Function at 0x41df50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f1ebd
mov eax, dword fs:[0]
push eax
sub esp, 0x844
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x542c54]
xor eax, esp
push eax
lea eax, [esp + 0x858]
mov dword fs:[0], eax
mov eax, dword [esp + 0x868]
mov edx, dword [esp + 0x878]
mov esi, ecx
mov ecx, dword [esp + 0x874]
push 0x54544c
mov dword [esp + 0x20], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], edx
call fcn.00419080
add esp, 4
push 0
lea ecx, [esi + 0x42c]
push 0x4f4b88
call fcn.00403330
push 0
lea ecx, [esi + 0x448]
push 0x4f4b88
mov dword [esp + 0x3c], ecx
call fcn.00403330
push 0
lea ecx, [esi + 0x4a0]
push 0x4f4b88
call fcn.00403330
push 0
lea ecx, [esi + 0x4bc]
push 0x4f4b88
call fcn.00403330
push 0
lea ecx, [esi + 0x4d8]
push 0x4f4b88
call fcn.00403330
push 0
lea ecx, [esi + 0x4f4]
push 0x4f4b88
call fcn.00403330
push 0
push 0x4f4b88
lea ecx, [esi + 0x510]
call fcn.00403330
push 0
call fcn.004ce03a
push eax
call fcn.004ce515
mov ecx, dword [0x54545c]
sub ecx, dword [0x545458]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add esp, 8
add edi, edx
call fcn.004ce527
xor edx, edx
div edi
mov dword [esi + 0x22c], edx
mov edi, dword [0x545458]
cmp edi, dword [0x54545c]
jbe 0x41e08e
call fcn.004cc9ff
mov ebp, dword [0x54544c]
jmp 0x41e0a0
mov ebx, dword [0x54545c]
cmp dword [0x545458], ebx
jbe 0x41e0b3
call fcn.004cc9ff
test ebp, ebp
je 0x41e0bf
cmp ebp, dword [0x54544c]
je 0x41e0c4
call fcn.004cc9ff
cmp edi, ebx
je 0x41e167
test ebp, ebp
jne 0x41e105
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41e0e1
call fcn.004cc9ff
mov eax, dword [edi]
cmp eax, dword [esi + 0x22c]
je 0x41e10f
test ebp, ebp
jne 0x41e10a
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41e100
call fcn.004cc9ff
add edi, 0x3c
jmp 0x41e0a0
mov eax, dword [ebp]
jmp 0x41e0d7
mov eax, dword [ebp]
jmp 0x41e0f6
test ebp, ebp
jne 0x41e20f
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41e128
call fcn.004cc9ff
push 0xffffffffffffffff
push 0
lea ecx, [edi + 4]
push ecx
lea ecx, [esi + 0x268]
call fcn.00403210
test ebp, ebp
jne 0x41e217
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41e154
call fcn.004cc9ff
push 0xffffffffffffffff
push 0
add edi, 0x20
push edi
lea ecx, [esi + 0x284]
call fcn.00403210
mov ecx, dword [0x54545c]
sub ecx, dword [0x545458]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edi, [eax - 1]
cmp edi, eax
jb 0x41e192
call fcn.004cc9ff
mov eax, dword [0x545458]
mov edx, edi
shl edx, 4
push 0xffffffffffffffff
sub edx, edi
xor ebx, ebx
lea eax, [eax + edx*4 + 4]
push ebx
push eax
lea ecx, [esi + 0x230]
call fcn.00403210
mov ecx, dword [0x54545c]
sub ecx, dword [0x545458]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edi, [eax - 1]
cmp edi, eax
jb 0x41e1de
call fcn.004cc9ff
mov edx, dword [0x545458]
mov ecx, edi
shl ecx, 4
sub ecx, edi
push 0xffffffffffffffff
lea eax, [edx + ecx*4 + 0x20]
push ebx
push eax
