Function at 0x436190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb7cf
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4ff684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x5080e8]
cmp eax, dword [edx + 4]
jle 0x4365dd
push 0x5080e8
call fcn.0048949a
add esp, 4
cmp dword [0x5080e8], 0xffffffff
jne 0x4365dd
mov dword [0x5080f0], 0
push 0x20
mov dword [0x508100], 0
mov dword [0x508104], 0xf
mov byte [0x5080f0], 0
call fcn.004892b3
movups xmm0, xmmword [str.EstimatedBatteryTime]
mov dword [0x508100], 0x14
add esp, 4
mov dword [0x508104], 0x1f
movups xmmword [eax], xmm0
mov ecx, dword [0x4ee944]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], 0
mov dword [0x5080f0], eax
push str.RootCIMV2
mov ecx, 0x508108
mov dword [ebp - 4], 0
call fcn.00435900
push str.select_EstimatedRunTime_from_Win32_Battery
mov ecx, 0x50810c
mov byte [ebp - 4], 1
call fcn.00435900
push str.EstimatedRunTime
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00435900
mov dword [ebp - 0x14], 3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, 0x508110
call fcn.004370b0
push 0x4359a0
push 1
push 8
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
call fcn.00489177
movq xmm0, qword [str._no_battery_]
mov eax, dword [0x4ee9a0]
mov dword [0x508130], 0xf
mov dword [0x50812c], 0xc
movq qword [0x50811c], xmm0
mov dword [0x508124], eax
mov byte [0x508128], 0
mov dword [ebp - 4], 6
movq xmm0, qword [str.SystemType]
movzx eax, word [0x4ee9b0]
mov dword [0x508148], 0xf
mov dword [0x508144], 0xa
movq qword [0x508134], xmm0
mov word [0x50813c], ax
mov byte [0x50813e], 0
push str.RootCIMV2
mov ecx, 0x50814c
mov byte [ebp - 4], 7
call fcn.00435900
push str.select_PCSystemTypeEx_from_Win32_ComputerSystem
mov ecx, 0x508150
mov byte [ebp - 4], 8
call fcn.00435900
push str.PCSystemTypeEx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.00435900
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, 0x508154
call fcn.004370b0
push 0x4359a0
push 1
push 8
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0xc
push eax
call fcn.00489177
mov eax, dword [str._error_]
mov dword [0x508160], eax
movzx eax, word [0x4ee9f8]
mov word [0x508164], ax
mov al, byte [0x4ee9fa]
mov dword [0x508174], 0xf
mov dword [0x508170], 7
mov byte [0x508166], al
mov byte [0x508167], 0
movq xmm0, qword [str.PowerState]
movzx eax, word [0x4eea04]
mov dword [0x50818c], 0xf
mov dword [0x508188], 0xa
movq qword [0x508178], xmm0
mov word [0x508180], ax
mov byte [0x508182], 0
push str.RootCIMV2
mov ecx, 0x508190
mov byte [ebp - 4], 0xe
call fcn.00435900
push str.select_PowerState_from_Win32_ComputerSystem
mov ecx, 0x508194
mov byte [ebp - 4], 0xf
call fcn.00435900
push str.PowerState
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x10
call fcn.00435900
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x11
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, 0x508198
call fcn.004370b0
push 0x4359a0
push 1
push 8
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x13
push eax
call fcn.00489177
mov eax, dword [str._error_]
mov dword [0x5081a4], eax
movzx eax, word [0x4ee9f8]
mov word [0x5081a8], ax
mov al, byte [0x4ee9fa]
mov dword [0x5081b8], 0xf
mov dword [0x5081b4], 7
mov byte [0x5081aa], al
mov byte [0x5081ab], 0
mov dword [0x5081d0], 0xf
mov dword [0x5081cc], 0xe
mov eax, dword [0x4eea3c]
movq xmm0, qword [str.WorstDiskState]
mov dword [0x5081c4], eax
movzx eax, word [0x4eea40]
movq qword [0x5081bc], xmm0
mov word [0x5081c8], ax
mov byte [0x5081ca], 0
push str.rootwmi
mov ecx, 0x5081d4
mov byte [ebp - 4], 0x15
call fcn.00435900
push str.select_PredictFailure_from_MSStorageDriver_FailurePredictStatus
mov ecx, 0x5081d8
mov byte [ebp - 4], 0x16
call fcn.00435900
push str.PredictFailure
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x17
call fcn.00435900
