Function at 0x6cea800
Capabilities:
Get domain information
Get hostname
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d29ba1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x958
mov eax, dword [0x6d3c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x82c], edi
mov dword [ebp - 4], 0
mov edx, str.DDd
mov dword [ebp - 0x838], edi
push 7
mov dword [ebp - 0x834], 0
call fcn.06cd2080
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x834], 1
call fcn.06cdd740
mov dword [ebp - 4], 1
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6cea8a3
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6cea8f9
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x824], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x828], edi
jbe 0x6cea8d4
mov eax, dword [edi]
mov dword [ebp - 0x828], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x828]
add esp, 0xc
mov ecx, dword [ebp - 0x824]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6cea910
push edx
push esi
mov byte [ebp - 0x824], 0
mov ecx, edi
push dword [ebp - 0x824]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6cea94e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6cea944
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc1e
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 0x1d
mov edx, 0x6d3ce14
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov dword [ebp - 4], 2
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6cea971
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6cea9c7
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x824], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x828], edi
jbe 0x6cea9a2
mov eax, dword [edi]
mov dword [ebp - 0x828], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x828]
add esp, 0xc
mov ecx, dword [ebp - 0x824]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6cea9de
push edx
push esi
mov byte [ebp - 0x824], 0
mov ecx, edi
push dword [ebp - 0x824]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceaa1c
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceaa12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc23
push ecx
push edx
call fcn.06d047d7
add esp, 8
cmp dword [ebx + 8], 0
je 0x6cebb30
push 0xc
mov edx, str.DDv
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov dword [ebp - 4], 3
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceaa49
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceaa9f
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x824], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x828], edi
jbe 0x6ceaa7a
mov eax, dword [edi]
mov dword [ebp - 0x828], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x828]
add esp, 0xc
mov ecx, dword [ebp - 0x824]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceaab6
push edx
push esi
mov byte [ebp - 0x824], 0
mov ecx, edi
push dword [ebp - 0x824]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceaaf4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceaaea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc28
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x828], 0
push 0x6d34928
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6bc], 0
movups xmmword [ebp - 0x6cc], xmm0
mov dword [ebp - 0x6b8], 0
call fcn.06cd9730
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 4
push eax
push 1
push 0
mov dword [ebp - 0x834], 3
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
test eax, eax
jne 0x6ceac25
mov eax, dword [ebp - 0x828]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x6ceabbb
mov eax, dword [ebp - 0x6b8]
cmp eax, 9
jb 0x6ceaba5
cmp eax, 7
mov dword [ebp - 0x6bc], 9
push 0x12
lea esi, [ebp - 0x6cc]
cmova esi, dword [ebp - 0x6cc]
push str.WORKGROUP
push esi
call fcn.06d05ee0
add esp, 0xc
xor eax, eax
mov word [esi + 0x12], ax
jmp 0x6ceac25
push str.WORKGROUP
mov byte [ebp - 0x824], 0
push dword [ebp - 0x824]
push 9
jmp 0x6ceac1a
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6ceabc0
mov eax, dword [ebp - 0x6b8]
sub ecx, esi
sar ecx, 1
cmp ecx, eax
ja 0x6ceac0b
lea esi, [ecx + ecx]
mov dword [ebp - 0x6bc], ecx
cmp eax, 7
lea edi, [ebp - 0x6cc]
push esi
cmova edi, dword [ebp - 0x6cc]
push edx
push edi
call fcn.06d05ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x830]
jmp 0x6ceac25
push edx
mov byte [ebp - 0x824], 0
push dword [ebp - 0x824]
push ecx
lea ecx, [ebp - 0x6cc]
call fcn.06cd9920
mov dword [ebp - 0x834], 0
mov dword [ebp - 4], 5
lea edx, [ebp - 0x6cc]
cmp dword [ebp - 0x6b8], 7
mov ecx, dword [edi + 0x10]
cmova edx, dword [ebp - 0x6cc]
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x6bc]
sub eax, ecx
mov dword [ebp - 0x69c], ecx
cmp esi, eax
ja 0x6ceaca5
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceac7e
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x69c]
add esp, 0xc
mov ecx, dword [ebp - 0x824]
add eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x6ceacbc
push esi
push edx
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push esi
call fcn.06cda4b0
push 0xf
mov edx, 0x6d3ce8c
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 6
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceacdc
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6cead32
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6cead0d
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6cead49
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6cead87
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6cead7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc2d
push ecx
push edx
call fcn.06d047d7
add esp, 8
lea eax, [ebp - 0x6d0]
mov dword [ebp - 0x6d0], 0x100
push eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x6ceaf06
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6ceadd4
sub ecx, edx
lea eax, [ebp - 0x498]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06cd9730
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x30]
call fcn.06cd79f0
mov byte [ebp - 4], 8
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceae17
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceae6d
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceae48
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceae84
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceaec2
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceaeb8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc32
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x6ceaf06
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceaefc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 0x13
mov edx, 0x6d3ce00
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 9
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceaf26
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceaf7c
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceaf57
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceaf93
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceafd1
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceafc7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc37
push ecx
push edx
call fcn.06d047d7
add esp, 8
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0x6d4], 0x100
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x6ceb152
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6ceb020
sub ecx, edx
lea eax, [ebp - 0x698]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06cd9730
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.06cd79f0
mov byte [ebp - 4], 0xb
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb063
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb0b9
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceb094
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb0d0
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb10e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb104
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc3c
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x6ceb152
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb148
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 0xf
mov edx, 0x6d3ce7c
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 0xc
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb172
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb1c8
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceb1a3
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb1df
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb21d
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb213
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc41
push ecx
push edx
call fcn.06d047d7
add esp, 8
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x69c], 0x100
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x824]
xor esi, esi
push eax
push 1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x824], esi
push eax
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
mov eax, dword [ebp - 0x824]
jne 0x6ceb267
mov esi, dword [eax + 0xc]
test eax, eax
je 0x6ceb272
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x16]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x6ceb275
push ecx
lea eax, [ebp - 0x16]
push eax
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.06cdd210
mov dword [ebp - 0x834], 0x30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6b4]
cmp dword [ebp - 0x6a0], 7
mov edx, dword [edi + 0x10]
mov esi, dword [ebp - 0x6b4]
cmova ecx, esi
mov eax, dword [edi + 0x14]
sub eax, edx
mov dword [ebp - 0x69c], edx
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x82c], ecx
cmp edx, eax
ja 0x6ceb33a
cmp dword [edi + 0x14], 7
mov ecx, dword [ebp - 0x69c]
mov dword [ebp - 0x824], edi
lea eax, [edx + ecx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x6ceb310
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x82c]
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb357
push edx
push ecx
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
mov esi, dword [ebp - 0x6b4]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6a0]
cmp eax, 7
jbe 0x6ceb395
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x6ceb38b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push esi
call fcn.06d047d7
add esp, 8
push 8
mov edx, 0x6d3ce60
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 0xe
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb3b5
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb40b
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x824], edi
jbe 0x6ceb3e6
mov eax, dword [edi]
mov dword [ebp - 0x824], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x824]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb422
push edx
push esi
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb460
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb456
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc46
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 0x6d34f18
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6ceb4b6
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x6ceb4b6
push 0x110
lea eax, [ebp - 0x81c]
push 0
push eax
call fcn.06d06470
add esp, 0xc
mov dword [ebp - 0x820], 0x114
lea eax, [ebp - 0x820]
push eax
call esi
test eax, eax
jne 0x6ceb4b6
lea esi, [ebp - 0x820]
jmp 0x6ceb4d2
push 0x114
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.06d06470
add esp, 0xc
lea esi, [ebp - 0x1b0]
mov ecx, 0x45
lea edi, [ebp - 0x968]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x960]
lea esi, [ebp - 0x6e]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x6ceb4f0
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.06cdd210
mov dword [ebp - 0x834], 0x3c
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x42]
mov ecx, dword [ebp - 0x964]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x6ceb535
push ecx
lea eax, [ebp - 0x42]
push eax
push esi
lea ecx, [ebp - 0x6b4]
call fcn.06cdd210
mov dword [ebp - 0x834], 0xfc
push 0x6d34f14
lea edx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x850]
call fcn.06cd9410
add esp, 4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x11
push ecx
push eax
push dword [ebp - 0x838]
lea ecx, [ebp - 0x704]
call fcn.06cd9f60
mov dword [ebp - 0x834], 0x1fc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x83c]
cmp ecx, 7
jbe 0x6ceb5f5
mov edx, dword [ebp - 0x850]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb5eb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc4b
push ecx
push edx
call fcn.06d047d7
add esp, 8
xor eax, eax
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 7
mov word [ebp - 0x850], ax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x6ceb656
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb64c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc4b
push ecx
push edx
call fcn.06d047d7
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 7
mov word [ebp - 0x6b4], ax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb6b1
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb6a7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc4b
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov edi, dword [ebp - 0x830]
lea esi, [ebp - 0x704]
cmp dword [ebp - 0x6f0], 7
mov edx, dword [ebp - 0x6f4]
cmova esi, dword [ebp - 0x704]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb724
cmp dword [edi + 0x14], 7
lea eax, [edx + ecx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x830], edi
jbe 0x6ceb6ff
mov eax, dword [edi]
mov dword [ebp - 0x830], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x830]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb73b
push edx
push esi
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
push 0xe
mov edx, str.DD6
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 0x16
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb75b
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb7b1
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x830], edi
jbe 0x6ceb78c
mov eax, dword [edi]
mov dword [ebp - 0x830], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x830]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb7c8
push edx
push esi
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb806
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb7fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc50
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov ecx, dword [ebp - 0x95c]
lea esi, [ebp - 0x42]
nop
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x6ceb810
push ecx
lea eax, [ebp - 0x42]
push eax
push esi
lea ecx, [ebp - 0x6ec]
call fcn.06cdd210
mov dword [ebp - 0x834], 0x7fc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6ec]
cmp dword [ebp - 0x6d8], 7
mov esi, dword [edi + 0x10]
cmova ecx, dword [ebp - 0x6ec]
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x6dc]
sub eax, esi
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x82c], esi
cmp edx, eax
ja 0x6ceb8c1
cmp dword [edi + 0x14], 7
lea eax, [edx + esi]
mov dword [ebp - 0x830], eax
mov esi, edi
mov dword [edi + 0x10], eax
jbe 0x6ceb897
mov esi, dword [edi]
mov eax, dword [ebp - 0x82c]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x69c]
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x830]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x6ceb8d8
push edx
push ecx
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
push 0xe
mov edx, 0x6d3ce50
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov byte [ebp - 4], 0x18
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb8f8
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceb94e
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x830], edi
jbe 0x6ceb929
mov eax, dword [edi]
mov dword [ebp - 0x830], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x830]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceb965
push edx
push esi
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceb9a3
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceb999
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc55
push ecx
push edx
call fcn.06d047d7
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.06cdd340
mov byte [ebp - 4], 0x19
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x6ceb9b9
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x6ceba0f
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x830], edi
jbe 0x6ceb9ea
mov eax, dword [edi]
mov dword [ebp - 0x830], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06d05ee0
mov eax, dword [ebp - 0x830]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6ceba26
push edx
push esi
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
push edx
call fcn.06cda4b0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6ceba64
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceba5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5a
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6d8]
cmp eax, 7
jbe 0x6cebaa8
mov edx, dword [ebp - 0x6ec]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6ceba9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6f0]
cmp eax, 7
jbe 0x6cebaec
mov edx, dword [ebp - 0x704]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6cebae2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6b8]
cmp ecx, 7
jbe 0x6cebb30
mov edx, dword [ebp - 0x6cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6cebb26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc5f
push ecx
push edx
call fcn.06d047d7
add esp, 8
push 2
mov edx, 0x6d3ce44
lea ecx, [ebp - 0x30]
call fcn.06cd2080
add esp, 4
mov dword [ebp - 4], 0x1a
mov edx, eax
cmp dword [eax + 0x14], 7
jbe 0x6cebb53
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x6cebbad
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [ebp - 0x82c], eax
mov dword [edi + 0x10], eax
mov dword [ebp - 0x828], edi
jbe 0x6cebb82
mov eax, dword [edi]
mov dword [ebp - 0x828], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebp - 0x828]
push edx
lea eax, [eax + esi*2]
push eax
call fcn.06d05ee0
mov eax, dword [ebp - 0x828]
add esp, 0xc
mov ecx, dword [ebp - 0x82c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x6cebbc4
push ecx
push edx
mov byte [ebp - 0x82c], 0
push dword [ebp - 0x82c]
push ecx
mov ecx, edi
call fcn.06cda4b0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x6cebbfe
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6cebbf4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6cebc64
push ecx
push edx
call fcn.06d047d7
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.06d047c9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
call fcn.06d0962a
int3