Function at 0x30049c20
Capabilities:
Accept command line arguments
Get common file path
Get disk information
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x3021be88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x400
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x408]
push 0
push eax
mov dword [ebp - 0x414], 0x400
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049c81
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30049c9e
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30049ca7
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x40c], eax
test ecx, ecx
je 0x30049cd9
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30049cd9
push ebx
popfd
test eax, eax
je 0x30049d08
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049ce6
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
mov dword [ebp - 0x414], 0x400
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049d45
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30049d62
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30049d6b
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x418], eax
test ecx, ecx
je 0x30049d9d
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30049d9d
push ebx
popfd
test eax, eax
je 0x30049dd2
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049db0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x43c]
add esp, 0xc
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x30049e44
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x43c]
call esi
push dword [ebp - 0x43c]
call edi
mov eax, dword [ebp - 0x408]
push 0x400
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call ebx
test eax, eax
jne 0x30049eb0
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x464]
push eax
push 0
push str.RegisteredOwner
push dword [ebp - 0x440]
call esi
push dword [ebp - 0x440]
call edi
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049ec0
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30049edd
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30049ee6
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x428], eax
test ecx, ecx
je 0x30049f18
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30049f18
push ebx
popfd
test eax, eax
je 0x30049f47
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049f25
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x428]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30049fb3
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0
push str.RegisteredOrganization
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30049fc0
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30049fdd
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30049fe6
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x42c], eax
test ecx, ecx
je 0x3004a018
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a018
push ebx
popfd
test eax, eax
je 0x3004a047
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a025
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x42c]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3004a0b3
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x474]
push eax
push 0
push str.ProductName
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a0c0
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a0dd
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a0e6
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x424], eax
test ecx, ecx
je 0x3004a118
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a118
push ebx
popfd
test eax, eax
je 0x3004a147
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a125
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x424]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a178
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a195
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a19e
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x41c], eax
test ecx, ecx
je 0x3004a1d0
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a1d0
push ebx
popfd
test eax, eax
je 0x3004a202
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a1e0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x41c]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a233
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a250
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a259
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x420], eax
test ecx, ecx
je 0x3004a28b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a28b
push ebx
popfd
test eax, eax
je 0x3004a2ba
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a298
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x420]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftCryptography
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3004a326
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a330
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a34d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a356
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x438], eax
test ecx, ecx
je 0x3004a388
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a388
push ebx
popfd
test eax, eax
je 0x3004a3b7
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a395
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x438]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x450]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0x30206968
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [0x3026f8a0]
test ecx, ecx
je 0x3004a3fd
mov dword [ebp - 0x450], ecx
jmp 0x3004a403
mov ecx, dword [ebp - 0x450]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x408]
push ecx
push str._04x__04x
push eax
call fcn.3001daf0
lea ecx, [ebp - 0x408]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a428
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a445
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a44e
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x430], eax
test ecx, ecx
je 0x3004a480
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004a480
push ebx
popfd
test eax, eax
je 0x3004a4b2
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004a490
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x430]
call fcn.3016bc70
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30162560
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x400
push eax
push 0x30206968
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
lea eax, [ebp - 0x408]
push 0x7d
push eax
call fcn.30161610
add esp, 8
test eax, eax
je 0x3004a4f7
mov byte [eax], 0
lea eax, [ebp - 0x408]
push 0x7b
push eax
call fcn.30161610
add esp, 8
test eax, eax
je 0x3004a51e
lea ecx, [eax + 1]
call fcn.3001e980
mov ecx, eax
mov dword [ebp - 0x434], ecx
jmp 0x3004a586
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004a532
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004a53b
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 1
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x434], ecx
test eax, eax
je 0x3004a56c
mov dword [eax + 0x34], esi
mov dword [eax + 0xbf4], edi
test ebx, ebx
je 0x3004a56c
push ebx
popfd
test ecx, ecx
je 0x3004a586
push 1
push 0x301f71e6
push ecx
call fcn.3016bc70
mov ecx, dword [ebp - 0x434]
add esp, 0xc
mov edx, dword [ebp - 0x454]
mov eax, dword [edx + 0x3c]
push dword [eax + edx + 0x50]
push str.MainExeSize
push edx
push str.MainExeBase
push dword [ebp - 0x438]
push str.MachineGUID
push ecx
push str.SystemVolumeGUID
push dword [ebp - 0x430]
push str.SystemVolumeSerialNumber
push dword [0x30272468]
push str.OSMinor
push dword [0x30272464]
push str.OSMajor
push dword [ebp - 0x424]
push str.ProductName
push dword [ebp - 0x42c]
push str.RegisteredOrganization
push dword [ebp - 0x428]
push str.RegisteredOwner
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.CommandLine
push dword [ebp - 0x420]
mov esi, dword [ebp - 0x40c]
push str.TempPath
push dword [ebp - 0x41c]
push str.WindowsPath
push dword [ebp - 0x410]
push str.InstallDate
push dword [ebp - 0x418]
push str.ComputerName
push esi
push str.UserName
push str.ssissssssiisssph
push 0
push 1
push str.__environ__
push str.__notification__
push 8
call fcn.300484a0
add esp, 0x98
pushfd
mov ebx, dword fs:[0x18]
pop dword [ebp - 0x410]
test ebx, ebx
jne 0x3004a66f
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004a678
mov edi, dword [ebx + 0x34]
mov ebx, dword [ebx + 0xbf4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a6a8
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x3004a6a8
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x410]
test eax, eax
jne 0x3004a6c1
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004a6ca
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0x418]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a6f9
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x3004a6f9
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x410]
test eax, eax
jne 0x3004a712
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004a71b
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0x41c]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a74a
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x3004a74a
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a765
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a774
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x420]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a7a3
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a7a3
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a7be
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a7cd
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x424]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a7fc
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a7fc
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a817
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a826
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x428]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a855
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a855
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a870
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a87f
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x42c]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a8ae
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a8ae
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a8c9
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a8d8
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x430]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a907
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a907
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a922
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a931
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x434]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a960
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a960
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004a97b
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004a98a
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x438]
push 0
push dword [0x30272510]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004a9b9
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004a9b9
push edi
popfd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret