Function at 0x40a516
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
Get mac address on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x320
lea esi, [esp + 0x1e0]
mov dword [esp + 0x190], ecx
mov ecx, esi
call fcn.00404ef6
lea edi, [esp + 0x308]
mov edx, esi
mov ecx, edi
call fcn.0049cecc
mov eax, dword [edi]
lea esi, [esp + 0x1e0]
mov edx, 0xe8
mov ecx, esi
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xd0], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x90], eax
push 0x1f4
call fcn.0049cb56
pop eax
mov eax, dword [esi]
test eax, eax
mov dword [esp + 0x14], eax
je 0x40a5b7
mov eax, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e8]
mov ecx, dword [esp + 0x1ec]
mov dword [esp + 0x100], eax
mov dword [esp + 0xf0], edx
mov dword [esp + 0x6c], ecx
jmp 0x40a5d3
mov eax, dword [esp + 0x1e4]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x1e8]
mov dword [esp + 0xf0], eax
push 9
pop ecx
xor edx, edx
mov dword [esp + 8], 0
call fcn.0044c587
mov esi, eax
mov dword [esp + 0x1c], edx
mov dword [eax], 0x61746f54
mov dword [eax + 4], 0x5043206c
mov byte [eax + 8], 0x55
push 8
pop ecx
mov edx, 0xa0
call fcn.0045244b
test eax, eax
mov dword [esp + 0x160], eax
je 0x40c13c
lea edi, [esp + 0x1e0]
mov ecx, edi
call fcn.00404ef6
lea ebx, [esp + 0x2f8]
mov edx, edi
mov ecx, ebx
call fcn.0049cecc
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0x150], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x48], eax
call fcn.00495710
lea ebx, [esp + 0x1e0]
mov edi, edx
mov edx, eax
mov ecx, ebx
push 0x19db1de
push 0xd53e8000
push edi
call fcn.00495790
add esp, 0xc
mov eax, dword [ebx]
or eax, dword [ebx + 4]
mov ebx, 0
jne 0x40a6b6
mov ebx, dword [esp + 0x1e8]
mov edi, dword [esp + 0x1ec]
call sub.KERNEL32.dll_GetTickCount64
push 0
push 0x3e8
push edx
push eax
call fcn.004b9e70
xor ecx, ecx
sub ebx, eax
sbb edi, edx
cmovb edi, ecx
cmovb ebx, ecx
mov dword [esp + 8], edi
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x1e0]
mov dword [edi], eax
mov eax, dword [esp + 0x100]
mov dword [edi + 4], eax
mov eax, dword [esp + 0xf0]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0xd0]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x90]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x1c]
and dword [edi + 0x94], 0
and dword [edi + 0x90], 0
and dword [edi + 0x44], 0
and dword [edi + 0x40], 0
and dword [edi + 0x4c], 0
and dword [edi + 0x48], 0
and dword [edi + 0x54], 0
and dword [edi + 0x50], 0
and dword [edi + 0x5c], 0
and dword [edi + 0x58], 0
mov dword [edi + 0x98], esi
xor esi, esi
inc esi
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], 9
mov dword [edi + 0xa4], esi
and dword [edi + 0xa8], 0
and dword [edi + 0xac], 0
mov dword [edi + 0xb0], esi
and dword [edi + 0xb8], 0
and dword [edi + 0xb4], 0
and dword [edi + 0xc0], 0
and dword [edi + 0xbc], 0
mov dword [edi + 0xd0], 8
and dword [edi + 0xd4], 0
and dword [edi + 0xd8], 0
mov byte [edi + 0xdc], 0
push 4
pop eax
mov ecx, dword [esp + 0x160]
mov dword [edi + 0xe0], eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe8], 0
mov dword [edi + 0xec], ecx
mov ecx, dword [esp + 0x48]
mov dword [edi + 0xf0], 2
and dword [edi + 0xf4], 0
and dword [edi + 0x60], 0
mov dword [edi + 0x20], 0x4ecdb0
and dword [edi + 0x24], 0
and dword [edi + 0x28], 0
and dword [edi + 0x2c], 0
mov dword [edi + 0x34], ecx
mov ecx, dword [esp + 0x150]
mov dword [edi + 0x30], ecx
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x38], ecx
mov ecx, dword [esp + 0x4c]
mov dword [edi + 0x3c], ecx
mov ecx, dword [esp + 8]
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ecx
mov dword [edi + 0xf8], eax
and dword [edi + 0xfc], 0
and dword [edi + 0x100], 0
mov ecx, edi
call fcn.0049cf14
mov ecx, edi
mov edx, esi
call fcn.0049cfd3
lea edi, [esp + 0x50]
mov ecx, edi
call fcn.0049e653
cmp dword [edi], 2
jne 0x40a857
push 8
pop ebx
jmp 0x40a9c9
mov eax, dword [esp + 0x68]
movq xmm0, qword [esp + 0x60]
movsd xmm2, qword [esp + 0x50]
movq xmm1, qword [esp + 0x58]
lea edi, [esp + 0x70]
lea edx, [esp + 0x20]
mov ecx, edi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movq qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0049e673
cmp dword [edi], 2
push 8
pop ebx
je 0x40a9c9
mov eax, dword [esp + 0x88]
movq xmm0, qword [esp + 0x80]
movsd xmm2, qword [esp + 0x70]
movq xmm1, qword [esp + 0x78]
lea edi, [esp + 0xb0]
lea edx, [esp + 0x20]
mov ecx, edi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movq qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0049e6c8
