Function at 0x466d77
Capabilities:
Check os version
Create thread
Terminate process

Disassembly:
sub esp, 0xd84
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0xd80], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xd94]
lea ecx, [esp + 0x2c]
push edi
mov dword [esp + 0x1c], esi
call fcn.00466577
push 0x54f910
lea ecx, [esp + 0x64]
call fcn.004665e8
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x53486c]
push 3
pop ebp
push 0x50
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x54e908]
mov dword [esp + 0x30], ebx
pop edi
cmp eax, dword [ecx + 4]
jle 0x466de1
jmp 0x467d70
push 3
pop ebp
xor eax, eax
inc eax
cmp byte [0x54e516], bl
jne 0x4683a2
mov byte [0x54e516], al
cmp word [0x5570e0], bx
je 0x466e1e
call fcn.0046c19a
call fcn.0040f455
movzx ecx, word [eax + 0x2b5e]
mov eax, dword [0x54efc0]
or byte [eax + ecx*8 + 0xf], 0x40
call fcn.0046c271
test esi, esi
jne 0x466e29
mov ecx, 0x4c060e
jmp 0x466e3a
push esi
call fcn.00447230
pop ecx
cmp eax, edi
mov ecx, str.Error_message_too_long_
cmovbe ecx, esi
push ecx
lea eax, [esp + 0x77c]
push eax
call fcn.00446f90
pop ecx
pop ecx
call fcn.0046c314
cmp word [0x5570e0], bx
je 0x466ef1
mov esi, dword [0x54efc0]
xor eax, eax
xor edi, edi
add esi, 8
cmp ax, word [0x54efc8]
jae 0x466eed
push 8
pop ebx
mov ecx, esi
call fcn.0046c303
test ax, ax
jne 0x466edf
push ebp
call fcn.0040f455
add eax, 0x702
push eax
lea eax, [esi + 2]
push eax
call fcn.0040a300
add esp, 0xc
test ax, ax
jne 0x466edf
lea eax, [esp + 0x694]
push eax
push edi
call fcn.0046be76
push 0x7b
call fcn.00441c9f
add esp, 0xc
test eax, eax
je 0x466ecb
lea ecx, [esp + 0x694]
push ecx
mov ecx, eax
call fcn.00466593
jmp 0x466ecd
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x14]
push eax
call fcn.00466cde
inc edi
add esi, ebx
cmp di, word [0x54efc8]
jb 0x466e75
xor ebx, ebx
mov esi, dword [esp + 0x1c]
xor edi, edi
push edi
call fcn.0040f455
movzx eax, word [eax + 0x2b5e]
push eax
call fcn.0046be76
push edi
call fcn.0046c453
push 0xb
lea eax, [esp + 0xbb]
push eax
push edi
call fcn.0045b85c
add esp, 0x18
test ax, ax
je 0x466f38
push 0xb
lea eax, [esp + 0xaf]
push 0x20
push eax
call fcn.00443240
add esp, 0xc
lea eax, [esp + 0x720]
push eax
call fcn.004a7bf1
lea eax, [esp + 0x748]
push eax
call fcn.0040972a
lea eax, [esp + 0x74c]
push eax
call fcn.0046f9a7
lea eax, [esp + 0x7d8]
push eax
call fcn.0046fa2e
add esp, 0x10
lea eax, [esp + 0x820]
push eax
call fcn.004a2b08
push eax
call fcn.0044140b
lea eax, [esp + 0x71c]
push eax
push dword [esp + 0xda8]
call fcn.004a6dfb
mov ebp, dword [esp + 0xdb0]
add esp, 0x10
test bp, bp
je 0x466fdc
lea eax, [esp + 0x714]
push 0x4db954
push eax
call fcn.00446fa0
pop ecx
pop ecx
lea eax, [esp + 0x714]
push 5
push eax
call fcn.00447230
pop ecx
lea ecx, [esp + 0x718]
add eax, ecx
push eax
push ebp
call fcn.0040a83c
add esp, 0xc
push str.axiserr.log
lea eax, [esp + 0x878]
push 1
push eax
call fcn.0046b01e
pop ecx
pop ecx
push eax
call fcn.00446fa0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x148]
call fcn.004a7891
push edi
lea ecx, [esp + 0x148]
call fcn.0040c68c
lea ecx, [esp + 0x144]
test ax, ax
je 0x46702b
push 3
pop edi
push edi
call fcn.0040c8b0
jmp 0x467034
push edi
call fcn.0040c808
push 3
pop edi
movzx eax, ax
test ax, ax
jne 0x4673a7
lea ecx, [esp + 0x144]
call fcn.0040ca35
test ax, ax
jne 0x46737b
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x148]
call fcn.0040c7a7
lea eax, [esp + 0x714]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x150]
push str.On__date__2_at__time__2_error_code__str__occurred.
