Function at 0x401060
Capabilities:
Access the windows event log
Create process on windows
Create service
Delete service
Modify service
Persist via windows service
Query or enumerate registry value
Query service status
Self delete
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push esi
push edi
push ebx
mov eax, 0x2ca4
call fcn.00402d60
mov dword [esp + 0x183c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x183c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4010a8
cmp dword [esp + 0x183c], 0
je 0x4010a8
mov ebx, 0x4155ec
jmp 0x4010ad
mov ebx, 0x4155f8
lea eax, [esp + 0x1c52]
push 0x802
push 0
push eax
call fcn.0040a820
lea eax, [esp + 0x2460]
push 0x802
push 0
push eax
call fcn.0040a820
add esp, 0x18
mov edi, dword [ebp + 8]
cmp edi, 2
jne 0x401127
mov esi, dword [ebp + 0xc]
push 0x415604
push dword [esi + 4]
call fcn.00402e13
add esp, 8
test eax, eax
je 0x4015cb
push 0x415618
push dword [esi + 4]
call fcn.00402e13
add esp, 8
test eax, eax
je 0x401338
push 0x415630
push dword [esi + 4]
call fcn.00402e13
add esp, 8
test eax, eax
je 0x401163
cmp dword [0x4125ec], 1
je 0x40168e
cmp edi, 1
jne 0x401151
push ebx
push 0x415660
call fcn.00402f7f
push 0x4156c0
call fcn.00402f7f
add esp, 0xc
mov eax, 1
add esp, 0x2ca4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x400
lea edi, [esp]
mov dword [esp + 0x1818], 1
mov dword [esp + 0x181c], eax
mov dword [esp + 0x1820], eax
push 0x802
push 0
push edi
call fcn.0040a820
lea eax, [esp + 0x80e]
push 0x802
push 0
push eax
call fcn.0040a820
lea esi, [esp + 0x101c]
push 0x802
push 0
push esi
call fcn.0040a820
add esp, 0x24
lea ebx, [esp + 0x1838]
push ebx
push 0x20119
push 0
push 0x415040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4011f7
push ebx
push 0x20219
push 0
push 0x415040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40131c
lea eax, [esp + 0x181c]
lea edx, [esp + 0x1818]
push eax
push edi
push edx
push 0
push 0x4150a0
push dword [esp + 0x184c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x182c], edi
lea edi, [esp + 0x1828]
mov eax, 0x4150c0
mov dword [esp + 0x1824], eax
mov dword [esp + 0x1828], 0x415040
push edi
push 0
push eax
push 0x400
push esi
call fcn.0040302b
add esp, 0x14
push dword [esp + 0x1838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x1838], eax
push ebx
push 0x20119
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40129c
push ebx
push 0x20219
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40131c
lea eax, [esp + 0x1820]
push eax
lea edx, [esp + 0x806]
push edx
lea ecx, [esp + 0x1820]
push ecx
push 0
push 0x4150cc
push dword [esp + 0x184c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x4150e0
lea edx, [esp + 0x180c]
mov dword [esp + 0x1808], ecx
lea eax, [esp + 0x802]
mov dword [esp + 0x180c], eax
push edx
push 0
push ecx
push 0x400
lea ebx, [esp + 0x2464]
push ebx
call fcn.0040302b
add esp, 0x14
push dword [esp + 0x1838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2454]
jmp 0x40131e
xor eax, eax
push eax
push 0x415628
call fcn.00402f7f
xor eax, eax
add esp, 0x2cac
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, 0x200
mov word [esp + 0x650], di
pxor xmm0, xmm0
movaps xmmword [esp + eax + 0x440], xmm0
movaps xmmword [esp + eax + 0x430], xmm0
movaps xmmword [esp + eax + 0x420], xmm0
movaps xmmword [esp + eax + 0x410], xmm0
sub eax, 0x40
jne 0x40134b
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
pxor xmm0, xmm0
test esi, esi
je 0x401bd6
push 0xf01ff
push section..data1
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
pxor xmm0, xmm0
test ebx, ebx
je 0x401bc4
push 0x413500
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
pxor xmm0, xmm0
test eax, eax
je 0x40145b
push 0x4151b8
push 0x415360
call fcn.00402f7f
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413500
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401423
mov eax, dword [0x413504]
cmp eax, 3
