Function at 0x4e1ed0
Capabilities:
Check internet connectivity via wininet
Get disk size
Get memory capacity
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4cdb
mov eax, dword fs:[0]
push eax
sub esp, 0x980
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x918], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x91c], edi
mov ebx, dword [edi + 4]
mov dword [ebp - 0x924], ebx
test ebx, ebx
jne 0x4e1f23
xor eax, eax
jmp 0x4e543e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push ecx
push 0
push 1
mov edx, str.Basic_computer_info
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 2
mov edx, str.Fixed__removable_and_optical_drives
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 3
mov edx, str.Windows_and_office_product_keys
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 4
mov edx, str.Local_user_profiles
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 5
mov edx, str.Video_adapters
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 6
mov edx, str.Monitor_displays
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 7
mov edx, str.Audio_adapters
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 8
mov edx, str.Network_adapters_and_IP_addresses
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 9
mov edx, str.Internet_connection_and_external_IP_address
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xa
mov edx, str.Processors
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xb
mov edx, str.Memory_devices_and_system_slots
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xc
mov edx, str.Battery_details_and_status
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xd
mov edx, str.Virtual_memory_and_page_files
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xe
mov edx, str.Security_software_and_settings
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0xf
mov edx, str.Automatic_updates_settings
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0x10
mov edx, str.Windows_updates_installed
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0x11
mov edx, str.Desktop_programs_installed
mov ecx, ebx
call fcn.005ca9c0
push ecx
push 0
push 0x12
mov edx, str.Windows_Store_apps_installed
mov ecx, ebx
call fcn.005ca9c0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x34], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
lea ecx, [ebp - 0xd0]
movq qword [ebp - 0xd0], xmm0
call fcn.005dc5e0
push 0
push 5
lea ecx, [esi + 0x14f0]
mov byte [ebp - 4], 2
call fcn.005b66e0
cmp dword [edi + 4], 0
je 0x4e21a0
mov ecx, 3
call fcn.0059e240
mov esi, eax
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 3
cmp dword [esi], 0
mov dword [ebp - 0x8fc], 0
jbe 0x4e215c
xor edx, edx
mov dword [ebp - 0x6c], edx
mov ecx, dword [esi + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add ecx, edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.005dc190
push eax
push str.HKU_
lea ecx, [ebp - 0x20]
call fcn.005dc200
push edi
push 0x11
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov ecx, dword [ebp - 0x918]
push eax
call fcn.004e1770
cmp dword [edi + 4], 0
je 0x4e21bc
mov eax, dword [ebp - 0x8fc]
mov edx, dword [ebp - 0x6c]
inc eax
add edx, 0xc
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 0x6c], edx
cmp eax, dword [esi]
jb 0x4e20f6
mov ecx, dword [ebp - 0x918]
push edi
push 0x11
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.004e1770
cmp dword [edi + 4], 0
je 0x4e21bc
mov ecx, dword [ebp - 0x918]
push edi
push 0x11
push str.HKLMSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
call fcn.004e1770
cmp dword [edi + 4], 0
je 0x4e21bc
push ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00402a20
mov esi, dword [ebp - 0x918]
push 0
push 0xa
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
cmp dword [edi + 4], 0
jne 0x4e21cb
xor esi, esi
jmp 0x4e5421
push ecx
mov ecx, esi
call fcn.00402a20
xor esi, esi
jmp 0x4e5421
mov eax, dword [edi]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edac0]
jbe 0x4e21f2
push 0xffffffffffffffff
push 0x12
push 0
push dword [edi + 0x10]
mov ecx, esi
push dword [eax + 0x14e4]
call fcn.004c51f0
push 0
push 0xf
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
push 0
push 1
push str.Operating_system
xor edx, edx
mov ecx, ebx
call fcn.005caa40
mov dword [ebp - 0x8fc], eax
call fcn.0058c0c0
push 0x38
lea eax, [ebp - 0xc4]
push 0
push eax
call fcn.00420090
add esp, 8
lea ecx, [ebp - 0xc4]
push str.ROOTCIMV2
call fcn.005889d0
push str.SELECT__FROM_Win32_OperatingSystem
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 4
call fcn.005887d0
test eax, eax
je 0x4e2417
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e2417
push 1
push str.Caption
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc510
push 0x11
push 1
push 1
push 0
push str.Microsoft_Windows
lea ecx, [ebp - 0x20]
call fcn.005daa70
test eax, eax
je 0x4e22ae
push 0xa
lea ecx, [ebp - 0x20]
call fcn.005dad50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.OSArchitecture
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push 0x62438c
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BuildNumber
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str._Build
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push str.CSDVersion
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc510
lea ecx, [ebp - 0x34]
call fcn.005dc3a0
test eax, eax
je 0x4e2361
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push 0x62438c
jmp 0x4e2390
lea eax, [ebp - 0x34]
push eax
call fcn.00570c90
test eax, eax
je 0x4e2398
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str._Version
lea ecx, [ebp - 0x20]
call fcn.005da780
push ecx
push str.InstallDate
lea ecx, [ebp - 0xc4]
call fcn.005882c0
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.____Installed_in
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x8fc]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
push 0
push str.SerialNumber
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0xd0]
call fcn.005dc510
jmp 0x4e25fb
push 0
push 0x20019
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0x8f8], 0
call fcn.005d6a80
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 5
push eax
push 0x62dfc8
lea ecx, [ebp - 0x8f8]
call fcn.005d6740
cmp byte [esi + 0x11], 0
mov ecx, str._32_bit
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, str._64_bit
cmove eax, ecx
lea ecx, [ebp - 0x20]
push 0
push eax
call fcn.005da780
lea eax, [ebp - 0x34]
push eax
push str.CurrentBuildNumber
lea ecx, [ebp - 0x8f8]
call fcn.005d6740
test al, al
jne 0x4e24b0
lea eax, [ebp - 0x34]
push eax
push str.CurrentBuild
lea ecx, [ebp - 0x8f8]
call fcn.005d6740
test al, al
je 0x4e2518
push 0xb
push 1
push 1
push 1
push str.Windows_10
lea ecx, [ebp - 0x20]
call fcn.005daa70
test eax, eax
je 0x4e24ee
lea ecx, [ebp - 0x34]
call fcn.005dafe0
cmp eax, 0x55f0
jb 0x4e24ee
push 0