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, 0x5081dc
call fcn.004370b0
push 0x4359a0
push 1
push 8
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
push eax
call fcn.00489177
mov dword [0x5081e8], 0
push 0x20
mov dword [0x5081f8], 0
mov dword [0x5081fc], 0xf
mov byte [0x5081e8], 0
call fcn.004892b3
movups xmm0, xmmword [str._error_or_not_supported_]
mov dword [0x5081f8], 0x18
mov dword [0x5081fc], 0x1f
movups xmmword [eax], xmm0
push 0x4cd4f0
movq xmm0, qword [0x4eeab0]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
mov dword [0x5081e8], eax
call fcn.00489162
push 0x5080e8
call fcn.00489450
add esp, 0xc
lea edi, [esi + 4]
mov dword [ebp - 0x78], 0
mov eax, 0x534f
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 2
mov word [ebp - 0x78], ax
mov byte [ebp - 0x76], 0
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0x1b
push eax
mov ecx, edi
add esi, 0x14
call fcn.00437300
cmp eax, esi
je 0x43662d
mov byte [ebp - 0x7c], 0
mov ecx, eax
push dword [ebp - 0x7c]
push esi
call fcn.0042b680
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x436668
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43665e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f1d
push edx
push ecx
call fcn.00488f15
add esp, 8
push str.kernel32.dll
mov dword [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4366d6
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4366d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4366d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4366d6
cmp word [eax + 4], 0
jne 0x4366d6
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x4366d6
movzx ecx, word [eax + 0x36]
movzx esi, word [eax + 0x30]
movzx edx, word [eax + 0x32]
movzx eax, word [eax + 0x34]
push eax
push ecx
push esi
lea ecx, [ebp - 0x78]
call fcn.00435680
add esp, 0xc
jmp 0x436702
mov eax, dword [str.0.0.0.0]
mov dword [ebp - 0x78], eax
mov ax, word [0x4ee8e0]
mov word [ebp - 0x74], ax
mov al, byte [0x4ee8e2]
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 7
mov byte [ebp - 0x72], al
mov byte [ebp - 0x71], 0
mov dword [ebp - 4], 0x1d
movq xmm0, qword [str.OS_Version]
mov ax, word [0x4eeac4]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0xa
movq qword [ebp - 0x30], xmm0
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00437300
mov ecx, eax
call fcn.00437480
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x436784
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43677a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f22
push edx
push ecx
call fcn.00488f15
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp edx, 0x10
jb 0x4367d1
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4367c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f22
push edx
push ecx
call fcn.00488f15
add esp, 8
mov eax, dword [0x4eead0]
movq xmm0, qword [str.Product_Version]
mov dword [ebp - 0x70], eax
mov ax, word [0x4eead4]
mov word [ebp - 0x6c], ax
mov al, byte [0x4eead6]
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0xf
movq qword [ebp - 0x78], xmm0
mov byte [ebp - 0x6a], al
mov byte [ebp - 0x69], 0
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0x1f
push eax
mov ecx, edi
call fcn.00437300
mov esi, eax
mov edi, 0xf
mov ecx, dword [esi + 0x14]
cmp ecx, 9
jb 0x43685b
mov dword [ebp - 0x7c], esi
cmp ecx, 0x10
jb 0x436838
mov eax, dword [esi]
mov dword [ebp - 0x7c], eax
push 9
push str.4.1.1.818
push eax
mov dword [esi + 0x10], 9
call fcn.0048af40
mov eax, dword [ebp - 0x7c]
add esp, 0xc
mov byte [eax + 9], 0
jmp 0x436943
mov edx, ecx
mov eax, SysReAllocString
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x436871
mov edx, SysReAllocString
jmp 0x43687c
lea eax, [ecx + edx]
mov edx, edi
cmp eax, 0xf
cmova edx, eax
xor ecx, ecx
mov dword [ebp - 0x7c], edx
add edx, 1
setb cl
neg ecx
or ecx, edx
cmp ecx, 0x1000
jb 0x4368df
