Function at 0x1001d3c0
Capabilities:
Get domain information
Get hostname
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e651
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x810
mov eax, dword [0x10070080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x6fc], edi
mov dword [ebp - 0x6f8], edi
mov dword [ebp - 4], 0
mov edx, str.DDd
mov dword [ebp - 0x704], edi
push 7
mov dword [ebp - 0x700], 0
call fcn.1001c4d0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x700], 1
call fcn.10010380
mov dword [ebp - 4], 1
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001d463
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001d4b9
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x1001d494
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001d4d0
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001d50e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001d504
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7e4
push ecx
push edx
call fcn.100385a2
add esp, 8
push 0x1f
mov edx, 0x10070e90
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov dword [ebp - 4], 2
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001d531
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001d587
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x1001d562
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001d59e
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001d5dc
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001d5d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7e9
push ecx
push edx
call fcn.100385a2
add esp, 8
cmp dword [ebx + 8], 0
je 0x1001e6fa
push 0xc
mov edx, str.DDv
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov dword [ebp - 4], 3
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001d609
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001d65f
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x1001d63a
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001d676
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001d6b4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001d6aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7ee
push ecx
push edx
call fcn.100385a2
add esp, 8
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x6f4], 0
push 0x10068948
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6bc], 0
movups xmmword [ebp - 0x6cc], xmm0
mov dword [ebp - 0x6b8], 0
call fcn.1000bb10
lea eax, [ebp - 0x6f4]
mov dword [ebp - 4], 4
push eax
push 1
push 0
mov dword [ebp - 0x700], 3
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
test eax, eax
jne 0x1001d800
mov eax, dword [ebp - 0x6f4]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x1001d77b
mov eax, dword [ebp - 0x6b8]
cmp eax, 9
jb 0x1001d765
cmp eax, 7
mov dword [ebp - 0x6bc], 9
push 0x12
lea esi, [ebp - 0x6cc]
cmova esi, dword [ebp - 0x6cc]
push str.WORKGROUP
push esi
call fcn.10039c30
add esp, 0xc
xor eax, eax
mov word [esi + 0x12], ax
jmp 0x1001d7e5
push str.WORKGROUP
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push 9
jmp 0x1001d7da
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d780
mov eax, dword [ebp - 0x6b8]
sub ecx, esi
sar ecx, 1
cmp ecx, eax
ja 0x1001d7cb
lea esi, [ecx + ecx]
mov dword [ebp - 0x6bc], ecx
cmp eax, 7
lea edi, [ebp - 0x6cc]
push esi
cmova edi, dword [ebp - 0x6cc]
push edx
push edi
call fcn.10039c30
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x6fc]
jmp 0x1001d7e5
push edx
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x6cc]
call fcn.1000bd70
mov eax, dword [ebp - 0x6f4]
test eax, eax
je 0x1001d800
push eax
call dword [sym.imp.NETAPI32.dll_DsRoleFreeMemory]
mov dword [ebp - 0x6f4], 0
mov dword [ebp - 0x700], 0
mov dword [ebp - 4], 5
lea edx, [ebp - 0x6cc]
cmp dword [ebp - 0x6b8], 7
mov ecx, dword [edi + 0x10]
cmova edx, dword [ebp - 0x6cc]
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x6bc]
sub eax, ecx
mov dword [ebp - 0x69c], ecx
cmp esi, eax
ja 0x1001d880
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001d859
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x69c]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
add eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x1001d897
push esi
push edx
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push esi
call fcn.1000d3d0
push 0xf
mov edx, 0x10070f08
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 6
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001d8b7
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001d90d
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001d8e8
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001d924
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001d962
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001d958
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7f3
push ecx
push edx
call fcn.100385a2
add esp, 8
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], 0x100
push eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1001dae2
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d9b0
sub ecx, edx
lea eax, [ebp - 0x498]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.1000bb10
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x30]
call fcn.100094b0
mov byte [ebp - 4], 8
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001d9f3
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001da49
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001da24
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001da60
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001da9e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001da94
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7f8
push ecx
push edx
call fcn.100385a2
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x1001dae2
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001dad8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push edx
call fcn.100385a2
add esp, 8
push 0x13
mov edx, 0x10070e7c
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 9
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001db02
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001db58
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001db33
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001db6f
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001dbad
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001dba3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e7fd
push ecx
push edx
call fcn.100385a2
add esp, 8
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], 0x100
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1001dd32
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001dc00
sub ecx, edx
lea eax, [ebp - 0x698]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.1000bb10
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.100094b0
mov byte [ebp - 4], 0xb
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001dc43
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001dc99
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001dc74
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001dcb0
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001dcee
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001dce4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e802
push ecx
push edx
call fcn.100385a2
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x1001dd32
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001dd28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push edx
call fcn.100385a2
add esp, 8
push 0xf
mov edx, 0x10070ef8
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 0xc
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001dd52
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001dda8
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001dd83
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001ddbf
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001ddfd
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ddf3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e807
push ecx
push edx
call fcn.100385a2
add esp, 8
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x69c], 0x100
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6f0]
xor esi, esi
push eax
push 1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x6f0], esi
push eax
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
mov eax, dword [ebp - 0x6f0]
jne 0x1001de47
mov esi, dword [eax + 0xc]
test eax, eax
je 0x1001de52
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x16]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x1001de55
