Function at 0x406ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x4d8094]
mov dword [esp + 0x24], 0
mov dword [esp], eax
mov ecx, dword [0x4deb94]
mov byte [esp + 0x24], 1
mov eax, dword [ecx + 0x138]
test eax, eax
je 0x406f50
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x16]
push ecx
mov ecx, dword [esp + 0x16]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x14]
push str.__02d__02d__02d:_02d:_02d_
push edx
call fcn.00487e9f
add esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x406fc0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x407001
lea ecx, [esp + 0xc]
push 0x4d43f4
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0048f8d6
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push ecx
mov bl, 2
push eax
push edx
mov byte [esp + 0x3c], bl
call fcn.0048f870
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 3
call fcn.0048f77a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048f641
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0048f641
jmp 0x407001
lea eax, [esp + 0x38]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
call fcn.0048f870
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 4
call fcn.0048f77a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 1
call fcn.0048f641
mov eax, dword [esp + 0x38]
mov ecx, dword [0x4deb94]
push eax
call fcn.00437af0
push 0x4d43f4
lea ecx, [esp + 0x3c]
call fcn.0048fa1d
mov ecx, dword [0x4d8094]
mov dword [esp + 0x10], ecx
mov bl, 5
test edi, edi
mov byte [esp + 0x30], bl
jne 0x407083
mov edx, dword [0x4deb94]
push str.CollectorText.txt
lea eax, [esp + 0x40]
push 0x4decc4
mov esi, dword [edx + 0x308]
push eax
add esi, 0x98
call fcn.0048f8d6
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.0048f77a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048f641
mov ecx, dword [0x4deb94]
mov ecx, dword [ecx + 0x308]
test ecx, ecx
je 0x40713b
call fcn.00407bc0
jmp 0x40713b
mov eax, dword [0x4deb94]
cmp edi, 0xb
jne 0x40709c
mov ecx, dword [eax + 0x124]
test ecx, ecx
jne 0x4070eb
jmp 0x40726b
cmp edi, 0xc
jne 0x4070b0
mov ecx, dword [eax + 0x130]
test ecx, ecx
jne 0x4070eb
jmp 0x40726b
cmp edi, 0xd
jne 0x4070c4
mov ecx, dword [eax + 0x12c]
test ecx, ecx
jne 0x4070eb
jmp 0x40726b
cmp edi, 0xe
jne 0x4070d8
mov ecx, dword [eax + 0x134]
test ecx, ecx
jne 0x4070eb
jmp 0x40726b
cmp edi, 0xf
jne 0x4070eb
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x40726b
mov esi, dword [eax + 0x308]
push str.CollectorOutput.txt
lea edx, [esp + 0x40]
push 0x4decc4
push edx
add esi, 0xd4
call fcn.0048f8d6
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0048f77a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048f641
mov eax, dword [0x4deb94]
mov ecx, dword [eax + 0x308]
test ecx, ecx
je 0x40713b
call fcn.00407c50
mov ecx, dword [0x4deb94]
mov eax, dword [ecx + 0x308]
test eax, eax
je 0x40720d
mov ecx, esi
call fcn.0048ec53
cmp eax, 0x100000
jl 0x4071a3
test edi, edi
jne 0x407176
push 0xffffffffffffffff
push edi
push 0xef5b
call fcn.00411e30
add esp, 0xc
jmp 0x40726b
cmp edi, 1
push 0xffffffffffffffff
push 0
jne 0x407191
push 0xef5c
call fcn.00411e30
add esp, 0xc
jmp 0x40726b
push 0xef5d
call fcn.00411e30
add esp, 0xc
jmp 0x40726b
mov edx, dword [0x4deb94]
mov ecx, dword [edx + 0x13c]
test ecx, ecx
je 0x4071d5
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push eax
mov eax, dword [esi + 0x1c]
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push ecx
jmp 0x4071f7
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esp + 0x38]
mov edx, dword [esi + 0x1c]
push ecx
push 0
push 0xc2
push edx
call edi
jmp 0x40726b
lea ecx, [esp + 0x18]
call fcn.0049089d
mov eax, dword [esp + 0x10]
push 0
push 0x3041
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.004909af
test eax, eax
je 0x40725e
mov edx, dword [esp + 0x18]
push 0
push 0
lea ecx, [esp + 0x20]
call dword [edx + 0x28]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00490b06
lea ecx, [esp + 0x18]
call fcn.00490bca
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.004908f2
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0048f641
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.0048f641
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048f641
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8