Function at 0x415a86
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x598], eax
push ebx
push esi
push edi
mov esi, 0x403600
or dword [esp + 0x4c], 0xffffffff
lea edi, [esp + 0x388]
mov dword [esp + 0x28], ecx
xor eax, eax
mov dword [esp + 0x44], 0xffff
xor ecx, ecx
xor ebx, ebx
movsd dword es:[edi], dword [esi]
inc ebx
push 0x48
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x1f], cl
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x58], ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], ecx
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x74]
mov byte [esp + 0x25], cl
stosd dword es:[edi], eax
pop esi
push esi
push ecx
stosd dword es:[edi], eax
mov dword [esp + 0x64], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x80010
mov dword [esp + 0x80], esi
mov word [esp + 0xb0], bx
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xbc], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xc0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp dword [esp + 0x28], 0
mov dword [esp + 0xc0], eax
je 0x4215e6
xor eax, eax
mov byte [esp + 0x37c], bl
mov esi, 0x104
mov dword [esp + 0x378], eax
push esi
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0x388], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x17c]
add esp, 0xc
cmp byte [esp + 0x37c], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x416005
mov edi, 0x402734
mov esi, 0x4000
push edi
push esi
call fcn.00416e45
push edi
push esi
mov dword [esp + 0x34], eax
call fcn.00416e45
push edi
push esi
mov dword [esp + 0x4c], eax
call fcn.00416e45
push edi
push 0x4000
mov esi, eax
call fcn.00416e45
mov edi, eax
push 0x402734
push 0x4000
mov dword [esp + 0x80], edi
call fcn.00416e45
push 0x402734
push 0x4000
mov dword [esp + 0x80], eax
call fcn.00416e45
push 0x402734
push 0x4000
mov dword [esp + 0x78], eax
call fcn.00416e45
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x24], 0
mov dword [esp + 0x3c], ecx
je 0x415f9d
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415f9d
test esi, esi
je 0x415f9d
test edi, edi
je 0x415f9d
cmp dword [esp + 0x50], 0
je 0x415f9d
cmp dword [esp + 0x40], 0
je 0x415f9d
test ecx, ecx
je 0x415f9d
xor ecx, ecx
mov dword [esp + 0x64], 5
mov word [edi], cx
mov word [eax], cx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, eax
call fcn.0040ab7f
push 0x22
pop edx
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x4215f6
lea edx, [esp + 0x14]
push 0x2000
cmp ecx, 0x2f
je 0x416038
push edi
xor ecx, ecx
call fcn.00416162
cmp eax, ebx
je 0x415f9d
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.0040f3a0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x60], eax
xor eax, eax
cmp word [edi], ax
je 0x421a61
push 0x22
pop eax
cmp word [edi], ax
je 0x415d1a
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x421a7a
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f3a0
mov ecx, edi
call fcn.00410060
push eax
mov edx, 0x2000
mov ecx, edi
call fcn.0040f3a0
xor eax, eax
mov edx, edi
mov byte [esp + 0x22], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x14]
push eax
push 0x2d
pop ecx
call fcn.0040ed90
cmp eax, 0xffffffff
jne 0x421acd
mov ecx, dword [esp + 0x50]
mov edx, 0x2000
push edi
call fcn.0040f3a0
push 0x2000
mov edx, edi
mov dword [esp + 0x14c], edi
lea ecx, [esp + 0x114]
call fcn.0040f410
cmp eax, 3
je 0x421aa8
test eax, eax
je 0x421ab4
push 5
pop ecx
cmp eax, ecx
je 0x421ab4
cmp eax, 2
je 0x421acd
push dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edx, 0x2000
call fcn.0040f3a0
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push 0x40234c
call fcn.0040fc40
mov eax, dword [esp + 0x60]
test eax, eax
je 0x415de9
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push eax
call fcn.0040fc40
cmp byte [esp + 0x1a], 0
jne 0x421bed
push 0x44
pop eax
push eax
xor eax, eax
push eax
lea eax, [esp + 0xd0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
cmp byte [esp + 0x13], 0
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x88], eax
jne 0x421bfc
xor ecx, ecx
lea eax, [esp + 0x68]
push eax
push ecx
push 2
push ecx
mov byte [esp + 0x23], cl
mov dword [esp + 0x78], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x421c41
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x421a9d
push dword [esp + 0x68]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x421c50
lea eax, [esp + 0x68]
push eax
xor eax, eax
push eax
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x421c5d
xor ecx, ecx
mov dword [esp + 0x6c], 1
push ecx
push ecx
push 4
lea eax, [esp + 0x78]
push eax
push 0x60001
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421c88
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc4], ebx
cmp eax, 0xffff
jne 0x421c9c
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x50]
mov eax, dword [esp + 0x18]
push dword [esp + 0x60]
or eax, 0x400
push eax
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x60]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x18]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ebx, ebx
inc ebx
cmp byte [esp + 0x1a], 0
jne 0x421cc2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp byte [esp + 0x13], 0
mov dword [0x4357a8], eax
jne 0x421d9c
cmp byte [esp + 0x14], 0
je 0x421d81
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x421cd1
cmp byte [esp + 0x21], 0
jne 0x421d72
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x415f99
cmp byte [esp + 0x23], 0
jne 0x421e32
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x415fad
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x415fbd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x415fcd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
je 0x415fd9
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x415fe5
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415ff5
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x416005
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x378]
xor ecx, ecx
mov dword [esp + 0x378], ecx
test eax, eax
je 0x416021
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x5a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b50
mov esp, ebp
pop ebp
ret
add eax, 2
mov ecx, ebx
push esi
mov dword [esp + 0x1c], eax
call fcn.00416162
cmp eax, ebx
je 0x415f9d
push 0x4026f0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421659
push 0x4026d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42176c
push 0x4026c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421779
push 0x4026bc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421786
push 0x4026a8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217a0
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x4217ad
push 0x40269c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x416151
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x42184f
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x421a24
push 0x402694
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41615b
push 0x40268c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421867
or dword [esp + 0xac], ebx
or word [esp + 0xb0], 7
mov eax, dword [esp + 0x14]
jmp 0x415c8f
or dword [esp + 0xc], 0x80
jmp 0x416148
or dword [esp + 0xc], 0x40
jmp 0x416148
lea eax, [esp + 0x388]
mov dword [esp + 0x28], eax
jmp 0x415b61
cmp dword [esp + 0x8c], 0
jne 0x415cb0
push 0x104
lea eax, [esp + 0x39c]
mov ecx, ebx
push eax
lea edx, [esp + 0x1c]
call fcn.00416162
cmp eax, ebx
je 0x415f9d
lea ecx, [esp + 0x398]
call fcn.00410060
push eax
mov edx, 0x104
lea ecx, [esp + 0x39c]
call fcn.0040f3a0
lea eax, [esp + 0x398]
mov byte [esp + 0x1b], bl
mov dword [esp + 0x8c], eax
jmp 0x416148
mov ecx, dword [esp + 0x14]
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x4219e8
cmp word [esi], 0x30
mov edx, esi
mov dword [esp + 0x28], edx
jne 0x4216a2
movzx ecx, word [esi + 2]
mov eax, edx
cmp ecx, 0x78
je 0x42169b
cmp ecx, 0x58
jne 0x4216a2
lea edx, [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4216ab
sub ecx, dword [esp + 0x1c]
sar ecx, 1
cmp ecx, 8
ja 0x421907
xor eax, eax
mov dword [esp + 0x30], eax
movzx eax, word [edx]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x421907
mov ecx, dword [esp + 0x1c]
test cx, cx
je 0x421753
mov edx, dword [esp + 0x30]
lea eax, [ecx - 0x30]
shl edx, 4
cmp ax, 9
ja 0x421712
add edx, 0xffffffd0
jmp 0x421723
lea eax, [ecx - 0x61]
cmp ax, word [esp + 0x64]
ja 0x421907
add edx, 0xffffffa9
