Function at 0x40c640
Capabilities:
Access peb ldr_data
Get ntdll base address
Link many functions at runtime
Rebuild import table

Disassembly:
push 0xffffffffffffffff
push 0x425e50
mov eax, dword fs:[0]
push eax
sub esp, 0x120
push ebx
push ebp
push esi
push edi
mov eax, dword [0x431520]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov dword [esi + 0x180], ebx
mov dword [esi + 0x184], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x190], ebx
mov dword [esi + 0x194], ebx
mov dword [esi + 0x198], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x1cc], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
push str.msi.dll
mov dword [esi + 0x1e0], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
cmp ebp, ebx
je 0x40c966
push str.MsiInstallProductA
push ebp
call edi
push str.MsiConfigureProductA
push ebp
mov dword [esi + 0x20], eax
call edi
push str.MsiQueryComponentStateA
push ebp
mov dword [esi + 0x24], eax
call edi
push str.MsiQueryProductStateA
push ebp
mov dword [esi + 0x1c], eax
call edi
push str.MsiQueryFeatureStateA
push ebp
mov dword [esi + 0x14], eax
call edi
push str.MsiGetProductInfoA
push ebp
mov dword [esi + 0x18], eax
call edi
push str.MsiEnumFeaturesA
push ebp
mov dword [esi + 0x10], eax
call edi
push str.MsiEnumProductsA
push ebp
mov dword [esi + 0xc], eax
call edi
push str.MsiEnumPatchesA
push ebp
mov dword [esi + 8], eax
call edi
push str.MsiDeterminePatchSequenceA
push ebp
mov dword [esi + 4], eax
call edi
mov dword [esi], eax
lea ebp, [ebx + 0x10]
jmp 0x40ca1a
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.Msi.dll
push eax
mov dword [esp + 0x144], ebx
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 1
jb 0x40c9b1
mov eax, dword [eax + 4]
jmp 0x40c9b4
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0xbb
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40c9e8
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Cfgmgr32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x40ca39
push str.CM_Get_DevNode_Status_Ex
push eax
call edi
mov dword [esi + 0x28], eax
jmp 0x40caec
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea ecx, [esp + 0x34]
push str.Cfgmgr32.dll
push ecx
mov dword [esp + 0x144], 2
call fcn.00408bc0
add esp, 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call fcn.00406ee0
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 3
jb 0x40ca83
mov eax, dword [eax + 4]
jmp 0x40ca86
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0xc6
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40caba
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40cbba
push str.OpenProcessToken
push ebp
call edi
push str.SetTokenInformation
push ebp
mov dword [esi + 0x48], eax
call edi
push str.ImpersonateLoggedOnUser
push ebp
mov dword [esi + 0x4c], eax
call edi
push str.RevertToSelf
push ebp
mov dword [esi + 0x50], eax
call edi
push str.DuplicateTokenEx
push ebp
mov dword [esi + 0x54], eax
call edi
push str.GetSecurityDescriptorDacl
push ebp
mov dword [esi + 0x60], eax
call edi
push str.GetAclInformation
push ebp
mov dword [esi + 0x68], eax
call edi
push str.GetAce
push ebp
mov dword [esi + 0x6c], eax
call edi
push str.LookupAccountSidA
push ebp
mov dword [esi + 0x70], eax
call edi
push str.GetTokenInformation
push ebp
mov dword [esi + 0x74], eax
call edi
push str.ChangeServiceConfig2A
push ebp
mov dword [esi + 0x148], eax
call edi
push str.GetNamedSecurityInfoA
push ebp
mov dword [esi + 0x78], eax
call edi
push str.SetEntriesInAclA
push ebp
mov dword [esi + 0x1b0], eax
call edi
push str.SetNamedSecurityInfoA
push ebp
mov dword [esi + 0x1b4], eax
call edi
push str.ConvertStringSidToSidA
push ebp
mov dword [esi + 0x1b8], eax
call edi
mov dword [esi + 0x174], eax
jmp 0x40cc72
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea edx, [esp + 0x34]
push str.Advapi32.dll
push edx
mov dword [esp + 0x144], 4
call fcn.00408bc0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 5