cmp dword [edi], 2
je 0x40a9c9
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
movsd xmm2, qword [esp + 0xb0]
movq xmm1, qword [esp + 0xb8]
lea edi, [esp + 0x134]
lea edx, [esp + 0x20]
mov ecx, edi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movq qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0049e73b
cmp dword [edi], 2
je 0x40a9c9
mov eax, dword [esp + 0x14c]
movq xmm0, qword [esp + 0x144]
movsd xmm2, qword [esp + 0x134]
movq xmm1, qword [esp + 0x13c]
lea edi, [esp + 0x118]
lea edx, [esp + 0x20]
mov ecx, edi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movq qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0049e7cf
cmp dword [edi], 2
je 0x40a9c9
mov eax, dword [esp + 0x130]
movq xmm0, qword [esp + 0x128]
movsd xmm2, qword [esp + 0x118]
movq xmm1, qword [esp + 0x120]
lea edi, [esp + 0x1c4]
lea edx, [esp + 0x20]
mov ecx, edi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movq qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0049e82a
mov eax, dword [edi]
cmp eax, 2
jne 0x40bf8c
xor esi, esi
push 4
pop edi
mov ecx, dword [esp + 0x2c0]
mov edx, dword [esp + 0x2c8]
call fcn.0049c908
mov ecx, dword [esp + 0x2c0]
mov edx, dword [esp + 0x2c4]
call fcn.00444b74
mov dword [esp + 0x2c0], edi
mov dword [esp + 0x2c4], esi
mov dword [esp + 0x2c8], esi
lea esi, [esp + 0x118]
and dword [esi], 0
push esi
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x40b842
lea edx, [esp + 0x210]
lea esi, [esp + 0x20]
mov eax, dword [edx - 0x10]
mov ecx, dword [edx - 0xc]
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + eax + 1]
mov dword [esi], eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [edx - 4]
pmovmskb eax, xmm0
not eax
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ecx
mov ecx, esi
call fcn.0049cb18
test eax, eax
je 0x40aa66
mov byte [edx + 0x6e], 0
jmp 0x40aa55
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.00404ef6
lea esi, [esp + 0x2e8]
mov edx, edi
mov ecx, esi
call fcn.0049cecc
mov edx, dword [esi]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov dword [edi], 0x4ecdb0
and dword [edi + 4], 0
and dword [edi + 8], 0
and dword [edi + 0xc], 0
lea edi, [esp + 0x30]
mov dword [edi], edx
mov edx, dword [esp + 0x118]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
lea eax, [esp + 0x70]
mov dword [edi + 0xc], ecx
xor edi, edi
mov dword [eax], 4
and dword [eax + 4], 0
and dword [eax + 8], 0
mov ecx, dword [edx]
add edx, 8
push 4
pop eax
xor ebx, ebx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x18], ecx
cmp ebx, ecx
je 0x40ae00
mov eax, ebx
inc ebx
imul esi, eax, 0x548
mov dword [esp + 0x10], eax
mov eax, dword [edx + esi + 0x4a8]
or eax, dword [edx + esi + 0x4ac]
jne 0x40ab13
mov eax, dword [edx + esi + 0x4b0]
or eax, dword [edx + esi + 0x4b4]
je 0x40aade
cmp dword [edx + esi + 0x48c], 2
je 0x40aade
cmp dword [edx + esi + 0x420], 0
je 0x40aade
mov dword [esp + 0x160], ebx
mov dword [esp + 0x14], edi
push 0x14
pop ecx
mov edi, edx
push 2
pop edx
call fcn.004997bd
mov ebx, eax
mov eax, dword [edi + esi + 0x10]
movzx edx, byte [edi + esi + 0x18]
movzx ecx, byte [edi + esi + 0x19]
mov dword [esp + 8], eax
movzx eax, byte [edi + esi + 0x14]
mov dword [esp + 0xc], eax
movzx eax, byte [edi + esi + 0x15]
mov dword [esp + 0xd0], eax
movzx eax, byte [edi + esi + 0x16]
mov dword [esp + 0x90], eax
movzx eax, byte [edi + esi + 0x17]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + esi + 0x1a]
movzx esi, byte [edi + esi + 0x1b]
mov edi, dword [esp + 8]
mov dword [ebx], edi
mov edi, dword [esp + 0xc]
mov word [ebx + 4], di
mov edi, dword [esp + 0xd0]
mov word [ebx + 6], di
mov edi, dword [esp + 0x90]
mov dword [esp + 0x90], 0
mov word [ebx + 8], di
mov edi, dword [esp + 0x1c]
mov word [ebx + 0xa], di
mov word [ebx + 0xc], dx
mov word [ebx + 0xe], cx
mov word [ebx + 0x10], ax
mov word [ebx + 0x12], si
push 0xa
pop ecx
xor edx, edx
call fcn.00499d8b
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov dword [esp + 0x100], edx
mov dword [esp + 0x1c], ebx
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0xa
mov dword [esp + 0xc], eax
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0049c508
add esp, 0x10
mov ecx, eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x150], eax
shr ecx, 0x19
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
mov dword [esp + 0xc], edi
and edi, eax
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0xf0], xmm1
movdqu xmm0, xmmword [edx + edi]