jne 0x401428
push 0x41537c
call fcn.00402f7f
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413500
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4013f1
mov eax, dword [0x413504]
cmp eax, 1
jne 0x401444
push 0x4151b8
push 0x415380
call fcn.00402f7f
add esp, 8
jmp 0x40158d
push 0x4151b8
push 0x41539c
call fcn.00402f7f
add esp, 8
jmp 0x40158d
mov word [esp + 0x230], di
mov eax, 0x200
movaps xmmword [esp + eax + 0x20], xmm0
movaps xmmword [esp + eax + 0x10], xmm0
movaps xmmword [esp + eax], xmm0
movaps xmmword [esp + eax - 0x10], xmm0
sub eax, 0x40
jne 0x401468
mov word [esp + 0x440], di
mov eax, 0x200
movaps xmmword [esp + eax + 0x230], xmm0
movaps xmmword [esp + eax + 0x220], xmm0
movaps xmmword [esp + eax + 0x210], xmm0
movaps xmmword [esp + eax + 0x200], xmm0
sub eax, 0x40
jne 0x40148d
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x2c]
push edi
push edi
push edx
push edi
push eax
push edi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4014e4
cmp eax, 0xf2
jle 0x401b74
mov word [esp + 0x240], di
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4014fb
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push section..data1
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [esp], eax
mov eax, 0x415100
lea ecx, [esp + 0x658]
mov dword [esp + 0x654], eax
lea edx, [esp + 0x240]
mov dword [esp + 0x658], 0x415000
mov dword [esp + 0x65c], edx
lea edx, [esp + 0x30]
push ecx
push 0
push eax
push 0x100
push edx
call fcn.0040302b
add esp, 0x14
mov dword [esp + 0x234], 0x4153c8
lea eax, [esp + 0x30]
mov dword [esp + 0x238], eax
cmp dword [esp], 0
je 0x40158d
lea eax, [esp + 0x234]
push edi
push eax
push edi
push 2
push edi
push edi
push edi
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x401acc
push 0x4151b8
push 0x4153f8
call fcn.00402f7f
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
add esp, 0x2ca4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x20]
push 0x402
push 0
push edi
call fcn.0040a820
add esp, 0xc
xor esi, esi
mov eax, 0x200
mov word [esp + 0x630], si
pxor xmm0, xmm0
movaps xmmword [esp + eax + 0x420], xmm0
movaps xmmword [esp + eax + 0x410], xmm0
movaps xmmword [esp + eax + 0x400], xmm0
movaps xmmword [esp + eax + 0x3f0], xmm0
sub eax, 0x40
jne 0x4015f2
mov eax, dword [0x40c1b8]
mov dword [esp + 0x18], eax
push 0x200
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401e20
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x401d75
push 0xf01ff
push section..data1
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x401c81
push 0x4151b8
push 0x415234
call fcn.00402f7f
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
add esp, 0x2ca4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x400
xor esi, esi
mov dword [esp + 0x1014], 1
lea edx, [esp]
mov dword [esp + 0x1018], eax
mov dword [esp + 0x101c], eax
push 0x802
push esi
push edx
mov dword [0x413520], 0x3c
mov dword [0x413524], 0x440
mov dword [0x413528], esi
mov dword [0x41352c], esi
call fcn.0040a820
lea eax, [esp + 0x81c]
push 0x802
push 0
push eax
call fcn.0040a820
lea edi, [esp + 0x1038]
push 0x802
push 0
push edi
call fcn.0040a820
add esp, 0x24
lea eax, [esp + 0x1838]
push eax
push 0x20119
push 0
push 0x415040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40174a
lea eax, [esp + 0x1838]
push eax
push 0x20219
push 0
push 0x415040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40188b
lea eax, [esp + 0x1018]
lea ecx, [esp + 0x1014]
push eax
lea edx, [esp + 4]
push edx
push ecx
push 0
push 0x4150a0
push dword [esp + 0x184c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x4150c0
lea edx, [esp + 0x2c6c]
mov dword [esp + 0x2c68], ecx
lea eax, [esp]
mov dword [esp + 0x2c6c], 0x415040
mov dword [esp + 0x2c70], eax
push edx
push 0
push ecx
push 0x400
push edi
call fcn.0040302b
add esp, 0x14
push dword [esp + 0x1838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1838], esi
lea eax, [esp + 0x1838]
