Function at 0x40bfa0
Capabilities:
Acquire debug privileges
Connect to wmi namespace via wbemlocator
Convert ip address from string
Get hostname
Initialize winsock library
Move file
Query environment variable
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1308
call fcn.0043cca0
mov eax, dword [0x44e040]
xor eax, esp
mov dword [esp + 0x1304], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], eax
push edi
cmp esi, 2
jg 0x40c048
push str.THDATA:_number_of_arguments_not_matching_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
push str.Arg_1___flag_readcfg_from___file_1___followed_by_Arg2_Cfg_file_path__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
push str.Arg_1___flag_readcfg_from___file_2___followed_by_Arg2_Sensor_IP___Arg3_Sensor_Port____Arg4_hostname____Arg5_Description___n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
push str.Usage_:_infrasense_compact__1__2___config_file__cmdline_args__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [esp + 0x1c4]
push eax
push str._systemroot__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0xc0c]
push str._sinfarlog_7f000001
push eax
call fcn.00401140
add esp, 0xc
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x30c]
push str._sinfarlog_7f000001.1
push eax
call fcn.00401140
add esp, 0xc
lea eax, [esp + 0x308]
push eax
call fcn.00420423
add esp, 4
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0xc0c]
push eax
call fcn.00423a1a
lea eax, [esp + 0xc10]
push 0x447a64
push eax
call fcn.0041fc98
add esp, 0x10
mov dword [0x12aa16c], eax
test eax, eax
je 0x40c0f0
push str.TD_DBG_LOG_INFRA_COMPACT
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x12addd0], eax
jmp 0x40c108
push str.Unable_to_open_debug_log_file__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
push 0
call fcn.0041c257
add esp, 4
push esi
push 0x447d68
push edx
push eax
push str.__lu__THDATA_:_Starting_IC_Bld_Version__s___argc_d_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push esi
push 0x447d68
push str.THDATA_:_Starting_IC_Bld_Version__s___argc_d
lea eax, [esp + 0x264]
push 0x80
push eax
call fcn.00401160
add esp, 0x2c
lea ecx, [esp + 0x240]
call fcn.004020c0
push str._Get_ItemProperty__HKLM:SOFTWAREMicrosoftWindows_NTCurrentVersion__.ProductName
push str.powershell.exe__Command___s_
lea eax, [esp + 0xa10]
mov byte [esp + 0xa10], 0
push 0x200
push eax
call fcn.00401160
lea eax, [esp + 0xa18]
mov dword [0x12b0e54], 0
push 0x448a10
push eax
call fcn.00423932
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40c1fc
push esi
call fcn.00424e18
add esp, 4
test eax, eax
jne 0x40c1f3
nop dword [eax]
nop word [eax + eax]
push esi
lea eax, [esp + 0xd0c]
mov byte [esp + 0xd0c], 0
push pe_nt_image_headers32
push eax
call fcn.00423a0f
add esp, 0xc
test eax, eax
jne 0x40c331
push esi
call fcn.00424e18
add esp, 4
test eax, eax
je 0x40c1c0
push esi
call fcn.00420137
add esp, 4
lea ecx, [esp + 0xd08]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c206
sub ecx, edx
je 0x40c283
push 9
lea eax, [esp + 0xd0c]
push str.Windows_7
push eax
call fcn.00423ad0
add esp, 0xc
test eax, eax
je 0x40c247
push 0x13
lea eax, [esp + 0xd0c]
push str.Windows_Server_2008
push eax
call fcn.00423ad0
add esp, 0xc
test eax, eax
jne 0x40c251
mov dword [0x12b0e54], 1
push 0
call fcn.0041c257
add esp, 4
lea ecx, [esp + 0xd08]
push dword [0x12b0e54]
push ecx
push edx
push eax
push str.__llu_THDATA:_Infrasense_compact_agent_detected_OS_Name__s___Cmd_scheme_used__d_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x18
cmp dword [0x12b0e54], 0
je 0x40ca05
push 0x160
push 0
push 0x12a9ff8
call fcn.00416780
add esp, 0xc
lea eax, [esp + 0xa08]
xor esi, esi
push str.Get_WmiObject__EA_0__query__SELECT_Version_Caption_OSArchitecture_FROM_Win32_OperatingSystem___Select_Object_Version_Caption_OSArchitecture__ConvertTo_Csv__Select_object__skip_2
push str.powershell.exe__Command___s_
push 0x200
push eax
call fcn.00401160
lea eax, [esp + 0xa18]
push 0x448a10
push eax
call fcn.00423932
mov edi, eax
add esp, 0x18
test edi, edi
je 0x40c554
push edi
call fcn.00424e18
add esp, 4
test eax, eax
jne 0x40c38d
nop dword [eax]
nop word [eax + eax]
push edi
lea eax, [esp + 0x40c]
mov byte [esp + 0x40c], 0
push 0x400
push eax
call fcn.00423a0f
add esp, 0xc
test eax, eax
jne 0x40c362
push edi
call fcn.00424e18
add esp, 4
test eax, eax
je 0x40c300
jmp 0x40c38d
lea ecx, [esp + 0xd08]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c340
sub ecx, edx
dec ecx
cmp ecx, 0x200
jae 0x40db36
mov byte [esp + ecx + 0xd08], al
jmp 0x40c1f3
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c370
sub ecx, edx
dec ecx
cmp ecx, 0x400
jae 0x40db36
mov byte [esp + ecx + 0x408], al
push edi
call fcn.00420137
lea ecx, [esp + 0x40c]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c3a0
sub ecx, edx
je 0x40c554
mov al, byte [esp + ecx + 0x407]
xorps xmm0, xmm0
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1d0], xmm0
movq qword [esp + 0x1e0], xmm0
cmp al, 0xd
je 0x40c3da
cmp al, 0xa
jne 0x40c3e2
mov byte [esp + ecx + 0x407], 0
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c3f0
sub ecx, edx
mov al, byte [esp + ecx + 0x407]
cmp al, 0xd
je 0x40c408
cmp al, 0xa
jne 0x40c410
mov byte [esp + ecx + 0x407], 0
mov al, byte [esp + 0x408]
lea ecx, [esp + 0x408]
xor ah, ah
xor edx, edx
mov byte [esp + 0x13], ah
mov edi, ecx
mov dword [esp + 0x1c0], edi
test al, al
je 0x40c4b0
cmp edx, 0xa
jge 0x40c486
cmp al, 0x22
jne 0x40c464
lea edi, [ecx + 1]
test ah, ah
jne 0x40c452
mov ah, 1
mov dword [esp + edx*4 + 0x1c0], edi
mov byte [esp + 0x13], ah
jmp 0x40c47e
mov al, byte [edi]
cmp al, 0x2c
je 0x40c45c
test al, al
jne 0x40c47e
xor ah, ah
mov byte [esp + 0x13], ah
jmp 0x40c47b
cmp al, 0x2c
jne 0x40c47e
test ah, ah
jne 0x40c47e
inc edx
lea eax, [ecx + 1]
mov dword [esp + edx*4 + 0x1c0], eax
mov ah, byte [esp + 0x13]
mov byte [ecx], 0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c433
cmp edx, 9
jle 0x40c4b0
push 0
push 0xa
lea eax, [edx + 1]
push eax
push str.Number_of_fields_parsed__d____max_expected__d__on_line__ld_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
jmp 0x40c554
lea eax, [edx + 1]
mov dword [esp + 0x18], eax
test eax, eax
jle 0x40c554
nop
mov ecx, dword [esp + esi*4 + 0x1c0]
mov edx, ecx
mov byte [esp + 0x308], 0
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40c4d4
lea eax, [esp + 0x308]
sub edx, edi
push eax
call fcn.00402190
mov eax, esi
add esp, 4
sub eax, 0
je 0x40c52d
sub eax, 1
je 0x40c514
sub eax, 1
jne 0x40c549
lea eax, [esp + 0x308]
push eax
push 0x446264
push 0x10
push 0x12aa088
jmp 0x40c541
lea eax, [esp + 0x308]
push eax
push 0x446264
push 0x80
push 0x12aa008
jmp 0x40c541
lea eax, [esp + 0x308]
push eax
push 0x446264
push 0x10
push 0x12a9ff8
call fcn.00401160
add esp, 0x10
inc esi
cmp esi, dword [esp + 0x18]
jl 0x40c4c0
push str.Get_WmiObject__EA_0__query__SELECT_Manufacturer_FROM_Win32_ComputerSystem___Select_Object_Manufacturer__ConvertTo_Csv__Select_object__skip_2
push str.powershell.exe__Command___s_
lea eax, [esp + 0xa10]
mov byte [esp + 0xa10], 0
push 0x200
push eax
call fcn.00401160
lea eax, [esp + 0xa18]
push 0x448a10
push eax
call fcn.00423932
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40c797
push esi
call fcn.00424e18
add esp, 4
test eax, eax
jne 0x40c60d
nop dword [eax]
nop dword [eax + eax]
push esi
lea eax, [esp + 0x40c]
mov byte [esp + 0x40c], 0
push 0x400
push eax
call fcn.00423a0f
add esp, 0xc
test eax, eax
jne 0x40c5e1
push esi
call fcn.00424e18
add esp, 4
test eax, eax
je 0x40c5b0
jmp 0x40c60d
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c5f0
sub ecx, edx
dec ecx
cmp ecx, 0x400
jae 0x40db36
mov byte [esp + ecx + 0x408], al
push esi
call fcn.00420137
lea ecx, [esp + 0x40c]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c620
sub ecx, edx
je 0x40c797
mov al, byte [esp + ecx + 0x407]
xorps xmm0, xmm0
xor esi, esi