movzx eax, cx
add edx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], edx
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
add dword [esp + 0x2c], 2
movzx eax, ax
pop ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x4216f4
cmp dword [esp + 0x30], 0
je 0x421907
or dword [esp + 0xc], 4
mov byte [esp + 0x21], bl
jmp 0x416148
or dword [esp + 0xc], 0x8000
jmp 0x416148
or dword [esp + 0xc], 0x4000
jmp 0x416148
mov ecx, dword [esp + 0xc]
and ecx, 0xffffffef
mov byte [esp + 0x1a], bl
or ecx, 0x200
mov dword [esp + 0xc], ecx
jmp 0x416148
mov dword [esp + 0x5c], 2
jmp 0x416148
lea edx, [esi + 2]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x4217b9
sub ecx, dword [esp + 0x1c]
sar ecx, 1
jne 0x4217f6
mov ecx, dword [esp + 0x14]
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x415f9d
mov edx, esi
mov ecx, edx
call fcn.00410060
push eax
lea ecx, [esp + 0x174]
call fcn.0040a641
mov eax, dword [esp + 0x378]
mov dword [esp + 0x48], eax
test eax, eax
jne 0x421824
lea eax, [esp + 0x170]
mov dword [esp + 0x48], eax
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x421829
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7fe7
jbe 0x416148
push dword [esp + 0x48]
jmp 0x421908
mov eax, dword [0x431590]
test eax, eax
je 0x416148
mov eax, dword [eax]
mov dword [esp + 0x54], eax
jmp 0x416148
push 0x404000
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421890
or dword [esp + 0xac], ebx
push 3
pop eax
or word [esp + 0xb0], ax
jmp 0x416148
push 0x404008
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x421913
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0040ab7f
push 0x2000
push esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, ebx
call fcn.00416162
cmp eax, ebx
je 0x4219e8
push 0xa
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x44], eax
test eax, eax
jne 0x4218ee
mov ecx, dword [esp + 0x1c]
cmp word [ecx], ax
jne 0x421907
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0x2c]
jbe 0x416148
push esi
push ebx
push 0x2362
jmp 0x4219db
push 0x404014
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42192f
or dword [esp + 0xc], 0x20
jmp 0x416148
push 0x404024
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42194e
or dword [esp + 0xc], 0x100
jmp 0x416148
push 0x404038
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42196d
or dword [esp + 0xc], 0x800
jmp 0x416148
push 0x40404c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42198c
or dword [esp + 0xc], 0x1000
jmp 0x416148
push 0x40405c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4219b0
push 0x404068
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4219e8
mov byte [esp + 0x23], bl
jmp 0x416148
sub edx, 2
xor ecx, ecx
mov word [edx], cx
mov edx, 0x2000
push esi
mov ecx, eax
call fcn.0040fc40
push dword [esp + 0x24]
xor ebx, ebx
inc ebx
push ebx
push 0x2375
call fcn.004078e4
add esp, 0xc
jmp 0x415f9d
mov eax, dword [esp + 0x24]
mov ecx, 0x4037e0
sub ecx, eax
mov ebx, 0x2000
mov edx, eax
mov edi, ecx
lea ecx, [ebx + 0x7fffdffe]
test ecx, ecx
je 0x421a1a
movzx ecx, word [edx + edi]
test cx, cx
je 0x421a1a
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x4219fc
mov edi, dword [esp + 0x58]
test ebx, ebx
jne 0x4219bc
jmp 0x4219b9
call fcn.004299d0
xor eax, eax
push eax
push 0x40002397
call fcn.004063bd
cmp byte [0x435755], 0
pop ecx
pop ecx
je 0x421a50
xor eax, eax
push eax
push 0x400023bf
call fcn.004063bd
pop ecx
pop ecx
xor eax, eax
mov byte [0x44805b], al
mov dword [0x44850c], eax
jmp 0x415f9d
lea eax, [esp + 0x388]
mov edx, 0x2000
push eax
mov ecx, edi
call fcn.0040f3a0
jmp 0x415cff
mov ecx, edi
call fcn.00410060
push eax
push 0x40406c
push 0x2000
push dword [esp + 0x48]
call fcn.00409abf
add esp, 0x10
jmp 0x415d3d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4357a8], eax
mov ecx, edi
call fcn.00425c14
jmp 0x415f9d
push dword [esp + 0x50]
mov edx, 0x2000
mov ecx, edi
call fcn.0040f3a0
mov byte [esp + 0x13], bl
jmp 0x415dad
mov ecx, 0x4024d0
call fcn.0040ec2e
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x421af1
push eax
push 0x400023d2
call fcn.004078e4
pop ecx
pop ecx
jmp 0x415f9d
push dword [esp + 0x3c]
push 0x404078
push 0x2000