push eax
push 0x20119
push esi
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401802
lea eax, [esp + 0x1838]
push eax
push 0x20219
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40188b
lea eax, [esp + 0x101c]
push eax
lea edx, [esp + 0x814]
push edx
lea ecx, [esp + 0x101c]
push ecx
push 0
push 0x4150cc
push dword [esp + 0x184c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x4150e0
lea edx, [esp + 0x2c5c]
mov dword [esp + 0x2c58], ecx
lea eax, [esp + 0x810]
mov dword [esp + 0x2c5c], eax
push edx
push 0
push ecx
push 0x400
lea edi, [esp + 0x2464]
push edi
call fcn.0040302b
add esp, 0x14
push dword [esp + 0x1838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2454]
mov dword [0x413530], eax
jmp 0x401895
mov dword [0x413530], 0x415740
mov dword [esp + 0x2c94], ebx
lea ebx, [esp + 0x2c94]
mov eax, 0x415760
mov dword [esp + 0x2c90], eax
mov dword [esp + 0x2c98], 0x4157e0
push ebx
push 0
push eax
push 0x400
lea edx, [esp + 0x1c62]
push edx
call fcn.0040302b
add esp, 0x14
mov dword [0x413538], esi
lea eax, [esp + 0x1c52]
mov dword [0x413534], eax
mov dword [0x41353c], 5
mov dword [0x413540], esi
push 0x413520
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401a4a
mov eax, 0x200
mov word [esp + 0x1a40], si
mov edx, eax
pxor xmm0, xmm0
movaps xmmword [esp + eax + 0x1830], xmm0
movaps xmmword [esp + eax + 0x1820], xmm0
movaps xmmword [esp + eax + 0x1810], xmm0
movaps xmmword [esp + eax + 0x1800], xmm0
sub eax, 0x40
jne 0x40191b
mov word [esp + 0x1c50], si
movaps xmmword [esp + edx + 0x1a40], xmm0
movaps xmmword [esp + edx + 0x1a30], xmm0
movaps xmmword [esp + edx + 0x1a20], xmm0
movaps xmmword [esp + edx + 0x1a10], xmm0
sub edx, 0x40
jne 0x401948
mov dword [esp + 0x80c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x80c]
push esi
push esi
push edx
push esi
push eax
push esi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4019a5
cmp eax, 0xf2
jle 0x401a67
mov word [esp + 0x1a50], si
lea edi, [esp + 0x1a50]
mov eax, dword [esp + 0x80c]
test eax, eax
je 0x4019c6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push section..data1
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ebx, eax
mov edx, 0x415100
lea eax, [esp + 0x2c80]
mov dword [esp + 0x2c7c], edx
mov dword [esp + 0x2c80], 0x415000
mov dword [esp + 0x2c84], edi
lea edi, [esp + 0x1840]
push eax
push 0
push edx
push 0x100
push edi
call fcn.0040302b
add esp, 0x14
test ebx, ebx
je 0x401a58
mov dword [esp + 0x808], edi
lea eax, [esp + 0x804]
mov dword [esp + 0x804], 0x415814
push esi
push eax
push esi
push 2
push esi
push esi
push esi
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x401a58
push 0xffffffffffffffff
push dword [0x413558]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0x2ca4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esp + 0x80c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x80c]
mov word [edx + eax*2 - 4], si
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x80c]
mov edx, 0x41501c
mov dword [esp + 0x182c], eax
lea eax, [esp + 0x1828]
mov dword [esp + 0x1824], edx
mov dword [esp + 0x1828], edi
lea edi, [esp + 0x1a50]
push eax
push 0
push edx
push 0x100
push edi
call fcn.0040302b
add esp, 0x14
jmp 0x4019b4
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x28]
push edi
push edi
push edx
push edi
push eax
push edi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401afa
cmp eax, 0xf2
jle 0x401b28
mov word [esp + 0x450], di
lea edi, [esp + 0x450]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x401b18
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
push 0x415414
call fcn.00402f7f
jmp 0x4015ab
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x28]
mov word [edx + eax*2 - 4], di
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x28]
mov edx, 0x41501c
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp], edx
mov dword [esp + 4], edi
lea edi, [esp + 0x450]
push eax
