Function at 0x662a850
Capabilities:
Get domain information
Get hostname
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6669e21
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x810
mov eax, dword [0x667c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x6fc], edi
mov dword [ebp - 0x6f8], edi
mov dword [ebp - 4], 0
mov edx, str.DDd
mov dword [ebp - 0x704], edi
push 7
mov dword [ebp - 0x700], 0
call fcn.06612080
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x700], 1
call fcn.0661d720
mov dword [ebp - 4], 1
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662a8f3
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662a949
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x662a924
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662a960
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662a99e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662a994
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc58
push ecx
push edx
call fcn.06644a77
add esp, 8
push 0x1e
mov edx, 0x667ce18
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov dword [ebp - 4], 2
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662a9c1
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662aa17
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x662a9f2
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662aa2e
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662aa6c
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662aa62
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc5d
push ecx
push edx
call fcn.06644a77
add esp, 8
cmp dword [ebx + 8], 0
je 0x662bb6a
push 0xc
mov edx, str.DDv
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov dword [ebp - 4], 3
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662aa99
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662aaef
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f0], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f4], edi
jbe 0x662aaca
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662ab06
push edx
push esi
mov byte [ebp - 0x6f0], 0
mov ecx, edi
push dword [ebp - 0x6f0]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662ab44
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662ab3a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc62
push ecx
push edx
call fcn.06644a77
add esp, 8
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x6f4], 0
push 0x6674928
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6bc], 0
movups xmmword [ebp - 0x6cc], xmm0
mov dword [ebp - 0x6b8], 0
call fcn.06619720
lea eax, [ebp - 0x6f4]
mov dword [ebp - 4], 4
push eax
push 1
push 0
mov dword [ebp - 0x700], 3
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
test eax, eax
jne 0x662ac75
mov eax, dword [ebp - 0x6f4]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x662ac0b
mov eax, dword [ebp - 0x6b8]
cmp eax, 9
jb 0x662abf5
cmp eax, 7
mov dword [ebp - 0x6bc], 9
push 0x12
lea esi, [ebp - 0x6cc]
cmova esi, dword [ebp - 0x6cc]
push str.WORKGROUP
push esi
call fcn.06646180
add esp, 0xc
xor eax, eax
mov word [esi + 0x12], ax
jmp 0x662ac75
push str.WORKGROUP
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push 9
jmp 0x662ac6a
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x662ac10
mov eax, dword [ebp - 0x6b8]
sub ecx, esi
sar ecx, 1
cmp ecx, eax
ja 0x662ac5b
lea esi, [ecx + ecx]
mov dword [ebp - 0x6bc], ecx
cmp eax, 7
lea edi, [ebp - 0x6cc]
push esi
cmova edi, dword [ebp - 0x6cc]
push edx
push edi
call fcn.06646180
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x6fc]
jmp 0x662ac75
push edx
mov byte [ebp - 0x6f0], 0
push dword [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x6cc]
call fcn.06619910
mov dword [ebp - 0x700], 0
mov dword [ebp - 4], 5
lea edx, [ebp - 0x6cc]
cmp dword [ebp - 0x6b8], 7
mov ecx, dword [edi + 0x10]
cmova edx, dword [ebp - 0x6cc]
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x6bc]
sub eax, ecx
mov dword [ebp - 0x69c], ecx
cmp esi, eax
ja 0x662acf5
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662acce
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x69c]
add esp, 0xc
mov ecx, dword [ebp - 0x6f0]
add eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x662ad0c
push esi
push edx
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push esi
call fcn.0661a4a0
push 0xf
mov edx, 0x667ce90
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 6
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662ad2c
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662ad82
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662ad5d
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662ad99
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662add7
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662adcd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc67
push ecx
push edx
call fcn.06644a77
add esp, 8
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x662af56
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x662ae24
sub ecx, edx
lea eax, [ebp - 0x498]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06619720
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x30]
call fcn.06617a00
mov byte [ebp - 4], 8
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662ae67
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662aebd
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662ae98
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662aed4
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662af12
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662af08
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc6c
push ecx
push edx
call fcn.06644a77
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x662af56
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662af4c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push edx
call fcn.06644a77
add esp, 8
push 0x13
mov edx, 0x667ce04
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 9
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662af76
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662afcc
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662afa7
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662afe3
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b021
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b017
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc71
push ecx
push edx
call fcn.06644a77
add esp, 8
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x662b1a2
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x6a0], 0
movups xmmword [ebp - 0x6b4], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x662b070
sub ecx, edx
lea eax, [ebp - 0x698]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.06619720
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.06617a00
mov byte [ebp - 4], 0xb
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b0b3
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b109
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662b0e4
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b120
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b15e
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b154
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc76
push ecx
push edx
call fcn.06644a77
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x662b1a2
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b198
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push edx
call fcn.06644a77
add esp, 8
push 0xf
mov edx, 0x667ce80
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 0xc
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b1c2
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b218
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662b1f3
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b22f
push edx
push esi
mov byte [ebp - 0x69c], 0
mov ecx, edi
push dword [ebp - 0x69c]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b26d
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b263
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc7b
push ecx
push edx
call fcn.06644a77
add esp, 8
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x69c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6f0]
xor esi, esi
push eax
push 1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x6f0], esi
push eax
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
mov eax, dword [ebp - 0x6f0]
jne 0x662b2b7
mov esi, dword [eax + 0xc]
test eax, eax
je 0x662b2c2
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x16]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x662b2c5
push ecx
lea eax, [ebp - 0x16]
push eax
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.0661d1f0
mov dword [ebp - 0x700], 0x30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6b4]
cmp dword [ebp - 0x6a0], 7
mov edx, dword [edi + 0x10]
mov esi, dword [ebp - 0x6b4]
cmova ecx, esi
mov eax, dword [edi + 0x14]
sub eax, edx
mov dword [ebp - 0x69c], edx
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6f8], ecx
cmp edx, eax
ja 0x662b38a
cmp dword [edi + 0x14], 7
mov ecx, dword [ebp - 0x69c]
mov dword [ebp - 0x6f0], edi
lea eax, [ecx + edx]
mov dword [ebp - 0x69c], eax
mov dword [edi + 0x10], eax
mov eax, edi
jbe 0x662b360
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x6f8]
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x69c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b3a7
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
mov esi, dword [ebp - 0x6b4]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6a0]
cmp eax, 7
jbe 0x662b3e5
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x662b3db
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push esi
call fcn.06644a77
add esp, 8
push 8
mov edx, 0x667ce64
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 0xe
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b405
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b45b
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6f0], edi
jbe 0x662b436
mov eax, dword [edi]
mov dword [ebp - 0x6f0], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6f0]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b472
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b4b0
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b4a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc80
push ecx
push edx
call fcn.06644a77
add esp, 8
push 0x6674f30
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x662b4fe
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x662b4fe
push 0x110
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.06646710
add esp, 0xc
mov dword [ebp - 0x1b0], 0x114
lea eax, [ebp - 0x1b0]
push eax
call esi
test eax, eax
je 0x662b514
push 0x114
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.06646710
add esp, 0xc
mov ecx, 0x45
lea edi, [ebp - 0x820]
lea esi, [ebp - 0x1b0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x818]
lea esi, [ebp - 0x42]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x662b530
push ecx
lea eax, [ebp - 0x42]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.0661d1f0
mov dword [ebp - 0x700], 0x3c
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x6e]
mov ecx, dword [ebp - 0x81c]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x662b580
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6b4]
call fcn.0661d1f0
mov dword [ebp - 0x700], 0xfc
push 0x6674f2c
lea edx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x30]
call fcn.06619400
add esp, 4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x11
push ecx
push eax
push dword [ebp - 0x704]
lea ecx, [ebp - 0x5c]
call fcn.06619f90
mov dword [ebp - 0x700], 0x1fc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b637
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b62d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc85
push ecx
push edx
call fcn.06644a77
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x6a0]
cmp ecx, 7
jbe 0x662b68f
mov edx, dword [ebp - 0x6b4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b685
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc85
push ecx
push edx
call fcn.06644a77
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 7
mov word [ebp - 0x6b4], ax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x662b6f0
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b6e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc85
push ecx
push edx
call fcn.06644a77
add esp, 8
mov edi, dword [ebp - 0x6fc]
lea esi, [ebp - 0x5c]
cmp dword [ebp - 0x48], 7
mov edx, dword [ebp - 0x4c]
cmova esi, dword [ebp - 0x5c]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b757
cmp dword [edi + 0x14], 7
lea eax, [edx + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x662b732
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b76e
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
push 0xe
mov edx, str.DD6
lea ecx, [ebp - 0x6e4]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 0x16
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b791
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b7e7
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x662b7c2
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b7fe
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6d0]
cmp ecx, 7
jbe 0x662b842
mov edx, dword [ebp - 0x6e4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b838
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc8a
push ecx
push edx
call fcn.06644a77
add esp, 8
mov ecx, dword [ebp - 0x814]
lea esi, [ebp - 0x6e]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x662b850
push ecx
lea eax, [ebp - 0x6e]
push eax
push esi
lea ecx, [ebp - 0x6e4]
call fcn.0661d1f0
mov dword [ebp - 0x700], 0x7fc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6e4]
cmp dword [ebp - 0x6d0], 7
mov esi, dword [edi + 0x10]
cmova ecx, dword [ebp - 0x6e4]
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x6d4]
sub eax, esi
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x6f8], esi
cmp edx, eax
ja 0x662b901
cmp dword [edi + 0x14], 7
lea eax, [edx + esi]
mov dword [ebp - 0x6fc], eax
mov esi, edi
mov dword [edi + 0x10], eax
jbe 0x662b8d7
mov esi, dword [edi]
mov eax, dword [ebp - 0x6f8]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x69c]
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x662b918
push edx
push ecx
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
push 0xe
mov edx, 0x667ce54
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov byte [ebp - 4], 0x18
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b938
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662b98e
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x662b969
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662b9a5
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662b9e3
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662b9d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc8f
push ecx
push edx
call fcn.06644a77
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.0661d320
mov byte [ebp - 4], 0x19
mov esi, eax
cmp dword [eax + 0x14], 7
jbe 0x662b9f9
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x662ba4f
cmp dword [edi + 0x14], 7
lea eax, [ecx + edx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x6fc], edi
jbe 0x662ba2a
mov eax, dword [edi]
mov dword [ebp - 0x6fc], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.06646180
mov eax, dword [ebp - 0x6fc]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662ba66
push edx
push esi
mov byte [ebp - 0x6f8], 0
mov ecx, edi
push dword [ebp - 0x6f8]
push edx
call fcn.0661a4a0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662baa4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662ba9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc94
push ecx
push edx
call fcn.06644a77
add esp, 8
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6d0]
cmp eax, 7
jbe 0x662bae8
mov edx, dword [ebp - 0x6e4]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662bade
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push edx
call fcn.06644a77
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x48]
cmp eax, 7
jbe 0x662bb26
mov edx, dword [ebp - 0x5c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662bb1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push edx
call fcn.06644a77
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6b8]
cmp ecx, 7
jbe 0x662bb6a
mov edx, dword [ebp - 0x6cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662bb60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc99
push ecx
push edx
call fcn.06644a77
add esp, 8
push 2
mov edx, 0x667ce48
lea ecx, [ebp - 0x30]
call fcn.06612080
add esp, 4
mov dword [ebp - 4], 0x1a
mov edx, eax
cmp dword [eax + 0x14], 7
jbe 0x662bb8d
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
sub eax, esi
cmp ecx, eax
ja 0x662bbe7
cmp dword [edi + 0x14], 7
lea eax, [esi + ecx]
mov dword [ebp - 0x6f8], eax
mov dword [edi + 0x10], eax
mov dword [ebp - 0x6f4], edi
jbe 0x662bbbc
mov eax, dword [edi]
mov dword [ebp - 0x6f4], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebp - 0x6f4]
push edx
lea eax, [eax + esi*2]
push eax
call fcn.06646180
mov eax, dword [ebp - 0x6f4]
add esp, 0xc
mov ecx, dword [ebp - 0x6f8]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x662bbfe
push ecx
push edx
mov byte [ebp - 0x6f8], 0
push dword [ebp - 0x6f8]
push ecx
mov ecx, edi
call fcn.0661a4a0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x662bc38
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x662bc2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x662bc9e
push ecx
push edx
call fcn.06644a77
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.06644a69
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
call fcn.066498ca
int3