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x436f27
push eax
call fcn.004892b3
add esp, 4
test eax, eax
je 0x436f2c
lea edx, [eax + 0x23]
and edx, 0xffffffe0
mov dword [edx - 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esi + 0x10], 9
mov dword [esi + 0x14], eax
movq xmm0, qword [str.4.1.1.818]
movq qword [edx], xmm0
mov al, byte [0x4eeae0]
mov byte [edx + 8], al
mov byte [edx + 9], 0
jmp 0x436941
test ecx, ecx
je 0x436916
push ecx
call fcn.004892b3
mov edx, eax
mov dword [esi + 0x10], 9
mov eax, dword [ebp - 0x7c]
add esp, 4
mov dword [esi + 0x14], eax
movq xmm0, qword [str.4.1.1.818]
movq qword [edx], xmm0
mov cl, byte [0x4eeae0]
mov byte [edx + 8], cl
mov byte [edx + 9], 0
jmp 0x436941
mov eax, dword [ebp - 0x7c]
xor edx, edx
mov dword [esi + 0x10], 9
xor ecx, ecx
mov dword [esi + 0x14], eax
movq xmm0, qword [str.4.1.1.818]
movq qword [ecx], xmm0
mov al, byte [0x4eeae0]
mov byte [ecx + 8], al
mov byte [9], cl
mov dword [esi], edx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x43697e
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x436974
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f2c
push edx
push ecx
call fcn.00488f15
add esp, 8
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], 4
mov dword [ebp - 0x78], 0x44495555
mov byte [ebp - 0x74], 0
mov dword [ebp - 4], 0x20
lea eax, [ebp - 0x78]
mov esi, dword [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00437300
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4369b2
mov ecx, dword [eax]
mov dword [eax + 0x10], 0
mov byte [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x4369f7
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4369ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f31
push edx
push ecx
call fcn.00488f15
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
mov dword [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x22
push eax
call fcn.00429d30
test al, al
jne 0x436a84
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x436b4d
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436b43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f36
jmp 0x436b43
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x60]
push eax
call fcn.00412193
add esp, 8
test al, al
jne 0x436bbc
call fcn.0041a770
push 1
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.0041a500
lea edx, [ebp - 0x80]
mov dword [ebp - 0x80], str.UIDService.cpp
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x7c], 0x74
call fcn.00412b24
mov edx, str.Failed_to_convert_wuuid_to_string
lea ecx, [ebp - 0x120]
call fcn.00412b80
lea ecx, [ebp - 0xc8]
call fcn.0041c460
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 0x23
push eax
mov dword [ebp - 0xc8], vtable.std::ios_base.0
call fcn.0047379d
mov byte [ebp - 4], 0x21
add esp, 4
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x436b4d
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436b43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f3b
push edx
push ecx
call fcn.00488f15
add esp, 8
movq xmm0, qword [str.Machine_ID]
mov ax, word [0x4eeaec]
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0xa
movq qword [ebp - 0x78], xmm0
mov word [ebp - 0x70], ax
mov byte [ebp - 0x6e], 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x25
push eax
mov ecx, esi
call fcn.00437300
mov esi, eax
mov eax, dword [esi + 0x14]
cmp eax, 9
jb 0x436c73
mov edi, esi
cmp eax, 0x10
jb 0x436b9c
mov edi, dword [esi]
push 9
push str.NO_REGKEY
push edi
mov dword [esi + 0x10], 9
call fcn.0048af40
add esp, 0xc
mov byte [edi + 9], 0
jmp 0x436d4e
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x436bfa
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436bf0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f3b
push edx
push ecx
call fcn.00488f15
add esp, 8
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 4