jb 0x40cc09
mov eax, dword [eax + 4]
jmp 0x40cc0c
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0xed
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40cc40
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40cca3
push str.SHGetSpecialFolderPathA
push ebp
call edi
push str.SHGetFolderPathA
push ebp
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x2c], eax
mov ebp, 0x10
jmp 0x40cd5b
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.shell32.dll
push eax
mov dword [esp + 0x144], 6
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 7
jb 0x40ccf2
mov eax, dword [eax + 4]
jmp 0x40ccf5
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0xfb
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40cd29
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.ShFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x40cd7a
push str.SHGetFolderPathA
push eax
call edi
mov dword [esi + 0x2c], eax
jmp 0x40ce2d
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea ecx, [esp + 0x34]
push str.shfolder.dll
push ecx
mov dword [esp + 0x144], 8
call fcn.00408bc0
add esp, 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call fcn.00406ee0
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 9
jb 0x40cdc4
mov eax, dword [eax + 4]
jmp 0x40cdc7
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x106
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40cdfb
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40ce64
push str.PathAppendA
push ebp
call edi
push str.PathFileExistsA
push ebp
mov dword [esi + 0x34], eax
call edi
push str.PathFindOnPathA
push ebp
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
jmp 0x40cf1c
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea edx, [esp + 0x34]
push str.shlwapi.dll
push edx
mov dword [esp + 0x144], 0xa
call fcn.00408bc0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0xb
jb 0x40ceb3
mov eax, dword [eax + 4]
jmp 0x40ceb6
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x115
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40ceea
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40cf83
push str.WTSQueryUserToken
push ebp
call edi
push str.WTSRegisterSessionNotification
push ebp
mov dword [esi + 0x5c], eax
call edi
push str.WTSEnumerateSessionsA
push ebp
mov dword [esi + 0x168], eax
call edi
push str.WTSQuerySessionInformationA
push ebp
mov dword [esi + 0x170], eax
call edi
push str.WTSFreeMemory
push ebp
mov dword [esi + 0x178], eax
call edi
push str.WTSUnRegisterSessionNotification
push ebp
mov dword [esi + 0x17c], eax
call edi
mov dword [esi + 0x16c], eax
jmp 0x40d03b
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.Wtsapi32.dll
push eax
mov dword [esp + 0x144], 0xc
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0xd
jb 0x40cfd2
mov eax, dword [eax + 4]
jmp 0x40cfd5
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x12f
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d009
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d1c5
push str.GetAdaptersInfo
push ebp
call edi
push str.GetAdaptersAddresses
push ebp
mov dword [esi + 0x7c], eax
call edi
push str.GetNetworkParams
push ebp
mov dword [esi + 0x80], eax
call edi
push str.GetPerAdapterInfo
push ebp
mov dword [esi + 0x88], eax
call edi
push str.GetIfEntry
push ebp
mov dword [esi + 0x84], eax
call edi
push str.GetIfTable
push ebp
mov dword [esi + 0x8c], eax
call edi
push str.SendARP
push ebp
mov dword [esi + 0x90], eax
call edi
push str.GetIpNetTable
push ebp
mov dword [esi + 0xb0], eax
call edi
push str.DeleteIpNetEntry
push ebp
mov dword [esi + 0xa8], eax
call edi
push str.AllocateAndGetTcpExTableFromStack
push ebp
mov dword [esi + 0xac], eax
call edi
push str.AllocateAndGetUdpExTableFromStack
push ebp
mov dword [esi + 0xb4], eax
call edi
push str.GetUdpTable
push ebp
mov dword [esi + 0xb8], eax
call edi
push str.GetTcpTable
push ebp
mov dword [esi + 0xbc], eax
call edi
