Function at 0x423780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7647cc
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x160], 0xf
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x174], 0
push 0
push 0x799e88
lea ecx, [ebp - 0x174]
call fcn.0042fb60
mov dword [ebp - 4], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
push 0
push 0x799e88
lea ecx, [ebp - 0x144]
call fcn.0042fb60
mov byte [ebp - 4], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
push 0
push 0x799e88
lea ecx, [ebp - 0x12c]
call fcn.0042fb60
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x174]
push edx
call dword [eax + 0xd8]
lea ecx, [ebp - 0x214]
call fcn.0048fe30
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x204], esp
push str.ROOTCIMV2
call fcn.00404f70
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214]
call fcn.00491720
mov byte [ebp - 0x114], 0
push 0xff
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.00723180
add esp, 0xc
push 8
push 0x100
lea eax, [ebp - 0x114]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x204], esp
push 0x799e88
call fcn.00404f70
mov byte [ebp - 4], 6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x208], esp
push str.SerialNumber
call fcn.00404f70
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x200], esp
push str.Win32_BIOS
call fcn.00404f70
mov byte [ebp - 4], 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214]
call fcn.00491040
cmp al, 1
jne 0x4239e0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x144]
call fcn.0040a400
mov byte [ebp - 0x1f9], 0x3a
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x144]
call fcn.0040ef30
mov esi, dword [eax]
lea edi, [ebp - 0x144]
cmp dword [ebp - 0x130], 0x10
cmovae edi, dword [ebp - 0x144]
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x144]
call fcn.0040ef30
lea ecx, [ebp - 0x1f9]
push ecx
push dword [eax]
push edi
lea eax, [ebp - 0x204]
push eax
call fcn.00418c20
add esp, 0x10
push esi
push dword [eax]
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x144]
call fcn.004304f0
push 8
push 0x100
lea eax, [ebp - 0x114]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
push str.DeviceID_.PHYSICALDRIVE0_
call fcn.00404f70
mov byte [ebp - 4], 9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x200], esp
push str.SerialNumber
call fcn.00404f70
mov byte [ebp - 4], 0xa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x208], esp
push str.Win32_DiskDrive
call fcn.00404f70
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x214]
call fcn.00491040
cmp al, 1
jne 0x423ad1
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040a400
mov byte [ebp - 0x1fa], 0x3a
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040ef30
mov esi, dword [eax]
lea edi, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae edi, dword [ebp - 0x12c]
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040ef30
lea ecx, [ebp - 0x1fa]
push ecx
push dword [eax]
push edi
lea eax, [ebp - 0x208]
push eax
call fcn.00418c20
add esp, 0x10
push esi
push dword [eax]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004304f0
cmp dword [ebp - 0x164], 0
jne 0x423d0b
push 0x79e4a4
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.00415d10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x12c]
push ecx
push eax
lea eax, [ebp - 0x18c]
push eax
call fcn.00408310
add esp, 0x18
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
cmp dword [ebp - 0x134], 0
je 0x423c5f
cmp dword [ebp - 0x11c], 0
je 0x423c5f
push str._s:_Saving_computer_configuration____s
lea ecx, [ebp - 0x1c0]
call fcn.00404f70
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x15c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x18c]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00483380
mov byte [ebp - 4], 0x11
push str.CtesWatchDog::HasComputerConfigurationChanged
mov byte [ebp - 4], 0x12
mov ecx, eax
call fcn.0043b560
mov ecx, eax
call fcn.00483750
mov byte [ebp - 4], 0x13
push eax
call fcn.00480c90
add esp, 4
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1a8]
call fcn.00483470
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c0]
call fcn.00404fd0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x18c]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x14
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
mov byte [ebp - 4], 0xe
call dword [eax + 0xdc]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x94]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18c]
call fcn.00404fd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214]
call fcn.004902f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call fcn.00404fd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.00404fd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.00404fd0
jmp 0x424257
push str._s:_Unable_to_save_computer_configuration____s
lea ecx, [ebp - 0x1c0]
call fcn.00404f70
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x15c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x18c]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00483380
mov byte [ebp - 4], 0x17
push str.CtesWatchDog::HasComputerConfigurationChanged
mov byte [ebp - 4], 0x18
mov ecx, eax
call fcn.0043b560
mov ecx, eax
call fcn.00483750
mov byte [ebp - 4], 0x19
push eax
call fcn.00480c90
add esp, 4
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1a8]
call fcn.00483470
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c0]
call fcn.00404fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18c]
jmp 0x424197
push 0x799e88
lea ecx, [ebp - 0x1f4]
call fcn.00404f70
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x134], 0
je 0x4240a0
cmp dword [ebp - 0x11c], 0
je 0x4240a0
push 0x79e4a4
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.00415d10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x12c]
push ecx
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.00408310
add esp, 0x18
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x1f4]
call fcn.0040a3a0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
push 0x799e88
lea ecx, [ebp - 0x18c]
call fcn.00404f70
mov byte [ebp - 4], 0x1d
push 0x799e88
lea ecx, [ebp - 0x1c0]
call fcn.00404f70
mov byte [ebp - 4], 0x1e
push 0
push 0x79e4a4
lea ecx, [ebp - 0x174]
call fcn.004305d0
mov esi, eax
test esi, esi
jle 0x423e4a
push esi
push 0
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x174]
call fcn.00431b30
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0040a3a0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
cmp esi, 0xffffffff
je 0x423e4a
push 0xffffffffffffffff
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x174]
call fcn.00431b30
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x18c]
call fcn.0040a3a0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
cmp dword [ebp - 0x1b0], 0
je 0x424082
cmp dword [ebp - 0x17c], 0
je 0x424082
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00414c90
neg eax
sbb esi, esi
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18c]
call fcn.00414c90
neg eax
sbb eax, eax
neg eax
neg esi
je 0x423fcd
test eax, eax
je 0x424082
push str._s:_Computer_Configuration_does_not_match___current__s____existing__s_
lea ecx, [ebp - 0x15c]
call fcn.00404f70
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x1a4]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x174]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x22
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x200], esp
lea eax, [ebp - 0x1f4]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00483380
mov byte [ebp - 4], 0x24
push str.CtesWatchDog::HasComputerConfigurationChanged
mov byte [ebp - 4], 0x25
mov ecx, eax
call fcn.004163d0
mov ecx, eax
call fcn.00483750
mov byte [ebp - 4], 0x26
push eax
call fcn.00481320
add esp, 4
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1dc]
call fcn.00483470
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1c0]
call fcn.00404fd0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x18c]
call fcn.00404fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1f4]
call fcn.00404fd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214]
call fcn.004902f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call fcn.00404fd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.00404fd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.00404fd0
mov al, 1
jmp 0x424259
test eax, eax
jne 0x424082
push str._s:_Current_computer_configuration_matches
lea ecx, [ebp - 0x15c]
call fcn.00404f70
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00483380
mov esi, eax
mov byte [ebp - 4], 0x28
push str.CtesWatchDog::HasComputerConfigurationChanged
mov ecx, esi
call fcn.00483720
lea eax, [ebp - 0x1a4]
push eax
mov ecx, esi
call fcn.00483750
mov byte [ebp - 4], 0x29
push eax
call fcn.00480c90
add esp, 4
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1dc]
call fcn.00483470
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1c0]
call fcn.00404fd0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x18c]
call fcn.00404fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1f4]
jmp 0x423c16
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1c0]
call fcn.00404fd0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x18c]
call fcn.00404fd0
push str._s:_Updating_computer_configuration___current__s____existing__s_
lea ecx, [ebp - 0x15c]
call fcn.00404f70
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x1a4]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x174]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x2b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x200], esp
lea eax, [ebp - 0x1f4]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00483380
mov byte [ebp - 4], 0x2d
push str.CtesWatchDog::HasComputerConfigurationChanged
mov byte [ebp - 4], 0x2e
mov ecx, eax
call fcn.004163d0
mov ecx, eax
call fcn.00483750
mov byte [ebp - 4], 0x2f
push eax
call fcn.00480c90
add esp, 4
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1a4]
call fcn.00404fd0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1dc]
call fcn.00483470
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x15c]
call fcn.00404fd0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea eax, [ebp - 0x1f4]
push eax
call fcn.00408f30
mov byte [ebp - 4], 0x30
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
mov byte [ebp - 4], 0x1a
call dword [eax + 0xdc]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x94]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1f4]
call fcn.00404fd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214]
call fcn.004902f0
mov dword [ebp - 4], 2
mov byte [ebp - 4], 1
cmp dword [ebp - 0x118], 0x10
jb 0x4241cd
push dword [ebp - 0x12c]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x130], 0x10
jb 0x424203
push dword [ebp - 0x144]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x160], 0x10
jb 0x42423c
push dword [ebp - 0x174]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0x160], 0xf
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x174], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret