Function at 0x41d3f0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x784
push edi
mov eax, dword [str.main]
mov dword [ebp - 0x238], eax
mov ecx, dword [0x4412b8]
mov dword [ebp - 0x234], ecx
mov dx, word [0x4412bc]
mov word [ebp - 0x230], dx
mov ax, word [0x44ba54]
mov word [ebp - 0x660], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x65e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x44ba5c]
mov word [ebp - 0x778], cx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x776]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dx, word [0x44ba64]
mov word [ebp - 0x210], dx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x44ba6c]
mov word [ebp - 0x104], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x102]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x780], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x224], 0x4412e0
mov dword [ebp - 0x220], 0x42f5e5
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x77c], 0
mov dword [ebp - 0x664], 0
call dword [sym.imp.SQLUNIRL.dll__GetUnicodeRedirectionLayer_0]
mov dword [0x44df4c], eax
mov dword [0x44b098], 1
push 0x1af8
push 0
push 0x44c400
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x44b08c], 0
mov ecx, dword [0x44b08c]
mov dword [0x44b090], ecx
push 0
mov edx, dword [0x44df4c]
call dword [edx + 0x224]
mov dword [0x44b818], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push 0x44c140
push 0x44b81c
mov eax, dword [0x44b818]
push eax
call dword [sym.imp.SQLRESLD.dll_SQLUILoadResourceDLL]
add esp, 0x10
test eax, eax
jne 0x41d59f
xor eax, eax
jmp 0x41dfec
mov dword [ebp - 0x108], 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0x44b2cc
call dword [sym.imp.SQLUNIRL.dll__GetComputerName_8]
push 0
push 0
push 0
push 1
call fcn.0042fe95
add esp, 0x10
mov dword [0x44b08c], eax
mov dword [0x44b090], 0
push 0x200
lea edx, [ebp - 0x660]
push edx
push 0x12
mov eax, dword [0x44b81c]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x441300
push 0x441314
lea ecx, [ebp - 0x660]
push ecx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 0xc
push 0x44c2e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c2c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c2a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c280
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c260
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c240
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c220
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c200
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c1e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c1c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c1a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c180
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44c160
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x44b08c], 0
jne 0x41d6b0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea edx, [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24c]
mov dword [0x44b0c0], eax
mov dword [0x44c148], 0
push 1
push 0x44c0c0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x41d729
push 0
push 0
push 1
push 0x44c0c0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x41d722
mov dword [0x44c0e0], 0xc
mov dword [0x44c0e4], 0x44c0c0
mov dword [0x44c0e8], 0
mov dword [0x44c148], 0x44c0e0
jmp 0x41d727
jmp 0x41db0b
jmp 0x41d72e
jmp 0x41db0b
call dword [sym.imp.SQLSVC.dll_SQLSvcInit]
test eax, eax
jne 0x41d73d
jmp 0x41db0b
cmp dword [0x44b08c], 0
jne 0x41d78b
push 0
push str.KERNEL32.DLL
push 3
call fcn.004066c0
add esp, 0xc
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x41d78b
push str.TryEnterCriticalSection
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.SQLUNIRL.dll__GetProcAddress__8]
mov dword [0x44b824], eax
cmp dword [0x44b824], 0
jne 0x41d78b
jmp 0x41db0b
push 1
call fcn.00420d98
add esp, 4
mov dword [0x44ba4c], eax
cmp dword [0x44ba48], 2
jne 0x41d7db
cmp dword [0x44ba4c], 0
jne 0x41d7db
push 0x200
lea edx, [ebp - 0x660]
push edx
push 0x78
mov eax, dword [0x44b81c]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea ecx, [ebp - 0x660]
push ecx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 4
jmp 0x41db0b
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x778]
push eax
push 0x44b0bc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041dff1
add esp, 0x14
test eax, eax
jne 0x41d807
jmp 0x41db0b
mov eax, dword [0x44b0bc]
and eax, 0x20
cmp eax, 0x20
jne 0x41d829
cmp dword [0x44b090], 0
jne 0x41d829
mov dword [ebp - 0x784], 0
jmp 0x41d833
mov dword [ebp - 0x784], 1
mov ecx, dword [ebp - 0x784]
mov dword [0x44b09c], ecx
mov edx, dword [ebp - 0x210]
and edx, 0xffff
neg edx
sbb edx, edx
lea eax, [ebp - 0x210]
and edx, eax
push edx
mov ecx, dword [ebp - 0x778]
and ecx, 0xffff
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x778]
and ecx, edx
push ecx
push 0x44c400
call fcn.0042bf80
add esp, 0xc
mov eax, dword [0x44b0bc]
and eax, 1
test eax, eax
jne 0x41d89c
cmp dword [0x44b08c], 0
jne 0x41d89c
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [ebp - 4], eax
cmp dword [0x44b08c], 0
jne 0x41d8b5
push 0
push 0x3ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 4], eax
push 0x104
push 0x44b0c4
push 0
call dword [sym.imp.SQLUNIRL.dll__GetModuleFileName_12]
push 0x44b0c4
call fcn.00421ab6
add esp, 4
push 0xa
push 0xadc
push 0x44c3e0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0xd08
push 0x44c3c0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 8
push 0x56c
push 0x44c3a0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x14
push 0x44c380
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x24
push 0x44c360
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 5
push 0x28
push 0x44c340
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x104
push 0x44c320
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x59c
push 0x44c300
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
mov ecx, dword [0x44b0bc]
and ecx, 1
test ecx, ecx
jne 0x41da71
push 0x44119c
call fcn.00406a10
add esp, 4
test eax, eax
je 0x41d9a1
mov dword [ebp - 0x224], 0x441380
jmp 0x41d9bd
push 0x44119c
push 0x44b4f4
call fcn.00421900
add esp, 8
mov dword [ebp - 0x224], 0x44b4f4
lea edx, [ebp - 0x224]
push edx
call fcn.0042f330
add esp, 4
test eax, eax
je 0x41d9df
mov dword [0x4412a4], 0
jmp 0x41da6f
cmp dword [ebp + 8], 1
jne 0x41da17
push 0x200
lea eax, [ebp - 0x660]
push eax
push 0xf
mov ecx, dword [0x44b81c]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x4413a0
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
jmp 0x41da6f
push 0x200
lea eax, [ebp - 0x660]
push eax
push 0x10
mov ecx, dword [0x44b81c]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
push 1
push 2
push 0xc0000064
push 1
push 1
call fcn.0041b7ad
add esp, 0x18
jmp 0x41dae2
call fcn.0041e4ea
test eax, eax
jne 0x41da7f
jmp 0x41db0b
push 0x4413c0
push 0x5e
push 0
push 4
call fcn.0041bfab
add esp, 0x10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x41fdbd
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.0041eb62
test eax, eax
je 0x41dae2
call fcn.0041fa32
test eax, eax
je 0x41dae2
push 0xffffffffffffffff
mov eax, dword [0x44df00]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0040255a
push 0xf
call fcn.0040ff36
add esp, 4
mov dword [0x4412a4], 0
call fcn.0042090f
lea ecx, [ebp - 0x104]
push ecx
call fcn.004270b5
add esp, 4
test eax, eax
je 0x41db0b
push 1
lea edx, [ebp - 0x104]
push edx
call fcn.00422c04
add esp, 8
call fcn.004102cb
cmp dword [0x44df10], 0
je 0x41db25
mov eax, dword [0x44df10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x44b814], 0
je 0x41db3b
mov ecx, dword [0x44b814]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x44b0b0], 0
jne 0x41df85
cmp dword [0x44b08c], 0
je 0x41db5e
push 0x44c200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x41db9f
push 0x44c200
call dword [0x44b824]
test eax, eax
jne 0x41db9f
cmp dword [0x44b090], 0
je 0x41db94
cmp dword [0x44dc84], 0
je 0x41db94
lea edx, [ebp - 0x238]
push edx
push 0x4413e0
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
push 0x44c200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x44b090], 0
je 0x41dbc6
cmp dword [0x44dc84], 0
je 0x41dbc6
lea eax, [ebp - 0x238]
push eax
push 0x44141c
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
mov dword [ebp - 0x66c], 0
jmp 0x41dbe1
mov ecx, dword [ebp - 0x66c]
add ecx, 1
mov dword [ebp - 0x66c], ecx
mov edx, dword [ebp - 0x66c]
cmp edx, dword [0x44c3e8]
jge 0x41dc44
mov dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x66c]
push eax
push 0x44c3e0
call dword [sym.imp.SQLSVC.dll_SHRecMemLock]
add esp, 8
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 0
je 0x41dc42
mov ecx, dword [ebp - 0x780]
cmp dword [ecx + 0x2a8], 0
je 0x41dc42
mov edx, dword [ebp - 0x780]
add edx, 0x2a0
push edx
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
jmp 0x41dbd2
push 0x44c200
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x44b090], 0
je 0x41dc76
cmp dword [0x44dc84], 0
je 0x41dc76
lea eax, [ebp - 0x238]
push eax
push 0x441450
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
push 0x44c380
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c3e0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c3c0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c3a0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c360
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c340
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c320
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44c300
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
cmp dword [0x44c090], 0
je 0x41dd9b
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [0x44c090]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x41dd8c
cmp dword [0x44c080], 0
je 0x41dd2f
mov edx, dword [0x44c080]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [0x44c084], 0
je 0x41dd44
mov eax, dword [0x44c084]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [0x44c088], 0
je 0x41dd5c
mov ecx, dword [0x44c088]
push ecx
call fcn.0042138d
add esp, 4
cmp dword [0x44c08c], 0
je 0x41dd74
mov edx, dword [0x44c08c]
push edx
call fcn.0042138d
add esp, 4
cmp dword [ebp - 0x664], 0
je 0x41dd8c
mov eax, dword [ebp - 0x664]
push eax
call fcn.0042138d
add esp, 4
mov ecx, dword [0x44c090]
push ecx
call fcn.0042138d
add esp, 4
mov dword [ebp - 0x66c], 0
jmp 0x41ddb6
mov edx, dword [ebp - 0x66c]
add edx, 1
mov dword [ebp - 0x66c], edx
cmp dword [ebp - 0x66c], 0x11
jge 0x41dde5
mov eax, dword [ebp - 0x66c]
cmp dword [eax*4 + 0x44df00], 0
je 0x41dde3
mov ecx, dword [ebp - 0x66c]
mov edx, dword [ecx*4 + 0x44df00]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41dda7
mov eax, dword [0x44ba38]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
je 0x41de0e
mov ecx, dword [0x44ba38]
push ecx
push 0x61
push 0
push 1
call fcn.0041bfab
add esp, 0x10
call fcn.00421572
mov edx, dword [ebp - 0x670]
or edx, eax
mov dword [ebp - 0x670], edx
cmp dword [0x44b090], 0
jne 0x41de33
cmp dword [ebp - 0x670], 0
je 0x41de77
mov eax, dword [0x44ba3c]
push eax
push 0x60
push 0
push 3
call fcn.0041bfab
add esp, 0x10
mov ecx, dword [0x44ba40]
push ecx
push 0x134
push 0
push 3
call fcn.0041bfab
add esp, 0x10
mov edx, dword [0x44ba44]
push edx
push 0x135
push 0
push 3
call fcn.0041bfab
add esp, 0x10
push 0x44c2c0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c2a0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c280
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c260
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c240
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c220
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c200
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c1e0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c1c0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c1a0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c180
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44c160
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.SQLSVC.dll_SQLSvcExit]
push 0x200
lea eax, [ebp - 0x660]
push eax
push 0xf2
mov ecx, dword [0x44b81c]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea edx, [ebp - 0x660]
push edx
push 0x441484
push 0x62
push 0
push 4
call fcn.0041bfab
add esp, 0x14
call fcn.00419bf3
mov eax, dword [0x44ba4c]
push eax
call fcn.00421538
add esp, 4
push 0x44b81c
mov ecx, dword [0x44b818]
push ecx
call dword [sym.imp.SQLRESLD.dll_SQLUIUnloadResourceDLL]
add esp, 8
cmp dword [ebp - 0x214], 0
je 0x41df77
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4412a4]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200
lea ecx, [ebp - 0x660]
push ecx
push 0xf3
mov edx, dword [0x44b81c]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea eax, [ebp - 0x660]
push eax
push 0x4414a4
push 0x62
push 0
push 2
call fcn.0041bfab
add esp, 0x14
cmp dword [0x44b80c], 0
je 0x41dfd3
mov ecx, dword [0x44b80c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [0x4412a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x4412a4]
pop edi
mov esp, ebp
pop ebp
ret