lea ecx, [esi + 0x24c]
call fcn.00403210
cmp dword [esi + 0x29c], 0x10
jb 0x41e21f
mov ecx, dword [esi + 0x288]
jmp 0x41e225
mov eax, dword [ebp]
jmp 0x41e11e
mov eax, dword [ebp]
jmp 0x41e14a
lea ecx, [esi + 0x288]
lea edx, [esp + 0x24c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x41e230
mov eax, dword [esi + 0x298]
push 0x1b
push str._____BEGIN_PUBLIC_KEY______n
lea ecx, [esp + 0xac]
mov byte [esp + eax + 0x254], bl
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
call fcn.00403330
mov eax, dword [esp + 0x14]
mov dword [esp + 0x860], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e281
sub eax, edx
je 0x41e361
mov eax, 0x40
sub eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e2a7
mov ecx, dword [esp + 0x14]
sub eax, edx
mov edx, dword [esp + 0x24]
lea ebp, [ecx + ebx]
add edx, ebp
cmp eax, edx
jbe 0x41e2c8
mov edi, 0x40
jmp 0x41e2dd
mov eax, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e2d0
sub eax, edx
sub eax, ebx
mov edi, eax
push 0x41
lea eax, [esp + 0x15c]
push 0
push eax
call fcn.004cb5a0
push edi
lea ecx, [esp + 0x168]
push ebp
push ecx
call fcn.004cd900
lea eax, [esp + 0x170]
add esp, 0x18
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41e310
sub eax, ecx
push eax
lea edx, [esp + 0x15c]
push edx
lea ecx, [esp + 0xac]
call fcn.00415a00
push 1
push 0x4f85ec
lea ecx, [esp + 0xac]
call fcn.00415a00
mov eax, dword [esp + 0x14]
add ebx, 0x40
lea edx, [eax + 1]
jmp 0x41e350
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e350
sub eax, edx
cmp ebx, eax
jb 0x41e2a0
push 0x19
push str._____END_PUBLIC_KEY______n
lea ecx, [esp + 0xac]
call fcn.00415a00
push 0x3ff
xor ebx, ebx
lea eax, [esp + 0x459]
push ebx
push eax
mov byte [esp + 0x460], 0
call fcn.004cb5a0
lea eax, [esp + 0x258]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e3a0
mov ecx, dword [esp + 0xa8]
mov ebp, 0x10
sub eax, edx
cmp dword [esp + 0xbc], ebp
jae 0x41e3c5
lea ecx, [esp + 0xa8]
lea edx, [esp + 0x454]
push edx
push ecx
push eax
lea eax, [esp + 0x258]
push eax
call fcn.004150c0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41e40e
mov ecx, dword [esp + 0x34]
push 0x1c
push str.ktbAgentValue__code_:_02__
call fcn.00415a00
cmp dword [esp + 0xbc], ebp
jb 0x41f434
mov ecx, dword [esp + 0xa8]
push ecx
jmp 0x41f42c
lea edx, [esp + 0x3c]
push edx
push eax
lea eax, [esp + 0x45c]
push eax
call fcn.00414660
add esp, 0xc
cmp eax, ebx
jle 0x41e453
mov edx, dword [esp + 0x3c]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e431
sub eax, edi
push eax
push edx
mov ecx, 0x53a7ac
call fcn.00403330
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004cd871
add esp, 4
mov ecx, esi
call fcn.00417400
test al, al
jne 0x41e47a
mov ecx, dword [esp + 0x34]
push 0x1c
push str.ktbAgentValue__code_:_01__
call fcn.00415a00
cmp dword [esp + 0xbc], ebp
jmp 0x41f422
mov eax, dword [esp + 0x870]
push 0x40
mov dword [esi + 0x2a0], eax
call fcn.004bf5a2
