Function at 0x41ecb0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x794
mov eax, dword [0x44d558]
mov dword [ebp - 0xc], eax
push edi
mov eax, dword [str.main]
mov dword [ebp - 0x658], eax
mov ecx, dword [0x444324]
mov dword [ebp - 0x654], ecx
mov dx, word [0x444328]
mov word [ebp - 0x650], dx
mov ax, word [0x44e858]
mov word [ebp - 0x410], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x44e860]
mov word [ebp - 0x790], cx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x78e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dx, word [0x44e868]
mov word [ebp - 0x518], dx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x516]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x44e870]
mov word [ebp - 0x638], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x636]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x644], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x684], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x534], 0x44434c
mov dword [ebp - 0x530], 0x431ae0
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x64c], 0
call dword [sym.imp.SQLUNIRL.dll__GetUnicodeRedirectionLayer_0]
mov dword [0x450d4c], eax
mov dword [0x44de9c], 1
push 0x1afc
push 0
push 0x44f200
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [0x44de90], 0
mov ecx, dword [0x44de90]
mov dword [0x44de94], ecx
push 0
mov edx, dword [0x450d4c]
call dword [edx + 0x224]
mov dword [0x44e61c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push 0x44ef40
push 0x44e620
mov eax, dword [0x44e61c]
push eax
call dword [sym.imp.SQLRESLD.dll_SQLUILoadResourceDLL]
add esp, 0x10
test eax, eax
jne 0x41ee66
xor eax, eax
jmp 0x41f894
mov dword [ebp - 0x520], 0x10
lea ecx, [ebp - 0x520]
push ecx
push 0x44e0d0
call dword [sym.imp.SQLUNIRL.dll__GetComputerName_8]
push 0
push 0
push 0
push 1
call fcn.00432430
add esp, 0x10
mov dword [0x44de90], eax
mov dword [0x44de94], 0
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0x12
mov eax, dword [0x44e620]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x44436c
push 0x444384
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 0xc
push 0x44f0e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f0c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f0a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f080
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f060
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f040
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f020
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44f000
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44efe0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44efc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44efa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44ef80
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x44ef60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x44de90], 0
jne 0x41ef77
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea edx, [ebp - 0x680]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x66c]
mov dword [0x44dec4], eax
mov dword [0x44ef48], 0
push 1
push 0x44eec0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x41eff0
push 0
push 0
push 1
push 0x44eec0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x41efe9
mov dword [0x44eee0], 0xc
mov dword [0x44eee4], 0x44eec0
mov dword [0x44eee8], 0
mov dword [0x44ef48], 0x44eee0
jmp 0x41efee
jmp 0x41f3be
jmp 0x41eff5
jmp 0x41f3be
call dword [sym.imp.SQLSVC.dll_SQLSvcInit]
test eax, eax
jne 0x41f004
jmp 0x41f3be
cmp dword [0x44de90], 0
jne 0x41f049
push 0
push str.KERNEL32.DLL
push 3
call fcn.00406cf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41f049
push str.TryEnterCriticalSection
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SQLUNIRL.dll__GetProcAddress__8]
mov dword [0x44e628], eax
cmp dword [0x44e628], 0
jne 0x41f049
jmp 0x41f3be
push 1
call fcn.004227c0
add esp, 4
mov dword [0x44e850], eax
cmp dword [0x44e84c], 2
jne 0x41f099
cmp dword [0x44e850], 0
jne 0x41f099
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0x78
mov eax, dword [0x44e620]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 4
jmp 0x41f3be
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x790]
push eax
push 0x44dec0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041f8b0
add esp, 0x14
test eax, eax
jne 0x41f0c5