mov esi, edx
movdqa xmmword [esp + 0xd0], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x50], ax
lea ecx, [esp + 0x50]
call fcn.0040caa2
test eax, eax
je 0x40aca3
add edx, edi
mov ebx, esi
and edx, dword [esp + 0xc]
shl edx, 4
sub ebx, edx
mov ecx, dword [ebx - 0x10]
mov edx, dword [ebx - 8]
push 0xa
push dword [esp + 0xc]
call fcn.0049c5ba
pop ecx
pop edx
test al, al
je 0x40ac70
jmp 0x40ace5
movdqa xmm1, xmmword [esp + 0xd0]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x40ad29
mov eax, dword [esp + 0x90]
movdqa xmm1, xmmword [esp + 0xf0]
mov edx, esi
lea edi, [edi + eax + 0x10]
add eax, 0x10
and edi, dword [esp + 0xc]
mov dword [esp + 0x90], eax
jmp 0x40ac53
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x100]
call fcn.004a8f90
mov eax, dword [ebx - 4]
inc eax
cmp eax, 1
mov dword [ebx - 4], eax
jle 0x40ad8b
mov ecx, dword [esp + 0x1c]
push 0xa
pop edx
call fcn.004a8f90
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x160]
jmp 0x40aade
cmp dword [esp + 0x28], 0
je 0x40adee
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push dword [esp + 0x48]
push dword [esp + 0x154]
call fcn.0049cb29
pop ecx
pop ecx
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 8]
and dl, 1
shl eax, 4
movzx edx, dl
sub dword [esp + 0x28], edx
mov ebx, ecx
sub ebx, eax
neg eax
mov dword [ecx + eax - 0x10], esi
mov ecx, dword [esp + 0x100]
mov dword [ebx - 0xc], ecx
mov dword [ebx - 8], 0xa
and dword [ebx - 4], 0
inc dword [esp + 0x2c]
jmp 0x40acf5
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x160]
cmp edx, dword [esp + 0x74]
jne 0x40adb3
lea ecx, [esp + 0x70]
call fcn.0049c76c
mov esi, dword [esp + 0x70]
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x18]
jmp 0x40adbb
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x10]
shl edx, 4
mov dword [esi + edx], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + edx + 4], eax
push 0xa
pop eax
mov dword [esi + edx + 8], eax
mov dword [esi + edx + 0xc], eax
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x6c], esi
mov edi, dword [esp + 0x78]
inc edi
mov dword [esp + 0x78], edi
jmp 0x40aade
lea ecx, [esp + 0x20]
lea edx, [esp + 0x30]
call fcn.004cbae8
jmp 0x40ad34
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
shl edi, 4
add edi, ecx
mov ebx, ecx
mov dword [esp + 0x188], eax
mov dword [esp + 0x184], ecx
mov dword [esp + 0x14], edi
mov esi, ebx
cmp ebx, edi
je 0x40b453
mov eax, dword [esi + 4]
lea ebx, [esi + 0x10]
test eax, eax
mov dword [esp + 8], eax
je 0x40b451
mov eax, dword [esi + 8]
mov edx, dword [esi]
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x160], eax
je 0x40af94
mov dword [esp + 0x18], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x90], eax
push eax
push dword [esp + 0xc]
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0049c508
add esp, 0x10
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xf0], 0
mov dword [esp + 0xd0], edx
and edx, eax
shr eax, 0x19
mov dword [esp + 0xc], ecx
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x150], xmm1
movdqu xmm0, xmmword [ecx + edx]
mov dword [esp + 0x10], edx
movdqa xmmword [esp + 0x100], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x50], ax
lea ecx, [esp + 0x50]
call fcn.0040caa2
mov esi, eax
test eax, eax
je 0x40af25
mov ebx, edx
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x90]
add ebx, dword [esp + 0x10]
and ebx, dword [esp + 0xd0]
mov eax, ebx
shl eax, 4
sub edi, eax
push dword [edi - 8]
push dword [edi - 0x10]
call fcn.0049c5ba
pop ecx
pop edx
test al, al
je 0x40aee0
jmp 0x40af70
movdqa xmm1, xmmword [esp + 0x100]
pcmpeqd xmm0, xmm0
mov ecx, dword [esp + 0xc]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x40af74
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
movdqa xmm1, xmmword [esp + 0x150]
lea edx, [edx + eax + 0x10]
add eax, 0x10
and edx, dword [esp + 0xd0]
mov dword [esp + 0xf0], eax
jmp 0x40aec1
mov ecx, dword [esp + 0xc]
shl ebx, 4
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, ebx
test esi, esi
mov ebx, dword [esp + 0x1c]
cmove ecx, esi
add ecx, 0xfffffff0
test esi, esi
cmove ecx, esi
jmp 0x40af96
xor ecx, ecx
lea eax, [ecx + 0xc]
test ecx, ecx
mov esi, 0x4f092c
cmove eax, esi
cmp dword [eax], 1
jg 0x40b234
mov eax, dword [esp + 0x4c]
imul ecx, edx, 0x548
xor esi, esi
mov dword [esp + 0xf0], ecx
lea edx, [eax + ecx]
lea eax, [eax + ecx + 0x1c]
mov dword [esp + 0x48], edx
cmp esi, 0x101
je 0x40afdc
cmp word [eax + esi*2], 0
je 0x40afe3
inc esi
jmp 0x40afca