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x860], 1
cmp eax, ebx
je 0x41e4b7
mov ecx, dword [esi + 0x2a0]
push ecx
mov ecx, eax
call fcn.004210e0
mov edi, eax
mov dword [esp + 0x30], eax
jmp 0x41e4bd
xor edi, edi
mov dword [esp + 0x30], edi
mov ecx, edi
mov byte [esp + 0x860], 0
call fcn.004214d0
lea ecx, [esp + 0x74]
call fcn.004c0991
push 4
mov byte [esp + 0x864], 2
call fcn.004bf5a2
add esp, 4
cmp eax, ebx
je 0x41e4f3
lea edx, [esp + 0x44]
mov dword [eax], edx
jmp 0x41e4f5
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
push 4
mov byte [esp + 0x864], 4
call fcn.004bf5a2
add esp, 4
cmp eax, ebx
je 0x41e523
lea ecx, [esp + 0x5c]
mov dword [eax], ecx
jmp 0x41e525
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
mov byte [esp + 0x86c], 6
call fcn.00418490
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x2a0]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
push edx
sar eax, 2
mov ecx, esi
mov dword [esp + 0x3c], eax
call fcn.00416120
mov eax, dword [esp + 0x86c]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0041dc30
mov edi, 0xf
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], 0
mov byte [esp + 0x860], 7
cmp dword [esi + 0x380], ebp
jb 0x41e5d2
mov eax, dword [esi + 0x36c]
jmp 0x41e5d8
lea eax, [esi + 0x36c]
lea edx, [esp + 0xc0]
push edx
push eax
call fcn.00422110
mov eax, dword [esp + 0xcc]
add esp, 8
cmp dword [esp + 0xd8], ebp
jae 0x41e600
lea eax, [esp + 0xc4]
push eax
push str.CNetworkAdapterInfo::GetMacAddressFromArpTable__s_n
call fcn.004cb644
add esp, 8
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], 0
mov eax, dword [esi + 0x328]
mov byte [esp + 0x860], 8
cmp eax, ebx
jne 0x41e63f
push 1
push 0x4f4b88
jmp 0x41e680
cmp dword [esi + 0x32c], ebp
jb 0x41e64f
mov ecx, dword [esi + 0x318]
jmp 0x41e655
lea ecx, [esi + 0x318]
lea edx, [esp + 0x114]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00416320
mov eax, dword [esp + 0x118]
cmp dword [esp + 0x12c], ebp
jae 0x41e67d
lea eax, [esp + 0x118]
push 1
push eax
mov ecx, esi
call fcn.004162c0
cmp dword [esi + 0x4d4], ebp
jb 0x41e697
mov eax, dword [esi + 0x4c0]
jmp 0x41e69d
lea eax, [esi + 0x4c0]
push ebx
push eax
mov ecx, esi
call fcn.004162c0
mov edi, dword [esi + 0x408]
mov dword [esp + 0x14], ebx
cmp edi, dword [esi + 0x40c]
jbe 0x41e6bd
call fcn.004cc9ff
mov ebx, dword [esi + 0x3fc]
mov dword [esp + 0x20], edi
lea ebp, [edi + 0x3c]
lea ebx, [ebx]
mov edi, dword [esi + 0x40c]
cmp dword [esi + 0x408], edi
jbe 0x41e6e3
call fcn.004cc9ff
mov eax, dword [esi + 0x3fc]
test ebx, ebx
je 0x41e6f1
cmp ebx, eax
je 0x41e6f6
call fcn.004cc9ff
cmp dword [esp + 0x20], edi
je 0x41e78f
test ebx, ebx
jne 0x41e743
call fcn.004cc9ff
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x10]
jb 0x41e719
call fcn.004cc9ff
cmp dword [ebp + 0x10], 0
jbe 0x41e765
test ebx, ebx
jne 0x41e747
call fcn.004cc9ff
xor eax, eax
mov edx, dword [esp + 0x20]
cmp edx, dword [eax + 0x10]
jb 0x41e738
call fcn.004cc9ff
cmp dword [ebp + 0x14], 0x10
jb 0x41e74b
mov eax, dword [ebp]
jmp 0x41e74d
mov eax, dword [ebx]
jmp 0x41e70b
mov eax, dword [ebx]
jmp 0x41e72a
mov eax, ebp
push 1
push eax
mov ecx, esi
call fcn.004162c0
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 3
mov dword [esp + 0x14], eax
jge 0x41e7b3
test ebx, ebx
jne 0x41e78b
call fcn.004cc9ff
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x10]
jb 0x41e77e
call fcn.004cc9ff
add dword [esp + 0x20], 0x58
add ebp, 0x58
jmp 0x41e6d0
mov eax, dword [ebx]
jmp 0x41e770
cmp dword [esp + 0x14], 3
jge 0x41e7b3
mov edi, 3
sub edi, dword [esp + 0x14]
nop
push 1
push 0x4f4b88
mov ecx, esi
call fcn.004162c0
sub edi, 1
jne 0x41e7a0
mov edi, dword [esi + 0x408]
mov dword [esp + 0x14], 0
cmp edi, dword [esi + 0x40c]
jbe 0x41e7ce
call fcn.004cc9ff
mov ebx, dword [esi + 0x3fc]
mov dword [esp + 0x20], edi
lea ebp, [edi + 0x20]
jmp 0x41e7e0
mov edi, dword [esi + 0x40c]
cmp dword [esi + 0x408], edi
jbe 0x41e7f3
call fcn.004cc9ff
mov eax, dword [esi + 0x3fc]
test ebx, ebx
je 0x41e801
cmp ebx, eax
je 0x41e806
call fcn.004cc9ff
cmp dword [esp + 0x20], edi
je 0x41e8c3
test ebx, ebx
jne 0x41e876
call fcn.004cc9ff
xor eax, eax
mov edx, dword [esp + 0x20]
cmp edx, dword [eax + 0x10]
jb 0x41e829
call fcn.004cc9ff
cmp byte [ebp + 0x34], 0
jne 0x41e899
test ebx, ebx
jne 0x41e87a
call fcn.004cc9ff
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x10]
jb 0x41e84c
call fcn.004cc9ff
cmp dword [ebp + 0x2c], 0
jbe 0x41e892
test ebx, ebx
jne 0x41e87e
call fcn.004cc9ff
xor eax, eax
mov edx, dword [esp + 0x20]
cmp edx, dword [eax + 0x10]
jb 0x41e86b
call fcn.004cc9ff
cmp dword [ebp + 0x14], 0x10
jb 0x41e882
mov eax, dword [ebp]
jmp 0x41e884
mov eax, dword [ebx]
jmp 0x41e81b
mov eax, dword [ebx]
jmp 0x41e83e
mov eax, dword [ebx]
jmp 0x41e85d
mov eax, ebp
push 1
push eax
mov ecx, esi
call fcn.004162c0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jge 0x41e8e6
test ebx, ebx
jne 0x41e8bf
call fcn.004cc9ff
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x10]
jb 0x41e8b2
call fcn.004cc9ff
add dword [esp + 0x20], 0x58
add ebp, 0x58
jmp 0x41e7e0
mov eax, dword [ebx]
jmp 0x41e8a4
cmp dword [esp + 0x14], 3
jge 0x41e8e6
mov edi, 3
sub edi, dword [esp + 0x14]
push 1
push 0x4f4b88
mov ecx, esi
call fcn.004162c0
sub edi, 1
jne 0x41e8d3
mov edi, 0x10
cmp dword [esi + 0x380], edi
jb 0x41e8fb
mov eax, dword [esi + 0x36c]
jmp 0x41e901
lea eax, [esi + 0x36c]
push 1
push eax
mov ecx, esi
call fcn.004162c0
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0xd8], edi
jae 0x41e922
lea eax, [esp + 0xc4]
push 1
push eax
mov ecx, esi
call fcn.004162c0
cmp dword [esi + 0x3b8], edi
jb 0x41e93c
mov eax, dword [esi + 0x3a4]
jmp 0x41e942
lea eax, [esi + 0x3a4]
push 1
push eax
mov ecx, esi
call fcn.004162c0
mov eax, dword [esi + 0x3b4]
push 1
mov ecx, esi
test eax, eax
jbe 0x41e961
push 0x4f8554
jmp 0x41e966
push 0x4f8550
call fcn.004162c0
cmp dword [esi + 0x348], edi
jb 0x41e97b
mov eax, dword [esi + 0x334]
jmp 0x41e981
lea eax, [esi + 0x334]
push 1
push eax
mov ecx, esi
call fcn.004162c0
mov edi, dword [esi + 0x420]
mov dword [esp + 0x14], 0
cmp edi, dword [esi + 0x424]
jbe 0x41e9a6
call fcn.004cc9ff
mov ebp, dword [esi + 0x414]
lea esp, [esp]
mov ebx, dword [esi + 0x424]
cmp dword [esi + 0x420], ebx
jbe 0x41e9c3
call fcn.004cc9ff
mov eax, dword [esi + 0x414]
test ebp, ebp
je 0x41e9d1
cmp ebp, eax
je 0x41e9d6
call fcn.004cc9ff
cmp edi, ebx
je 0x41eac9
test ebp, ebp
jne 0x41eaa3
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41e9f7
call fcn.004cc9ff
push 0xffffffffffffffff
push 0
lea edx, [edi + 0x1c]
push edx
lea ecx, [esp + 0x104]
mov dword [esp + 0x11c], 0xf
mov dword [esp + 0x118], 0
mov byte [esp + 0x108], 0
call fcn.00403210
mov eax, dword [esp + 0xfc]
mov ebx, 0x10
mov byte [esp + 0x860], 9
cmp dword [esp + 0x110], ebx
jae 0x41ea4d
lea eax, [esp + 0xfc]
push 1
push eax
mov ecx, esi
call fcn.004162c0
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 2
mov dword [esp + 0x14], eax
mov byte [esp + 0x860], 8
jge 0x41eab0
cmp dword [esp + 0x110], ebx
jb 0x41ea86
mov eax, dword [esp + 0xfc]
push eax
call fcn.004bf5d1
add esp, 4
test ebp, ebp
jne 0x41eaab
call fcn.004cc9ff
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41ea9b
call fcn.004cc9ff
add edi, 0x58
jmp 0x41e9b0
mov eax, dword [ebp]
jmp 0x41e9ed
mov eax, dword [ebp]
jmp 0x41ea91
cmp dword [esp + 0x110], ebx
jb 0x41eac9
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.004bf5d1
add esp, 4
mov edi, dword [esp + 0x14]
cmp edi, 2
jge 0x41eaf1
push 1
mov ecx, esi
test edi, edi
jne 0x41eae1
push str.11000000000000000001
jmp 0x41eae6
push 0x4f4b88
call fcn.004162c0
inc edi
cmp edi, 2
jl 0x41ead2
mov edi, 0x10
cmp dword [esi + 0x2d8], edi
jb 0x41eb06
mov eax, dword [esi + 0x2c4]
jmp 0x41eb0c
lea eax, [esi + 0x2c4]
push 1
push eax
mov ecx, esi
call fcn.004162c0
cmp dword [esi + 0x2bc], edi
jb 0x41eb26
mov eax, dword [esi + 0x2a8]
jmp 0x41eb2c
lea eax, [esi + 0x2a8]
push 1
push eax
mov ecx, esi
call fcn.004162c0
push 1
push 0x4f854c
mov ecx, esi
call fcn.004162c0
mov edx, dword [esp + 0x40]
push 1
push edx
mov ecx, esi
call fcn.004162c0
call fcn.004bfb80
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41eb6e
push 0x80004005
call fcn.00402700
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
xor ebx, ebx
cmp dword [esp + 0x24], edi
mov byte [esp + 0x860], 0xa
mov byte [esp + 0x1b], 0
mov dword [esp + 0x2c], edi
jle 0x41edda
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x28], edi
jmp 0x41ebb2
xor edi, edi
cmp byte [esp + 0x1b], 0
jne 0x41edda
cmp dword [esp + 0x38], edi
mov dword [esp + 0x14], edi
jle 0x41edca
jmp 0x41ebd0
mov ecx, dword [esp + 0x54]
sub ecx, dword [esp + 0x50]
sar ecx, 2
cmp dword [esp + 0x14], ecx
jb 0x41ebe6
call fcn.004cc9ff
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
lea edi, [edx + eax*4]
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
