Function at 0x40acab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00401971
mov ebx, dword [ebp + 8]
mov esi, eax
lea edi, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x114
push esi
call fcn.004095ce
mov edi, eax
pop ecx
test edi, edi
je 0x40acf1
push edi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [0x419048], edi
jmp 0x40acf8
and dword [0x419048], 0
push 0xb0
call fcn.004095ce
pop ecx
test eax, eax
je 0x40ad12
mov edi, eax
call fcn.0040a942
mov esi, eax
jmp 0x40ad14
xor esi, esi
push esi
call fcn.0040a9a7
sub esp, 0x10
mov dword [0x419030], esi
mov esi, esp
lea edi, [ebx + 0xc]
push str._service
mov dword [esp + 0x20], edi
call fcn.004099a2
mov eax, edi
call fcn.00409cf5
test al, al
je 0x40ad5e
push 0xc
mov byte [ebx + 0x42], 1
call fcn.004095ce
pop ecx
test eax, eax
je 0x40ad5e
and dword [eax + 4], 0
and dword [eax + 8], 0
mov dword [0x419038], eax
push 4
call fcn.004095ce
mov esi, eax
pop ecx
test esi, esi
je 0x40ad98
mov eax, dword [0x419030]
add eax, 0x30
push eax
lea eax, [esp + 0x24]
call fcn.0040996d
push 0x4176b0
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [esi], eax
lea eax, [esp + 0x20]
call fcn.00409a00
jmp 0x40ad9a
xor esi, esi
push 0
mov dword [ebx + 0x4c], esi
call fcn.0040b304
cmp byte [ebx + 0x42], 0
mov dword [ebx + 0x44], eax
jne 0x40adb7
push 1
call fcn.0040b304
mov dword [ebx + 0x48], eax
mov edi, 0x4153b9
push edi
lea esi, [esp + 0x14]
call fcn.004099a2
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x40adeb
push 0
push edi
push eax
lea ebx, [esp + 0x2c]
call fcn.0040a26a
mov eax, ebx
call fcn.00409bba
mov eax, ebx
call fcn.00409a00
mov ebx, dword [ebp + 8]
push edi
lea eax, [esp + 0x14]
push eax
call fcn.00409b85
mov byte [ebx + 0x40], al
test al, al
je 0x40ae49
push 0x416b50
lea esi, [esp + 0x24]
call fcn.004099a2
mov edi, esi
lea esi, [esp + 0x10]
call fcn.00409c0b
mov eax, edi
call fcn.00409a00
mov edi, dword [0x419030]
add edi, 0x20
call fcn.00409c0b
mov ecx, dword [0x419030]
sub esp, 0x10
add ecx, 0x10
mov eax, esp
push ecx
call fcn.0040996d
mov eax, esi
call fcn.00409af4
mov byte [ebx + 0x41], al
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test al, al
je 0x40af25
cmp dword [0x419038], 0
jne 0x40af07
sub esp, 0x10
mov esi, esp
push str._uipath:
call fcn.004099a2
mov eax, dword [esp + 0x1c]
call fcn.00409cf5
test al, al
jne 0x40aec9
lea eax, [esp + 0x20]
push eax
call fcn.0040ac6e
pop ecx
push dword [esp + 0x20]
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_FindWindowW]
xor edi, edi
cmp eax, edi
je 0x40aebe
push edi
push edi
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x20]
call fcn.00409a00
call fcn.0040b2f5
jmp 0x40aeff
lea eax, [esp + 0x20]
call fcn.00409a00
jmp 0x40aecb
xor edi, edi
push 0x28
call fcn.004095ce
mov esi, eax
pop ecx
cmp esi, edi
je 0x40aefa
lea eax, [esi + 0x18]
push eax
push edi
push edi
push 0x40b066
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
jmp 0x40aefc
xor esi, esi
mov dword [ebx + 4], esi
cmp dword [0x419038], edi
je 0x40af0e
call fcn.0040c6d8
jmp 0x40af19
push 0xffffffffffffffff
push dword [ebx + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebx + 4]
test esi, esi
je 0x40af25
call fcn.0040afab
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [0x419038]
test eax, eax
je 0x40af4b
push eax
mov esi, eax
call fcn.0040b877
push esi
call fcn.00409607
and dword [0x419038], 0
pop ecx
mov esi, dword [ebx + 0x44]
test esi, esi
je 0x40af57
call fcn.00403a75
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x40af63
call fcn.00403a75
mov ebx, dword [ebx + 0x4c]
test ebx, ebx
je 0x40af7e
mov eax, dword [ebx]
test eax, eax
je 0x40af77
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push ebx
call fcn.00409607
pop ecx
push dword [0x419048]
call fcn.00409607
mov esi, dword [0x419030]
pop ecx
test esi, esi
je 0x40af99
call fcn.0040affc
lea eax, [esp + 0x10]
call fcn.00409a00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4