mov esi, 0x101
jmp 0x40aff9
mov ecx, eax
mov edx, 0x101
push 0x4eca88
push esi
call fcn.00444c71
pop ecx
pop ecx
mov esi, edx
mov edx, eax
lea ecx, [esp + 0x50]
push esi
call fcn.00426c90
pop eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
test eax, eax
je 0x40b22d
mov dword [esp + 0x18], edx
mov esi, dword [esp + 0x58]
mov edx, dword [esp + 0x214]
mov ecx, dword [esp + 0x210]
mov dword [esp + 0xd0], esi
push esi
mov dword [esp + 0x10], eax
push eax
push dword [esp + 0x224]
push dword [esp + 0x224]
call fcn.0049c450
add esp, 0x10
mov ecx, eax
mov edi, dword [esp + 0x204]
mov dword [esp + 0x18c], edx
mov edx, dword [esp + 0x200]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x100], 0
shr ecx, 0x19
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
mov dword [esp + 0x10], edi
and edi, eax
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x150], xmm1
movdqu xmm0, xmmword [edx + edi]
mov esi, edx
movdqa xmmword [esp + 0x90], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x50], ax
lea ecx, [esp + 0x50]
call fcn.0040caa2
test eax, eax
je 0x40b0ee
add edx, edi
mov ebx, esi
and edx, dword [esp + 0x10]
shl edx, 7
sub ebx, edx
mov ecx, dword [ebx - 0x80]
mov edx, dword [ebx - 0x78]
push dword [esp + 0xd0]
push dword [esp + 0x10]
call fcn.0043d254
pop ecx
pop edx
test al, al
je 0x40b0b6
jmp 0x40b134
movdqa xmm1, xmmword [esp + 0x90]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x40b249
mov eax, dword [esp + 0x100]
movdqa xmm1, xmmword [esp + 0x150]
mov edx, esi
lea edi, [edi + eax + 0x10]
add eax, 0x10
and edi, dword [esp + 0x10]
mov dword [esp + 0x100], eax
jmp 0x40b099
mov eax, dword [ebx - 0x68]
mov ecx, dword [ebx - 0x64]
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0xf0]
mov esi, 0xffffffff
mov dword [ebx - 0x5c], ecx
mov dword [ebx - 0x60], eax
mov eax, dword [edx + edi + 0x504]
mov ecx, dword [edx + edi + 0x500]
mov dword [ebx - 0x68], ecx
mov dword [ebx - 0x64], eax
mov eax, dword [ebx - 0x54]
mov ecx, dword [ebx - 0x58]
mov dword [ebx - 0x50], ecx
mov dword [ebx - 0x4c], eax
movsd xmm0, qword [edx + edi + 0x4b8]
movsd qword [ebx - 0x58], xmm0
movsd xmm0, qword [ebx - 0x48]
movsd qword [ebx - 0x40], xmm0
mov eax, dword [edx + edi + 0x4c0]
mov ecx, dword [edx + edi + 0x4c4]
add eax, dword [edx + edi + 0x4c8]
adc ecx, dword [edx + edi + 0x4cc]
cmovb ecx, esi
cmovb eax, esi
mov dword [ebx - 0x44], ecx
mov dword [ebx - 0x48], eax
movsd xmm0, qword [ebx - 0x38]
movsd qword [ebx - 0x30], xmm0
mov ecx, dword [edx + edi + 0x508]
mov eax, dword [edx + edi + 0x50c]
add ecx, dword [edx + edi + 0x510]
adc eax, dword [edx + edi + 0x514]
cmovb eax, esi
cmovb ecx, esi
mov dword [ebx - 0x38], ecx
mov dword [ebx - 0x34], eax
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [ebx - 0x28]
movsd qword [ebx - 0x20], xmm0
movsd xmm0, qword [edx + edi + 0x4d8]
movsd qword [ebx - 0x28], xmm0
movsd xmm0, qword [ebx - 0x18]
movsd qword [ebx - 0x10], xmm0
movq xmm0, qword [edx + edi + 0x520]
mov edx, dword [esp + 0x18]
movq qword [ebx - 0x18], xmm0
mov byte [ebx - 2], 1
call fcn.004a8f7f
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
jmp 0x40b234
xor ecx, ecx
call fcn.0049e649
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x160]
call fcn.004a8f90
jmp 0x40ae21
cmp dword [esp + 0x208], 0
je 0x40b439
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0xf0]
mov ecx, 0xffffffff
mov edi, dword [eax + edx + 0x4c0]
mov esi, dword [eax + edx + 0x4c4]
mov ebx, dword [eax + edx + 0x50c]
add edi, dword [eax + edx + 0x4c8]
adc esi, dword [eax + edx + 0x4cc]
cmovb esi, ecx
cmovb edi, ecx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x90], edi
movsd xmm0, qword [esi]
mov esi, dword [eax + edx + 0x508]
add esi, dword [eax + edx + 0x510]
movsd qword [esp + 0x1b8], xmm0
adc ebx, dword [eax + edx + 0x514]
cmovb ebx, ecx
cmovb esi, ecx
mov ecx, dword [eax + edx + 0x500]
mov dword [esp + 0x178], ecx
mov ecx, dword [eax + edx + 0x504]
mov dword [esp + 0x174], ecx
mov ecx, dword [eax + edx + 0x4b8]
mov dword [esp + 0x180], ecx
mov ecx, dword [eax + edx + 0x4bc]
mov dword [esp + 0x17c], ecx
mov ecx, dword [eax + edx + 0x4d8]
mov dword [esp + 0x150], ecx
mov ecx, dword [eax + edx + 0x4dc]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + edx + 0x520]
mov eax, dword [eax + edx + 0x524]
mov edx, dword [esp + 0x204]
mov dword [esp + 0x100], ecx
mov ecx, dword [esp + 0x200]
mov dword [esp + 0xf0], eax
push dword [esp + 0x18c]
push dword [esp + 0x70]
call fcn.0049cb29