jb 0x41ec11
call fcn.004cc9ff
mov eax, dword [ebp + 0xc]
mov edx, dword [edi]
mov ecx, dword [esp + 0x28]
cmp edx, dword [ecx + eax + 4]
jne 0x41edb0
cmp dword [esp + 0x2c], 0x14
jg 0x41edc5
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x41ec4e
call fcn.004cc9ff
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x28]
lea eax, [edx + ecx + 0x10]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x108]
push str._d._d._d._d
push eax
call fcn.00415550
lea ecx, [esp + 0x110]
push str.127.0.0.1
push ecx
call fcn.004cb8b7
add esp, 0x20
test eax, eax
je 0x41edb0
mov dword [esp + 0x148], 0xf
mov dword [esp + 0x144], 0
mov byte [esp + 0x134], 0
mov eax, dword [esp + 0x14]
mov byte [esp + 0x860], 0xb
test eax, eax
jl 0x41eee2
cmp eax, dword [esp + 0x7c]
jge 0x41eee2
mov edx, dword [esp + 0x78]
mov ecx, dword [edx + eax*4]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41ece3
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0x138]
call fcn.00415a00
push 0x2f
push 1
lea ecx, [esp + 0x138]
call fcn.00415850
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
jb 0x41ed2a
call fcn.004cc9ff
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + edx + 0xc]
push ecx
lea edx, [esp + 0x20]
push 0x4f4b6c
push edx
call fcn.00403410
mov edi, dword [esp + 0x28]
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ed51
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x138]
call fcn.00415a00
cmp dword [esp + 0x148], 0x10
mov eax, dword [esp + 0x134]
jae 0x41ed80
lea eax, [esp + 0x134]
push 1
push eax
mov ecx, esi
call fcn.004162c0
inc dword [esp + 0x2c]
cmp dword [esp + 0x148], 0x10
mov byte [esp + 0x860], 0xa
jb 0x41edb0
mov eax, dword [esp + 0x134]
push eax
call fcn.004bf5d1
add esp, 4
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
jl 0x41ebd0
jmp 0x41edca
mov byte [esp + 0x1b], 1
add dword [esp + 0x28], 0x44
inc ebx
cmp ebx, dword [esp + 0x24]
jl 0x41ebb0
mov edi, dword [esp + 0x30]
push 0x14
push 0x24
lea ebx, [esi + 0x42c]
push ebx
mov ecx, edi
call fcn.00420400
push 0x80
lea ecx, [esp + 0x1d0]
push 0
push ecx
call fcn.004cb5a0
add esp, 0xc
push 0x80
lea edx, [esp + 0x1d0]
push edx
mov ecx, edi
call fcn.00420880
push 1
lea eax, [esp + 0x1d0]
push eax
mov ecx, esi
call fcn.004162c0
mov ecx, edi
call fcn.00420ca0
push edi
call fcn.004bf5d1
mov ecx, dword [esp + 0x874]
add esp, 4
push ebx
push ecx
mov ecx, esi
call fcn.00417d60
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebp, eax
call edi
push eax
push ebp
push str._dx_d
lea edx, [esp + 0x1a8]
push 0x30
push edx
call fcn.004cd853
add esp, 0x14
push 1
lea eax, [esp + 0x1a0]
push eax
mov ecx, esi
call fcn.004162c0
mov ecx, dword [esi + 0x3f8]
push ecx
lea edx, [esp + 0x150]
push 0x4f4b6c
push edx
call fcn.00415570
add esp, 0xc
push 1
lea eax, [esp + 0x150]
push eax
mov ecx, esi
call fcn.004162c0
mov ecx, esi
call fcn.004150f0
push 1
mov ecx, esi
test al, al
je 0x41eefb
push 0x4f8554