push str.GetExtendedTcpTable
push ebp
mov dword [esi + 0xc0], eax
call edi
push str.NotifyAddrChange
push ebp
mov dword [esi + 0xc4], eax
call edi
push str.NotifyRouteChange
push ebp
mov dword [esi + 0xc8], eax
call edi
mov dword [esi + 0xcc], eax
call fcn.0040bfd0
test eax, eax
je 0x40d181
push str.IcmpCreateFile
push ebp
call edi
push str.Icmp6CreateFile
push ebp
mov dword [esi + 0xd0], eax
call edi
push str.IcmpSendEcho
push ebp
mov dword [esi + 0xd4], eax
call edi
push str.Icmp6SendEcho2
push ebp
mov dword [esi + 0xd8], eax
call edi
push str.IcmpCloseHandle
push ebp
mov dword [esi + 0xdc], eax
call edi
mov dword [esi + 0xe0], eax
jmp 0x40d27d
push str.Icmp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d27d
push str.IcmpCreateFile
push ebp
call edi
push str.IcmpSendEcho
push ebp
mov dword [esi + 0xd0], eax
call edi
push str.IcmpCloseHandle
push ebp
mov dword [esi + 0xd8], eax
call edi
mov dword [esi + 0xe0], eax
jmp 0x40d27d
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea ecx, [esp + 0x34]
push str.Iphlpapi.dll
push ecx
mov dword [esp + 0x144], 0xe
call fcn.00408bc0
add esp, 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0xf
jb 0x40d214
mov eax, dword [eax + 4]
jmp 0x40d217
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x176
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d24b
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
cmp dword [esi + 0xd0], ebx
jne 0x40d2c0
push str.Icmp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d2c0
push str.IcmpCreateFile
push ebp
call edi
push str.IcmpSendEcho
push ebp
mov dword [esi + 0xd0], eax
call edi
push str.IcmpCloseHandle
push ebp
mov dword [esi + 0xd8], eax
call edi
mov dword [esi + 0xe0], eax
push str.inetmib1.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d3d7
push str.SnmpExtensionInit
push ebp
call edi
push str.SnmpExtensionQuery
push ebp
mov dword [esi + 0x94], eax
call edi
push str.Snmpapi.dll
mov dword [esi + 0x98], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d331
push str.SnmpUtilMemReAlloc
push ebp
call edi
push str.SnmpUtilVarBindListFree
push ebp
mov dword [esi + 0x9c], eax
call edi
push str.SnmpUtilOidCpy
push ebp
mov dword [esi + 0xa0], eax
call edi
mov dword [esi + 0xa4], eax
jmp 0x40d48f
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea edx, [esp + 0x34]
push str.Snmpapi.dll
mov ebp, 0x10
push edx
mov dword [esp + 0x144], ebp
call fcn.00408bc0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00406ee0
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x11
jb 0x40d37c
mov eax, dword [eax + 4]
jmp 0x40d37f
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x19b
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d3b3
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea edx, [esp + 0x80]
push edx
jmp 0x40d47c
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.inetmib1
push eax
mov dword [esp + 0x144], 0x12
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x13
jb 0x40d426
mov eax, dword [eax + 4]
jmp 0x40d429
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x1a9
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d45d
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, eax
push str.GetSystemTimes
push ebp
call edi
push str.CreateToolhelp32Snapshot
push ebp
mov dword [esi + 0x40], eax
call edi
push str.Process32First
push ebp
mov dword [esi + 0xe4], eax
call edi
push str.Process32Next
push ebp
mov dword [esi + 0xe8], eax
call edi
push str.ProcessIdToSessionId
push ebp
mov dword [esi + 0xec], eax
call edi
push str.WTSGetActiveConsoleSessionId
push ebp
mov dword [esi + 0x64], eax
call edi
push str.GetProcessTimes
push ebp
mov dword [esi + 0x58], eax
call edi
push str.ReadProcessMemory
push ebp
mov dword [esi + 0x150], eax
call edi
push str.GetProcessHandleCount
push ebp
mov dword [esi + 0x154], eax
call edi
push 0x427bc8
push ebp
mov dword [esi + 0x144], eax
call edi
push str.GlobalMemoryStatusEx
push ebp
mov dword [esi + 0x158], eax
call edi
push str.QueryFullProcessImageNameA
push ebp
mov dword [esi + 0x15c], eax
call edi
push str.Psapi.dll
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x40d591
push str.GetModuleFileNameExA
mov ecx, eax
push ecx
call edi
mov edx, dword [esp + 0x14]
push str.GetProcessMemoryInfo
push edx
mov dword [esi + 0xf0], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esp + 0x14]
push str.GetProcessImageFileNameA
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.EnumProcessModules
push ecx
mov dword [esi + 0xf4], eax
call edi
mov dword [esi + 0xf8], eax
push str.Netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x40d6ef
push str.NetUserEnum
mov edx, eax
push edx
call edi
mov dword [esi + 0xfc], eax
mov eax, dword [esp + 0x14]
push str.NetShareEnum
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetShareDel
push ecx
mov dword [esi + 0x100], eax
call edi
mov edx, dword [esp + 0x14]
push str.NetShareGetInfo
push edx
mov dword [esi + 0x104], eax
call edi
mov dword [esi + 0x108], eax
mov eax, dword [esp + 0x14]
push str.NetUserGetInfo
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetApiBufferFree
push ecx
mov dword [esi + 0x10c], eax
call edi
mov edx, dword [esp + 0x14]
push str.NetGroupEnum
push edx
mov dword [esi + 0x110], eax
call edi
mov dword [esi + 0x114], eax
mov eax, dword [esp + 0x14]
push str.NetGroupGetUsers
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetUserGetGroups
push ecx
mov dword [esi + 0x118], eax
call edi
mov edx, dword [esp + 0x14]
push str.NetLocalGroupEnum
push edx
mov dword [esi + 0x11c], eax
call edi
mov dword [esi + 0x120], eax
mov eax, dword [esp + 0x14]
push str.NetLocalGroupGetMembers
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetUserGetLocalGroups
push ecx
mov dword [esi + 0x124], eax
call edi
mov edx, dword [esp + 0x14]
push str.NetUserAdd
push edx
mov dword [esi + 0x128], eax
call edi
mov dword [esi + 0x12c], eax
mov eax, dword [esp + 0x14]
push str.NetUserDel
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetUserSetInfo
push ecx
mov dword [esi + 0x130], eax
call edi
mov edx, dword [esp + 0x14]
push str.NetApiBufferAllocate
push edx
mov dword [esi + 0x134], eax
call edi
mov dword [esi + 0x138], eax
push str.NetUserModalsGet
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x14]
push str.NetUserModalsSet
push ecx
mov dword [esi + 0x13c], eax
call edi
mov dword [esi + 0x140], eax
jmp 0x40d7a4
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea edx, [esp + 0x34]
push str.Netapi32.dll
push edx
mov dword [esp + 0x144], 0x14
call fcn.00408bc0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00406ee0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x13c], 0x15
jb 0x40d73a
mov eax, dword [eax + 4]
jmp 0x40d73d
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x1fe
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], 0x10
jb 0x40d772
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Wow64DisableWow64FsRedirection
push ebp
call edi
push str.Wow64RevertWow64FsRedirection
push ebp
mov dword [esi + 0x180], eax
call edi
push str.GetSystemWow64DirectoryA
push ebp
mov dword [esi + 0x184], eax
call edi
push str.wininet.dll
mov dword [esi + 0x188], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d838
push str.InternetOpenA
push ebp
call edi
push str.InternetOpenUrlA
push ebp
mov dword [esi + 0x18c], eax
call edi
push str.HttpQueryInfoA
push ebp
mov dword [esi + 0x190], eax
call edi
push str.InternetReadFile
push ebp
mov dword [esi + 0x194], eax
call edi
push str.InternetCloseHandle
push ebp
mov dword [esi + 0x19c], eax
call edi
push str.InternetSetOptionA
push ebp
mov dword [esi + 0x1a0], eax
call edi
mov dword [esi + 0x198], eax
jmp 0x40d8f0
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.wininet.dll
push eax
mov dword [esp + 0x144], 0x16
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x17
jb 0x40d887
mov eax, dword [eax + 4]
jmp 0x40d88a
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x21a
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d8be
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40d94c
push str.NtQueryInformationProcess
push ebp
call edi
push str.NtQuerySystemInformation
push ebp
mov dword [esi + 0x160], eax
call edi
push str.NtCreateFile
push ebp
mov dword [esi + 0x164], eax
call edi
push str.NtDeviceIoControlFile
push ebp
mov dword [esi + 0x1a4], eax
call edi
push str.NtClose
push ebp
mov dword [esi + 0x1a8], eax
call edi
mov dword [esi + 0x1ac], eax
jmp 0x40da04
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea ecx, [esp + 0x34]
push str.ntdll.dll
push ecx
mov dword [esp + 0x144], 0x18
call fcn.00408bc0
add esp, 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x19
jb 0x40d99b
mov eax, dword [eax + 4]
jmp 0x40d99e
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x22e
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40d9d2
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.version.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40da44
push str.GetFileVersionInfoA
push ebp
call edi
push str.GetFileVersionInfoSizeA
push ebp
mov dword [esi + 0x1bc], eax
call edi
push str.VerQueryValueA
push ebp
mov dword [esi + 0x1c0], eax
call edi
mov dword [esi + 0x1c4], eax
jmp 0x40dafc
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea edx, [esp + 0x34]
push str.version.dll
push edx
mov dword [esp + 0x144], 0x1a
call fcn.00408bc0
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x1b
jb 0x40da93
mov eax, dword [eax + 4]
jmp 0x40da96
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x23d
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40daca
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40db4a
push str.CM_Get_Device_ID_List_ExW
push ebp
call edi
push str.CM_Get_HW_Prof_Flags_ExW
push ebp
mov dword [esi + 0x1c8], eax
call edi
push str.CM_Set_HW_Prof_Flags_ExW
push ebp
mov dword [esi + 0x1cc], eax
call edi
push str.SetupDiGetHwProfileList
push ebp
mov dword [esi + 0x1d0], eax
call edi
mov dword [esi + 0x1d4], eax
jmp 0x40dc02
push 1
push 2
lea ecx, [esp + 0x3c]
call fcn.00408fb0
lea eax, [esp + 0x34]
push str.setupapi.dll
push eax
mov dword [esp + 0x144], 0x1c
call fcn.00408bc0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00406ee0
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
mov byte [esp + 0x13c], 0x1d
jb 0x40db99
mov eax, dword [eax + 4]
jmp 0x40db9c
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x24e
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], ebp
jb 0x40dbd0
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x80]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x84], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40dc42
push str.getaddrinfo
push ebp
call edi
push str.getnameinfo
push ebp
mov dword [esi + 0x1d8], eax
call edi
push str.freeaddrinfo
push ebp
mov dword [esi + 0x1dc], eax
call edi
mov dword [esi + 0x1e0], eax
jmp 0x40dd13
push 1
push 2
lea ecx, [esp + 0xbc]
call fcn.00408fb0
lea ecx, [esp + 0xb4]
push str.ws2_32.dll
push ecx
mov dword [esp + 0x144], 0x1e
call fcn.00408bc0
add esp, 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0xb8]
call fcn.00406ee0
mov edi, 0x10
cmp dword [eax + 0x18], edi
mov byte [esp + 0x13c], 0x1f
jb 0x40dc9a
mov eax, dword [eax + 4]
jmp 0x40dc9d
add eax, 4
push eax
push str.CFunctionPoint::CFunctionPoint
push 0x25d
push str..common_funcpoint.cpp
push 0xf0000000
call fcn.004097d0
mov ecx, eax
call fcn.0040bdb0
cmp dword [esp + 0x30], edi
jb 0x40dcd1
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ecb6
add esp, 4
lea ecx, [esp + 0x100]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x13c], 0xffffffff
call fcn.004061d0
lea ecx, [esp + 0x100]
push ecx
mov dword [esp + method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0040ea59
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret