Function at 0x41b950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2606
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x50f52c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.004194a0
mov byte [ebp - 4], 5
xor esi, esi
mov ebx, 8
cmp dword [ebp + 0x2b4], esi
je 0x41be48
cmp dword [0x50d54c], esi
je 0x41be48
mov eax, dword [ebp + 8]
push str.Action
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x6c], eax
call fcn.004019e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea edx, [ebp + 0xc]
push edx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41b9f0
mov eax, dword [ebp - 0x28]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov word [ebp - 0x28], cx
mov edi, 7
push str.Timestamp
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
call fcn.004019e0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x68]
call fcn.00419500
push eax
call fcn.00417a10
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41ba39
mov eax, dword [ebp - 0x28]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov word [ebp - 0x28], cx
push str.OSVersion
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
call fcn.004019e0
mov byte [ebp - 4], bl
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp + 0x3f0]
call fcn.0042e880
mov dword [ebp + 8], eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00419500
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push esi
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], bl
cmp dword [ebp - 0x30], ebx
jb 0x41ba99
mov edx, dword [ebp - 0x44]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41baba
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
push str.OSArchitecture
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], dx
call fcn.004019e0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea ecx, [ebp + 0x55c]
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bb09
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.OSSPLevel
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.004019e0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp + 0x408]
call fcn.0042e880
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x68]
call fcn.00419500
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push esi
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x30], ebx
jb 0x41bb6b
mov edx, dword [ebp - 0x44]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bb8c
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
push str.Language
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], dx
call fcn.004019e0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea ecx, [ebp + 0x2d4]
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bbdb
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.Version
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.004019e0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea edx, [ebp + 0xe8]
push edx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bc2a
mov eax, dword [ebp - 0x28]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov word [ebp - 0x28], cx
push 0x4e3784
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
call fcn.004019e0
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea ecx, [ebp + 0x294]
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bc79
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.Error
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.004019e0
mov byte [ebp - 4], 0x10
lea ecx, [ebp + 0x28]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00419c10
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00419500
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push esi
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x30], ebx
jb 0x41bcd9
mov edx, dword [ebp - 0x44]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bcfa
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
push str.Param
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], dx
call fcn.004019e0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00419500
push 0xffffffffffffffff
push esi
lea ecx, [ebp + 0x578]
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bd49
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.SystemID
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.004019e0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00419500
push eax
call fcn.00428800
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bd8d
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push 0x4e374c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.004019e0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00419500
push eax
call fcn.00425e30
test eax, eax
sete byte [ebp + 0xb]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], ebx
jb 0x41bdd7
mov edx, dword [ebp - 0x28]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
cmp byte [ebp + 0xb], al
je 0x41be11
push 0x4e374c
lea ecx, [ebp - 0x48]
call fcn.004019e0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00418950
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x48]
call fcn.00490320
lea edx, [ebp - 0x6c]
push edx
mov ecx, 0x510914
call fcn.0041a740
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x41b870
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp + 0x594], esi
je 0x41be4d
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x41be4d
mov edi, 7
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
mov dword [ebp + 8], ecx
mov byte [ebp - 4], 3
call fcn.0040eae0
mov byte [ebp - 4], 2
cmp dword [ebp + 0x24], ebx
jb 0x41be75
mov edx, dword [ebp + 0x10]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x20], esi
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x2c]
call fcn.00412920
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3f0]
call fcn.004041d0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x590], ebx
jb 0x41beba
mov ecx, dword [ebp + 0x57c]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp + 0x590], edi
mov dword [ebp + 0x58c], esi
mov word [ebp + 0x57c], dx
lea eax, [edx + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x590