push 1
push str.Windows_11
push str.Windows_10
lea ecx, [ebp - 0x20]
call fcn.005da270
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str._Build
lea ecx, [ebp - 0x20]
call fcn.005da780
lea eax, [ebp - 0x34]
push eax
call fcn.00570c90
test eax, eax
je 0x4e254f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str._Version
lea ecx, [ebp - 0x20]
call fcn.005da780
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push eax
push str.InstallTime
lea ecx, [ebp - 0x8f8]
movlpd qword [ebp - 0x64], xmm0
call fcn.005d6620
test al, al
je 0x4e25bd
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x34]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x88], eax
call fcn.005d0520
test al, al
je 0x4e25bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.____Installed_in
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x8fc]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
lea eax, [ebp - 0xd0]
push eax
push str.ProductId
lea ecx, [ebp - 0x8f8]
call fcn.005d6740
lea ecx, [ebp - 0x8f8]
mov byte [ebp - 4], 4
call fcn.005d69e0
cmp dword [edi + 4], 0
jne 0x4e2608
xor esi, esi
jmp 0x4e5416
push 0
push 0x14
lea ecx, [esi + 0x14f0]
call fcn.005b66e0
lea ecx, [ebp - 0x144]
call fcn.00402870
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 6
call fcn.005894d0
push 0
push 1
push str.Computer
mov edx, 1
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x138]
mov esi, eax
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x914], 0
push eax
lea eax, [ebp - 0x914]
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
mov ecx, dword [ebp - 0x918]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ecx + 0x198]
call fcn.005dc190
push eax
push str.Name:
lea ecx, [ebp - 0x20]
call fcn.005dc200
mov eax, dword [ebp - 0xd4]
cmp eax, 2
jne 0x4e26de
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x914]
push str.____WorkGroup:
jmp 0x4e2702
cmp eax, 3
jne 0x4e270a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x914]
push str.____Domain:
lea ecx, [ebp - 0x20]
call fcn.005da780
mov eax, dword [ebp - 0x914]
test eax, eax
je 0x4e271b
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
push 0
push 1
push str.PC_Info
mov edx, 2
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 1
push str.Motherboard
mov edx, 3
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x108]
mov esi, eax
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 1
push str.BIOS
mov edx, 4
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.005dc190
push eax
push 0x62f928
lea ecx, [ebp - 0x12c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 1
push str.Serial_and_SNID_Service_tag
mov edx, 5
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
mov esi, eax
mov edi, 6
call fcn.005dc190
push eax
push str.Serial:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0xfc]
call fcn.005dc3a0
test eax, eax
je 0x4e285b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xfc]
call fcn.005dc190
push eax
push 0x62f928
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push str.Select_Name_from_Win32_PnPEntity
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e28f3
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e28f3
push 0
push str.Name
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc510
push 0
push 1
push 1
push 0
push str.Chipset
lea ecx, [ebp - 0x20]
call fcn.005daa70
test eax, eax
je 0x4e2883
push 0
push 1
push str.Chipset_driver
mov edx, edi
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
mov edi, 7
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push str.Select_PCSystemType__SystemType_from_Win32_ComputerSystem
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e29f6
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e29f6
push str.PCSystemType
lea ecx, [ebp - 0xc4]
call fcn.00588350
lea ecx, [ebp - 0x20]
cmp eax, 1
jne 0x4e2942
push 0x689928
call fcn.005dc510
jmp 0x4e299c
cmp eax, 2
jne 0x4e2953
push str.Mobile
call fcn.005dc510
jmp 0x4e299c
cmp eax, 4
jne 0x4e2964
push str.Enterprise_Server
call fcn.005dc510
jmp 0x4e299c
cmp eax, 5
jne 0x4e2975
push str.Small_Office_and_Home_Office__SOHO__Server
call fcn.005dc510
jmp 0x4e299c
cmp eax, 6
jne 0x4e2986
push str.Appliance_PC
call fcn.005dc510
jmp 0x4e299c
cmp eax, 7
jne 0x4e2997
push str.Performance_Server
call fcn.005dc510
jmp 0x4e299c
call fcn.005dc400
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemType
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 1
push str.Computer_type
mov edx, edi
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
inc edi
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 0x20019
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0
call fcn.005d6a80
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 7
push eax
push str.RegisteredOwner
lea ecx, [ebp - 0x6c]
call fcn.005d6740
lea eax, [ebp - 0x34]
push eax
push str.RegisteredOrganization
lea ecx, [ebp - 0x6c]
call fcn.005d6740
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.____Organization:
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push str.Owner:
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 1
push str.PC_owner_info
mov edx, edi
mov ecx, ebx
call fcn.005caa40
mov esi, dword [ebp - 0x91c]
lea ecx, [ebp - 0x20]
inc edi
mov dword [esi + 8], eax
call fcn.005dc190
mov edx, dword [esi + 8]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x19
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e5401
push edi
mov ecx, ebx
call fcn.00594d00
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x54], xmm0
mov edi, eax
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x78], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x84]
movq qword [ebp - 0x84], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov byte [ebp - 4], 0xb
push 0x1a
lea ecx, [ebp - 0x910]
movlpd qword [ebp - 0x910], xmm0
call fcn.00403c80
mov byte [ebp - 4], 0xc
mov edx, 3
mov esi, dword [ebp - 0x910]
mov ecx, esi
push 2
call fcn.00598220
mov dword [ebp - 0x8fc], eax
test eax, eax
jle 0x4e2cd8
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.005dc190
lea edx, [ebp - 0x54]
mov ecx, eax
call fcn.005980c0
test eax, eax
je 0x4e2cbf
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
lea eax, [ebp - 0x64]
push eax
push 0
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4e2cbf
push ecx
push 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x64]
call fcn.005daea0
push ecx
push 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x78]
push dword [ebp - 0x8c]
call fcn.005daea0
lea ecx, [ebp - 0x54]
call fcn.005dbeb0
test al, al
je 0x4e2bf7
push str.Local_disk
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
mov ecx, esi
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 2
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
mov ecx, dword [ebp - 0x24]
mov esi, eax
push 0
push 0
push 0
push 0
push str._disk_volume.
inc edi
call fcn.005dc190
push ecx
mov ecx, eax
call fcn.00598410
add esp, 4
mov ecx, 0x62ef8c
test al, al
mov eax, str.Hard
cmove ecx, eax
push ecx
push str..___Type:
lea ecx, [ebp - 0x84]
call fcn.005dc190
push eax
push str..___File_system:
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push str._free_of
lea ecx, [ebp - 0x78]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
mov esi, dword [ebp - 0x24]
add esi, 0xc
sub dword [ebp - 0x8fc], 1
mov dword [ebp - 0x24], esi
jne 0x4e2b76
mov esi, dword [ebp - 0x910]
push 2
mov edx, 2
mov ecx, esi
call fcn.00598220
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x4e2e32
mov dword [ebp - 0x8fc], esi
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.005dc190
lea edx, [ebp - 0x54]
mov ecx, eax
call fcn.005980c0
test eax, eax
je 0x4e2e1f
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
lea eax, [ebp - 0x64]
push eax
push 0
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4e2e1f
push ecx
push 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x64]
call fcn.005daea0
push ecx
push 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x78]
push dword [ebp - 0x8c]
call fcn.005daea0
lea ecx, [ebp - 0x54]
call fcn.005dbeb0
test al, al
je 0x4e2d78
push str.Removable_disk_volume
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
mov ecx, esi
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 2
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push str.____Type:_Removable_media
lea ecx, [ebp - 0x84]
mov esi, eax
inc edi
call fcn.005dc190
push eax
push str..___File_system:
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push str._free_of
lea ecx, [ebp - 0x78]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
mov esi, dword [ebp - 0x8fc]
add esi, 0xc
sub dword [ebp - 0x24], 1
mov dword [ebp - 0x8fc], esi
jne 0x4e2cf7
push str.Select_Drive__Name__MediaType_from_Win32_CDROMDrive
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e2f3f
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e2f3f
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
push 0
push str.Drive
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.Optical_drive__
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 2
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Name
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.00588410
push eax
push str.Name:
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MediaType
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Type:
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e2e60
mov eax, dword [ebp - 0x910]
test eax, eax
je 0x4e2f75
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0xd
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
lea ecx, [ebp - 0x84]
call fcn.005dc430
lea ecx, [ebp - 0x78]
call fcn.005dc430
lea ecx, [ebp - 0x40]
call fcn.005dc430
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 7
call fcn.005dc430
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x1e
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e5401
push 0
push 3
push str.Windows_activation_state
mov edx, edi
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.0058b170
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 3
push str.Windows_serial
lea edx, [edi + 1]
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0xd0]
mov esi, eax
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push str.HKLM64SOFTWAREMicrosoftWindows_NTCurrentVersion
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
call fcn.005dc570
push 0
push 3
push str.Windows_product_key
lea edx, [edi + 2]
mov byte [ebp - 4], 0xe
mov ecx, ebx
call fcn.005caa40
mov esi, eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x20]
push eax
call fcn.005dc190
mov edx, str.DigitalProductId
mov ecx, eax
call fcn.004305a0
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 3
push str.Windows_product_key_4
lea edx, [edi + 3]
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.005dc400
push eax
lea ecx, [ebp - 0x40]
call fcn.005dc190
mov edx, str.DigitalProductId4
mov ecx, eax
call fcn.004305a0
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DefaultProductKey
lea ecx, [ebp - 0x40]
call fcn.005da780
push 0
push 3
push str.Windows_default_product_key
lea edx, [edi + 4]
mov ecx, ebx
call fcn.005caa40
mov esi, eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x20]
add edi, 5
push eax
call fcn.005dc190
mov edx, str.DigitalProductId
mov ecx, eax
call fcn.004305a0
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 0
push 0
push 0x1f0
lea ecx, [ebp - 0x20]
call fcn.005db9a0
mov ecx, eax
call fcn.00588ef0
test eax, eax
jle 0x4e3164
push 0
push 3
push str.Windows_product_key_from_BIOS
mov edx, edi
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x20]
mov esi, eax
inc edi
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
movq qword [ebp - 0x64], xmm0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x64]
call fcn.0042ffe0
xor ecx, ecx
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x28], ecx
test eax, eax
jle 0x4e3280
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
sub esi, edx
mov dword [ebp - 0x900], edx
mov dword [ebp - 0x8f8], esi
mov dword [ebp - 0x8fc], eax
nop dword [eax + eax]
lea eax, [ecx + 1]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x64], ecx
ja 0x4e3200
mov dword [ebp - 0x64], eax
jmp 0x4e3203
mov dword [ebp - 0x24], eax
push 0
push 3
lea ecx, [edx + esi]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
mov ecx, dword [ebp - 0x900]
mov esi, eax
mov eax, dword [ebp - 0x8fc]
inc edi
cmp eax, dword [ebp - 0x28]
cmovbe eax, dword [ebp - 0x24]
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x20]
push eax
call fcn.005dc190
mov edx, str.DigitalProductId
mov ecx, eax
call fcn.004305a0
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
mov edx, dword [ebp - 0x900]
mov ecx, dword [ebp - 0x24]
add edx, 0xc
mov esi, dword [ebp - 0x8f8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x900], edx
cmp ecx, dword [ebp - 0x90c]
jl 0x4e31f0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4e32b3
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x11
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4e32e6
push fcn.005dc430
lea esi, [eax - 4]
mov byte [ebp - 4], 0x12
push dword [esi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.005dc430
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
push edi
mov ecx, ebx
call fcn.00594470
push str.Select_Caption__DriverVersion__AdapterRAM__Status__CurrentHorizontalResolution__CurrentVerticalResolution_from_Win32_VideoController
lea ecx, [ebp - 0xc4]
mov edi, eax
call fcn.005887d0
test eax, eax
je 0x4e34c6
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e34c6
nop word [eax + eax]
push 0
push str.Caption
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc510
push 7
lea ecx, [ebp - 0x20]
call fcn.005da0f0
push 0
push 5
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DriverVersion
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.00588410
push eax
push str.Driver_version:
lea ecx, [ebp - 0x20]
call fcn.005dc200
push ecx
push 0
push str.AdapterRAM
lea ecx, [ebp - 0xc4]
call fcn.00588310
push 0
push eax
lea ecx, [ebp - 0x34]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.____VRAM:
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Status
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Status:
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.CurrentHorizontalResolution
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Resolution:
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._px.