push eax
call fcn.004a7916
add esp, 0x14
test esi, esi
je 0x4670a8
lea eax, [esp + 0x778]
push eax
lea eax, [esp + 0x148]
push eax
call fcn.004a7916
pop ecx
pop ecx
push 0x23
lea eax, [esp + 0x7b]
push eax
lea eax, [esp + 0x14c]
push str.Function_Description___txt__
push eax
call fcn.004a7916
add esp, 0x10
lea eax, [esp + 0x7cc]
cmp byte [esp + 0x744], 0
push eax
lea eax, [esp + 0x724]
push eax
jne 0x467101
push 0x14
pop eax
push eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x154]
push str.User_ID___txt___on_Workstation___str___using__str_
push eax
call fcn.004a7916
add esp, 0x18
jmp 0x46712a
lea eax, [esp + 0x74c]
push eax
push 0x14
pop eax
push eax
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x158]
push str.User_ID___txt___on_Client_Station___str___attached_to_Terminal_Server___str___using__str_
push eax
call fcn.004a7916
add esp, 0x1c
push 0xb
lea eax, [esp + 0xaf]
push eax
push 0x20
call fcn.0045b85c
add esp, 0xc
test ax, ax
jne 0x467188
call fcn.004472d4
cmp dword [eax], edi
jl 0x467188
call fcn.004136a7
push dword [eax + 8]
lea eax, [esp + 0x824]
push eax
push edi
lea eax, [esp + 0xbf]
push eax
push 8
pop eax
push eax
lea eax, [esp + 0xbf]
push eax
lea eax, [esp + 0x15c]
push str.The_function_was__txt_._txt___str__entry_point__str_
push eax
call fcn.004a7916
add esp, 0x20
jmp 0x4671a5
lea eax, [esp + 0x820]
push eax
lea eax, [esp + 0x148]
push str.The_function_was__str_
push eax
call fcn.004a7916
add esp, 0xc
cmp dword [esp + 0x40], 0
lea ecx, [esp + 0x144]
je 0x46732a
push str.The_multiuser_activity_in_that_company_group_at_that_time_was:
call fcn.004a79bc
push str.User_________________Function______________________________Workstation_____Client__________Additional_Information
lea ecx, [esp + 0x148]
call fcn.004a79bc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
call fcn.00466afd
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x34]
call fcn.004a8ca0
mov ebx, dword [esp + 0x28]
cmp ebx, dword [eax + 8]
je 0x467334
push 0x14
pop ebp
lea ecx, [esp + 0x20]
call fcn.0046665e
push 0
push ebp
lea ecx, [esp + 0x14c]
mov edi, dword [eax]
push edi
call fcn.0040cb13
push 0
push 1
push 0x4cc5f0
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 0x23
lea eax, [edi + 0x14]
push eax
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 1
push 0x4cc5f0
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 1
lea esi, [edi + 0x37]
push esi
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 1
push 0x4cc5f0
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 0xf
pop eax
push eax
lea eax, [edi + 0x38]
push eax
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 1
push 0x4cc5f0
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 0x30
pop eax
push eax
lea eax, [edi + 0x47]
push eax
lea ecx, [esp + 0x150]
call fcn.0040cb13
cmp byte [esi], 0x56
jl 0x4672f0
push 0
push 1
push 0x4cc5f0
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0
push 0xb
push str.CORRUPTIBLE
lea ecx, [esp + 0x150]
call fcn.0040cb13
push 0x4c060e
lea ecx, [esp + 0x148]
call fcn.004a79bc
lea eax, [esp + 0x44]
inc ebx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebx
call fcn.004a8ca0
cmp ebx, dword [eax + 8]
jne 0x4671fe
mov ebp, dword [esp + 0xda0]
mov esi, dword [esp + 0x1c]
jmp 0x467334
push str.The_function_was_running_in_a_singleuser_environment
call fcn.004a79bc
cmp word [esp + 0xda4], 0
jne 0x467348
cmp byte [0x54f949], 0x56
jl 0x467359
push str.AS_A_RESULT__THIS_COMPANY_GROUP_IS_NOW_CORRUPT_
lea ecx, [esp + 0x148]
call fcn.004a79bc
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x148]
call fcn.0040c7a7
push str.________________________________________________________________________________
lea ecx, [esp + 0x148]
call fcn.004a79bc
lea ecx, [esp + 0x144]
call fcn.0040c61c
lea eax, [esp + 0x50]
xor ecx, ecx
push eax
push ecx
lea eax, [esp + 0x68]
push eax
push 0x466845
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
mov dword [esp + 0x2c], eax
cmp word [esp + 0xda4], 0
jne 0x4673bb
cmp byte [0x54f949], 0x56
jl 0x4673d8
lea eax, [esp + 0x778]
push eax
push ebp
push dword [esp + 0xda4]
push 0x54f910
call fcn.004ac5d8
add esp, 0x10
push str.Program_aborted___Axis_error_code
mov edi, 0x54e608
push edi
call fcn.00446f90
lea eax, [esp + 0x71c]
push eax
push edi
call fcn.00446fa0
push str._from__
push edi
call fcn.00446fa0
push 0x23
lea eax, [esp + 0x93]
push eax
push edi
call fcn.0045ba3a
push 0x22
push edi
call fcn.0040970e
push 0x4c
push 0xb
lea eax, [esp + 0x748]
push 0x54e518
push eax
call fcn.00409819
add esp, 0x3c
test esi, esi
je 0x46744f
push 0x33
lea eax, [esp + 0x77c]
push 0x54e660
push eax
call fcn.004a6f83
add esp, 0xc
jmp 0x46745a
push 0x54e660
call fcn.0040972a
pop ecx
lea eax, [esp + 0x10]
push eax
call fcn.0040f455
add eax, 0x400
push eax
call fcn.0045dd6f
push 0xc
pop eax
push eax
push 0x20
mov ebp, 0x54e694
mov byte [esp + 0x23], 0
push ebp
call fcn.00443240
push 0xb
lea eax, [esp + 0xc3]
push eax
push 0x20
call fcn.0045b85c
add esp, 0x20
test ax, ax
jne 0x46750f
push ebp
push 8
pop eax
push eax
lea eax, [esp + 0xb3]
push eax
call fcn.0045bdd9
push ebp
call fcn.0045bb79
push 0x2e
push ebp
call fcn.0040970e
push ebp
call fcn.00447230
push 3
add eax, ebp
lea ecx, [esp + 0xd3]
pop ebp
push ebp
push ecx
push eax
call fcn.00442cc0
add esp, 0x28
call fcn.004472d4
cmp dword [eax], 2
jle 0x4674ff
push 0x4c
push ebp
push 0x54e6a0
call fcn.004136a7
push dword [eax + 8]
call fcn.00409819
add esp, 0x10
jmp 0x46750f
push ebp
push 0x20
push 0x54e6a0
call fcn.00443240
add esp, 0xc
push 0x4c
push 0x50
pop ebp
push ebp
lea eax, [esp + 0x828]
push 0x54e5b8
push eax
call fcn.00409819
push 0x14
pop eax
push eax
push 0x54f912
push 0x54e6a4
call fcn.00442cc0
push 0x4c
push 0xf
pop eax
push eax
lea eax, [esp + 0x744]
push 0x54e554
push eax
call fcn.00409819
push 0x4c
push ebp
lea eax, [esp + 0x800]
push 0x54e568
push eax
call fcn.00409819
push 0x4c
push 0x30
pop eax
push eax
lea eax, [esp + 0x788]
push 0x54e524
push eax
call fcn.00409819
add esp, 0x4c
push 2
push 0x1d
pop eax
push eax
lea eax, [esp + 0x78]
push 0x54e6b8
push eax
call fcn.0045aa22
push 2
push 8
pop eax
push eax
lea eax, [esp + 0x8c]
push 0x54e6d8
push eax
call fcn.0040a76b
add esp, 0x20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46787c
xor ebp, ebp
mov edi, 0x54e490
push 3
inc ebp
pop ebx
mov ecx, 0x200
mov eax, dword [0x510504]
push str.axis_diplomat_Error
push 0x51a588
mov eax, dword [eax]
or word [eax + 0x10], cx
call fcn.00421d32
pop ecx
pop ecx
movzx ecx, ax
mov edx, 0xfdff
mov eax, dword [0x510504]
mov eax, dword [eax]
and word [eax + 0x10], dx
mov eax, ecx
mov ecx, 0x200
sub eax, 0
je 0x4675d7
sub eax, 1
je 0x4678a1
cmp word [esp + 0xda4], 0
jne 0x46767d
cmp byte [0x54f949], 0x56
jge 0x46767d
lea eax, [esp + 0x10]
push eax
push 0x54e6e0
push str.Your_axis_diplomat__str__data_is_not_corrupt._This_function_will_now_exit_but_other_users_will_continue_to_operate_normally.