jmp 0x41f3be
mov eax, dword [0x44dec0]
and eax, 0x20
je 0x41f0e4
cmp dword [0x44de94], 0
jne 0x41f0e4
mov dword [ebp - 0x794], 0
jmp 0x41f0ee
mov dword [ebp - 0x794], 1
mov ecx, dword [ebp - 0x794]
mov dword [0x44dea0], ecx
movzx edx, word [ebp - 0x518]
neg edx
sbb edx, edx
lea eax, [ebp - 0x518]
and edx, eax
push edx
movzx ecx, word [ebp - 0x790]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x790]
and ecx, edx
push ecx
push 0x44f200
call fcn.0042e280
add esp, 0xc
mov eax, dword [0x44dec0]
and eax, 1
jne 0x41f14e
cmp dword [0x44de90], 0
jne 0x41f14e
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [ebp - 0x644], eax
cmp dword [0x44de90], 0
jne 0x41f16a
push 0
push 0x3ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 0x644], eax
push 0x104
push 0x44dec8
push 0
call dword [sym.imp.SQLUNIRL.dll__GetModuleFileName_12]
push 0x44dec8
call fcn.00423640
add esp, 4
push 0xa
push 0xadc
push 0x44f1e0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0xd08
push 0x44f1c0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 8
push 0x56c
push 0x44f1a0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x14
push 0x44f180
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x24
push 0x44f160
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 5
push 0x28
push 0x44f140
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x104
push 0x44f120
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x59c
push 0x44f100
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
mov ecx, dword [0x44dec0]
and ecx, 1
jne 0x41f324
push 0x444208
call fcn.00407230
add esp, 4
test eax, eax
je 0x41f254
mov dword [ebp - 0x534], 0x4443f0
jmp 0x41f270
push 0x444208
push 0x44e2f8
call fcn.00423450
add esp, 8
mov dword [ebp - 0x534], 0x44e2f8
lea edx, [ebp - 0x534]
push edx
call fcn.004317f0
add esp, 4
test eax, eax
je 0x41f292
mov dword [0x444310], 0
jmp 0x41f322
cmp dword [ebp + 8], 1
jne 0x41f2ca
push 0x200
lea eax, [ebp - 0x410]
push eax
push 0xf
mov ecx, dword [0x44e620]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x444410
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
jmp 0x41f322
push 0x200
lea eax, [ebp - 0x410]
push eax
push 0x10
mov ecx, dword [0x44e620]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
push 1
push 2
push 0xc0000064
push 1
push 1
call fcn.0041cf30
add esp, 0x18
jmp 0x41f395
call fcn.0041fe00
test eax, eax
jne 0x41f332
jmp 0x41f3be
push 0x444430
push 0x5e
push 0
push 4
call fcn.0041d760
add esp, 0x10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x421710
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.004204a0
test eax, eax
je 0x41f395
call fcn.00421380
test eax, eax
je 0x41f395
push 0xffffffffffffffff
mov eax, dword [0x450d00]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00402720
push 0xf
call fcn.00411190
add esp, 4
mov dword [0x444310], 0
call fcn.00422350
lea ecx, [ebp - 0x638]
push ecx
call fcn.00429070
add esp, 4
test eax, eax
je 0x41f3be
push 1
lea edx, [ebp - 0x638]
push edx
call fcn.004249c0
add esp, 8
call fcn.00411570
cmp dword [0x450d10], 0
je 0x41f3d8
mov eax, dword [0x450d10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x44e618], 0
je 0x41f3ee
mov ecx, dword [0x44e618]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x44deb4], 0
jne 0x41f82e
cmp dword [0x44de90], 0
je 0x41f411
push 0x44f000
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x41f452
push 0x44f000
call dword [0x44e628]
test eax, eax
jne 0x41f452
cmp dword [0x44de94], 0
je 0x41f447
cmp dword [0x450a88], 0
je 0x41f447
lea edx, [ebp - 0x658]
push edx
push 0x444450
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
push 0x44f000
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x44de94], 0
je 0x41f479
cmp dword [0x450a88], 0
je 0x41f479
lea eax, [ebp - 0x658]
push eax
push 0x44448c
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
mov dword [ebp - 0x524], 0
jmp 0x41f494
mov ecx, dword [ebp - 0x524]
add ecx, 1
mov dword [ebp - 0x524], ecx
mov edx, dword [ebp - 0x524]
cmp edx, dword [0x44f1e8]
jge 0x41f4f7
mov dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x524]
push eax
push 0x44f1e0
call dword [sym.imp.SQLSVC.dll_SHRecMemLock]
add esp, 8
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0
je 0x41f4f5
mov ecx, dword [ebp - 0x684]
cmp dword [ecx + 0x2a8], 0
je 0x41f4f5
mov edx, dword [ebp - 0x684]
add edx, 0x2a0
push edx
