea0
cmp dword [esp + 0x64], ebx
jne 0x40fd12
push 0x104
lea eax, [esp + 0x114]
xor ecx, ecx
push eax
lea edx, [esp + 0x1c]
inc ecx
call fcn.00410055
cmp eax, 1
je 0x417b2e
lea ecx, [esp + 0x110]
call fcn.0040220d
push eax
mov edx, 0x104
lea ecx, [esp + 0x114]
call fcn.00401da3
lea eax, [esp + 0x110]
mov dword [esp + 0x64], eax
jmp 0x410228
mov ecx, dword [esp + 0x14]
call fcn.004024cb
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
push esi
lea eax, [esp + 0x524]
xor ecx, ecx
push eax
inc ecx
call fcn.00410055
cmp eax, 1
je 0x417b98
cmp word [esp + 0x520], 0x30
lea edx, [esp + 0x520]
mov dword [esp + 0x18], edx
jne 0x4178ad
cmp word [esp + 0x522], 0x78
je 0x4178a2
cmp word [esp + 0x522], 0x58
jne 0x4178ad
lea edx, [esp + 0x524]
mov dword [esp + 0x18], edx
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4178b2
sub ecx, esi
sar ecx, 1
cmp ecx, 8
ja 0x417ac5
movzx eax, word [edx]
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x1c], 2
pop ecx
movzx esi, ax
push esi
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x417ac5
test si, si
je 0x417949
mov ecx, dword [esp + 0x1c]
lea eax, [esi - 0x30]
shl ecx, 4
cmp ax, 9
ja 0x41790b
add ecx, 0xffffffd0
jmp 0x41791d
push 5
lea eax, [esi - 0x61]
pop edx
cmp ax, dx
ja 0x417ac5
add ecx, 0xffffffa9
movzx eax, si
add ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x1c], 2
pop ecx
movzx esi, ax
push esi
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x4178f1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x417ac5
or edi, 4
jmp 0x410228
and edi, 0xffffffef
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 1
or edi, 0x200
jmp 0x410228
lea ecx, [esp + 0x522]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x417981
sub ecx, edx
sar ecx, 1
je 0x41799b
lea ecx, [esp + 0x522]
jmp 0x4179cd
mov ecx, dword [esp + 0x14]
call fcn.004024cb
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
push esi
lea eax, [esp + 0x524]
xor ecx, ecx
push eax
inc ecx
call fcn.00410055
cmp eax, 1
je 0x417b2e
lea ecx, [esp + 0x520]
call fcn.0040220d
push eax
mov edx, 0x104
lea ecx, [esp + 0x31c]
call fcn.00401da3
lea eax, [esp + 0x318]
mov ecx, eax
mov dword [esp + 0x28], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4179f4
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jbe 0x410228
lea eax, [esp + 0x318]
jmp 0x417acc
mov eax, dword [0x426130]
test eax, eax
je 0x410228
mov eax, dword [eax]
mov dword [esp + 0x40], eax
jmp 0x410228
mov ax, word [esp + 0x88]
mov ecx, 0xfffe
or dword [esp + 0x84], 1
and ax, cx
push 3
pop ecx
or ax, cx
jmp 0x410220
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
call fcn.004024cb
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
push esi
lea eax, [esp + 0x524]
xor ecx, ecx
push eax
inc ecx
call fcn.00410055
cmp eax, 1
je 0x417b98
push 0xa
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x528]
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
mov esi, eax
add esp, 0xc
mov dword [esp + 0x2c], esi
test esi, esi
jne 0x417ab0
mov ecx, dword [esp + 0x18]
cmp word [ecx], bx
jne 0x417ac5
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
cmp esi, dword [esp + 0x30]
jbe 0x410228
lea eax, [esp + 0x520]
push eax
push 1
push 0x2362
jmp 0x417bd0
or edi, 0x20
jmp 0x410228
or edi, 0x100
jmp 0x410228
or edi, 0x800
jmp 0x410228
or edi, 0x1000
jmp 0x410228
lea eax, [esp + 0x520]
push 0x417b94
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x414ff2
jmp 0x417b98
push ebx
push 0x400023d2
call fcn.0040bd02
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x41002b
push 0x41c300
mov edx, esi
lea ecx, [esp + 0xc524]
call fcn.00401da3
lea eax, [esp + 0x520]
mov edx, esi
push eax
lea ecx, [esp + 0xc524]
call fcn.00402c8a
lea eax, [esp + 0xc520]
push eax
push 1
push 0x2375
call fcn.0040bd02
add esp, 0xc
jmp 0x417b2e
call fcn.00423648
push ebx
push 0x40002397
call fcn.0040bd74
pop ecx
pop ecx
cmp byte [0x426004], bl
je 0x417c04
push ebx
push 0x400023bf
call fcn.0040bd74
pop ecx
pop ecx
mov byte [0x441818], bl
mov dword [0x441b28], ebx
jmp 0x417b2e
lea eax, [esp + 0x100]
mov edx, 0x2000
push eax
lea ecx, [esp + 0x4524]
call fcn.00401da3
mov ax, word [esp + 0x4520]
jmp 0x40fd74
lea ecx, [esp + 0x4520]
call fcn.0040220d
push eax
push 0x417dc4
lea eax, [esp + 0x8528]
push 0x2000
push eax
call fcn.004026f3
add esp, 0x10
jmp 0x40fdcd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x4260a4], eax
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
lea ecx, [esp + 0x4520]
call fcn.00420c1d
jmp 0x417b2e
lea eax, [esp + 0x14520]
push eax
push 1
push 0x2363
call fcn.0040bd02
add esp, 0xc
jmp 0x414f1b
push 1
push ebx
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x40feaa
mov dword [0x4260a4], 0x54f
jmp 0x417c81
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x4260a4], eax
jmp 0x417c81
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push esi
mov dword [0x4260a4], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_DeleteProcThreadAttributeList]
jmp 0x417c72
push ebx
push ebx
push 2
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
push 0x20004
push ebx
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x40ff84
jmp 0x417cd5
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x40ffdc
xor eax, eax
lea edi, [esp + 0xf4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0xf4]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.api_ms_win_core_processtopology_l1_2_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x417d48
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xffff
je 0x417d9a
xor eax, eax
lea edi, [esp + 0xe8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x417d98
mov eax, dword [esp + 0xe8]
and eax, dword [esp + 0x20]
je 0x417d98
push ebx
push dword [esp + 0xec]
mov dword [esp + 0x28], eax
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl esi, cl
jmp 0x417d9a
mov esi, ebx
mov eax, dword [esp + 0x20]
and esi, eax
je 0x417da4
mov eax, esi
push eax
push dword [esp + 0x48]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
jmp 0x40fffb
cmp eax, 0x2e4
jne 0x417c81
jmp 0x415153