Function at 0x454c9c
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405fdc
xor eax, eax
push ebp
push 0x455252
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [0x56b848]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x454524]
call fcn.004546bc
mov dword [ebp - 0xc], eax
mov eax, dword [0x56b848]
mov eax, dword [eax]
movzx edx, byte [eax + 0x31]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov dl, 3
mov eax, dword [ebp - 0xc]
call fcn.0047e374
mov eax, dword [ebp - 0xc]
call fcn.0047e750
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x64]
call fcn.00430c40
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x285], 1
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0047eca8
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0047ec8c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x214], edx
mov dword [eax + 0x210], 0x454728
mov eax, dword [ebp - 0xc]
call fcn.0047e750
lea edx, [ebp - 0x14]
call fcn.004544cc
push 4
mov ebx, dword [ebp - 0x14]
push ebx
push 8
call fcn.00408ccc
mov dword [ebp - 0x18], eax
push 8
mov eax, dword [ebp - 0x10]
push eax
push 8
call fcn.00408ccc
mov dword [ebp - 0x1c], eax
push 4
push ebx
push 0xa
call fcn.00408ccc
mov dword [ebp - 0x20], eax
push 8
mov eax, dword [ebp - 0x10]
push eax
push 0xa
call fcn.00408ccc
mov dword [ebp - 0x24], eax
push 4
push ebx
push 0x32
call fcn.00408ccc
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov esi, 0x5710ac
mov dword [ebp - 0x50], 0x5688c8
mov eax, ebx
cmp al, 0xf
ja 0x454dc5
and eax, 0x7f
bt dword [ebp - 7], eax
jae 0x454e2f
cmp dword [esi], 0
jne 0x454e25
push 0
lea eax, [ebp - 0x64]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041fa58
mov eax, dword [ebp - 0xc]
call fcn.00467a98
or eax, 0x420
push eax
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
call fcn.004083d4
mov eax, dword [ebp - 0x68]
call fcn.00406080
push eax
mov eax, dword [ebp - 0xc]
call fcn.0047e750
call fcn.00430d24
push eax
call fcn.00409134
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x64]
add eax, 8
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
jle 0x454e2f
mov dword [ebp - 0x28], eax
inc ebx
add dword [ebp - 0x50], 4
add esi, 4
cmp bl, 0xc
jne 0x454db8
push 8
mov eax, dword [ebp - 0x10]
push eax
push 0xe
call fcn.00408ccc
mov dword [ebp - 0x2c], eax
push 4
mov eax, dword [ebp - 0x14]
push eax
push 4
call fcn.00408ccc
mov dword [ebp - 0x30], eax
push 0
mov eax, dword [0x56bb44]
mov eax, dword [eax]
call fcn.004834e8
sar eax, 1
jns 0x454e75
adc eax, 0
push eax
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call sub.KERNEL32.DLL_LockResource
mov eax, dword [ebp - 0xc]
call fcn.0047e750
call fcn.00430d24
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x454eaf
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x454eaf
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405608
mov esi, eax
test esi, esi
je 0x454eba
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebp - 0xc]
call fcn.00467a98
mov edi, eax
or edi, 0x450
push edi
lea eax, [ebp - 0x64]
push eax
inc esi
push esi
mov eax, dword [ebp - 4]
call fcn.00406080
push eax
push ebx
call fcn.00409134
mov dword [ebp - 0x4c], eax
movzx eax, byte [ebp - 5]
mov edi, dword [eax*4 + 0x5688b4]
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], eax
test edi, edi
je 0x454f10
mov eax, dword [ebp - 0x20]
add eax, 0x20
add esi, eax
cmp dword [ebp - 0x34], 0x20
jge 0x454f10
mov dword [ebp - 0x34], 0x20
xor eax, eax
xor ebx, ebx
mov edx, ebx
cmp dl, 0xf
ja 0x454f22
and edx, 0x7f
bt dword [ebp - 7], edx
jae 0x454f25
inc eax
inc ebx
cmp bl, 0xc
jne 0x454f14
xor ebx, ebx
test eax, eax
je 0x454f3d
mov ebx, dword [ebp - 0x28]
imul ebx, eax
dec eax
imul dword [ebp - 0x30]
add ebx, eax
cmp ebx, esi
jge 0x454f45
mov eax, esi
jmp 0x454f47
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, edx
add edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0047d434
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, eax
add edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0047d468
mov eax, dword [0x56bb44]
mov eax, dword [eax]
call fcn.004834e8
mov edx, eax
sar edx, 1
jns 0x454f83
adc edx, 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x48]
sar eax, 1
jns 0x454f90
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004828f8
mov eax, dword [0x56bb44]
mov eax, dword [eax]
call fcn.004834dc
mov edx, eax
sar edx, 1
jns 0x454faf
adc edx, 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x4c]
sar eax, 1
jns 0x454fbc
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00482934
cmp byte [ebp - 5], 4
je 0x454fec
lea edx, [ebp - 0x6c]
movzx eax, byte [ebp - 5]
mov eax, dword [eax*4 + 0x5688a0]
call fcn.004083d4
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
call fcn.00464f74
jmp 0x455006
lea edx, [ebp - 0x70]
mov eax, dword [0x56b848]
mov eax, dword [eax]
call fcn.00485c5c
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
call fcn.00464f74
test edi, edi
je 0x455066
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x44b55c]
call fcn.0044ca68
mov dword [ebp - 0x48], eax
mov edx, 0x455274
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push edi
push 0
call sub.KERNEL32.DLL_GetComputerNameW
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x1a8]
call fcn.00432db4
pop edx
call fcn.0043791c
push 0x20
push 0x20
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov edi, dword [eax]
call dword [edi + 0x88]
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x43c3dc]
call fcn.004431e8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x378], eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 0x378]
mov edx, 0x45528c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov dl, 1
mov eax, edi
call fcn.00443b70
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00464f74
lea edx, [ebp - 0x64]
mov eax, edi
call fcn.00464810
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + 0x5f]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x70]
sub esi, dword [ebp - 0x5c]
add esi, dword [ebp - 0x18]
mov dword [ebp - 0x3c], esi
mov eax, edi
mov si, 0xffc7
call fcn.00404498
test al, al
je 0x4550f1
mov eax, dword [ebp - 0xc]
call fcn.0046484c
sub eax, dword [ebp - 0x3c]
sub eax, dword [edi + 0x48]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x88]
test byte [ebp - 7], 8
je 0x455115
mov byte [ebp - 0x3d], 3
jmp 0x455125
test byte [ebp - 7], 2
je 0x455121
mov byte [ebp - 0x3d], 1
jmp 0x455125
mov byte [ebp - 0x3d], 2
mov eax, dword [ebp - 0xc]
call fcn.0046484c
sub eax, ebx
sar eax, 1
jns 0x455136
adc eax, 0
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov dword [ebp - 0x50], 0x5688f8
mov esi, 0x5688c8
mov dword [ebp - 0x54], 0x568928
mov eax, ebx
cmp al, 0xf
ja 0x45515b
and eax, 0x7f
bt dword [ebp - 7], eax
jae 0x45521a
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x43fcf4]
call fcn.004477b0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x74]
mov eax, dword [esi]
call fcn.004083d4
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x44]
call fcn.00464f74
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x29c], eax
cmp bl, byte [ebp + 8]
jne 0x4551c8
mov dl, 1
mov eax, dword [ebp - 0x44]
call fcn.00447c7c
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
call fcn.0047fd9c
cmp bl, byte [ebp - 0x3d]
jne 0x4551d7
mov eax, dword [ebp - 0x44]
mov byte [eax + 0x269], 1
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov edi, dword [eax]
call dword [edi + 0x88]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
add dword [ebp - 0x38], eax
cmp bl, 0xa
jne 0x45521a
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x114], edx
mov dword [eax + 0x110], 0x454710
inc ebx
add dword [ebp - 0x54], 4
add esi, 4
add dword [ebp - 0x50], 4
cmp bl, 0xc
jne 0x45514e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455259
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.00405fec
lea eax, [ebp - 4]
call fcn.00405fe4
ret