call fcn.004162c0
mov ecx, esi
call fcn.00415390
mov ecx, esi
test al, al
je 0x41eee7
push 1
push str.VMware
jmp 0x41ef0e
call fcn.004bfa15
call fcn.004154a0
push 1
mov ecx, esi
test al, al
je 0x41ef09
push str.VirtualBox
jmp 0x41ef0e
push 0x4f8550
call fcn.004162c0
push 1
mov ecx, esi
push 0x4f4b88
call fcn.004162c0
cmp byte [esi + 0x3f6], 0
push 1
mov ecx, esi
je 0x41ef27
push 0x4f8554
jmp 0x41ef2c
push 0x4f8550
call fcn.004162c0
cmp byte [esi + 0x3f5], 0
push 1
mov ecx, esi
je 0x41ef45
push 0x4f8554
jmp 0x41ef4a
push 0x4f8550
call fcn.004162c0
cmp byte [esi + 0x3f7], 0
push 1
mov ecx, esi
je 0x41ef63
push 0x4f8554
jmp 0x41ef68
push 0x4f8550
call fcn.004162c0
mov eax, dword [esi + 0x440]
lea ebp, [eax + eax]
push ebp
call fcn.004bf5dc
push ebp
mov edi, eax
push 0
push edi
call fcn.004cb5a0
add esp, 0x10
cmp dword [ebx + 0x18], 0x10
jb 0x41ef95
mov ebx, dword [ebx + 4]
jmp 0x41ef98
add ebx, 4
push ebx
push ebp
push edi
call fcn.004cc266
add esp, 0xc
xor ebp, ebp
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], ebp
mov byte [esp + 0x8c], 0
mov eax, edi
mov byte [esp + 0x860], 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41efd0
sub eax, ecx
lea ecx, [esp + 0x88]
push ecx
push eax
push edi
mov ecx, esi
call fcn.00416320
push edi
call fcn.004bf5d1
mov edi, dword [esp + 0x38]
add esp, 4
push 0xe
push str.ktbAgentValue_
mov ecx, edi
call fcn.00403330
push 0xc
push str._code_:_00_
mov ecx, edi
call fcn.00415a00
push 9
push str.__info_:_
mov ecx, edi
call fcn.00415a00
push 6
push str._P1004
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x90]
push edx
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
mov eax, dword [esi + 0x4b4]
mov ebx, 0x10
cmp dword [esi + 0x4b8], ebx
jb 0x41f06a
mov ecx, dword [esi + 0x4a4]
jmp 0x41f070
lea ecx, [esi + 0x4a4]
lea edx, [esp + 0x88]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00416320
cmp dword [esi + 0x4b8], ebx
jb 0x41f091
mov eax, dword [esi + 0x4a4]
jmp 0x41f097
lea eax, [esi + 0x4a4]
push eax
push str.m_strExtraDiskData____s___n
call fcn.004cb644
add esp, 8
push 8
push str.__mac_:_
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x90]
push eax
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
cmp dword [esi + 0x4ec], ebp
jne 0x41f0ed
push 0x14
push str.11000000000000000001
lea ecx, [esi + 0x4d8]
call fcn.00403330
mov ecx, dword [esi + 0x4ec]
cmp dword [esi + 0x4f0], ebx
jb 0x41f103
mov eax, dword [esi + 0x4dc]
jmp 0x41f109
lea eax, [esi + 0x4dc]
lea edx, [esp + 0x88]
push edx
push ecx
push eax
mov ecx, esi
call fcn.00416320
push 8
push str.__hdd_:_
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x90]
push eax
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
mov eax, dword [esi + 0x508]
cmp dword [esi + 0x50c], ebx
jb 0x41f15e
mov ecx, dword [esi + 0x4f8]
jmp 0x41f164
lea ecx, [esi + 0x4f8]
lea edx, [esp + 0x88]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00416320
push 8
push str.__cpu_:_
