Function at 0x684a7e0
Capabilities:
Get domain information
Get hostname
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6889db1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x810
mov eax, dword [0x689c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x6fc], edi
mov dword [ebp - 0x6f8], edi
mov dword [ebp - 4], 0
mov edx, str.DDd
mov dword [ebp - 0x704], edi
push 7
mov dword [ebp - 0x700], 0
call fcn.06832080
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x700], 1
call fcn.0683d710
mov dword [ebp - 4], 1
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684a883
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684a8d9
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x684a8b4
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684a8f0
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684a92e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684a924
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bbe8
push ecx
push edx
call fcn.06864a07
add esp, 8
push 0x20
mov edx, 0x689ce14
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov dword [ebp - 4], 2
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684a951
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684a9a7
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x684a982
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684a9be
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684a9fc
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684a9f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bbed
push ecx
push edx
call fcn.06864a07
add esp, 8
cmp dword [ebx + 8], 0
je 0x684bafa
push 0xc
mov edx, str.DDv
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov dword [ebp - 4], 3
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684aa29
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684aa7f
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x684aa5a
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684aa96
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684aad4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684aaca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bbf2
push ecx
push edx
call fcn.06864a07
add esp, 8
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x6f4], 0
push 0x6894928
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6bc], 0
movups xmmword [ebp - 0x6cc], xmm0
mov dword [ebp - 0x6b8], 0
call fcn.06839710
lea eax, [ebp - 0x6f4]
mov dword [ebp - 4], 4
push eax
push 1
push 0
mov dword [ebp - 0x700], 3
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
test eax, eax
jne 0x684ac05
mov eax, dword [ebp - 0x6f4]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x684ab9b
mov eax, dword [ebp - 0x6b8]
cmp eax, 9
jb 0x684ab85
cmp eax, 7
mov dword [ebp - 0x6bc], 9
push 0x12
lea esi, [ebp - 0x6cc]
cmova esi, dword [ebp - 0x6cc]
push str.WORKGROUP
push esi
call fcn.06866110
add esp, 0xc
xor eax, eax
mov word [esi + 0x12], ax
jmp 0x684ac05
push str.WORKGROUP
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push 9
jmp 0x684abfa
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x684aba0
mov eax, dword [ebp - 0x6b8]
sub ecx, esi
sar ecx, 1
cmp ecx, eax
ja 0x684abeb
lea esi, [ecx + ecx]
mov dword [ebp - 0x6bc], ecx
cmp eax, 7
lea edi, [ebp - 0x6cc]
push esi
cmova edi, dword [ebp - 0x6cc]
push edx
push edi
call fcn.06866110
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x6fc]
jmp 0x684ac05
push edx
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x6cc]
call fcn.06839900
mov dword [ebp - 0x700], 0
mov dword [ebp - 4], 5
lea edx, [ebp - 0x6cc]
cmp dword [ebp - 0x6b8], 7
mov ecx, dword [edi + 0x10]
cmova edx, dword [ebp - 0x6cc]
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x6bc]
sub eax, ecx
mov dword [ebp - 0x69c], ecx
cmp esi, eax
ja 0x684ac85
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684ac5e
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x69c]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
add eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x684ac9c
push esi
push edx
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push esi
call fcn.0683a490
push 0xf
mov edx, 0x689ce90
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 6
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684acbc
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684ad12
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684aced
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684ad29
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0683a490
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684ad67
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684ad5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bbf7
push ecx
push edx
call fcn.06864a07
add esp, 8
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x684aee6
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x684adb4
sub ecx, edx
lea eax, [ebp - 0x498]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06839710
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x30]
call fcn.068379f0
mov byte [ebp - 4], 8
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684adf7
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684ae4d
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684ae28
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684ae64
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0683a490
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684aea2
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684ae98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bbfc
push ecx
push edx
call fcn.06864a07
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x684aee6
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684aedc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push edx
call fcn.06864a07
add esp, 8
push 0x13
mov edx, 0x689ce00
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 9
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684af06
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684af5c
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684af37
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684af73
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0683a490
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684afb1
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684afa7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc01
push ecx
push edx
call fcn.06864a07
add esp, 8
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x684b132
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x684b000
sub ecx, edx
lea eax, [ebp - 0x698]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06839710
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.068379f0
mov byte [ebp - 4], 0xb
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b043
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b099
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684b074
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b0b0
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684b0ee
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b0e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc06
push ecx
push edx
call fcn.06864a07
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x684b132
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b128
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push edx
call fcn.06864a07
add esp, 8
push 0xf
mov edx, 0x689ce80
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 0xc
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b152
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b1a8
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684b183
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b1bf
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0683a490
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684b1fd
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b1f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc0b
push ecx
push edx
call fcn.06864a07
add esp, 8
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x69c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6f0]
xor esi, esi
push eax
push 1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x6f0], esi
push eax
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
mov eax, dword [ebp - 0x6f0]
jne 0x684b247
mov esi, dword [eax + 0xc]
test eax, eax
je 0x684b252
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x16]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x684b255