push 0
push edx
push 0x100
push edi
call fcn.0040302b
add esp, 0x14
jmp 0x401b09
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x2c]
mov word [edx + eax*2 - 4], di
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x2c]
mov edx, 0x41501c
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x240]
push eax
push 0
push edx
push 0x100
push ecx
call fcn.0040302b
add esp, 0x14
jmp 0x4014ec
push 0x415460
call fcn.00402f7f
add esp, 4
jmp 0x4015b5
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x14]
push edi
push edi
push edx
push edi
push eax
push edi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401c04
cmp eax, 0xf2
jle 0x401c35
mov word [esp + 0x450], di
lea ebx, [esp + 0x450]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401c22
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push 0x4154c0
call fcn.00402f7f
add esp, 8
jmp 0x4015bc
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x14]
mov word [edx + eax*2 - 4], di
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x14]
mov edx, 0x41501c
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp], edx
mov dword [esp + 4], ebx
lea ebx, [esp + 0x450]
push eax
push 0
push edx
push 0x100
push ebx
call fcn.0040302b
add esp, 0x14
jmp 0x401c13
push esi
push esi
push 0x4151d8
push esi
push esi
push edi
push 1
push 2
push 0x10
push 0xf01ff
push 0x4151b8
push section..data1
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x401ccd
lea edx, [esp + 0x18]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x4151b8
push 0x4151dc
call fcn.00402f7f
jmp 0x401675
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x14]
push esi
push esi
push edx
push esi
push eax
push esi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401cfb
cmp eax, 0xf2
jle 0x401d29
mov word [esp + 0x430], si
lea esi, [esp + 0x430]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401d19
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x4151fc
call fcn.00402f7f
jmp 0x401675
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x14]
mov word [edx + eax*2 - 4], si
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov edx, 0x41501c
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp], edx
mov dword [esp + 4], esi
lea esi, [esp + 0x430]
push eax
push 0
push edx
push 0x100
push esi
call fcn.0040302b
add esp, 0x14
jmp 0x401d0a
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x14]
push esi
push esi
push edx
push esi
push eax
push esi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401da3
cmp eax, 0xf2
jle 0x401dd4
mov word [esp + 0x430], si
lea ebx, [esp + 0x430]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401dc1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push 0x415280
call fcn.00402f7f
add esp, 8
jmp 0x40167f
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x14]
mov word [edx + eax*2 - 4], si
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x14]
mov edx, 0x41501c
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp], edx
mov dword [esp + 4], ebx
lea ebx, [esp + 0x430]
push eax
push 0
push edx
push 0x100
push ebx
call fcn.0040302b
add esp, 0x14
jmp 0x401db2
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x14]
push esi
push esi
push edx
push esi
push eax
push esi
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401e4e
cmp eax, 0xf2
jle 0x401e84
mov word [esp + 0x430], si
lea ebx, [esp + 0x430]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401e6c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push 0x4151b8
push 0x415180
call fcn.00402f7f
add esp, 0xc
jmp 0x40167f
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x14]
mov word [edx + eax*2 - 4], si
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x14]
mov edx, 0x41501c
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp], edx
mov dword [esp + 4], ebx
lea ebx, [esp + 0x430]
push eax
push 0
push edx
push 0x100
push ebx
call fcn.0040302b
add esp, 0x14
jmp 0x401e5d