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
jmp 0x41f485
push 0x44f000
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x44de94], 0
je 0x41f529
cmp dword [0x450a88], 0
je 0x41f529
lea eax, [ebp - 0x658]
push eax
push 0x4444c0
call dword [sym.imp.MSVCR71.dll_wprintf]
add esp, 8
push 0x44f180
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f1e0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f1c0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f1a0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f160
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f140
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f120
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x44f100
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
cmp dword [0x44ee90], 0
je 0x41f64e
lea ecx, [ebp - 0x648]
push ecx
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x51c]
push eax
mov ecx, dword [0x44ee90]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x41f63f
cmp dword [0x44ee80], 0
je 0x41f5e2
mov edx, dword [0x44ee80]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [0x44ee84], 0
je 0x41f5f7
mov eax, dword [0x44ee84]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [0x44ee88], 0
je 0x41f60f
mov ecx, dword [0x44ee88]
push ecx
call fcn.00422e50
add esp, 4
cmp dword [0x44ee8c], 0
je 0x41f627
mov edx, dword [0x44ee8c]
push edx
call fcn.00422e50
add esp, 4
cmp dword [ebp - 0x64c], 0
je 0x41f63f
mov eax, dword [ebp - 0x64c]
push eax
call fcn.00422e50
add esp, 4
mov ecx, dword [0x44ee90]
push ecx
call fcn.00422e50
add esp, 4
mov dword [ebp - 0x524], 0
jmp 0x41f669
mov edx, dword [ebp - 0x524]
add edx, 1
mov dword [ebp - 0x524], edx
cmp dword [ebp - 0x524], 0x11
jge 0x41f698
mov eax, dword [ebp - 0x524]
cmp dword [eax*4 + 0x450d00], 0
je 0x41f696
mov ecx, dword [ebp - 0x524]
mov edx, dword [ecx*4 + 0x450d00]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41f65a
mov eax, dword [0x44e83c]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x41f6c1
mov ecx, dword [0x44e83c]
push ecx
push 0x61
push 0
push 1
call fcn.0041d760
add esp, 0x10
call fcn.00423070
or eax, dword [ebp - 0x63c]
mov dword [ebp - 0x63c], eax
cmp dword [0x44de94], 0
jne 0x41f6e4
cmp dword [ebp - 0x63c], 0
je 0x41f728
mov edx, dword [0x44e840]
push edx
push 0x60
push 0
push 3
call fcn.0041d760
add esp, 0x10
mov eax, dword [0x44e844]
push eax
push 0x134
push 0
push 3
call fcn.0041d760
add esp, 0x10
mov ecx, dword [0x44e848]
push ecx
push 0x135
push 0
push 3
call fcn.0041d760
add esp, 0x10
push 0x44f0c0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f0a0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f080
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f060
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f040
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f020
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44f000
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44efe0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44efc0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44efa0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44ef80
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x44ef60
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.SQLSVC.dll_SQLSvcExit]
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0xf2
mov eax, dword [0x44e620]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea ecx, [ebp - 0x410]
push ecx
push 0x4444f4
push 0x62
push 0
push 4
call fcn.0041d760
add esp, 0x14
call fcn.0041b1c0
mov edx, dword [0x44e850]
push edx
call fcn.00423020
add esp, 4
push 0x44e620
mov eax, dword [0x44e61c]
push eax
call dword [sym.imp.SQLRESLD.dll_SQLUIUnloadResourceDLL]
add esp, 8
cmp dword [ebp - 4], 0
je 0x41f821
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x444310]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200
lea eax, [ebp - 0x410]
push eax
push 0xf3
mov ecx, dword [0x44e620]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea edx, [ebp - 0x410]
push edx
push 0x444514
push 0x62
push 0
push 2
call fcn.0041d760
add esp, 0x14
cmp dword [0x44e610], 0
je 0x41f87b
mov eax, dword [0x44e610]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x444310]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x444310]
mov ecx, dword [ebp - 0xc]
call fcn.00434de1
pop edi
mov esp, ebp
pop ebp
ret