push 0
push str.CurrentVerticalResolution
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push 0x628af8
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e3340
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x28
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e5401
push 0x344
lea eax, [ebp - 0x5a8]
mov dword [ebp - 0x8fc], 0
push 0
push eax
mov dword [ebp - 0x28], 0
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x5ac], 0x348
lea eax, [ebp - 0x5ac]
push 1
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x4e38a2
xor esi, esi
nop dword [eax]
test dword [ebp - 0x468], 5
je 0x4e385e
xor esi, esi
lea eax, [ebp - 0x8f0]
push 0x344
push esi
push eax
mov dword [ebp - 0x8f8], esi
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x8f4], 0x348
lea eax, [ebp - 0x8f4]
push 1
push eax
push esi
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x4e385b
nop word [eax + eax]
test dword [ebp - 0x7b0], 5
mov eax, dword [ebp - 0x8fc]
mov ecx, eax
je 0x4e3815
inc eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x8fc], eax
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x900]
mov dword [ebp - 0x900], 0
xorps xmm0, xmm0
push eax
movsd qword [ebp - 0x64], xmm0
call fcn.00594020
test eax, eax
je 0x4e3629
mov ecx, dword [ebp - 0x900]
call fcn.004048c0
mov ecx, dword [ebp - 0x24]
movsd qword [ebp - 0x64], xmm0
call fcn.004048c0
addsd xmm0, qword [ebp - 0x64]
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x4e3617
sqrtsd xmm0, xmm0
jmp 0x4e361c
call fcn.005ea8c0
divsd xmm0, qword [0x6edb58]
movsd qword [ebp - 0x64], xmm0
push 1
lea eax, [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x34]
call fcn.005dc400
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x84]
movq qword [ebp - 0x84], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x78], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x15
movsd xmm0, qword [ebp - 0x64]
ucomisd xmm0, qword [0x6eda28]
lahf
test ah, 0x44
jnp 0x4e3728
movaps xmm1, xmm0
lea ecx, [ebp - 0x84]
call fcn.005db690
push 4
lea ecx, [ebp - 0x84]
call fcn.005dae00
mov ecx, dword [ebp - 0x24]
movsx eax, cx
lea ecx, [ebp - 0x78]
push eax
call fcn.005db320
mov ecx, dword [ebp - 0x900]
movsx eax, cx
lea ecx, [ebp - 0x40]
push eax
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push str.mm.
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push 0x628af8
lea ecx, [ebp - 0x78]
call fcn.005dc190
push eax
push str.__screen.____Physical_size:
lea ecx, [ebp - 0x84]
call fcn.005dc190
push eax
push str.Type:
lea ecx, [ebp - 0x34]
call fcn.005dc200
push 0xdc
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00420090
add esp, 0xc
mov eax, 0xdc
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x264]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
je 0x4e37b7
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x78]
call fcn.005db290
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x40]
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._px.
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push 0x628af8
lea ecx, [ebp - 0x78]
call fcn.005dc190
push eax
push str.Resolution:
lea ecx, [ebp - 0x34]
call fcn.005da780
lea ecx, [ebp - 0x34]
call fcn.005dc3a0
test eax, eax
je 0x4e37f6
push 0
push 6
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
lea ecx, [ebp - 0x34]
mov esi, eax
inc edi
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
mov esi, dword [ebp - 0x8f8]
lea ecx, [ebp - 0x40]
call fcn.005dc430
lea ecx, [ebp - 0x78]
call fcn.005dc430
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.005dc430
push 0x344
lea eax, [ebp - 0x8f0]
inc esi
push 0
push eax
mov dword [ebp - 0x8f8], esi
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x8f4], 0x348
lea eax, [ebp - 0x8f4]
push 1
push eax
push esi
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x4e35a0
mov esi, dword [ebp - 0x28]
push 0x344
lea eax, [ebp - 0x5a8]
inc esi
push 0
push eax
mov dword [ebp - 0x28], esi
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x5ac], 0x348
lea eax, [ebp - 0x5ac]
push 1
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x4e3540
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
push str.Select_ProductName__StatusInfo__Manufacturer_from_Win32_SoundDevice
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e3990
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e3990
push 0
push 7
push 0
push 0x62dfc8
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.StatusInfo
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x90c], eax
inc edi
call fcn.00588350
lea ecx, [ebp - 0x34]
cmp eax, 4
jne 0x4e391d
push str.Disabled
jmp 0x4e3922
push str.Enabled
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Manufacturer
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Manufacturer:
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.State:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e38d7
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x32
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
push edi
mov ecx, ebx
call fcn.00594830
cmp dword [esi + 4], 0
mov edi, eax
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x3c
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e5401
push 0
push 9
push str.Internet_connection_state
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
mov esi, eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
mov edx, str.Not_connected
mov ecx, str.Connected
cmove ecx, edx
mov edx, esi
push ecx
push 1
mov ecx, ebx
call fcn.005ca650
push 0
push 9
push str.External_IP_address
lea edx, [edi + 1]
mov ecx, ebx
call fcn.005caa40
mov esi, dword [ebp - 0x91c]
add edi, 2
cmp dword [esi + 4], 0
mov dword [esi + 0xc], eax
je 0x4e5401
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._from_Win32_Processor
push str.__CurrentClockSpeed__MaxClockSpeed
push str.Select_Name__AddressWidth__NumberOfCores__NumberOfLogicalProcessors
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e3c13
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e3c13
mov esi, dword [ebp - 0x918]
push 0
push 0xa
push 0
push str.Name
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AddressWidth
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x90c], eax
inc edi
call fcn.00588410
push eax
push str.Arch:_x
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.NumberOfCores
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Cores:
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.NumberOfLogicalProcessors
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Logical_processors:
lea ecx, [ebp - 0x20]
call fcn.005da780
movsd xmm0, qword [esi + 8]
comisd xmm0, xmmword [0x6eda90]
jbe 0x4e3be2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._MHz.
push 0
push str.CurrentClockSpeed
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Actual_speed:
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._MHz.
