Function at 0x44efd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac8
mov eax, dword [0x50c0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
lea eax, [ebp - 0x624]
push eax
call fcn.0047b170
add esp, 4
mov ecx, eax
call fcn.0043a470
push eax
mov ecx, dword [sym.imp.MSVCR110.dll___wargv]
mov edx, dword [ecx]
push edx
mov eax, dword [sym.imp.MSVCR110.dll___argc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.Dbglog.dll_void___cdecl_Init_dbglog_unsigned_long_int__wchar_t____wchar_t_const___int__int_]
add esp, 0x14
lea ecx, [ebp - 0x624]
call fcn.0042a480
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx edx, al
test edx, edx
je 0x44f048
push 0
mov ecx, 0x50cbec
call fcn.00452090
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx eax, al
test eax, eax
je 0x44f321
xor ecx, ecx
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x750], 0
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004790f0
add esp, 8
mov dword [ebp - 0x74c], eax
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx eax, al
test eax, eax
jne 0x44f0dc
jmp 0x44f17d
mov ecx, dword [ebp - 0x750]
and ecx, 0xffff
push ecx
push 0x4af9fc
mov edx, dword [ebp - 0x74c]
and edx, 0xffff
push edx
push 0x4afa00
mov eax, dword [ebp - 0x74c]
shr eax, 0x10
and eax, 0xffff
push eax
push str.Initializing_Agent_version
lea ecx, [ebp - 0x978]
push ecx
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_short_int_]
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_short_int_]
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_short_int_]
lea ecx, [ebp - 0x978]
call fcn.0042b3f0
xor edx, edx
mov dword [ebp - 0x778], edx
mov dword [ebp - 0x774], edx
mov dword [ebp - 0x770], edx
mov dword [ebp - 0x76c], edx
mov dword [ebp - 0x768], edx
mov dword [ebp - 0x764], edx
mov dword [ebp - 0x760], edx
mov dword [ebp - 0x75c], edx
mov dword [ebp - 0x758], edx
lea eax, [ebp - 0x778]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x11c
push 0
lea ecx, [ebp - 0x740]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x740], 0x11c
lea edx, [ebp - 0x740]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx eax, al
test eax, eax
jne 0x44f20d
jmp 0x44f2e1
movzx ecx, byte [ebp - 0x626]
cmp ecx, 1
jne 0x44f225
mov dword [ebp - 0x754], str._Workstation
jmp 0x44f22f
mov dword [ebp - 0x754], str._Server
movzx edx, word [ebp - 0x778]
cmp edx, 9
jne 0x44f247
mov dword [ebp - 0x748], str._x64
jmp 0x44f251
mov dword [ebp - 0x748], str._x86
mov eax, dword [ebp - 0x754]
push eax
mov ecx, dword [ebp - 0x748]
push ecx
mov edx, dword [ebp - 0x738]
push edx
push 0x4afa48
mov eax, dword [ebp - 0x73c]
push eax
push str.Windows:_version
lea ecx, [ebp - 0xac8]
push ecx
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
lea ecx, [ebp - 0xac8]
call fcn.0042b3f0
mov dword [ebp - 0x77c], 0x100
push 0x200
push 0
lea edx, [ebp - 0x40c]
push edx
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x60c]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x780], 2
mov ecx, dword [sym.imp.MSVCR110.dll___wargv]
mov edx, dword [ecx]
push edx
mov eax, dword [sym.imp.MSVCR110.dll___argc]
mov ecx, dword [eax]
push ecx
mov ecx, 0x50cbcc
call fcn.00401020
push str.opentsm
call fcn.00472600
add esp, 4
call fcn.00403c60
movzx edx, al
test edx, edx
je 0x44f474
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00479350
add esp, 4
mov dword [ebp - 0x744], eax
movzx eax, byte [0x50cbcc]
test eax, eax
je 0x44f3f1
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx ecx, al
test ecx, ecx
jne 0x44f394
jmp 0x44f3e7
mov edx, dword [ebp - 0x744]
push edx
push str.Close_running_instance_of_Agent_for_session
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea ecx, [ebp - 0x828]
call fcn.0042b3f0
call fcn.00403650
jmp 0x44f474
push 0xbb8
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx ecx, al
test ecx, ecx
jne 0x44f40c
jmp 0x44f46d
mov edx, dword [ebp - 0x744]
push edx
push str.Agent_is_already_running_for_session
push 0x4afac8
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
push eax
call fcn.00409fd0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea ecx, [ebp - 0xa20]
call fcn.0042b3f0
xor eax, eax
jmp 0x44f517
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x50cbc8
call fcn.00401a80
test eax, eax
jne 0x44f48d
xor eax, eax
jmp 0x44f517
call fcn.004727f0
mov ecx, 0x50cbc8
call fcn.00402800
mov ecx, 0x50cbc8
call fcn.00402860
push 0x7d0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.004445b0
movzx edx, al
test edx, edx
jne 0x44f4c1
jmp 0x44f505
push str.Agent_process_finished
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.00414cf0
add esp, 4
mov ecx, eax
call fcn.00447b70
mov ecx, eax
call fcn.0043e040
mov ecx, eax
call fcn.00446a20
push eax
call fcn.00409fd0
add esp, 8
lea ecx, [ebp - 0x8d0]
call fcn.0042b3f0
call dword [sym.imp.Dbglog.dll_void___cdecl_Shutdown_dbglog_void_]
mov ecx, 0x50cbec
call fcn.00452760
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a2a4
mov esp, ebp
pop ebp
ret 0x10