push dword [esp + 0x30]
call fcn.00409abf
add esp, 0x10
mov edx, 0x2000
mov ecx, edi
push dword [esp + 0x2c]
call fcn.0040f3a0
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f3a0
push 0x404088
push dword [esp + 0x28]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x421bdc
mov ecx, dword [esp + 0x34]
xor eax, eax
cmp word [ecx], ax
je 0x421bdc
mov edx, ecx
lea eax, [edx + 2]
mov dword [esp + 0x2c], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x38]
jne 0x421b5b
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, eax
sar edx, 1
mov dword [esp + 0x1c], edx
lea edx, [edi + 2]
mov dword [esp + 0x64], edx
mov dx, word [edi]
add edi, 2
cmp dx, word [esp + 0x38]
jne 0x421b7f
mov edx, edi
mov dword [esp + 0x2c], edi
sub edx, dword [esp + 0x64]
mov edi, dword [esp + 0x58]
sar edx, 1
add edx, dword [esp + 0x1c]
cmp edx, 0x2000
jae 0x421bcd
push 0x40234c
mov edx, 0x2000
mov ecx, eax
call fcn.0040fc40
push dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov edx, 0x2000
call fcn.0040fc40
jmp 0x421bdc
push ecx
push ebx
push 0x2363
call fcn.004078e4
add esp, 0xc
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov byte [esp + 0x22], bl
jmp 0x415dad
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415df4
cmp dword [esp + 0x5c], 2
je 0x415e3c
cmp dword [esp + 0x30], 0
jne 0x415e3c
cmp dword [esp + 0x44], 0xffff
jne 0x415e3c
cmp dword [esp + 0x54], 0
jne 0x415e3c
call fcn.004173f8
test al, al
je 0x415e3c
mov byte [esp + 0x13], bl
jmp 0x415f32
mov dword [0x4357a8], 0x54f
jmp 0x421aa8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4357a8], eax
jmp 0x421c79
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x4357a8], eax
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, edi
call fcn.00425c14
xor ebx, ebx
inc ebx
jmp 0x415f9d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov dword [0x4357a8], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
jmp 0x421c68
xor ecx, ecx
mov word [esp + 0x14], ax
push ecx
push ecx
push 2
lea eax, [esp + 0x20]
push eax
push 0x20004
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421c88
jmp 0x415ee0
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
jmp 0x415f3d
xor eax, eax
lea edi, [esp + 0x164]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x164]
push eax
push dword [esp + 0x78]
call dword [sym.imp.api_ms_win_core_processtopology_l1_1_0.dll_GetThreadGroupAffinity]
test eax, eax
je 0x421cfe
mov eax, dword [esp + 0x164]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x44]
cmp ecx, 0xffff
je 0x421d54
xor eax, eax
lea edi, [esp + 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaNodeProcessorMaskEx]
test eax, eax
je 0x421d50
mov eax, dword [esp + 0x158]
and eax, dword [esp + 0x4c]
je 0x421d50
mov dword [esp + 0x4c], eax
xor eax, eax
push eax
push dword [esp + 0x15c]
call dword [sym.imp.ntdll.dll_RtlFindLeastSignificantBit]
mov ecx, eax
shl ebx, cl
jmp 0x421d54
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x4c]
and ebx, eax
je 0x421d5e
mov eax, ebx
push eax
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processtopology_obsolete_l1_1_0.dll_SetProcessAffinityMask]
mov edi, dword [esp + 0x58]
jmp 0x415f6a
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
jmp 0x415f75
cmp byte [0x435755], 0
je 0x421d91
cmp eax, 0xc1
je 0x421d9c
cmp eax, 0x2e4
jne 0x421aa8
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x38]
jne 0x421da1
sub ecx, edx
push 5
sar ecx, 1
pop eax
cmp ecx, eax
jb 0x421dd9
add ecx, 0xfffffffc
push eax
push 0x404108
lea eax, [edi + ecx*2]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
neg eax
sbb al, al
and al, byte [esp + 0x1b]
jmp 0x421ddd
mov al, byte [esp + 0x1b]
and dword [esp + 0xc], 0xfffffffb
lea ecx, [esp + 0x398]
movzx eax, al
neg eax
sbb eax, eax
and eax, ecx
cmp byte [esp + 0x22], 0
mov ecx, dword [esp + 0x24]
jne 0x421e01
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x74]
push edx
push eax
push dword [esp + 0x68]
movzx eax, word [esp + 0xc0]
mov edx, edi
push eax
push dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0042b6a4
test eax, eax
je 0x421aa8
jmp 0x415f7f
mov ecx, eax
call fcn.004081ec
mov dword [0x4355dc], eax
jmp 0x415f99