push 0
push str.MaxClockSpeed
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
push str.____Max_speed:
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e3aa2
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x46
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
push 0
push 0xb
push str.Total_physical_memory
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push ecx
push 0
push dword [ebp - 0x140]
inc edi
lea ecx, [ebp - 0x20]
push dword [ebp - 0x144]
mov esi, eax
mov dword [ebp - 0x920], edi
call fcn.005daea0
push dword [ebp - 0x140]
lea ecx, [ebp - 0x34]
push dword [ebp - 0x144]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bytes_
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
xor esi, esi
cmp dword [ebp - 0x13c], esi
jle 0x4e3d5d
mov dword [ebp - 0x24], esi
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x20]
call fcn.005db320
sub esp, 0xc
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Memory_device
call fcn.005da510
push 0
push 0xb
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
inc edi
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0xf0], esi
lea ecx, [esi + 1]
mov esi, ecx
ja 0x4e3d29
mov dword [ebp - 0xf0], ecx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0xe8]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
add dword [ebp - 0x24], 0xc
cmp esi, dword [ebp - 0x13c]
jl 0x4e3cd0
mov dword [ebp - 0x920], edi
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e5401
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x8fc], eax
test eax, eax
je 0x4e3e22
mov dword [ebp - 0x24], 0
xor esi, esi
nop word [eax + eax]
sub esp, 0xc
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.System_slot
push esi
call fcn.005db290
mov ecx, eax
call fcn.005da510
push 0
push 0xb
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
inc edi
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0xe4], esi
lea ecx, [esi + 1]
mov esi, ecx
ja 0x4e3de8
mov dword [ebp - 0xe4], ecx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0xdc]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
add dword [ebp - 0x24], 0xc
cmp esi, dword [ebp - 0x8fc]
jb 0x4e3d90
mov esi, dword [ebp - 0x91c]
mov dword [ebp - 0x920], edi
cmp dword [esi + 4], 0
je 0x4e5401
mov ecx, dword [ebp - 0x918]
push 0
push 0x4b
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
lea ecx, [ebp - 0x96c]
call fcn.005dc5e0
lea ecx, [ebp - 0x960]
call fcn.005dc5e0
lea ecx, [ebp - 0x954]
call fcn.005dc5e0
lea ecx, [ebp - 0x948]
call fcn.005dc5e0
lea ecx, [ebp - 0x93c]
call fcn.005dc5e0
lea ecx, [ebp - 0x930]
call fcn.005dc5e0
mov byte [ebp - 4], 0x16
cmp dword [esi + 4], 0
je 0x4e53bb
push 0
push 0xc
push str.Installed_battery
mov edx, edi
mov ecx, ebx
call fcn.005caa40
inc edi
mov dword [ebp - 0x8fc], eax
lea ecx, [ebp - 0x98c]
mov dword [ebp - 0x920], edi
call fcn.0058df20
test al, al
jne 0x4e3ecf
mov edx, dword [ebp - 0x8fc]
push str.No_battery_detected
jmp 0x4e4145
lea ecx, [ebp - 0x20]
call fcn.005dc400
lea ecx, [ebp - 0x948]
call fcn.005dc3a0
test eax, eax
je 0x4e3efc
push 1
lea ecx, [ebp - 0x948]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x960]
call fcn.005dc3a0
test eax, eax
je 0x4e3f4e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x960]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x948]
call fcn.005dc3a0
test eax, eax
mov ecx, 0x62438c
mov eax, 0x62439c
cmove ecx, eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x93c]
call fcn.005dc3a0
test eax, eax
je 0x4e3fa0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x93c]
call fcn.005dc190
push eax
push str.Serial:
lea ecx, [ebp - 0x20]
call fcn.005dc3a0
test eax, eax
mov ecx, 0x62889c
mov eax, 0x62439c
cmove ecx, eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x8fc]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
push 0
push 0xc
push str.Battery_level_and_status
mov edx, edi
mov ecx, ebx
call fcn.005caa40
movzx ecx, byte [ebp - 0x98c]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x90c], eax
call fcn.005db290
mov eax, dword [ebp - 0x988]
test eax, 0x10000
je 0x4e400d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___on_AC_power.
jmp 0x4e408f
test eax, 0x40000
je 0x4e4031
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___charging.
jmp 0x4e408f
test eax, 0x20000
je 0x4e4097
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___in_use.
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x96c]
call fcn.005dc3a0
test eax, eax
je 0x4e4097
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x96c]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
push 0
push 0xc
push str.Battery_wear_and_health
lea edx, [edi + 1]
mov ecx, ebx
call fcn.005caa40
sub esp, 0xc
mov dword [ebp - 0x90c], eax
movzx eax, byte [ebp - 0x98b]
lea ecx, [ebp - 0x20]
add edi, 2
mov dword [ebp - 0x920], edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Estimated_wear_rate:
push eax
call fcn.005db290
mov ecx, eax
call fcn.005da510
test dword [ebp - 0x988], 0x80000
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
je 0x4e412c
push str.___iminent_failure.
jmp 0x4e4131
push str.___battery_seems_healthy.
call fcn.005da780
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
push eax
push 1
mov ecx, ebx
call fcn.005ca650
cmp dword [esi + 4], 0
je 0x4e53bb
mov ecx, dword [ebp - 0x918]
push 0
push 0x53
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e53bb
push 0x40
lea eax, [ebp - 0x184]
push 0
push eax
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x184], 0x40
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x54], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x84]
movq qword [ebp - 0x84], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x78], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x184]
mov byte [ebp - 4], 0x1a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4e42e8
push 0
push 0xd
push str.Virtual_memory
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push ecx
push 0
push dword [ebp - 0x168]
inc edi
lea ecx, [ebp - 0x40]
push dword [ebp - 0x16c]
mov esi, eax
mov dword [ebp - 0x920], edi
call fcn.005daea0
push ecx
push 0
push dword [ebp - 0x160]
lea ecx, [ebp - 0x54]
push dword [ebp - 0x164]
call fcn.005daea0
mov eax, dword [ebp - 0x160]
mov ecx, 0x64
push dword [ebp - 0x168]
mul ecx
push dword [ebp - 0x16c]
mov ecx, eax
mov edx, 0x64
mov eax, dword [ebp - 0x164]
mul edx
add ecx, edx
push ecx
push eax
call fcn.0042fc60
push edx
push eax
lea ecx, [ebp - 0x34]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0x628f7c
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.____Usage:
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
push str.____Free:
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push str.Total:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
push 1
push str.Select_Name__CurrentUsage__PeakUsage_from_Win32_PageFileUsage
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e442b
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e442b
nop word [eax + eax]
push 0
push str.Name
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
lea ecx, [ebp - 0x78]
call fcn.005dc510
push 0
push 0xd
lea ecx, [ebp - 0x78]
call fcn.005dc190
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push ecx
push 2
push str.CurrentUsage
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x34]
call fcn.005daea0
push ecx
push 2
push str.PeakUsage
lea ecx, [ebp - 0xc4]
call fcn.005883d0
push edx
push eax
lea ecx, [ebp - 0x84]
call fcn.005daea0
push ecx
push 0
lea ecx, [ebp - 0x78]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push edx
push eax
lea ecx, [ebp - 0x40]
call fcn.005daea0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push str.____Size:
lea ecx, [ebp - 0x84]
call fcn.005dc190
push eax
push str.____Peak_usage:
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.Current_usage:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e4330
mov dword [ebp - 0x920], edi
lea ecx, [ebp - 0x78]
call fcn.005dc430
lea ecx, [ebp - 0x84]
call fcn.005dc430
lea ecx, [ebp - 0x54]
call fcn.005dc430
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x16
call fcn.005dc430
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e53bb
mov ecx, dword [ebp - 0x918]
push 0
push 0x55
add ecx, 0x14f0
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e53bb
mov eax, dword [ebp - 0x918]
push ecx
lea ecx, [ebp - 0xc4]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edab0]
jb 0x4e44a4
push str.rootSecurityCenter2
jmp 0x4e44a9
push str.rootSecurityCenter
call fcn.00588830
push 1
push str.Select_DisplayName__ProductState_from_AntiVirusProduct
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e4592
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e4592
nop dword [eax]
push 0
push 0xe
push 0
push str.DisplayName
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.ProductState
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.00588310
push 0
push 0
push 0
push 0
push 0
mov ecx, eax
mov edx, str.Updated
push 0
push 0
test cl, 0x10
mov eax, str.Outdated
push 0
cmove eax, edx
test ecx, 0x1000
push 0
push eax
mov ecx, str.Disabled_
mov eax, str.Enabled_
cmove eax, ecx
lea ecx, [ebp - 0x20]
push eax
push str.Type:_Antivirus_software____State:
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e44f0
jmp 0x4e45b5
push 0
push 0xe
push str.NO_Antivirus_software_detected___
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.Advise:_Install_an_Antivirus_software_as_soon_as_possible.
push 1
mov edx, eax
mov ecx, ebx
inc edi
call fcn.005ca650
push 1
push str.Select_DisplayName__ProductState_from_AntiSpywareProduct
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e4695
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e4695
push 0
push 0xe
push 0
push str.DisplayName
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.ProductState
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.00588310
push 0
push 0
push 0
push 0
push 0
mov ecx, eax
mov edx, str.Updated
push 0
push 0
test cl, 0x10
mov eax, str.Outdated
push 0
cmove eax, edx
test ecx, 0x1000
push 0
push eax
mov ecx, str.Disabled_
mov eax, str.Enabled_
cmove eax, ecx
lea ecx, [ebp - 0x20]
push eax
push str.Type:_AntiSpyware_software____State:
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e45f3
jmp 0x4e46b8
push 0
push 0xe
push str.NO_AntiSpyware_software_detected___
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.This_computer_has_NO_AntiSpyware_software_installed.
push 1
mov edx, eax
mov ecx, ebx
inc edi
call fcn.005ca650
push 1
push str.Select_DisplayName__ProductState_from_FirewallProduct
lea ecx, [ebp - 0x20]
call fcn.005dc260
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xc4]
call fcn.005887d0
test eax, eax
je 0x4e4784
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
je 0x4e4784
push 0
push 0xe
push 0
push str.DisplayName
lea ecx, [ebp - 0xc4]
call fcn.00588410
push eax
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push str.ProductState
lea ecx, [ebp - 0xc4]
mov esi, eax
inc edi
call fcn.00588310
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test eax, 0x1000
mov ecx, str.Disabled
push 0
mov eax, str.Enabled
cmove eax, ecx
lea ecx, [ebp - 0x20]
push eax
push str.Type:_Firewall_software____State:
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0xc4]
call fcn.00588680
test eax, eax
jne 0x4e46f6
push 0
push 0xe
push str.Windows_firewall
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, eax
inc edi
call fcn.005ce740
test al, al
mov ecx, str.Enabled
mov eax, str.Disabled
cmove ecx, eax
push ecx
push str.Type:_Firewall_software____State:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
mov eax, dword [ebp - 0x918]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edab0]
jbe 0x4e488f
push 0
push 0xe
push str.User_account_control__UAC_
mov edx, edi
mov ecx, ebx
call fcn.005caa40
push 0
push 0x20019
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov esi, eax
inc edi
call fcn.005d6a80
lea eax, [ebp - 0x8fc]
mov dword [ebp - 0x8fc], 0
push eax
push str.EnableLUA
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], 0
call fcn.005d66b0