call fcn.0045bbb0
mov eax, dword [0x510504]
mov ecx, 0x200
push str.axis_diplomat_Error
push 0x51b460
mov eax, dword [eax]
or word [eax + 0x10], cx
call fcn.00421d32
movzx ecx, ax
mov edx, 0xfdff
mov eax, dword [0x510504]
add esp, 0x14
mov eax, dword [eax]
and word [eax + 0x10], dx
jmp 0x46786f
lea eax, [esp + 0x10]
push eax
push eax
push 0x54e760
push str.Your_axis_diplomat__str__data_is_corrupt_and_you_will_need_to_use_the_axis_diplomat__Restore_Data__function_to_recover_your__str__system_from_a_backup.
call fcn.0045bbb0
add esp, 0x10
call fcn.0046cbca
cmp eax, 5
je 0x4676a3
cmp eax, ebx
jne 0x4676a5
mov eax, ebp
push 0
push 0
lea ecx, [esp + 0x738]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.0046ceeb
add esp, 0x18
test ax, ax
jne 0x4676fd
push 0x14
pop eax
push eax
lea eax, [esp + 0x734]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push str.checkpoint
lea eax, [esp + 0x24]
push eax
push 0x54e7f8
push str.Your_last__str___str__was_taken_at__time__1_on__date2__2_by__txt_.
call fcn.0045bbb0
add esp, 0x20
jmp 0x46770e
push str.There_are_no_available_checkpoints.
push 0x54e7f8
call fcn.00446f90
pop ecx
pop ecx
push 0
push 0
lea eax, [esp + 0x738]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0046ce02
add esp, 0x14
test ax, ax
jne 0x467765
push 0x14
pop eax
push eax
lea eax, [esp + 0x734]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push str.full_backup
lea eax, [esp + 0x24]
push eax
push 0x54e880
push str.Your_last__str___str__was_taken_at__time__1_on__date2__2_by__txt_.
call fcn.0045bbb0
add esp, 0x20
jmp 0x467776
push str.There_are_no_available_full_backups.
push 0x54e880
call fcn.00446f90
pop ecx
pop ecx
mov eax, dword [0x510504]
mov ecx, 0x200
push str.axis_diplomat_Error
push 0x51b0e0
mov eax, dword [eax]
or word [eax + 0x10], cx
call fcn.00421d32
pop ecx
pop ecx
movzx ecx, ax
mov edx, 0xfdff
mov eax, dword [0x510504]
mov eax, dword [eax]
and word [eax + 0x10], dx
cmp cx, bp
jne 0x46786f
mov ebx, 0x200
mov eax, dword [0x519580]
mov al, byte [eax + 0x198]
cmp al, 0x16
jb 0x4677ce
mov ecx, str.https:__www.axisfirst.co.uk_documentation_Steps_To_Take_Before_Recovering_A_Corrupt_System_articles_15263
jmp 0x46782c
cmp al, 0x14
jb 0x4677d9
mov ecx, str.http:__www.axisfirst.co.uk_documentation_Steps_To_Take_Before_Recovering_A_Corrupt_System_article_98715
jmp 0x46782c
cmp al, 0x13
jb 0x4677e4
mov ecx, str.http:__www.axisfirst.co.uk_documentation_Article.asp_P31C7765B293A89595
jmp 0x46782c
cmp al, 0x12
jb 0x4677ef
mov ecx, str.http:__www.axisfirst.co.uk_documentation_Article.asp_P24C4538B195A77945
jmp 0x46782c
cmp al, 0x11
jb 0x4677fa
mov ecx, str.http:__www.axisfirst.co.uk_documentation_Article.asp_P23C3752B160A74373
jmp 0x46782c
push 0xf7
call fcn.00460b68
pop ecx
test ax, ax
je 0x467811
mov ecx, str.http:__www.axisfirst.co.uk_documentation_Article.asp_P1C6B4A62379
jmp 0x46782c
push 0xf8
call fcn.00460b68
pop ecx
test ax, ax
mov ecx, str.http:__www.axisfirst.co.uk_software_support_diplomat2004_support_tsn_2004_132.asp
mov edx, str.http:__www.axisfirst.co.uk_software_support_diplomat2000_support_tsn_2000_132.asp
cmove ecx, edx
push ecx
call fcn.0043c421
mov eax, dword [0x510504]
mov dword [esp], str.axis_diplomat_Error
push 0x51b0e0
mov eax, dword [eax]
or word [eax + 0x10], bx
call fcn.00421d32
pop ecx
pop ecx
movzx ecx, ax
mov edx, 0xfdff
mov eax, dword [0x510504]
mov eax, dword [eax]
and word [eax + 0x10], dx
cmp cx, bp
je 0x4677b8
push 3
pop ebx
test cx, cx
je 0x4675d2
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
call fcn.00466afd
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x34]
call fcn.004a8ca0
mov edi, dword [esp + 0x28]
jmp 0x467d10
mov eax, dword [0x510504]
mov ecx, 0x200
push str.axis_diplomat_Error
push 0x51ac38
mov eax, dword [eax]
or word [eax + 0x10], cx
call fcn.00421d32
pop ecx
pop ecx
movzx ecx, ax
mov edx, 0xfdff
mov eax, dword [0x510504]
mov eax, dword [eax]
and word [eax + 0x10], dx
mov eax, ecx
sub eax, 1
jne 0x4675d2
push 0x84
push eax
push 2
push edi
call fcn.0049f3a9
add esp, 0x10
test ax, ax
je 0x4678a1
xor eax, eax
mov word [0x54e514], ax
call fcn.004667cd
push str.FUNCTION_NAME
call fcn.00447230
push eax
push str.FUNCTION_NAME
push edi
call fcn.00442cc0
push 0x23
lea eax, [esp + 0x8b]
push eax
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
push str.ERROR_CODE
call fcn.00447230
push eax
push str.ERROR_CODE
push edi
call fcn.00442cc0
push 0xb
push 0x54e518
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
add esp, 0x40
test esi, esi
je 0x4679a6
push str.ERROR_TEXT
call fcn.00447230
push eax
push str.ERROR_TEXT
push edi
call fcn.00442cc0
lea eax, [esp + 0x788]
push eax
call fcn.00447230
push eax
lea eax, [esp + 0x790]
push eax
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
add esp, 0x24
push str.PROGRAM_NAME
call fcn.00447230
push eax
push str.PROGRAM_NAME
push edi
call fcn.00442cc0
push 0xc
pop eax
push eax
push 0x54e694
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
push str.ENTRY_POINT
call fcn.00447230
push eax
push str.ENTRY_POINT
push edi
call fcn.00442cc0
push ebx
push 0x54e6a0
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
add esp, 0x40
push str.VERSION
call fcn.00447230
push eax
push str.VERSION
push edi
call fcn.00442cc0
push 0x50
pop eax
push eax
push 0x54e5b8
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
push str.USER_ID
call fcn.00447230
push eax
push str.USER_ID
push edi
call fcn.00442cc0
push 0x14
pop eax
push eax
push 0x54e6a4
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
add esp, 0x40
push str.WORKSTATION_NAME
call fcn.00447230
push eax
push str.WORKSTATION_NAME
push edi
call fcn.00442cc0
push 0xf
pop eax
push eax
push 0x54e554
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
push str.WORKSTATION_OPERATING_SYSTEM
call fcn.00447230
push eax
push str.WORKSTATION_OPERATING_SYSTEM
push edi
call fcn.00442cc0
lea eax, [esp + 0x7fc]
push eax
push 0x54e4b8
call fcn.00446f90
push ebp
call fcn.004164e1
push str.CLIENT_NAME
call fcn.00447230
add esp, 0x40
push eax
push str.CLIENT_NAME
push edi
call fcn.00442cc0
push 0x30
pop eax
push eax
push 0x54e524
push 0x54e4b8
call fcn.00442cc0
push ebp
call fcn.004164e1
push str.DATE
call fcn.00447230
push eax
push str.DATE
push edi
call fcn.00442cc0
push 2
push 0x1d
pop eax
push eax
lea eax, [esp + 0xa4]
push 0x54e4b8
push eax
call fcn.0045aa22
push ebp
call fcn.004164e1
add esp, 0x40
push str.TIME
call fcn.00447230
push eax
push str.TIME
push edi
call fcn.00442cc0
push 2
push 8
pop eax
push eax
lea eax, [esp + 0x8c]
push 0x54e4b8
push eax
call fcn.0040a76b
push 2
call fcn.004164e1
add esp, 0x24
cmp dword [esp + 0x40], 0
je 0x467c95
push str.CURRENT_ACTIVITY
call fcn.00447230
push eax
push str.CURRENT_ACTIVITY
push edi
call fcn.00442cc0
push 2
call fcn.004164e1
push str.USER_________________FUNCTION___________________________STATUS_WORKSTATION____CLIENT__________ADDITIONAL_INFORMATION
call fcn.00447230
push eax
push str.USER_________________FUNCTION___________________________STATUS_WORKSTATION____CLIENT__________ADDITIONAL_INFORMATION
push edi
call fcn.00442cc0
push 2
call fcn.004164e1
add esp, 0x28
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
push eax
call fcn.00466afd
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x34]
call fcn.004a8ca0
mov edi, dword [esp + 0x28]
cmp edi, dword [eax + 8]
je 0x467c86
push 0x14
pop ebx
lea ecx, [esp + 0x20]
call fcn.0046665e
mov esi, dword [eax]
call fcn.0049f3cb
test ax, ax
je 0x467bf1
call fcn.004667cd
push ebx
push esi
push 0x54e490
call fcn.00442cc0
push 0x23
lea eax, [esi + 0x14]
push eax
push 0x54e4a5
call fcn.00442cc0
mov al, byte [esi + 0x37]
push 0xf
mov byte [0x54e4ca], al
pop eax
push eax
lea eax, [esi + 0x38]
push eax
push 0x54e4cf
call fcn.00442cc0
push 0x30
pop eax
push eax
lea eax, [esi + 0x47]
push eax
push 0x54e4de
call fcn.00442cc0
add esp, 0x30
cmp byte [esi + 0x37], 0x56
jl 0x467c5c
mov esi, str.CORRUPTIBLE
push esi
call fcn.00447230
push eax
push esi
push 0x54e4ee
call fcn.00442cc0
add esp, 0x10
push ebp
call fcn.004164e1
pop ecx
lea eax, [esp + 0x44]
inc edi
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call fcn.004a8ca0
cmp edi, dword [eax + 8]
jne 0x467bd7
mov esi, dword [esp + 0x1c]
push 3
pop ebx
mov edi, 0x54e490
call fcn.00416828
jmp 0x4678a1
push str.FUNCTION_WAS_RUNNING_IN_A_SINGLE_USER_ENVIRONMENT
call fcn.00447230
push eax
push str.FUNCTION_WAS_RUNNING_IN_A_SINGLE_USER_ENVIRONMENT
push edi
call fcn.00442cc0
push ebp
call fcn.004164e1
add esp, 0x14
jmp 0x467c8b
push 0x7b
lea ecx, [esp + 0x24]
call fcn.0046665e
push dword [eax]
call fcn.00442214
push ecx
mov esi, esp
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
and dword [esi], 0
and dword [esi + 4], 0
call fcn.0042a1a6
lea eax, [esp + 0x60]
mov dword [esi + 8], edi
push eax
lea ecx, [esp + 0x40]
call fcn.00466c94
mov esi, eax
lea ecx, [esp + 0x20]
push esi
call fcn.0042a1a6
mov edi, dword [esi + 8]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call fcn.004a8ca0
cmp edi, dword [eax + 8]
jne 0x467cb6
test ebx, ebx
je 0x467d29
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.0046cdc9
pop ecx
call fcn.004683f4
lea ecx, [esp + 0x67d]
call fcn.00440809
lea ecx, [esp + 0x144]
call fcn.0040c5fb
lea ecx, [esp + 0x30]
call fcn.004859b1
mov ecx, dword [esp + 0xd90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0xd84
ret
mov ebp, 0x54e908
push ebp
call fcn.00442110
cmp dword [0x54e908], 0xffffffff
pop ecx
jne 0x466dde
xor edx, edx
lea eax, [esp + 0x77]
mov dword [0x51a8d0], eax
mov edi, 0x51a8fa
xor eax, eax
mov ecx, 0x18000
push 0xb
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51a91e], ax
mov edi, 0x51a944
mov byte [0x51a920], al
xor eax, eax
mov dword [0x51a904], edx
mov dword [0x51a908], edx
mov dword [0x51a90c], 0x4db67c
mov dword [0x51a910], edx
mov dword [0x51a914], edx
mov word [0x51a918], 0x534b
mov dword [0x51a91a], 0x54e518
mov byte [0x51a921], dl
mov dword [0x51a922], edx
mov dword [0x51a926], 0x10000
mov dword [0x51a92a], edx
mov dword [0x51a92e], edx
mov dword [0x51a932], edx
mov dword [0x51a936], edx
mov dword [0x51a93a], edx
mov dword [0x51a93e], 0x4db688
mov word [0x51a942], dx
stosd dword es:[edi], eax
push 0xc
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51a968], ax
mov edi, 0x51a98e
xor eax, eax
mov dword [0x51a94e], edx
mov dword [0x51a952], edx
mov dword [0x51a956], 0x4db6b4
mov dword [0x51a95a], edx
mov dword [0x51a95e], edx
mov word [0x51a962], 0x4c4b
mov dword [0x51a964], 0x54e694
mov word [0x51a96a], dx
mov dword [0x51a96c], edx
mov dword [0x51a970], ecx
mov dword [0x51a974], edx
mov dword [0x51a978], edx
mov dword [0x51a97c], edx
mov dword [0x51a980], edx
mov dword [0x51a984], edx
mov dword [0x51a988], 0x4db6c4
mov word [0x51a98c], dx
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51a9b2], ax
xor eax, eax
mov dword [0x51a998], edx
mov dword [0x51a99c], edx
mov dword [0x51a9a0], 0x4db6f0
mov dword [0x51a9a4], edx
mov dword [0x51a9a8], edx
mov word [0x51a9ac], 0x4c4b
mov dword [0x51a9ae], 0x54e6a0
mov word [0x51a9b4], dx
mov dword [0x51a9b6], edx
mov dword [0x51a9ba], ecx
mov dword [0x51a9be], edx
mov dword [0x51a9c2], edx
mov dword [0x51a9c6], edx
mov dword [0x51a9ca], edx
mov dword [0x51a9ce], edx
mov dword [0x51a9d2], 0x4db700
mov word [0x51a9d6], dx
mov edi, 0x51a9d8
push 0x50
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51a9fc], ax
mov edi, 0x51aa22
xor eax, eax
mov dword [0x51a9e2], edx
mov dword [0x51a9e6], edx
mov dword [0x51a9ea], 0x4cd6a4
mov dword [0x51a9ee], edx
mov dword [0x51a9f2], edx
mov word [0x51a9f6], 0x4c4b
mov dword [0x51a9f8], 0x54e5b8
mov word [0x51a9fe], dx
mov dword [0x51aa00], edx
mov dword [0x51aa04], ecx
mov dword [0x51aa08], edx
mov dword [0x51aa0c], edx
mov dword [0x51aa10], edx
mov dword [0x51aa14], edx
mov dword [0x51aa18], edx
mov dword [0x51aa1c], 0x4db750
mov word [0x51aa20], dx
stosd dword es:[edi], eax
push 0x14
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51aa46], ax
mov edi, 0x51aa6c
xor eax, eax
mov dword [0x51aa2c], edx
mov dword [0x51aa30], edx
mov dword [0x51aa34], 0x4db7c0
mov dword [0x51aa38], edx
mov dword [0x51aa3c], edx
mov word [0x51aa40], 0x4c4b
mov dword [0x51aa42], 0x54e6a4
mov word [0x51aa48], dx
mov dword [0x51aa4a], edx
mov dword [0x51aa4e], ecx
mov dword [0x51aa52], edx
mov dword [0x51aa56], edx
mov dword [0x51aa5a], edx
mov dword [0x51aa5e], edx
mov dword [0x51aa62], edx
mov dword [0x51aa66], 0x4db7c8
mov word [0x51aa6a], dx
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51aa90], ax
mov edi, 0x51aab6
mov dword [0x51aa76], edx
xor eax, eax
mov dword [0x51aa7a], edx
mov dword [0x51aa7e], 0x4db7f8
mov dword [0x51aa82], edx
mov dword [0x51aa86], edx
mov word [0x51aa8a], 0x4c4b
mov dword [0x51aa8c], 0x54e554
mov word [0x51aa92], dx
mov dword [0x51aa94], edx
mov dword [0x51aa98], ecx
mov dword [0x51aa9c], edx
mov dword [0x51aaa0], edx
mov dword [0x51aaa4], edx
mov dword [0x51aaa8], edx
mov dword [0x51aaac], edx
mov dword [0x51aab0], 0x4db80c
mov word [0x51aab4], dx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [0x51aac0], edx
mov dword [0x51aac4], edx
push 0x50
pop eax
mov word [0x51aada], ax
mov edi, 0x51ab00
xor eax, eax
mov dword [0x51aac8], 0x4db834
mov dword [0x51aacc], edx
mov dword [0x51aad0], edx
mov word [0x51aad4], 0x4c4b
mov dword [0x51aad6], 0x54e568
mov word [0x51aadc], dx
mov dword [0x51aade], edx
mov dword [0x51aae2], ecx
mov dword [0x51aae6], edx
mov dword [0x51aaea], edx
mov dword [0x51aaee], edx
mov dword [0x51aaf2], edx
mov dword [0x51aaf6], edx
mov dword [0x51aafa], 0x4db844
mov word [0x51aafe], dx
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51ab24], ax
mov edi, 0x51ab4a
xor eax, eax
mov dword [0x51ab0a], edx
mov dword [0x51ab0e], edx
mov dword [0x51ab12], 0x4db870
mov dword [0x51ab16], edx
mov dword [0x51ab1a], edx
mov word [0x51ab1e], 0x4c4b
mov dword [0x51ab20], 0x54e524
mov word [0x51ab26], dx
mov dword [0x51ab28], edx
mov dword [0x51ab2c], ecx
mov dword [0x51ab30], edx
mov dword [0x51ab34], edx
mov dword [0x51ab38], edx
mov dword [0x51ab3c], edx
mov dword [0x51ab40], edx
mov dword [0x51ab44], 0x4db880
mov word [0x51ab48], dx
stosd dword es:[edi], eax
push 0x1d
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
mov word [0x51ab6e], ax
mov edi, 0x51ab94
mov dword [0x51ab54], edx
xor eax, eax
mov dword [0x51ab58], edx
mov dword [0x51ab5c], 0x4db514
mov dword [0x51ab60], edx
mov dword [0x51ab64], edx
mov word [0x51ab68], 0x4c4b
mov dword [0x51ab6a], 0x54e6b8
mov word [0x51ab70], dx
mov dword [0x51ab72], edx
mov dword [0x51ab76], ecx
mov dword [0x51ab7a], edx
mov dword [0x51ab7e], edx
mov dword [0x51ab82], edx
mov dword [0x51ab86], edx
mov dword [0x51ab8a], edx
mov dword [0x51ab8e], 0x4db8d0
mov word [0x51ab92], dx
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [0x51ab9e], edx
mov dword [0x51aba2], edx
mov dword [0x51aba6], 0x4db51c
mov dword [0x51abaa], edx
mov dword [0x51abae], edx
mov word [0x51abb2], 0x4c4b
mov dword [0x51abb4], 0x54e6d8
pop eax
mov word [0x51abb8], ax
mov edi, 0x51abde
mov word [0x51abba], dx
xor eax, eax
mov dword [0x51abbc], edx
xorps xmm0, xmm0
mov dword [0x51abc0], ecx
mov dword [0x51abc4], edx
mov dword [0x51abc8], edx
mov dword [0x51abcc], edx
mov dword [0x51abd0], edx
mov dword [0x51abd4], edx
mov dword [0x51abd8], 0x4db8fc
mov word [0x51abdc], dx
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov edi, 0x51ac28
mov dword [0x51abf8], edx
movups xmmword [0x51abe8], xmm0
mov word [0x51abfc], 0x5a4b
mov dword [0x51abfe], edx
mov dword [0x51ac02], eax
mov dword [0x51ac06], 0x4db928
mov dword [0x51ac0a], 0x100
mov dword [0x51ac0e], edx
mov dword [0x51ac12], 0x42ceba
mov dword [0x51ac16], 0x42cc70
mov dword [0x51ac1a], edx
mov dword [0x51ac1e], edx
mov dword [0x51ac22], edx
mov word [0x51ac26], dx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.004420d1
pop ecx
push 3
pop ebp
push 0x50
pop edi
jmp 0x466de1
mov word [0x54e90c], ax
call fcn.004a8399
call fcn.004a74f4
push 0
call fcn.00447bf2
int3