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1d0], xmm0
movq qword [esp + 0x1e0], xmm0
cmp al, 0xd
je 0x40c65c
cmp al, 0xa
jne 0x40c664
mov byte [esp + ecx + 0x407], 0
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c670
sub ecx, edx
mov al, byte [esp + ecx + 0x407]
cmp al, 0xd
je 0x40c688
cmp al, 0xa
jne 0x40c690
mov byte [esp + ecx + 0x407], 0
mov al, byte [esp + 0x408]
lea ecx, [esp + 0x408]
xor ah, ah
xor edx, edx
mov byte [esp + 0x13], ah
mov edi, ecx
mov dword [esp + 0x1c0], edi
test al, al
je 0x40c731
cmp edx, 0xa
jge 0x40c70a
cmp al, 0x22
jne 0x40c6e8
lea edi, [ecx + 1]
test ah, ah
jne 0x40c6d6
mov ah, 1
mov dword [esp + edx*4 + 0x1c0], edi
mov byte [esp + 0x13], ah
jmp 0x40c702
mov al, byte [edi]
cmp al, 0x2c
je 0x40c6e0
test al, al
jne 0x40c702
xor ah, ah
mov byte [esp + 0x13], ah
jmp 0x40c6ff
cmp al, 0x2c
jne 0x40c702
test ah, ah
jne 0x40c702
inc edx
lea eax, [ecx + 1]
mov dword [esp + edx*4 + 0x1c0], eax
mov ah, byte [esp + 0x13]
mov byte [ecx], 0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c6b7
cmp edx, 9
jle 0x40c731
push 0
push 0xa
lea eax, [edx + 1]
push eax
push str.Number_of_fields_parsed__d____max_expected__d__on_line__ld_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
jmp 0x40c797
lea eax, [edx + 1]
mov dword [esp + 0x18], eax
test eax, eax
jle 0x40c797
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x1c0]
mov edx, ecx
mov byte [esp + 0x308], 0
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40c754
lea eax, [esp + 0x308]
sub edx, edi
push eax
call fcn.00402190
add esp, 4
test esi, esi
jne 0x40c790
lea eax, [esp + 0x308]
push eax
push 0x446264
push 0x80
push 0x12aa098
call fcn.00401160
add esp, 0x10
inc esi
cmp esi, dword [esp + 0x18]
jl 0x40c740
push str.Get_WmiObject__EA_0__query__SELECT_Name_FROM_Win32_Processor___Select_Object_Name__ConvertTo_Csv__Select_object__skip_2
push str.powershell.exe__Command___s_
lea eax, [esp + 0xa10]
mov byte [esp + 0xa10], 0
push 0x200
push eax
call fcn.00401160
lea eax, [esp + 0xa18]
push 0x448a10
push eax
call fcn.00423932
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40c9d4
push esi
call fcn.00424e18
add esp, 4
test eax, eax
jne 0x40c84d
nop word [eax + eax]
push esi
lea eax, [esp + 0x40c]
mov byte [esp + 0x40c], 0
push 0x400
push eax
call fcn.00423a0f
add esp, 0xc
test eax, eax
jne 0x40c821
push esi
call fcn.00424e18
add esp, 4
test eax, eax
je 0x40c7f0
jmp 0x40c84d
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c830
sub ecx, edx
dec ecx
cmp ecx, 0x400
jae 0x40db36
mov byte [esp + ecx + 0x408], al
push esi
call fcn.00420137
lea ecx, [esp + 0x40c]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c860
sub ecx, edx
je 0x40c9d4
mov al, byte [esp + ecx + 0x407]
xorps xmm0, xmm0
xor esi, esi
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1d0], xmm0
movq qword [esp + 0x1e0], xmm0
cmp al, 0xd
je 0x40c89c
cmp al, 0xa
jne 0x40c8a4
mov byte [esp + ecx + 0x407], 0
lea ecx, [esp + 0x408]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c8b0
sub ecx, edx
mov al, byte [esp + ecx + 0x407]
cmp al, 0xd
je 0x40c8c8
cmp al, 0xa
jne 0x40c8d0
mov byte [esp + ecx + 0x407], 0
mov al, byte [esp + 0x408]
lea ecx, [esp + 0x408]
xor ah, ah
xor edx, edx
mov byte [esp + 0x13], ah
mov edi, ecx
mov dword [esp + 0x1c0], edi
test al, al
je 0x40c971
cmp edx, 0xa
jge 0x40c94a
cmp al, 0x22
jne 0x40c928
lea edi, [ecx + 1]
test ah, ah
jne 0x40c916
mov ah, 1
mov dword [esp + edx*4 + 0x1c0], edi
mov byte [esp + 0x13], ah
jmp 0x40c942
mov al, byte [edi]
cmp al, 0x2c
je 0x40c920
test al, al
jne 0x40c942
xor ah, ah
mov byte [esp + 0x13], ah
jmp 0x40c93f
cmp al, 0x2c
jne 0x40c942
test ah, ah
jne 0x40c942
inc edx
lea eax, [ecx + 1]
mov dword [esp + edx*4 + 0x1c0], eax
mov ah, byte [esp + 0x13]
mov byte [ecx], 0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c8f7
cmp edx, 9
jle 0x40c971
push 0
push 0xa
lea eax, [edx + 1]
push eax
push str.Number_of_fields_parsed__d____max_expected__d__on_line__ld_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
jmp 0x40c9d4
lea eax, [edx + 1]
mov dword [esp + 0x18], eax
test eax, eax
jle 0x40c9d4
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x1c0]
mov edx, ecx
mov byte [esp + 0x308], 0
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40c994
lea eax, [esp + 0x308]
sub edx, edi
push eax
call fcn.00402190
add esp, 4
test esi, esi
jne 0x40c9cd
lea eax, [esp + 0x308]
push eax
push 0x446264
push 0x40
push 0x12aa118
call fcn.00401160
add esp, 0x10
inc esi
cmp esi, dword [esp + 0x18]
jl 0x40c980
push 0x12aa118
push 0x12aa098
push 0x12aa088
push 0x12aa008
push 0x12a9ff8
push str.THDATA_:_OS_det_Ver__s__caption__s__arch__s_vendor__s__cpumodel__s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x1c
mov eax, dword [esp + 0x14]
push dword [eax + 4]
call fcn.00424dd9
mov edi, eax
mov dword [0x12ab234], 0
add esp, 4
mov dword [esp + 0x18], edi
cmp edi, 2
jne 0x40cb25
push str.Get_WmiObject__EA_0__query_SELECT_DeviceName_ClassGuid_DriverVersion_FROM_Win32_PnPSignedDriver_where_DeviceName_LIKE__Active_Management_Technology___Select_Object_DeviceName_ClassGuid__ConvertTo_Csv__Select_object__skip_2
push str.powershell.exe__Command___s_
lea eax, [esp + 0xa10]
push 0x200
push eax
call fcn.00401160
lea eax, [esp + 0xa18]
push 0x448a10
push eax
call fcn.00423932
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40cb25
push esi
call fcn.00424e18
add esp, 4
test eax, eax
jne 0x40cadd
nop word [eax + eax]
push esi
lea eax, [esp + 0xf0c]
mov byte [esp + 0xf0c], 0
push 0x400
push eax
call fcn.00423a0f
add esp, 0xc
test eax, eax
jne 0x40cab1
push esi
call fcn.00424e18
add esp, 4
test eax, eax
je 0x40ca80
jmp 0x40cadd
lea ecx, [esp + 0xf08]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cac0
sub ecx, edx
dec ecx
cmp ecx, 0x400
jae 0x40db36
mov byte [esp + ecx + 0xf08], al
push esi
call fcn.00420137
lea ecx, [esp + 0xf0c]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40caf0
sub ecx, edx
je 0x40cb25
lea eax, [esp + 0xf08]
push eax
push str.THDATA___Current_OS___BIOS_support_AMT_Det__s_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
mov dword [0x12ab234], 1
push 0
push 0
mov dword [0x1739d28], 8
mov dword [0x12aa168], 7
mov dword [0x44fdec], 0xd
call fcn.00424128
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cb79
push str._getcwd_error
call fcn.00420273
add esp, 4
lea eax, [esi + 1]
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push str._n_______________________________________________n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push 0
call fcn.0041c257
add esp, 0xc
push edx
push eax
push str.___llu__THDATA:_Starting_Infrasense_compact.Loading_command_definitions_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
mov dword [0x12ab220], 0
cmp edi, 1
jne 0x40cc6f
push str.wmi_cmds.txt
push esi
push str._s_s
lea eax, [esp + 0x814]
mov byte [esp + 0x814], 0
push 0x200
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x808]
push eax
push str.WMI_cmds_File_name___s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
push 0x488e00
push 0
push 0x12b0f28
call fcn.00416780
add esp, 0xc
lea edx, [edi + 0x7f]
lea ecx, [esp + 0x808]
push 0x12b0f28
call fcn.0040bac0
add esp, 4
mov dword [0x12ab220], eax
test eax, eax
jg 0x40cc97
push str.THDATA:_Default_monitoring_commands_not_configured_or_not_intialized___CfgFile
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
mov edx, dword [0x1739d28]
mov ecx, 0x44eb1c
push 0x12b0f28
call fcn.0040b640
add esp, 4
mov dword [0x12ab220], eax
test eax, eax
jg 0x40cc97
push str.THDATA:_Default_monitoring_commands_not_configured_or_not_intialized___Default
jmp 0x40cc46
push 0x244700
push 0
push 0x4500c8
call fcn.00416780
add esp, 0xc
mov dword [0x12b0e50], 0
cmp edi, 1
jne 0x40ce18
push str.wmi_cmds_daily.txt
push esi
push str._s_s
lea eax, [esp + 0x814]
mov byte [esp + 0x814], 0
push 0x200
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x808]
push eax
push str.WMI_cmds_Daily_run_File_name___s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
lea edx, [edi + 0x3f]
lea ecx, [esp + 0x808]
push 0x4500c8
call fcn.0040bac0
add esp, 4
mov dword [0x12b0e50], eax
lea eax, [esp + 0x808]
mov byte [esp + 0x808], 0
push str.win_shell_cmds.txt
push esi
push str._s_s
push 0x200
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x808]
push eax
push str.Sh_cmds_run_File_name___s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
push 0x60ac00
push 0
push 0xc9f3f8
call fcn.00416780
add esp, 0xc
lea ecx, [esp + 0x808]
push 0xc9f3f8
call fcn.0040b070
add esp, 4
mov dword [0x6947dc], eax
cmp dword [0x12b0e54], 0
je 0x40ce3f
push str.win_cmds_psmode.txt
push esi
push str._s_s
lea eax, [esp + 0x814]
mov byte [esp + 0x814], 0
push 0x200
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x808]
push eax
push str.WMI_PwSh_cmds_run_File_name___s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
push 0x60ac00
push 0
push 0x6947f8
call fcn.00416780
add esp, 0xc
lea ecx, [esp + 0x808]
push 0x6947f8
call fcn.0040b070
mov dword [0x44fdf0], eax
jmp 0x40ce3c
mov edx, dword [0x12aa168]
mov ecx, 0x44eb00
push 0x4500c8
call fcn.0040b640
mov dword [0x12b0e50], eax
call fcn.0040ab20
mov dword [0x6947dc], eax
add esp, 4
push 0
call fcn.0041c257
add esp, 4
push dword [0x44fdf0]
push dword [0x6947dc]
push dword [0x12b0e50]
push dword [0x12ab220]
push edx
push eax
push str.__lu__Commands_:_DefWmi__d__DefWmiJson__d__defPwSh__d___WMI_EQ_PSH__d__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push dword [0x44fdf0]
lea eax, [esp + 0x264]
push dword [0x6947dc]
push dword [0x12b0e50]
push dword [0x12ab220]
push str.Cmds_:_DefWmi__d__DefWmiJson__d__defPwSh__d___WMI_EQ_PSH__d_
push 0x80
push eax
call fcn.00401160
add esp, 0x3c
lea ecx, [esp + 0x240]
call fcn.004020c0
cmp dword [0x12ab220], 0
jne 0x40cf52
cmp dword [0x12b0e50], 0
jne 0x40cf52
cmp dword [0x6947dc], 0
jne 0x40cf52
push str.__lu__Monitoring_Commands_not_initialized.._Exiting_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push 0
call fcn.0041c257
add esp, 0xc
push dword [0x44fdf0]
push dword [0x6947dc]
push dword [0x12b0e50]
push dword [0x12ab220]
push edx
push eax
push str.Monitoring_Cmds_not_initialized_DefWmi__d__DefWmiJson__d__defPwSh__d___WMI_EQ_PSH__d_
lea eax, [esp + 0x25c]
push 0x80
push eax
call fcn.00401160
add esp, 0x24
lea ecx, [esp + 0x240]
call fcn.004020c0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push str.tdorgid.det
push esi
push str._s_s
lea eax, [esp + 0x814]
mov dword [0x12ab238], 0
push pe_nt_image_headers32
push eax
mov byte [0x12aa170], 0
mov byte [esp + 0x81c], 0
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x808]
push 0x449320
push eax
call fcn.0041fc98
mov edi, eax
add esp, 8
test edi, edi
jne 0x40cfaa
xor ecx, ecx
jmp 0x40cfd9
push edi
push 0x1000
push 0x12aa170
call fcn.00423a0f
add esp, 0xc
push edi
call fcn.00420137
mov ecx, 0x12aa170
add esp, 4
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cfd0
sub ecx, edx
push 0
mov dword [0x12ab238], ecx
call fcn.0041c257
add esp, 4
push dword [0x12ab238]
push edx
push eax
push str.__lu_THDATA:_orgdetails_len___d_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
cmp dword [0x12ab238], 0
je 0x40d03b
push 0
call fcn.0041c257
add esp, 4
push 0x12aa170
push edx
push eax
push str.__lu_THDATA:_orgdetails_value___s_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
push esi
push 0x446264
push 0xff
push 0x1739d30
mov byte [0x1739d30], 0
call fcn.00401160
push esi
call fcn.0041c2bf
add esp, 0x14
push 0xac
push 0
push 0x12ab170
call fcn.00416780
add esp, 0xc
push 0x12ab170
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea eax, [esp + 0x308]
xorps xmm0, xmm0
push eax
movups xmmword [0x6947cc], xmm0
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
test eax, eax
jne 0x40d0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetCurrentHwProfile_failed_with_error__lx_n
jmp 0x40d16e
push 0x80
lea eax, [esp + 0xc0c]
push 0
push eax
call fcn.00416780
add esp, 0xc
lea eax, [esp + 0x30e]
push 0x40
push eax
lea eax, [esp + 0xc10]
push eax
call fcn.004244fe
add esp, 0xc
lea eax, [esp + 0xc08]
push 0x6947db
push 0x6947da
push 0x6947d9
push 0x6947d8
push 0x6947d7
push 0x6947d6
push 0x6947d5
push 0x6947d4
push 0x6947d3
push 0x6947d2
push 0x6947d1
push 0x6947d0
push 0x6947cf
push 0x6947ce
push 0x6947cd
push 0x6947cc
push str._02hhX_02hhX_02hhX_02hhX__02hhX_02hhX__02hhX_02hhX__02hhX_02hhX__02hhX_02hhX_02hhX_02hhX_02hhX_02hhX
push eax
call fcn.00401190
add esp, 0x48
mov byte [esp + 0x1c0], 0
lea eax, [esp + 0x1c0]
push 0x41
push eax
push 0x6947cc
push 0x17
call dword [sym.imp.WS2_32.dll_inet_ntop]
lea eax, [esp + 0x1c0]
push eax
push str.THDATA:_System_Guid_Hex_s_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
push 0x40a840
push 0x16
call fcn.00427412
push 0x40a840
push 2
call fcn.00427412
push 0x40a840
push 0xf
call fcn.00427412
add esp, 0x18
lea eax, [esp + 0x30]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40d1ee
push eax
push str.THDATA:WSAStartup_failed_with_error:__d_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x18]
mov eax, 0x1433
mov word [0x44eb3c], ax
mov byte [0x44fd68], 0
mov byte [0x12b0e58], 0
mov dword [0x6947e0], 0
mov dword [esp + 0x1c], 0
cmp edi, 3
ja case.default.0x40d226
jmp dword [edi*4 + 0x40db3c]
mov eax, 0x1f90
mov dword [0x6947e0], 1
mov word [0x44eb3c], ax
mov esi, dword [esp + 0x14]
mov edx, 0x12b0ee0
mov ecx, dword [esi + 8]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40d250
mov eax, dword [ebp + 8]
cmp eax, 4
jl 0x40d27a
push dword [esi + 0xc]
call fcn.00424dd9
mov word [0x44eb3c], ax
add esp, 4
mov eax, dword [ebp + 8]
cmp eax, 5
jl 0x40d2bf
mov ecx, dword [esi + 0x10]
mov edx, 0x12b0e58
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40d287
lea eax, [esp + 0x1c]
push eax
push 0x12b0e58
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
mov eax, dword [ebp + 8]
jle 0x40d2bf
cmp dword [esp + 0x1c], 0
je 0x40d2bf
mov dword [0x12ae2b8], 1
cmp eax, 6
jl case.default.0x40d226
mov ecx, dword [esi + 0x14]
mov edx, 0x12addd8
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40d2d0
jmp case.default.0x40d226
mov dword [0x6947e0], 1
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
call fcn.0040a880
test eax, eax
js 0x40c02f
mov ecx, 0x44fd68
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d306
sub ecx, edx
jne 0x40d321
push 0x80
push 0x44fd68
call dword [sym.imp.WS2_32.dll_gethostname]
push 0
call fcn.0041c257
add esp, 4
push 0x12b0e58
push 0x44fd68
push edx
push eax
push str.__llu_THDATA:_Starting_Infrasense_compact_with_hostname__s__aliasname___s__n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push 0
call fcn.0041c257
movzx ecx, word [0x44eb3c]
add esp, 0x1c
push ecx
push 0x12b0ee0
push edx
push eax
push str.__llu_THDATA:_Connecting_to_Infrasense_on__s:_u_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
movzx ecx, word [0x44eb3c]
add esp, 0x18
mov edx, 0x12b0ee0
mov dword [0x12ab21c], 2
call fcn.00403280
mov dword [0x44fde8], eax
cmp eax, 0xffffffff
jne 0x40d420
movzx eax, word [0x44eb3c]
push eax
push 0x12b0ee0
push str.Exiting_Unable_to_create_socket_connection_to_Infrasense_on__s:_u_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
push 0x12b0ee0
push str.Exiting_Unable_to_create_socket_connection_to__s
lea eax, [esp + 0x258]
mov byte [esp + 0x258], 0
push 0x80
push eax
call fcn.00401160
add esp, 0x20
lea ecx, [esp + 0x240]
call fcn.004020c0
push dword [0x12addd0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push 0
call fcn.0041c257
add esp, 4
push 0x44fd68
push edx
push eax
push str.__llu_THDATA:_Infrasense_compact_agent__s__started..._n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
lea eax, [esp + 0x240]
push 0x44fd68
push str.THDATA:_Infrasense_compact_agent__s__started...
push 0x80
push eax
call fcn.00401160
add esp, 0x10
lea ecx, [esp + 0x240]
call fcn.004020c0
cmp dword [0x6947e0], 0
je 0x40d4dd
push 0
call fcn.0041c257
add esp, 4
push dword [0x12b0e50]
push edx
push eax
push str.__llu_THDATA:_Resetting_Json_based_WMI_commands__d__for_Aggr_mode._n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
lea eax, [esp + 0x240]
push dword [0x12b0e50]
push str.THDATA:_Resetting_Json_based_WMI_commands__d__for_Aggr_mode.
push 0x80
push eax
call fcn.00401160
add esp, 0x10
lea ecx, [esp + 0x240]
call fcn.004020c0
mov dword [0x12b0e50], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d55d
lea eax, [esp + 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40d575
push 0
push 0
push 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
push eax
push 0
push dword [esp + 0x2c]
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x40d575
push str.Error_during_open_process
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 8
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
jns 0x40d5f6
push esi
push str.THDATA:_Failed_to_initialize_COM_library._Error_code__0x_x_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
mov byte [esp + 0x240], 0
lea eax, [esp + 0x240]
push esi
push str.THDATA:_Failed_to_initialize_COM_library._Error_code__0x_x
push 0x80
push eax
call fcn.00401160
add esp, 0x10
lea ecx, [esp + 0x240]
call fcn.004020c0
push dword [0x12addd0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 2
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jns 0x40d68b
push esi
push str.THDATA:_Failed_to_initialize_security._Error_code__0x_x_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
push str.THDATA:_Failed_to_initialize_security._Error_code__0x_x
lea eax, [esp + 0x248]
mov byte [esp + 0x248], 0
push 0x80
push eax
call fcn.00401160
add esp, 0x10
lea ecx, [esp + 0x240]
call fcn.004020c0
push dword [0x12addd0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
push 0x6947c8
push 0x43f140
push 1
push 0
push 0x43f150
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x40d711
push esi
push str.THDATA:_Failed_to_create_IWbemLocator_object._Err_code__0x_x_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
push str.THDATA:_Failed_to_create_IWbemLocator_object._Err_code__0x_x
lea eax, [esp + 0x248]
mov byte [esp + 0x248], 0
push 0x80
push eax
call fcn.00401160
add esp, 0x10
lea ecx, [esp + 0x240]
call fcn.004020c0
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
cmp edi, 2
jne 0x40d72a
push str.GLOB_TD_AGENTS
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x12ab224], eax
cmp dword [0x12ab220], 0
jle 0x40d809
cmp dword [0x12b0e54], 0
jne 0x40d809
push 0x2b90
push 0
push 0x12ab240
call fcn.00416780
add esp, 0xc
push str.127.0.0.1_WMI
push 0x3c
push 0x12ab240
call fcn.00401160
add esp, 0xc
mov ecx, 0x12ab240
call fcn.00403d10
mov dword [0x12ab3c0], 5
test eax, eax
jne 0x40d796
push eax
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___llu__td_setup_wmi_connection_failed_local_host_n
jmp 0x40d7c2
push 0x12ab240
push 0x408e10
mov ecx, 0x12ab3ac
call fcn.00412270
add esp, 8
push 0
test eax, eax
je 0x40d7d7
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___u_rhost_data_collection___thread_create_failed_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
jmp 0x40d809
mov eax, dword [0x12ab3ac]
mov byte [0x12ab3b4], 1
mov esi, dword [eax + 0x58]
call fcn.0041c257
add esp, 4
push esi
push edx
push eax
push str.THDATA:___u_rhost_data_collection_thread_started___thread_id___lu_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
cmp dword [0x12b0e50], 0
jle 0x40d8e8
cmp dword [0x12b0e54], 0
jne 0x40d8e8
push 0x2b90
push 0
push 0x12ae2c0
call fcn.00416780
add esp, 0xc
push str.127.0.0.1_WMIJson
push 0x3c
push 0x12ae2c0
call fcn.00401160
add esp, 0xc
mov dword [0x12ae440], 5
mov ecx, 0x12ae2c0
call fcn.00403d10
test eax, eax
jne 0x40d875
push eax
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___llu__td_setup_wmi_connection_failed_local_host___for_daily_polling_collection_n
jmp 0x40d8a1
push 0x12ae2c0
push 0x407090
mov ecx, 0x12ae42c
call fcn.00412270
add esp, 8
push 0
test eax, eax
je 0x40d8b6
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___llu_rhost_daily_data_collection____thread_create_failed_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
jmp 0x40d8e8
mov eax, dword [0x12ae42c]
mov byte [0x12ae434], 1
mov esi, dword [eax + 0x58]
call fcn.0041c257
add esp, 4
push esi
push edx
push eax
push str.THDATA:___llu_rhost_daily_data_collection_thread_started___thread_id___lu_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
cmp dword [0x6947dc], 0
mov dword [0x12b0ed8], 1
jle 0x40d972
push 0x12b0ed8
push 0x404670
mov ecx, 0x12ab22c
call fcn.00412270
add esp, 8
push 0
test eax, eax
je 0x40d940
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___llu_rhost_shell_cmd_data_collection____thread_create_failed_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
jmp 0x40d972
mov byte [0x44fd66], 1
call fcn.0041c257
mov ecx, dword [0x12ab22c]
add esp, 4
push dword [ecx + 0x58]
push edx
push eax
push str.THDATA:___llu_rhost_shell_cmd_data_collection_thread_started___thread_id___lu_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
cmp dword [0x12b0e54], 0
mov dword [0x44fdf8], 0
je 0x40da4f
call fcn.004043c0
test eax, eax
jns 0x40d9cc
push 0
call fcn.0041c257
add esp, 4
push edx
push eax
push str.__lu__infrasnse_static_agent_det_cmds_init_failed_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1304]
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
cmp dword [0x44fdf0], 0
jle 0x40da4f
push 0x44fdf8
push 0x404670
mov ecx, 0x4500a0
call fcn.00412270
add esp, 8
push 0
test eax, eax
je 0x40da1a
call fcn.0041c257
add esp, 4
push edx
push eax
push str.THDATA:___llu_rhost_shell_cmd_data_collection_WMI_PS_MODE____thread_create_failed_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x10
jmp 0x40da4f
mov dword [0x12b0f20], 1
call fcn.0041c257
mov ecx, dword [0x4500a0]
add esp, 4
push dword [ecx + 0x58]
push edx
push eax
push str.THDATA:___llu_rhost_shell_cmd_data_collection_thread_started___WMI_PS_MODE___thread_id___lu_n
push 2
call fcn.0041c1d3
add esp, 4
push eax
call fcn.004010a0
add esp, 0x14
cmp byte [0x12ae434], 0
je 0x40da6c
push dword [0x12ae430]
push dword [0x12ae42c]
call fcn.00412150
add esp, 8
cmp byte [0x12ab3b4], 0
je 0x40da89
push dword [0x12ab3b0]
push dword [0x12ab3ac]
call fcn.00412150
add esp, 8
cmp byte [0x44fd66], 0
je 0x40daa6
push dword [0x12ab230]
push dword [0x12ab22c]
call fcn.00412150
add esp, 8
cmp dword [0x12b0f20], 0
je 0x40dac3
push dword [0x4500a4]
push dword [0x4500a0]
call fcn.00412150
add esp, 8
mov eax, dword [0x12ab228]
test eax, eax
je 0x40dadf
push eax
call fcn.00420137
add esp, 4
mov dword [0x12ab228], 0
mov eax, dword [0x6947c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [0x44fde8]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x12aa16c]
test eax, eax
je 0x40db14
push eax
call fcn.00420137
add esp, 4
push dword [0x12addd0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0x130c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00413b45
mov esp, ebp
pop ebp
ret
call fcn.00413c75
nop
inc edx
rol byte [eax], cl
ljmp 0x40d2