pop ecx
pop ecx
and dl, 1
mov edi, dword [esp + 0xc]
shl eax, 7
movq xmm0, qword [esp + 0x1b8]
movzx ecx, dl
mov edx, dword [esp + 0x200]
sub dword [esp + 0x208], ecx
mov ecx, edx
sub ecx, eax
neg eax
mov dword [edx + eax - 0x80], edi
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x174]
mov edi, dword [esp + 0x150]
mov dword [ecx - 0x7c], eax
mov eax, dword [esp + 0xd0]
mov dword [ecx - 0x78], eax
mov eax, dword [esp + 0x178]
movq qword [ecx - 0x70], xmm0
mov dword [ecx - 0x64], edx
mov dword [ecx - 0x68], eax
mov dword [ecx - 0x5c], edx
mov dword [ecx - 0x60], eax
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x180]
mov dword [ecx - 0x54], edx
mov dword [ecx - 0x58], eax
mov dword [ecx - 0x4c], edx
mov dword [ecx - 0x50], eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x90]
mov dword [ecx - 0x44], eax
mov dword [ecx - 0x48], edx
mov dword [ecx - 0x40], edx
mov edx, dword [esp + 0x48]
mov dword [ecx - 0x3c], eax
mov dword [ecx - 0x34], ebx
mov dword [ecx - 0x38], esi
mov dword [ecx - 0x30], esi
mov dword [ecx - 0x2c], ebx
mov dword [ecx - 0x28], edi
mov esi, dword [esp + 0x100]
mov dword [ecx - 0x24], edx
mov dword [ecx - 0x1c], edx
mov edx, dword [esp + 0xf0]
mov dword [ecx - 0x20], edi
mov dword [ecx - 0x18], esi
mov dword [ecx - 0x14], edx
mov dword [ecx - 0xc], edx
mov dword [ecx - 0x10], esi
and dword [ecx - 8], 0
and word [ecx - 4], 0
mov byte [ecx - 2], 1
inc dword [esp + 0x20c]
jmp 0x40b223
lea ecx, [esp + 0x200]
lea edx, [esp + 0x210]
call fcn.004cbdb6
jmp 0x40b257
mov esi, ebx
sub edi, esi
add esi, 8
shr edi, 4
sub edi, 1
jb 0x40b46f
mov ecx, dword [esi - 4]
mov edx, dword [esi]
call fcn.004a8f90
add esi, 0x10
jmp 0x40b45b
mov eax, dword [esp + 0x188]
test eax, eax
je 0x40b48e
shl eax, 4
push 4
pop edx
mov ecx, dword [esp + 0x184]
push eax
call fcn.00408eed
pop eax
push dword [esp + 0x118]
call sub.IPHLPAPI.DLL_FreeMibTable
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40b55b
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x40b539
mov edx, dword [esp + 0x20]
lea esi, [esp + 0x5c]
movdqa xmm0, xmmword [edx]
lea eax, [eax + edx + 1]
mov dword [esi - 0xc], edx
add edx, 0x10
mov dword [esi - 8], edx
mov dword [esi - 4], eax
pmovmskb edi, xmm0
not edi
mov word [esi], di
xor edi, edi
mov dword [esi + 4], ecx
inc edi
test edi, edi
je 0x40b535
mov ecx, esi
call fcn.0040caa2
cmp eax, 1
je 0x40b511
mov eax, dword [esp + 0x54]
movdqa xmm0, xmmword [eax]
add eax, 0x10
pmovmskb ecx, xmm0
not ecx
mov word [esp + 0x5c], cx
add dword [esp + 0x50], 0xffffff00
mov dword [esp + 0x54], eax
jmp 0x40b4e1
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x50]
shl edx, 4
mov ecx, eax
dec edi
sub ecx, edx
mov dword [esp + 0x60], edi
neg edx
mov ecx, dword [ecx - 0x10]
mov edx, dword [eax + edx - 0xc]
call fcn.004a8f90
jmp 0x40b4dd
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea esi, [esp + 0x50]
mov ecx, esi
push 0x10
push eax
call fcn.0049ca45
pop eax
pop ecx
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push dword [esi + 8]
call fcn.00408eed
pop eax
mov eax, dword [esp + 0x200]
mov ecx, dword [esp + 0x204]
mov edi, dword [esp + 0x20c]
lea esi, [esp + 0x20]
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + eax + 1]
mov dword [esi], eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
pmovmskb edx, xmm0
not edx
mov word [esi + 0xc], dx
mov dword [esi + 0x10], edi
mov ecx, esi
call fcn.0049c01d
test eax, eax
je 0x40b5cc
cmp byte [eax - 2], 0
mov edi, eax
jne 0x40b594
mov edx, dword [esp + 0x200]
lea ecx, [esp + 0x200]
sub edx, edi
sar edx, 7
call fcn.0049ce65
mov ecx, dword [edi - 0x80]
mov edx, dword [edi - 0x7c]
call fcn.004a8f7f
jmp 0x40b594
and dword [esp + 0xb0], 0
lea edi, [esp + 0x134]
mov dword [edi], 0x3c00
push 3
pop ebx
sub ebx, 1
jb 0x40b667
push dword [esp + 0x134]
call fcn.004bdaf3
pop ecx
test eax, eax
je 0x40b633
mov esi, eax
push edi
push eax
push 0
push 0xe
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
mov dword [esp + 0xb0], eax
jne 0x40b61e
push esi
call fcn.004bdafe
pop eax
jmp 0x40b5e4
test eax, eax
jne 0x40b660
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
and dword [esp + 0x50], 0
xor esi, esi
jmp 0x40b6a5
push 0x32
pop edi
mov ecx, edi
xor edx, edx
call fcn.0044c587
mov esi, eax
mov ebx, edx
push edi
push str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESIndex_out_of_bounds
push eax
call fcn.004ba8e0
add esp, 0xc
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], edi
jmp 0x40b6a5
push esi
call fcn.004bdafe
pop eax
lea eax, [esp + 0xb0]
lea edx, [esp + 0x20]
lea ecx, [esp + 0x70]
lea esi, [esp + 0x50]
mov dword [esp + 0x70], eax
xor eax, eax
mov dword [edx], str.GetAdaptersAddresses___failed_with_code
mov dword [esp + 0x74], fcn.00428870
inc eax
mov dword [edx + 4], eax
and dword [edx + 0x10], 0
mov dword [edx + 8], ecx
mov ecx, esi
mov dword [edx + 0xc], eax
call fcn.00498cc6
mov esi, dword [esi]
test esi, esi
push 8
pop ebx
je 0x40b6bc
mov edx, dword [esp + 0x54]
mov ecx, esi
call fcn.004a8f7f
jmp 0x40b83b
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x70]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [esp + 0x20]
lea edx, [esp + 0x70]
call fcn.0049e5c1
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 8], eax
je 0x40b831
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x20c], 0
mov dword [esp + 0xd0], eax
je 0x40b81c
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x210]
mov edx, dword [esp + 0x214]
mov dword [esp + 0x10], eax
push eax
push dword [esp + 0xc]
push dword [esp + 0x224]
push dword [esp + 0x224]
call fcn.0049c450
add esp, 0x10
mov esi, dword [esp + 0x204]
mov ecx, dword [esp + 0x200]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], esi
and esi, eax
shr eax, 0x19
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x160], xmm1
movdqu xmm0, xmmword [ecx + esi]
mov edi, ecx
movdqa xmmword [esp + 0x90], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0xb0], ax
lea ecx, [esp + 0xb0]
call fcn.0040caa2
test eax, eax
je 0x40b7c6
add edx, esi
mov ebx, edi
mov ecx, dword [esp + 8]
and edx, dword [esp + 0xc]
shl edx, 7
sub ebx, edx
mov edx, dword [esp + 0x10]
push dword [ebx - 0x78]
push dword [ebx - 0x80]
call fcn.0043d254
pop ecx
pop edx
test al, al
je 0x40b78e
jmp 0x40b805
movdqa xmm1, xmmword [esp + 0x90]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
push 8
pop ebx
jne 0x40b81c
mov eax, dword [esp + 0x14]
movdqa xmm1, xmmword [esp + 0x160]
mov ecx, edi
lea esi, [esi + eax + 0x10]
add eax, 0x10
and esi, dword [esp + 0xc]
mov dword [esp + 0x14], eax
jmp 0x40b76e
lea ecx, [esp + 0x2c]
add ebx, 0xffffff80
movzx eax, word [ecx + 4]
mov word [ebx + 0x7c], ax
mov eax, dword [ecx]
mov dword [ebx + 0x78], eax
push 8
pop ebx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xd0]
call fcn.004a8f7f
jmp 0x40b6cd
push dword [esp + 0x70]
call fcn.004bdafe
pop eax
lea esi, [esp + 0x118]
lea ecx, [esp + 0x1e0]
mov edx, 0x10101
call fcn.0049d6b2
call sub.KERNEL32.dll_GetLogicalDrives
test eax, eax
mov dword [esp + 0x118], eax
je 0x40b99a
lea ebx, [esp + 0x20]
mov dword [esp + 0xb0], 8
and dword [esp + 0xb4], 0
and dword [esp + 0xb8], 0
mov dword [ebx], esi
and dword [ebx + 4], 0
push 0x20
pop edi
mov ecx, edi
mov dword [ebx + 8], edi
call fcn.0049c2c9
lea esi, [esp + 0x70]
mov edx, edi
mov ecx, esi
push ebx
push edi
push 0
push 1
push eax
push 0
call fcn.00499e15
add esp, 0x18
mov eax, dword [esi + 8]
xor edx, edx
sub eax, 1
jb 0x40b8ca
mov esi, dword [esi]
test esi, esi
je 0x40b8ca
add edx, dword [esi + 8]
add esi, 0xc
jmp 0x40b8b7
lea ecx, [esp + 0xb0]
call fcn.0049c5d9
mov eax, dword [esp + 0x78]
movq xmm0, qword [esp + 0x70]
lea ecx, [esp + 0x50]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea ecx, [esp + 0x50]
call fcn.0049af04
test eax, eax
je 0x40b976
movq xmm0, qword [eax + 4]
mov esi, dword [eax]
mov ecx, eax
movq qword [esp + 0x134], xmm0
call fcn.00405280
test esi, esi
je 0x40b976
mov edi, dword [esp + 0x138]
mov eax, dword [esp + 0x134]
lea ecx, [esp + 0xb0]
mov dword [esp + 0x20], esi
mov edx, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
call fcn.0049c5d9
mov ebx, dword [esp + 0xb8]
imul ecx, edi, 0x50
imul eax, ebx, 0x50
add eax, dword [esp + 0xb0]
push ecx
push esi
push eax
call fcn.004ba8e0
add esp, 0xc
and dword [esp + 0x28], 0
add ebx, edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xb8], ebx
call fcn.00499073
jmp 0x40b8eb
lea ecx, [esp + 0x50]
call fcn.0049a706
mov eax, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb0]
mov edi, dword [esp + 0xb8]
mov dword [esp + 8], eax
jmp 0x40b9a4
mov dword [esp + 8], 0
xor edi, edi
lea ecx, [esp + 0x2cc]
lea esi, [esp + 0x2d8]
call fcn.00499073
mov eax, dword [esp + 8]
mov dword [esi - 0xc], ebx
lea ebx, [esp + 0x134]
mov dword [esi - 8], eax
mov dword [esi - 4], edi
lea edi, [esp + 0x118]
lea eax, [esp + 0x194]
mov dword [edi], 4
and dword [edi + 4], 0
and dword [edi + 8], 0
and dword [eax], 0
and dword [esp + 0xac], 0
