Function at 0x49eb10
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d4fe
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x49ecf2
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x49ecf2
xor eax, eax
cmp dword [ebp + 0x10], 1
mov word [edi], ax
jne 0x49ebcc
push eax
push str.computer
push esi
push edi
call fcn.00482030
lea eax, [ebp - 0x218]
push 0x41
push eax
call fcn.0047ea00
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
push 0
push str.__user
push esi
push edi
call fcn.00482030
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0047ea60
add esp, 0x40
lea eax, [ebp - 0x218]
push 0
push eax
push esi
push edi
call fcn.00482030
push 0
push 0x54e748
push esi
push edi
call fcn.00482030
add esp, 0x20
push 0x59
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x464], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x44c], 0
call fcn.0049fd90
push 0x548868
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x474], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x49ec86
lea ecx, [ebp - 0x448]
push ecx
call eax
push 0x11c
lea eax, [ebp - 0x400]
push 0
push eax
call fcn.00509680
add esp, 0xc
mov dword [ebp - 0x400], 0x11c
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x46c], eax
mov edx, 1
test eax, eax
jne 0x49ed0f
push 0x11c
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.00509680
add esp, 0xc
mov dword [ebp - 0x400], 0x94
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x49ed24
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x2e6]
xor ecx, ecx
sub al, 2
cmp al, 1
cmovbe ecx, edx
mov dword [ebp - 0x44c], ecx
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.user32.dll
push eax
call fcn.0048f340
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480cc0
mov cx, word [ebp - 0x2cc]
add esp, 0x54
mov ax, word [ebp - 0x2bc]
test cx, cx
jne 0x49edac
test ax, ax
jne 0x49edac
mov edx, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x3fc]
jmp 0x49ede7
movzx edx, cx
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x2c8], edx
cmp ecx, edx
jne 0x49edd2
mov edx, dword [ebp - 0x3f8]
movzx eax, ax
cmp edx, eax
je 0x49ede7
mov edx, dword [ebp - 0x2c8]
mov ecx, edx
movzx edx, word [ebp - 0x2bc]
mov dword [ebp - 0x3fc], ecx
mov dword [ebp - 0x3f8], edx
mov eax, dword [ebp - 0x3f0]
sub eax, 0
je 0x49f52b
sub eax, 1
je 0x49f4b6
sub eax, 1
jne 0x49f53c
shl ecx, 8
or ecx, edx
cmp ecx, 0x600
ja 0x49eee7
je 0x49eeac
sub ecx, 0x500
je 0x49ee8a
sub ecx, 1
je 0x49ee72
sub ecx, 1
jne case.default.0x49ef08
cmp dword [ebp - 0x44c], ecx
je 0x49ee72
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
test eax, eax
je 0x49ee52
push str.Windows_Server_2003_R2
jmp 0x49ee57
push str.Windows_Server_2003
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x464], 1
xor eax, eax
jmp 0x49eff3
push 0
push str.Windows_XP
push esi
push edi
call fcn.00482030
add esp, 0x10
xor eax, eax
jmp 0x49eff3
push 0
push str.Windows_2000
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x460], 1
xor eax, eax
jmp 0x49eff3
cmp dword [ebp - 0x44c], 0
push 0
je 0x49eec7
cmp dword [ebp - 0x2c0], 0
jne 0x49ef3a
push str.Windows_Server_2008
jmp 0x49ef3f
push str.Windows_Vista
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x454], 1
xor eax, eax
jmp 0x49eff3
cmp ecx, 0xa00
ja case.default.0x49ef08
je 0x49efa9
sub ecx, 0x601
cmp ecx, 3
ja case.default.0x49ef08
jmp dword [ecx*4 + 0x49fbd0]
cmp byte [ebp - 0x2e6], 1
push 0
jne 0x49ef3a
push str.Windows_7
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x458], 1
xor eax, eax
jmp 0x49eff3
push str.Windows_Server_2008_R2
push esi
push edi
call fcn.00482030
add esp, 0x10
xor ecx, ecx
mov edx, 1
xor eax, eax
jmp 0x49eff7
cmp dword [ebp - 0x44c], 0
push 0
je 0x49ef69
push str.Windows_Server_2012
jmp 0x49ef6e
push str.Windows_8
push esi
push edi
call fcn.00482030
add esp, 0x10
mov ecx, 1
xor eax, eax
jmp 0x49eff5
push 0
push str.Windows_8.1
jmp 0x49ef6e
push 0
push str.Windows_10
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x2e4], 1
xor eax, eax
jmp 0x49eff3
cmp dword [ebp - 0x44c], 0
push 0
je 0x49ef8c
push str.Windows_Server_2016
jmp 0x49ef91
cmp dword [ebp - 0x44c], 0
push 0
je 0x49efcd
push str.Windows_Server
jmp 0x49efd2
push str.Windows_NT
push esi
push edi
call fcn.00482030
xor eax, eax
add esp, 0x10
cmp dword [ebp - 0x3fc], 4
mov ecx, 1
mov dword [ebp - 0x468], ecx
cmove eax, ecx
xor ecx, ecx
xor edx, edx
cmp dword [ebp - 0x46c], 0
je 0x49f2ad
cmp dword [ebp - 0x44c], 0
je 0x49f150
test eax, eax
je 0x49f034
test byte [ebp - 0x2e8], 2
push 0
je 0x49f075
push str._Server_Enterprise_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
cmp dword [ebp - 0x460], 0
je 0x49f089
mov eax, dword [ebp - 0x2e8]
push 0
test al, al
jns 0x49f05d
push str._Datacenter_Server
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test al, 2
je 0x49f075
push str._Advanced_Server
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
push str._Server
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
cmp dword [ebp - 0x464], 0
je 0x49f0f9
mov eax, dword [ebp - 0x2e8]
push 0
test eax, 0x400
je 0x49f0b5
push str._Web_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test al, al
jns 0x49f0cd
push str._Datacenter_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test al, 2
je 0x49f0e5
push str._Enterprise_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
push str._Standard_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test edx, edx
je 0x49f125
mov eax, dword [ebp - 0x2e8]
test al, al
js 0x49f13a
test al, 2
je 0x49f369
push 0
push str._Enterprise
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test ecx, ecx
je 0x49f369
test byte [ebp - 0x2e8], 0x80
je 0x49f369
push 0
push str._Datacenter
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
test dword [ebp - 0x2e8], 0x200
je 0x49f19f
push 0
push str._Home
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [ebp - 0x454], 0
jne 0x49f183
cmp dword [ebp - 0x458], 0
je 0x49f369
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
test eax, eax
je 0x49f198
push str._Premium
jmp 0x49f1da
push str._Basic
jmp 0x49f1da
mov eax, dword [ebp - 0x3fc]
sub eax, 4
je 0x49f297
sub eax, 1
je 0x49f281
cmp dword [ebp - 0x454], 0
je 0x49f1f3
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
test eax, eax
je 0x49f1d5
push str._Ultimate
jmp 0x49f1da
push str._Business
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x450], 0
jmp 0x49f369
cmp dword [ebp - 0x458], 0
je 0x49f24e
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49f211
push 0
push str._Starter
jmp 0x49f22b
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
test eax, eax
je 0x49f226
push str._Ultimate
jmp 0x49f22b
push str._Professional
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x45c], 0
jmp 0x49f369
test ecx, ecx
jne 0x49f25e
cmp dword [ebp - 0x2e4], ecx
je 0x49f369
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x474], 0
jmp 0x49f369
push 0
push str._Professional
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
push 0
push str._Workstation
push esi
push edi
call fcn.00482030
add esp, 0x10
jmp 0x49f369
xor eax, eax
mov dword [ebp - 0x2e4], 0
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2e4]
push eax
push str.SystemCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x49f369
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.ProductType
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49f35d
lea eax, [ebp - 0x218]
push str.WinNt
push eax
call fcn.0050d5a0
add esp, 8
test eax, eax
jne 0x49f335
push eax
push str._Workstation
jmp 0x49f353
lea eax, [ebp - 0x218]
push str.ServerNt
push eax
call fcn.0050d5a0
add esp, 8
test eax, eax
jne 0x49f35d
push eax
push str._Server
push esi
push edi
call fcn.00482030
add esp, 0x10
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c4]
test eax, eax
je 0x49f381
cmp eax, 9
jne 0x49f392
push 0
push str._x64
jmp 0x49f388
push 0
push str._x86
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [ebp - 0x468], 0
je 0x49f3cb
push dword [ebp - 0x3f8]
lea eax, [ebp - 0x218]
push dword [ebp - 0x3fc]
push str.__d._02d
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x49f53f
cmp dword [ebp - 0x46c], 0
je 0x49f459
mov cx, word [ebp - 0x2ec]
test cx, cx
je 0x49f53f
mov ax, word [ebp - 0x2ea]
test ax, ax
jne 0x49f428
movzx eax, cx
push eax
push str._SP_d
lea eax, [ebp - 0x218]
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
jmp 0x49f53c
movzx eax, ax
push eax
movzx eax, cx
push eax
push str._SP_d._02d
lea eax, [ebp - 0x218]
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
jmp 0x49f53c
cmp word [ebp - 0x3ec], 0
je 0x49f53f
mov ecx, 0x547150
lea eax, [ebp - 0x3ec]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49f498
test dx, dx
je 0x49f494
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49f498
add eax, 4
add ecx, 4
test dx, dx
jne 0x49f472
xor eax, eax
jmp 0x49f49d
sbb eax, eax
or eax, 1
test eax, eax
je 0x49f53c
lea eax, [ebp - 0x3ec]
push eax
push 0x554b80
jmp 0x49f404
mov eax, ecx
shl eax, 8
or eax, edx
sub eax, 0x400
je 0x49f507
sub eax, 0xa
je 0x49f4e3
sub eax, 0x50
je 0x49f4da
push edx
push ecx
push str.Windows_9x_Me_v_d._02d
jmp 0x49f435
push 0
push str.Windows_Me
jmp 0x49f532
push 0
push str.Windows_98
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp word [ebp - 0x3ea], 0x41
jne 0x49f53c
push 0
push 0x5546ec
jmp 0x49f532
push 0
push str.Windows_95
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp word [ebp - 0x3ea], 0x42
jne 0x49f53c
push 0
push str._OSR2
jmp 0x49f532
push 0
push str.Win32s
push esi
push edi
call fcn.00482030
add esp, 0x10
mov eax, dword [ebp + 0x10]
cmp eax, 2
jne 0x49f573
mov eax, dword [ebp - 0x3f4]
test eax, eax
je 0x49f573
push eax
lea eax, [ebp - 0x218]
push str.__Build__d
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
push 0x50
lea eax, [ebp - 0x2b8]
push eax
push 9
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x49f602
push 0
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.004ab300
add esp, 0xc
test eax, eax
je 0x49f602
mov eax, dword [ebp - 0x2e0]
movzx ecx, ax
and eax, 0x3ff
cmp eax, 9
je 0x49f602
push 0x50
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp + 0x10]
push ecx
mov ecx, 0x58ea18
call fcn.00442aa0
test eax, eax
je 0x49f602
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x218]
push 0x554b80
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
mov eax, dword [ebp + 0x10]
cmp eax, 1
jne 0x49f752
mov eax, dword [ebp - 0x470]
mov cx, word [ebp - 0x424]
test eax, eax
je 0x49f665
mov ax, word [ebp - 0x448]
cmp cx, ax
je 0x49f665
movzx eax, ax
push dword [eax*4 + 0x5544d0]
movzx eax, cx
push dword [eax*4 + 0x5544d0]
lea eax, [ebp - 0x218]
push str._nArchitecture:__s__reported____s__actual_
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
jmp 0x49f698
test cx, cx
je 0x49f698
movzx eax, cx
push dword [eax*4 + 0x5544d0]
lea eax, [ebp - 0x218]
push str._nArchitecture:__s
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.0047d3b0
mov eax, dword [ebp - 0x2c4]
add esp, 8
test eax, eax
je 0x49f6dd
push eax
lea eax, [ebp - 0x218]
push str._nProcessors:__d
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
cmp dword [ebp - 0x450], 0
je 0x49f703
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49f703
push 0
push str._nMedia_Center_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [ebp - 0x45c], 0
je 0x49f729
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49f729
push 0
push str._nStarter_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [ebp - 0x474], 0
je 0x49f74f
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49f74f
push 0
push str._nTablet_PC_Edition
push esi
push edi
call fcn.00482030
add esp, 0x10
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x3f0], 2
jne 0x49faef
cmp eax, 1
jne 0x49fbc6
push 0
push 0x54e748
push esi
push edi
call fcn.00482030
mov eax, dword [ebp - 0x2e8]
add esp, 0x10
test al, 0x10
je 0x49f78c
push 0
push str._nTerminal_Server__multiuser_
jmp 0x49f79a
test eax, 0x100
je 0x49f7a4
push 0
push str._nTerminal_Server__single_user_
push esi
push edi
call fcn.00482030
add esp, 0x10
xorps xmm0, xmm0
lea ecx, [ebp - 0x2dc]
movups xmmword [ebp - 0x2dc], xmm0
call fcn.0047ab50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2dc]
mov esi, dword [ebp - 0x2dc]
call sub.KERNEL32.dll_WTSGetActiveConsoleSessionId
push eax
push esi
lea eax, [ebp - 0x218]
push str._ncurrent_session_ID___d__active_console_session_ID___d
push eax
call fcn.00405510
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
call fcn.0047b210
test eax, eax
je 0x49f852
push 0
push str._nremote_session
push esi
push edi
call fcn.00482030
add esp, 0x10
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x2dc]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.0047acc0
test eax, eax
je 0x49f852
push 0
push str._from_client
push esi
push edi
call fcn.00482030
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
push 0
push 0x54e748
push esi
push edi
call fcn.00482030
add esp, 0x10
lea ecx, [ebp - 0x2dc]
call fcn.0047ad50
mov dword [ebp - 0x44c], eax
test eax, eax
je 0x49fa3c
nop dword [eax]
push dword [eax]
lea eax, [ebp - 0x218]
push str._nsession__d
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
mov eax, dword [ebp - 0x44c]
add esp, 0x1c
mov eax, dword [eax + 4]
test eax, eax
je 0x49f8bc
cmp word [eax], 0
je 0x49f8bc
push eax
jmp 0x49f8c1
push str.no_name
lea eax, [ebp - 0x218]
push str.___s_
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x2dc]
push 0x104
push eax
mov eax, dword [ebp - 0x44c]
push dword [eax]
call fcn.0047af20
test eax, eax
je 0x49f92b
push 0
push 0x5543e8
push esi
push edi
call fcn.00482030
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
jmp 0x49f954
push str.no_user
lea eax, [ebp - 0x218]
push str.____s
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x44c]
lea ecx, [ebp - 0x2dc]
push dword [eax]
call fcn.0047acc0
test eax, eax
je 0x49f998
push 0
push str.__client
push esi
push edi
call fcn.00482030
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x20
mov eax, dword [ebp - 0x44c]
lea ecx, [ebp - 0x2dc]
push dword [eax]
call fcn.0047aeb0
test eax, eax
js 0x49f9d4
push eax
lea eax, [ebp - 0x218]
push str.__protocol__d
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
mov eax, dword [ebp - 0x44c]
lea ecx, [ebp - 0x2dc]
push dword [eax]
call fcn.0047afb0
push eax
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x218]
push str.__token__p
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
mov eax, dword [ebp - 0x2c4]
add esp, 0x1c
test eax, eax
je 0x49fa23
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2dc]
call fcn.0047ae80
mov dword [ebp - 0x44c], eax
test eax, eax
jne 0x49f880
push 0
push 0x54e748
push esi
push edi
call fcn.00482030
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.00472de0
add esp, 0x18
push 0
test eax, eax
jle 0x49fa97
push str._nadministrative_user
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [0x58f684], 5
jl 0x49fadb
cmp dword [ebp - 0x2c0], 0
push 0
je 0x49fa90
push str.__elevated_
jmp 0x49fa9c
push str.__not_elevated_
jmp 0x49fa9c
push str._nnon_administrative_user
push esi
push edi
call fcn.00482030
add esp, 0x10
cmp dword [0x58f684], 5
jl 0x49fadb
push 0
push str._nprocess_integrity_level:
push esi
push edi
call fcn.00482030
add esp, 0x10
push 0
push dword [ebp - 0x2c8]
call fcn.00472980
add esp, 4
push eax
push esi
push edi
call fcn.00482030
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2dc]
call fcn.0047abc0
jmp 0x49faf8
cmp eax, 1
jne 0x49fbc6
cmp word [ebp - 0x3ec], 0
je 0x49fb6a
mov ecx, 0x547150
lea eax, [ebp - 0x3ec]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49fb36
test dx, dx
je 0x49fb32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49fb36
add eax, 4
add ecx, 4
test dx, dx
jne 0x49fb10
xor eax, eax
jmp 0x49fb3b
sbb eax, eax
or eax, 1
test eax, eax
je 0x49fb6a
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x218]
push str._nszCSDVersion____s_
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x1c
push 0
push 0x54e748
push esi
push edi
call fcn.00482030
movzx eax, word [ebp - 0x2e8]
push eax
movzx eax, byte [ebp - 0x2e6]
push dword [eax*4 + 0x5544fc]
movzx eax, word [ebp - 0x3f4]
push eax
push dword [ebp - 0x3f8]
lea eax, [ebp - 0x218]
push dword [ebp - 0x3fc]
push str.Windows__d._02d_Build__d_n_s_nwSuiteMask_04x
push eax
call fcn.00405510
push 0
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call fcn.00482030
add esp, 0x3c
movzx eax, word [edi]
jmp 0x49ecf4