push ecx
lea eax, [ebp - 0x16]
push eax
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.1000fe50
mov dword [ebp - 0x700], 0x30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6b4]
cmp dword [ebp - 0x6a0], 7
mov edx, dword [edi + 0x10]
mov esi, dword [ebp - 0x6b4]
cmova ecx, esi
mov eax, dword [edi + 0x14]
sub eax, edx
mov dword [ebp - 0x69c], edx
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6f8], ecx
cmp edx, eax
ja 0x1001df1a
cmp dword [edi + 0x14], 7
mov ecx, dword [ebp - 0x69c]
mov dword [ebp - 0x6f0], edi
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x1001def0
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x6f8]
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001df37
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
mov esi, dword [ebp - 0x6b4]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6a0]
cmp eax, 7
jbe 0x1001df75
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x1001df6b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push esi
call fcn.100385a2
add esp, 8
push 8
mov edx, 0x10070edc
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 0xe
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001df95
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001dfeb
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x1001dfc6
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e002
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001e040
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e036
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e80c
push ecx
push edx
call fcn.100385a2
add esp, 8
push 0x10068fa0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001e08e
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1001e08e
push 0x110
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.1003a1b0
add esp, 0xc
mov dword [ebp - 0x1b0], 0x114
lea eax, [ebp - 0x1b0]
push eax
call esi
test eax, eax
je 0x1001e0a4
push 0x114
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.1003a1b0
add esp, 0xc
mov ecx, 0x45
lea edi, [ebp - 0x820]
lea esi, [ebp - 0x1b0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x818]
lea esi, [ebp - 0x42]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001e0c0
push ecx
lea eax, [ebp - 0x42]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.1000fe50
mov dword [ebp - 0x700], 0x3c
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x6e]
mov ecx, dword [ebp - 0x81c]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001e110
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6b4]
call fcn.1000fe50
mov dword [ebp - 0x700], 0xfc
push 0x10068f9c
lea edx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x30]
call fcn.1000b7f0
add esp, 4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x11
push ecx
push eax
push dword [ebp - 0x704]
lea ecx, [ebp - 0x5c]
call fcn.1000c6b0
mov dword [ebp - 0x700], 0x1fc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001e1c7
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e1bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e811
push ecx
push edx
call fcn.100385a2
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x1001e21f
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e215
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e811
push ecx
push edx
call fcn.100385a2
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 7
mov word [ebp - 0x6b4], ax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x1001e280
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e276
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e811
push ecx
push edx
call fcn.100385a2
add esp, 8
mov edi, dword [ebp - 0x6fc]
lea esi, [ebp - 0x5c]
cmp dword [ebp - 0x48], 7
mov edx, dword [ebp - 0x4c]
cmova esi, dword [ebp - 0x5c]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001e2e7
cmp dword [edi + 0x14], 7
lea eax, [edx + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x1001e2c2
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e2fe
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
push 0xe
mov edx, str.DD6
lea ecx, [ebp - 0x6e4]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 0x16
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001e321
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001e377
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x1001e352
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e38e
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x1001e3d2
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e3c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e816
push ecx
push edx
call fcn.100385a2
add esp, 8
mov ecx, dword [ebp - 0x814]
lea esi, [ebp - 0x6e]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001e3e0
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.1000fe50
mov dword [ebp - 0x700], 0x7fc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6e4]
cmp dword [ebp - 0x6d0], 7
mov esi, dword [edi + 0x10]
cmova ecx, dword [ebp - 0x6e4]
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x6d4]
sub eax, esi
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x6f8], esi
cmp edx, eax
ja 0x1001e491
cmp dword [edi + 0x14], 7
lea eax, [edx + esi]
mov dword [ebp - 0x6fc], eax
mov esi, edi
mov dword [edi + 0x10], eax
jbe 0x1001e467
mov esi, dword [edi]
mov eax, dword [ebp - 0x6f8]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x69c]
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1001e4a8
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
push 0xe
mov edx, 0x10070ecc
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov byte [ebp - 4], 0x18
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001e4c8
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001e51e
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x1001e4f9
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e535
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001e573
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e569
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e81b
push ecx
push edx
call fcn.100385a2
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.1000ff80
mov byte [ebp - 4], 0x19
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x1001e589
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001e5df
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x1001e5ba
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.10039c30
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e5f6
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.1000d3d0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001e634
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e62a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e820
push ecx
push edx
call fcn.100385a2
add esp, 8
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6d0]
cmp eax, 7
jbe 0x1001e678
mov edx, dword [ebp - 0x6e4]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e66e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push edx
call fcn.100385a2
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x48]
cmp eax, 7
jbe 0x1001e6b6
mov edx, dword [ebp - 0x5c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e6ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push edx
call fcn.100385a2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6b8]
cmp ecx, 7
jbe 0x1001e6fa
mov edx, dword [ebp - 0x6cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e6f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e825
push ecx
push edx
call fcn.100385a2
add esp, 8
push 2
mov edx, 0x10070ec0
lea ecx, [ebp - 0x30]
call fcn.1001c4d0
add esp, 4
mov dword [ebp - 4], 0x1a
mov edx, eax
cmp dword [eax + 0x14], 7
jbe 0x1001e71d
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x1001e777
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov dword [ebp - 0x6f4], edi
jbe 0x1001e74c
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebp - 0x6f4]
push edx
lea eax, [eax + esi*2]
push eax
call fcn.10039c30
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001e78e
push ecx
push edx
mov byte [ebp - 0x6f8], 0
push dword [ebp - 0x6f8]
push ecx
mov ecx, edi
call fcn.1000d3d0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x1001e7c4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e7ba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e82a
push ecx
push edx
call fcn.100385a2
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10038594
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
call fcn.1003d38a
int3