push ecx
lea eax, [ebp - 0x16]
push eax
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.0683d1e0
mov dword [ebp - 0x700], 0x30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6b4]
cmp dword [ebp - 0x6a0], 7
mov edx, dword [edi + 0x10]
mov esi, dword [ebp - 0x6b4]
cmova ecx, esi
mov eax, dword [edi + 0x14]
sub eax, edx
mov dword [ebp - 0x69c], edx
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6f8], ecx
cmp edx, eax
ja 0x684b31a
cmp dword [edi + 0x14], 7
mov ecx, dword [ebp - 0x69c]
mov dword [ebp - 0x6f0], edi
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x684b2f0
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x6f8]
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b337
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
mov esi, dword [ebp - 0x6b4]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6a0]
cmp eax, 7
jbe 0x684b375
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x684b36b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push esi
call fcn.06864a07
add esp, 8
push 8
mov edx, 0x689ce64
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 0xe
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b395
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b3eb
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x684b3c6
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b402
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684b440
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b436
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc10
push ecx
push edx
call fcn.06864a07
add esp, 8
push 0x6894f18
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x684b48e
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x684b48e
push 0x110
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.068666a0
add esp, 0xc
mov dword [ebp - 0x1b0], 0x114
lea eax, [ebp - 0x1b0]
push eax
call esi
test eax, eax
je 0x684b4a4
push 0x114
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.068666a0
add esp, 0xc
mov ecx, 0x45
lea edi, [ebp - 0x820]
lea esi, [ebp - 0x1b0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x818]
lea esi, [ebp - 0x42]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x684b4c0
push ecx
lea eax, [ebp - 0x42]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.0683d1e0
mov dword [ebp - 0x700], 0x3c
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x6e]
mov ecx, dword [ebp - 0x81c]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x684b510
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6b4]
call fcn.0683d1e0
mov dword [ebp - 0x700], 0xfc
push 0x6894f14
lea edx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x30]
call fcn.068393f0
add esp, 4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x11
push ecx
push eax
push dword [ebp - 0x704]
lea ecx, [ebp - 0x5c]
call fcn.06839f80
mov dword [ebp - 0x700], 0x1fc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684b5c7
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b5bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc15
push ecx
push edx
call fcn.06864a07
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x684b61f
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b615
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc15
push ecx
push edx
call fcn.06864a07
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 7
mov word [ebp - 0x6b4], ax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x684b680
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b676
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc15
push ecx
push edx
call fcn.06864a07
add esp, 8
mov edi, dword [ebp - 0x6fc]
lea esi, [ebp - 0x5c]
cmp dword [ebp - 0x48], 7
mov edx, dword [ebp - 0x4c]
cmova esi, dword [ebp - 0x5c]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b6e7
cmp dword [edi + 0x14], 7
lea eax, [edx + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x684b6c2
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b6fe
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
push 0xe
mov edx, str.DD6
lea ecx, [ebp - 0x6e4]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 0x16
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b721
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b777
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x684b752
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b78e
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x684b7d2
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b7c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc1a
push ecx
push edx
call fcn.06864a07
add esp, 8
mov ecx, dword [ebp - 0x814]
lea esi, [ebp - 0x6e]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x684b7e0
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.0683d1e0
mov dword [ebp - 0x700], 0x7fc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6e4]
cmp dword [ebp - 0x6d0], 7
mov esi, dword [edi + 0x10]
cmova ecx, dword [ebp - 0x6e4]
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x6d4]
sub eax, esi
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x6f8], esi
cmp edx, eax
ja 0x684b891
cmp dword [edi + 0x14], 7
lea eax, [edx + esi]
mov dword [ebp - 0x6fc], eax
mov esi, edi
mov dword [edi + 0x10], eax
jbe 0x684b867
mov esi, dword [edi]
mov eax, dword [ebp - 0x6f8]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x69c]
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x684b8a8
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
push 0xe
mov edx, 0x689ce54
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov byte [ebp - 4], 0x18
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b8c8
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b91e
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x684b8f9
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b935
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684b973
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684b969
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc1f
push ecx
push edx
call fcn.06864a07
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.0683d310
mov byte [ebp - 4], 0x19
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x684b989
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x684b9df
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x684b9ba
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06866110
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684b9f6
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0683a490
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684ba34
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684ba2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc24
push ecx
push edx
call fcn.06864a07
add esp, 8
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6d0]
cmp eax, 7
jbe 0x684ba78
mov edx, dword [ebp - 0x6e4]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684ba6e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push edx
call fcn.06864a07
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x48]
cmp eax, 7
jbe 0x684bab6
mov edx, dword [ebp - 0x5c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684baac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push edx
call fcn.06864a07
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6b8]
cmp ecx, 7
jbe 0x684bafa
mov edx, dword [ebp - 0x6cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684baf0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc29
push ecx
push edx
call fcn.06864a07
add esp, 8
push 2
mov edx, 0x689ce48
lea ecx, [ebp - 0x30]
call fcn.06832080
add esp, 4
mov dword [ebp - 4], 0x1a
mov edx, eax
cmp dword [eax + 0x14], 7
jbe 0x684bb1d
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x684bb77
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov dword [ebp - 0x6f4], edi
jbe 0x684bb4c
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebp - 0x6f4]
push edx
lea eax, [eax + esi*2]
push eax
call fcn.06866110
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x684bb8e
push ecx
push edx
mov byte [ebp - 0x6f8], 0
push dword [ebp - 0x6f8]
push ecx
mov ecx, edi
call fcn.0683a490
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x684bbc8
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x684bbbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x684bc2e
push ecx
push edx
call fcn.06864a07
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.068649f9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
call fcn.0686985a
int3