lea eax, [ebp - 0x24]
push eax
push str.ConsentPromptBehaviorAdmin
lea ecx, [ebp - 0x28]
call fcn.005d66b0
cmp dword [ebp - 0x8fc], 0
jbe 0x4e4876
cmp dword [ebp - 0x24], 0
mov eax, str.State:_Enabled
ja 0x4e487b
mov eax, str.State:_Disabled
push eax
push 1
mov edx, esi
mov ecx, ebx
call fcn.005ca650
lea ecx, [ebp - 0x28]
call fcn.005d69e0
push 0
push 0xe
push str.System_restore
mov edx, edi
mov ecx, ebx
call fcn.005caa40
mov ecx, dword [ebp - 0x918]
inc edi
mov esi, eax
mov dword [ebp - 0x920], edi
lea ecx, [ecx + 0x1290]
call fcn.00553420
test eax, eax
mov edx, str.State:_Enabled
mov ecx, str.State:_Disabled
cmove ecx, edx
mov edx, esi
push ecx
push 1
mov ecx, ebx
call fcn.005ca650
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
je 0x4e53bb
mov ecx, dword [ebp - 0x918]
push 0
push 0x5a
lea ecx, [ecx + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e53bb
mov dword [ebp - 0x8f8], 0
lea eax, [ebp - 0x8f8]
mov byte [ebp - 4], 0x1b
push eax
push 0x6ed970
push 1
push 0
push 0x6ed9b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4e493b
mov byte [ebp - 4], 0x1c
jmp 0x4e4a8d
mov eax, dword [ebp - 0x8f8]
lea edx, [ebp - 0x8fc]
mov dword [ebp - 0x8fc], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 0
push 0xf
push str.Service_state
mov edx, edi
mov ecx, ebx
call fcn.005caa40
inc edi
mov edx, str.Disabled
cmp word [ebp - 0x8fc], 0
mov ecx, str.Enabled
mov dword [ebp - 0x920], edi
cmove ecx, edx
mov edx, eax
push ecx
push 1
mov ecx, ebx
call fcn.005ca650
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0x1d
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x8f8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x4e49cb
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e49c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1f
jmp 0x4e4a8d
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4e49fd
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e49f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x21
jmp 0x4e4a8d
push 0
push 0xf
push str.Notification_level
mov edx, edi
mov ecx, ebx
call fcn.005caa40
mov ecx, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x920], edi
test ecx, ecx
jne 0x4e4a2a
push str.Automatic_updates_are_not_configured
jmp 0x4e4a58
cmp ecx, 1
jne 0x4e4a36
push str.Automatic_updates_are_disabled
jmp 0x4e4a58
cmp ecx, 2
jne 0x4e4a42
push str.User_is_notified_before_downloading_updates
jmp 0x4e4a58
cmp ecx, 3
jne 0x4e4a4e
push str.User_is_notified_before_installation_of_updates
jmp 0x4e4a58
cmp ecx, 4
jne 0x4e4a60
push str.Updates_are_installed_according_to_scheduled_installation
lea ecx, [ebp - 0x20]
call fcn.005dc510
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edx, dword [ebp - 0x90c]
mov ecx, ebx
push eax
push 1
call fcn.005ca650
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e4a89
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e4a9d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x16
cmp dword [esi + 4], 0
je 0x4e53bb
mov edi, dword [ebp - 0x918]
push 0
push 0x5f
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
cmp dword [esi + 4], 0
je 0x4e53bb
movsd xmm2, qword [edi + 8]
call fcn.0058fa60
mov dword [ebp - 0x5c], eax
cmp eax, 4
jne 0x4e4af0
movsd xmm3, qword [edi + 8]
lea edx, [eax - 1]
push 0xffffffffffffffff
mov ecx, str.wuauserv
call fcn.0058f7a0
mov dword [ebp - 0x908], 0
lea eax, [ebp - 0x908]
mov byte [ebp - 4], 0x24
push eax
push 0x6ed960
push 1
push 0
push 0x6ed6f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4e4b3a
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e539b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4e539b
mov eax, dword [ebp - 0x908]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
movsd xmm0, qword [0x6edb98]
comisd xmm0, xmmword [edi + 8]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x8f8], 0
jbe 0x4e4ff1
mov byte [ebp - 4], 0x26
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x908]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
js 0x4e4fd4
mov edx, dword [ebp - 0x68]
cmp edx, 1
jl 0x4e4fd4
mov eax, dword [ebp - 0x908]
lea esi, [ebp - 0x8f8]
push esi
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov esi, dword [ebp - 0x91c]
test eax, eax
jns 0x4e4bd8
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e4bcf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2a
jmp 0x4e4b21
cmp dword [esi + 4], 0
jne 0x4e4bfb
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e4bf2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2c
jmp 0x4e4b21
mov ecx, dword [ebp - 0x68]
xor esi, esi
mov dword [ebp - 0x8fc], esi
test ecx, ecx
jle 0x4e4fcb
add edi, 0x14f0
xor eax, eax
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x90c], eax
cdq
idiv ecx
push 0
add eax, 0x5f
mov ecx, edi
push eax
call fcn.005b66e0
mov dword [ebp - 0x904], 0
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x904]
mov eax, dword [ebp - 0x8f8]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4e4c75
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e4c6c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
jmp 0x4e4faa
mov eax, dword [ebp - 0x904]
lea edx, [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
jns 0x4e4c8f
mov byte [ebp - 4], 0x2f
jmp 0x4e4c5c
mov eax, dword [ebp - 0x24]
cmp eax, 2
je 0x4e4ca2
cmp eax, 3
je 0x4e4ca2
mov byte [ebp - 4], 0x30
jmp 0x4e4c5c
mov dword [ebp - 0x900], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0x32
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x904]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x4e4cd1
mov byte [ebp - 4], 0x33
jmp 0x4e4c5c
mov eax, dword [ebp - 0x904]
lea ecx, [ebp - 0x900]
mov esi, dword [eax]
call fcn.00401b60
push eax
push dword [ebp - 0x904]
call dword [esi + 0x30]
test eax, eax
jns 0x4e4d59
mov esi, dword [ebp - 0x900]
test esi, esi
je 0x4e4d3c
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4e4d3c
mov eax, dword [esi]
test eax, eax
je 0x4e4d1a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4e4d31
push eax
call fcn.0041e1c3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041e7c1
add esp, 8
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e4d50
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
jmp 0x4e4fa4
lea ecx, [ebp - 0x28]
call fcn.00401b60
movsd xmm0, qword [ebp - 0x54]
push eax
push SysReAllocString
push 0
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.OLEAUT32.dll_VarBstrFromDisp]
mov edi, dword [ebp - 0x900]
test edi, edi
jne 0x4e4dd4
push 0xc
call fcn.0041e3d6
mov edi, eax
add esp, 4
mov dword [ebp - 0x900], edi
test edi, edi
je 0x4e4dc0
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 1
mov dword [edi], 0
jmp 0x4e4dc2
xor edi, edi
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x900], edi
test edi, edi
je 0x4e545c
push dword [edi]
lea ecx, [ebp - 0x20]
call fcn.005dc510
push ecx
push 8
lea eax, [ebp - 0x34]
push eax
push str.KBd
lea ecx, [ebp - 0x20]
call fcn.005d9870
mov esi, dword [ebp - 0x28]
test al, al
je 0x4e4e74
test esi, esi
jne 0x4e4e45
push 0xc
call fcn.0041e3d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4e4e34
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi], 0
jmp 0x4e4e36
xor esi, esi
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4e545c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627930
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push 0x62d7ec
push dword [esi]
lea ecx, [ebp - 0x34]
call fcn.005dc200
jmp 0x4e4eca
test esi, esi
jne 0x4e4ec0
push 0xc
call fcn.0041e3d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4e4eaf
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi], 0
jmp 0x4e4eb1
xor esi, esi
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4e545c
push dword [esi]
lea ecx, [ebp - 0x34]
call fcn.005dc510
push 0
push 0x10
lea ecx, [ebp - 0x34]
call fcn.005dc190
mov edx, dword [ebp - 0x920]
mov ecx, ebx
push eax
call fcn.005caa40
inc dword [ebp - 0x920]
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.005dc190
push eax
mov edx, ebx
mov ebx, dword [ebp - 0x924]
push 1
mov ecx, ebx
call fcn.005ca650
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4e4f46
mov eax, dword [esi]
test eax, eax
je 0x4e4f24
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4e4f3b
push eax
call fcn.0041e1c3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041e7c1
add esp, 8
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4e4f86
mov eax, dword [edi]
test eax, eax
je 0x4e4f64
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4e4f7b
push eax
call fcn.0041e1c3
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0041e7c1
add esp, 8
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e4f9a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0x8fc]
mov eax, dword [ebp - 0x90c]
inc esi
mov ecx, dword [ebp - 0x68]
add eax, 5
mov dword [ebp - 0x8fc], esi
mov dword [ebp - 0x90c], eax
cmp esi, ecx
jl 0x4e4c22
mov byte [ebp - 4], 0x39
jmp 0x4e533c
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e4fe8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x28
jmp 0x4e4b21
mov dword [ebp - 0x904], 0
push str.IsInstalled1
mov byte [ebp - 4], 0x3b
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x908]
mov edi, eax
lea eax, [ebp - 0x8f8]
push eax
push edi
mov edx, dword [ecx]
push ecx
call dword [edx + 0x4c]
push edi
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x4e5074
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e5041
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e5055
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e5069
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x918]
jmp 0x4e5395
mov esi, dword [ebp - 0x91c]
cmp dword [esi + 4], 0
jne 0x4e50c7
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e5094
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x40
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e50a8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e50bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x918]
jmp 0x4e539b
mov eax, dword [ebp - 0x8f8]
lea edx, [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, 2
je 0x4e512b
cmp eax, 3
je 0x4e512b
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e50f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e510c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e50bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x918]
jmp 0x4e539b
mov eax, dword [ebp - 0x8f8]
lea edx, [ebp - 0x904]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x4e518d
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e5156
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e516a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e50bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x918]
jmp 0x4e539b
mov eax, dword [ebp - 0x904]
lea edx, [ebp - 0x68]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x34]
call fcn.005db320
mov ecx, dword [ebp - 0x68]
xor edi, edi
test ecx, ecx
jle 0x4e5324
mov eax, dword [ebp - 0x918]
add eax, 0x14f0
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x90c], eax
nop
cdq
idiv ecx
mov ecx, dword [ebp - 0x88]
push 0
add eax, 0x5f
push eax
call fcn.005b66e0
mov dword [ebp - 0x900], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0x48
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x904]
push edx
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4e5228
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e52f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4e52f2
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x900]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x4e5242
mov byte [ebp - 4], 0x4a
jmp 0x4e5212
push dword [ebp - 0x900]
lea ecx, [ebp - 0x34]
call fcn.005dc510
push ecx
push 8
lea eax, [ebp - 0x20]
push eax
push str.KBd
lea ecx, [ebp - 0x34]
call fcn.005d9870
test al, al
jne 0x4e5290
sub esp, 0xc
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Update
push edi
call fcn.005db320
mov ecx, eax
call fcn.005da510
cmp dword [esi + 4], 0
je 0x4e5313
push 0
push 0x10
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov esi, dword [ebp - 0x920]
mov ecx, ebx
push eax
mov edx, esi
call fcn.005caa40
push dword [ebp - 0x900]
inc esi
mov edx, eax
push 1
mov ecx, ebx
mov dword [ebp - 0x920], esi
call fcn.005ca650
mov eax, dword [ebp - 0x900]
test eax, eax
je 0x4e52db
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x4c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e52ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x91c]
mov byte [ebp - 4], 0x3b
inc edi
mov eax, dword [ebp - 0x90c]
mov ecx, dword [ebp - 0x68]
add eax, 5
mov dword [ebp - 0x90c], eax
cmp edi, ecx
jl 0x4e51d0
jmp 0x4e5324
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4e5324
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x904]
test eax, eax
je 0x4e5338
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4e
mov eax, dword [ebp - 0x8f8]
test eax, eax
je 0x4e534c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x918]
mov byte [ebp - 4], 0x24
cmp dword [ebp - 0x5c], 4
jne 0x4e5381
push ecx
push 1
push str.wuauserv
mov ecx, edi
call fcn.00437d40
movsd xmm3, qword [edi + 8]
mov edx, 4
push 0xffffffffffffffff
mov ecx, str.wuauserv
call fcn.0058f7a0
mov byte [ebp - 4], 0x4f
mov eax, dword [ebp - 0x908]
test eax, eax
je 0x4e5395
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x91c]
mov byte [ebp - 4], 0x16
cmp dword [esi + 4], 0
je 0x4e53bb
push 0
push 0x64
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
mov esi, 1
jmp 0x4e53bd
xor esi, esi
lea ecx, [ebp - 0x930]
call fcn.005dc430
lea ecx, [ebp - 0x93c]
call fcn.005dc430
lea ecx, [ebp - 0x948]
call fcn.005dc430
lea ecx, [ebp - 0x954]
call fcn.005dc430
lea ecx, [ebp - 0x960]
call fcn.005dc430
lea ecx, [ebp - 0x96c]
call fcn.005dc430
jmp 0x4e5403
xor esi, esi
lea ecx, [ebp - 0x6c]
call fcn.005d69e0
lea ecx, [ebp - 0x144]
call fcn.004028e0
lea ecx, [ebp - 0xc4]
call fcn.00588a50
lea ecx, [ebp - 0xd0]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.0041de50
int3