and dword [esp + 0x114], 0
and dword [esp + 0x198], 0
lea eax, [esp + 0x194]
push eax
lea eax, [esp + 0x19c]
push eax
lea eax, [esp + 0x11c]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xbc]
push eax
push 2
push 0
push 0
call sub.NETAPI32.dll_NetUserEnum
cmp eax, 0xea
je 0x40ba3e
test eax, eax
jne 0x40bd53
mov dword [esp + 0xd0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0x114]
lea eax, [ecx + eax*4]
mov dword [esp + 0xc], eax
cmp ecx, dword [esp + 0xc]
je 0x40bd35
mov esi, ecx
add ecx, 4
cmp dword [esi], 0
je 0x40ba5a
and dword [esp + 0xe8], 0
lea eax, [esp + 0xe8]
mov dword [esp + 8], ecx
push eax
push 0x17
push dword [esi]
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x40bd1b
mov eax, dword [esp + 0xe8]
mov ecx, ebx
mov edx, dword [eax + 0x10]
call fcn.004997fb
mov edx, dword [esp + 0x134]
test edx, edx
je 0x40bd1b
lea ecx, [esp + 0x20]
call fcn.0049dd23
cmp dword [esp + 0x20], 0
je 0x40bae1
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [esp + 0xb8], eax
movq qword [esp + 0xb0], xmm0
jmp 0x40baef
mov edx, dword [esi]
lea ecx, [esp + 0xb0]
call fcn.00498d34
mov eax, dword [esi]
and dword [esp + 0xec], 0
and dword [esp + 0x19c], 0
and dword [esp + 0x1c4], 0
lea ecx, [esp + 0x1c4]
push ecx
lea ecx, [esp + 0x1a0]
push ecx
push 0xffffffffffffffff
lea ecx, [esp + 0xf8]
push ecx
push 1
push 0
push eax
push 0x500d14
call sub.NETAPI32.dll_NetUserGetLocalGroups
xor esi, esi
test eax, eax
je 0x40bb42
push 4
pop eax
xor ecx, ecx
jmp 0x40bcb9
mov ecx, dword [esp + 0x19c]
test ecx, ecx
push 4
pop eax
je 0x40bb8d
xor ebx, ebx
cmp ecx, 0xaaaaaab
setb al
jae 0x40c12a
imul esi, ecx, 0xc
test esi, esi
js 0x40c12a
mov bl, al
mov edi, ecx
mov edx, esi
shl ebx, 2
mov ecx, ebx
call fcn.0045244b
mov ecx, edi
test eax, eax
lea edi, [esp + 0x118]
je 0x40c131
mov edx, dword [esp + 0xec]
test edx, edx
je 0x40bbf3
mov esi, dword [esp + 0x19c]
lea ebx, [esp + 0x134]
cmp ecx, esi
mov dword [esp + 0x10], esi
jae 0x40bc0c
lea ebx, [ecx + ecx]
mov dword [esp + 0x90], edx
cmp ebx, esi
cmovbe ebx, esi
cmp ebx, 5
push 4
pop edi
cmovb ebx, edi
xor edx, edx
cmp ebx, 0xaaaaaab
mov dword [esp + 0x14], ebx
setb dl
imul edi, ebx, 0xc
shl edx, 2
test ecx, ecx
je 0x40bc1a
mov ebx, ecx
imul ecx, ecx, 0xc
mov esi, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], ecx
push 4
pop ecx
jmp 0x40bc20
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
and dword [esp + 0x40], 0
lea ebx, [esp + 0x134]
jmp 0x40bcd6
test esi, esi
mov esi, 0
jne 0x40bc62
jmp 0x40bcb9
mov ebx, ecx
xor ecx, ecx
mov esi, eax
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x70]
lea eax, [esp + 0x50]
push eax
push edi
call fcn.0042fc60
pop eax
pop ecx
cmp dword [esp + 0x70], 0
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov eax, SysReAllocString
cmove ebx, dword [esp + 0x14]
cmove esi, ecx
cmove ecx, eax
call fcn.00407f59
mov edx, dword [esp + 0x90]
mov ecx, ebx
mov eax, esi
xor edi, edi
mov esi, eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x14], eax
mov ebx, edx
mov edx, dword [edx + edi*4]
lea ecx, [esp + 0x50]
call fcn.00498d34
mov eax, dword [esp + 0x58]
inc edi
mov edx, ebx
mov dword [esi + 8], eax
movq xmm0, qword [esp + 0x50]
movq qword [esi], xmm0
add esi, 0xc
cmp dword [esp + 0x10], edi
jne 0x40bc71
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x118]
lea ebx, [esp + 0x134]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], esi
test edx, edx
je 0x40bcd6
push edx
call sub.NETAPI32.dll_NetApiBufferFree
movsd xmm0, qword [esp + 0x134]
mov eax, dword [esp + 0x13c]
mov edx, dword [esp + 0xb8]
lea ecx, [esp + 0x2c]
movsd qword [esp + 0x20], xmm0
movq xmm0, qword [esp + 0xb0]
mov dword [esp + 0x28], eax
and dword [esp + 0x44], 0
mov dword [ecx + 8], edx
lea edx, [esp + 0x20]
movq qword [ecx], xmm0
mov ecx, edi
call fcn.0049ddb8
mov eax, dword [esp + 0xe8]
test eax, eax
je 0x40bd2c
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 8]
jmp 0x40ba5a
cmp dword [esp + 0xd0], 0xea
jne 0x40bd53
mov ecx, dword [esp + 0xac]
call fcn.0049dd0b
jmp 0x40b9ea
mov ecx, dword [esp + 0xac]
call fcn.0049dd0b
and dword [esp + 0x134], 0
and dword [esp + 0xb0], 0
lea eax, [esp + 0xb0]
push eax
push ebx
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x40be12
mov eax, dword [esp + 0x120]
movsd xmm0, qword [esp + 0x118]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xb0]
movsd qword [esp + 0x20], xmm0
test eax, eax
je 0x40bdb0
push eax
call sub.Secur32.dll_LsaFreeReturnBuffer
mov ecx, dword [esp + 0x2d8]