mov dword [ebp - 0x78], 0x44495555
mov byte [ebp - 0x74], 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x24
push eax
mov ecx, esi
call fcn.00437300
lea ecx, [ebp - 0x60]
cmp eax, ecx
je 0x436c38
mov byte [ebp - 0x7c], 0
push dword [ebp - 0x7c]
push ecx
mov ecx, eax
call fcn.0042b680
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x436b4d
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x436b43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f40
jmp 0x436b43
mov ecx, eax
mov edx, SysReAllocString
shr ecx, 1
sub edx, ecx
cmp eax, edx
jbe 0x436c89
mov edi, SysReAllocString
jmp 0x436c91
add eax, ecx
cmp eax, 0xf
cmova edi, eax
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x436cf0
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x436f45
push eax
call fcn.004892b3
add esp, 4
test eax, eax
je 0x436f4a
lea edx, [eax + 0x23]
and edx, 0xffffffe0
mov dword [edx - 4], eax
mov dword [esi + 0x10], 9
mov dword [esi + 0x14], edi
movq xmm0, qword [str.NO_REGKEY]
movq qword [edx], xmm0
mov al, byte [0x4eeaf8]
mov byte [edx + 8], al
mov byte [edx + 9], 0
jmp 0x436d4c
test ecx, ecx
je 0x436d24
push ecx
call fcn.004892b3
mov edx, eax
mov dword [esi + 0x10], 9
mov dword [esi + 0x14], edi
add esp, 4
movq xmm0, qword [str.NO_REGKEY]
movq qword [edx], xmm0
mov cl, byte [0x4eeaf8]
mov byte [edx + 8], cl
mov byte [edx + 9], 0
jmp 0x436d4c
mov dword [esi + 0x10], 9
xor edx, edx
mov dword [esi + 0x14], edi
xor ecx, ecx
movq xmm0, qword [str.NO_REGKEY]
movq qword [ecx], xmm0
mov al, byte [0x4eeaf8]
mov byte [ecx + 8], al
mov byte [9], cl
mov dword [esi], edx
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x436d86
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x436d7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f4a
push edx
push ecx
call fcn.00488f15
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x26
push eax
call fcn.0042a530
test al, al
je 0x436e3f
movq xmm0, qword [str.Machine_ID]
mov ax, word [0x4eeaec]
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0xa
movq qword [ebp - 0x78], xmm0
mov word [ebp - 0x70], ax
mov byte [ebp - 0x6e], 0
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x78]
mov edi, dword [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00437300
lea ecx, [ebp - 0x48]
cmp eax, ecx
je 0x436e05
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.0042b680
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x436e42
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x436e33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436f4f
push edx
push ecx
call fcn.00488f15
add esp, 8
jmp 0x436e42
mov edi, dword [ebp - 0x14]
push 0x4ee89c
mov byte [ebp - 4], 0x28
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x436e91
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x436e91
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, esi
call dword [0x4ce328]
call esi
test eax, eax
je 0x436e91
cmp dword [ebp - 0x14], 0
je 0x436e91
mov al, 1
jmp 0x436e93
xor al, al
movq xmm0, qword [str.OS_Platform]
test al, al
mov ax, word [0x4eeb04]
mov esi, 0x4eeb08
mov word [ebp - 0x70], ax
mov ecx, 0x4eeb0c
mov al, byte [0x4eeb06]
cmove esi, ecx
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0xb
movq qword [ebp - 0x78], xmm0
mov byte [ebp - 0x6e], al
mov byte [ebp - 0x6d], 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x29
push eax
mov ecx, edi
call fcn.00437300
push esi
mov ecx, eax
call fcn.0041467b
lea ecx, [ebp - 0x78]
call fcn.004146ca
lea ecx, [ebp - 0x48]
call fcn.004146ca
lea ecx, [ebp - 0x60]
call fcn.004146ca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00488f07
mov esp, ebp
pop ebp
ret
call fcn.0048e1b0
call fcn.0048e1b0
call fcn.00414539
call fcn.0048e1b0
call fcn.0048e1b0
call fcn.0048e1b0
call fcn.0048e1b0
call fcn.0048e1b0
call fcn.00414539
call fcn.0048e1b0
call fcn.0048e1b0
int3