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x90]
push eax
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], ebp
mov byte [esp + 0xe0], 0
push 1
push 0x4f84a8
lea ecx, [esp + 0xe4]
mov byte [esp + 0x868], 0xd
call fcn.00403330
push 0xffffffffffffffff
push ebp
lea ecx, [esi + 0x34c]
push ecx
lea ecx, [esp + 0xe8]
call fcn.00415900
push 2
push 0x4f84a4
lea ecx, [esp + 0xe4]
call fcn.00415a00
mov eax, dword [esi + 0x524]
mov ecx, dword [esp + 0xe0]
cmp dword [esp + 0xf4], ebx
jae 0x41f21e
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x88]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00416320
push 7
push str.__ip_:_
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x90]
push eax
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
push 0xc
push str.__version_:_
mov ecx, edi
call fcn.00415a00
mov esi, dword [esp + 0x40]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41f274
sub eax, ecx
push eax
push esi
mov ecx, edi
call fcn.00415a00
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
push 0xc
push str.__postfix_:_
mov ecx, edi
call fcn.00415a00
push 0xffffffffffffffff
push ebp
push 0x53a7ac
mov ecx, edi
call fcn.00415900
push 1
push 0x4f50f0
mov ecx, edi
call fcn.00415a00
push 2
push 0x4f8478
mov ecx, edi
call fcn.00415a00
cmp dword [esp + 0xf4], ebx
jb 0x41f2e6
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.004bf5d1
add esp, 4
mov esi, 0xf
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebp
mov byte [esp + 0xe0], 0
cmp dword [esp + 0xa0], ebx
jb 0x41f31a
mov edx, dword [esp + 0x8c]
push edx
call fcn.004bf5d1
add esp, 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebp
mov byte [esp + 0x8c], 0
mov byte [esp + 0x860], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f358
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x12c], ebx
jb 0x41f371
mov ecx, dword [esp + 0x118]
push ecx
call fcn.004bf5d1
add esp, 4
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebp
mov byte [esp + 0x118], 0
cmp dword [esp + 0xd8], ebx
jb 0x41f3a0
mov edx, dword [esp + 0xc4]
push edx
call fcn.004bf5d1
add esp, 4
mov eax, dword [esp + 0x68]
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebp
mov byte [esp + 0xc4], 0
cmp eax, ebp
je 0x41f3c7
push eax
call fcn.004bf5d1
add esp, 4
mov eax, dword [esp + 0x5c]
push eax
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
call fcn.004bf5d1
mov eax, dword [esp + 0x54]
add esp, 4
cmp eax, ebp
je 0x41f3f1
push eax
call fcn.004bf5d1
add esp, 4
mov ecx, dword [esp + 0x44]
push ecx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
call fcn.004bf5d1
add esp, 4
lea ecx, [esp + 0x74]
mov byte [esp + 0x860], 0
call fcn.004c0b48
cmp dword [esp + 0xbc], ebx
jb 0x41f434
mov edx, dword [esp + 0xa8]
push edx
call fcn.004bf5d1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x858]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x840]
xor ecx, esp
call fcn.004cb553
add esp, 0x850
ret 0x14