mov edx, dword [esp + 0x2e0]
call fcn.0049c9ab
mov ecx, dword [esp + 0x2d8]
mov edx, dword [esp + 0x2dc]
call fcn.0049ca33
mov eax, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
lea ecx, [esp + 0x2d8]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push 0x108
lea eax, [esp + 0x1e4]
push eax
push dword [esp + 0x198]
call fcn.004ba8e0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0x134]
lea esi, [ebx + eax*8]
mov dword [esp + 0x14], esi
cmp ebx, esi
je 0x40bd85
and dword [esp + 0x70], 0
lea eax, [esp + 0x70]
push eax
push ebx
add ebx, 8
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x40be51
mov ecx, dword [esp + 0x70]
call fcn.0049dd17
jmp 0x40be27
mov ecx, dword [esp + 0x70]
test ecx, ecx
je 0x40be46
cmp dword [ecx + 0x24], 3
je 0x40be4a
mov edx, dword [ecx + 0x10]
movzx eax, word [ecx + 0xc]
mov dword [esp + 0x90], edx
mov edx, dword [ecx + 0x2c]
lea ecx, [esp + 0x20]
mov dword [esp + 0xd0], eax
call fcn.004997fb
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 8], eax
je 0x40be46
mov eax, dword [esp + 0x24]
imul esi, dword [esp + 0x120], 0x28
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x118]
test esi, esi
je 0x40bee5
mov ecx, dword [eax]
mov edx, dword [eax + 8]
lea edi, [eax + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00427614
pop ecx
pop edx
add esi, 0xffffffd8
test al, al
mov eax, edi
je 0x40beab
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
call fcn.004a8f7f
mov esi, dword [esp + 0x14]
jmp 0x40be46
mov edx, dword [esp + 8]
lea ecx, [esp + 0x50]
call fcn.0049dd23
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x14]
test ecx, ecx
je 0x40bf08
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
jmp 0x40bf3c
mov eax, dword [esp + 0xd0]
mov edx, dword [esp + 0x90]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
call fcn.00426c90
pop eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40bf37
mov ecx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
jmp 0x40bf3c
xor ecx, ecx
mov edx, eax
inc ecx
mov edi, dword [esp + 8]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x28], edi
and dword [esp + 0x44], 0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], 4
and dword [esp + 0x3c], 0
and dword [esp + 0x40], 0
lea ecx, [esp + 0x118]
lea edx, [esp + 0x20]
call fcn.0049ddb8
jmp 0x40be46
movsd xmm0, qword [esp + 0x1d8]
movsd xmm2, qword [esp + 0x1c8]
movsd xmm1, qword [esp + 0x1d0]
lea edi, [esp + 0x19c]
lea ebx, [esp + 0xb0]
mov ecx, ebx
mov edx, edi
movsd qword [edi + 0x14], xmm0
movsd qword [edi + 0xc], xmm1
movsd qword [edi + 4], xmm2
mov dword [edi], eax
push 1
call fcn.0049e8d1
pop eax
mov ebx, dword [ebx + 4]
mov eax, dword [edi + 0x18]
movq xmm0, qword [edi + 0x10]
movsd xmm2, qword [edi]
movq xmm1, qword [edi + 8]
cmp ebx, 2
mov dword [esp + 0x68], eax
movq qword [esp + 0x60], xmm0
movq qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
jne 0x40c014
lea ecx, [esp + 0x50]
call fcn.0049c93a
xor esi, esi
push 8
pop ebx
jmp 0x40a9cb
movss xmm2, dword [esp + 0xb8]
movsd xmm1, qword [esp + 0x1ac]
movss xmm0, dword [esp + 0xb0]
mov eax, dword [esp + 0x1b4]
movss dword [esp + 0xc], xmm2
movsd qword [esp + 0x30], xmm1
movsd xmm2, qword [esp + 0x19c]
movsd xmm1, qword [esp + 0x1a4]
movss dword [esp + 8], xmm0
mov dword [esp + 0x38], eax
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x20], xmm2
push 8
pop ecx
xor edx, edx
call fcn.0044c587
mov dword [eax + 4], 0x72657475
mov dword [eax], 0x706d6f43
mov edi, eax
mov dword [esp + 0x10], edx
movsd xmm1, qword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
mov eax, dword [esp + 0x38]
movsd qword [esp + 0x78], xmm1
movsd xmm1, qword [esp + 0x30]
movsd qword [esp + 0x70], xmm0
mov dword [esp + 0x88], eax
movsd qword [esp + 0x80], xmm1
push 0x38
pop ecx
push 4
pop edx
call fcn.004997bd
movss xmm0, dword [esp + 0xc]
mov dword [eax], ebx
movss dword [eax + 4], xmm0
movsd xmm0, qword [esp + 0x70]
movq xmm1, qword [esp + 0x78]
movsd qword [eax + 8], xmm0
movq qword [eax + 0x10], xmm1
movsd xmm0, qword [esp + 0x80]
movsd qword [eax + 0x18], xmm0
movd xmm0, dword [esp + 8]
mov ecx, dword [esp + 0x88]
mov dword [eax + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x24], edi
mov edi, eax
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], 8
movd dword [edi + 0x30], xmm0
movd dword [edi + 0x34], xmm0
push 8
pop ebx
jmp 0x40a9ce
call fcn.00425d50
ud2
mov ecx, ebx
mov edx, esi
call fcn.004c8580
ud2
push 8
pop ecx
mov edx, 0xa0
jmp 0x40c135