Function at 0x4d84ce
Capabilities:
Enumerate pe sections
Get disk information
Get logon sessions
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
lea esi, [esp + 0x188]
mov dword [esp + 8], ecx
mov dword [esp + 0xb8], edx
mov ecx, esi
call fcn.00420e15
mov eax, dword [esi]
mov edx, 0xe8
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
lea esi, [esp + 0x28]
mov ecx, esi
mov dword [esp + 0x18], eax
push 0x1f4
call fcn.004d8178
pop eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esi]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x7c], eax
push 9
pop ecx
call fcn.00441781
mov ebx, edx
mov dword [esp + 0x1c], eax
mov dword [edx], 0x61746f54
mov dword [edx + 4], 0x5043206c
mov byte [edx + 8], 0x55
push 8
pop edx
mov ecx, 0xa0
call fcn.004946d6
test eax, eax
mov dword [esp + 4], eax
je 0x4d9af9
lea edi, [esp + 0x178]
mov ecx, edi
call fcn.00420e15
mov eax, dword [edi + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x50], eax
mov eax, dword [edi]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xdc], eax
call fcn.004d11a0
mov edi, edx
lea esi, [esp + 0x28]
mov edx, eax
mov ecx, esi
push 0x19db1de
push 0xd53e8000
push edi
call fcn.004d1220
add esp, 0xc
mov eax, dword [esi]
xor edi, edi
or eax, dword [esi + 4]
mov esi, 0
jne 0x4d85fd
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
call sub.kernel32.dll_GetTickCount64
push 0
push 0x3e8
push edx
push eax
call fcn.004fee90
xor ecx, ecx
sub edi, eax
sbb esi, edx
cmovb esi, ecx
cmovb edi, ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
and dword [eax + 0x44], 0
and dword [eax + 0x40], 0
and dword [eax + 0x48], 0
and dword [eax + 0x50], 0
and dword [eax + 0x94], 0
and dword [eax + 0x90], 0
and dword [eax + 0x9c], 0
and dword [eax + 0x98], 0
and dword [eax + 0xa4], 0
and dword [eax + 0xa0], 0
and dword [eax + 0xac], 0
and dword [eax + 0xa8], 0
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ebx
mov dword [eax + 0x60], 9
and dword [eax + 0x64], 0
xor ebx, ebx
inc ebx
mov dword [eax + 0x68], ebx
and dword [eax + 0x6c], 0
and dword [eax + 0x70], 0
mov dword [eax + 0x74], ebx
and dword [eax + 0x78], 0
and dword [eax + 0x80], 0
mov dword [eax + 0x84], 8
and dword [eax + 0x88], 0
mov byte [eax + 0x8c], 0
and dword [eax + 0xe0], 0
push 4
pop ecx
mov edx, dword [esp + 4]
mov dword [eax + 0xe4], ecx
and dword [eax + 0xe8], 0
mov dword [eax + 0xec], 2
mov dword [eax + 0xf0], edx
mov edx, dword [esp + 0xdc]
and dword [eax + 0xf4], 0
and dword [eax + 0xcc], 0
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x4c]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x50]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x54]
mov dword [eax + 0x2c], edx
and dword [eax + 0x30], 0
and dword [eax + 0x34], 0
and dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0x559580
mov dword [eax + 0xdc], esi
mov esi, dword [esp + 0xb8]
mov dword [eax + 0xd8], edi
and dword [eax + 0xf8], 0
mov dword [eax + 0xfc], ecx
and dword [eax + 0x100], 0
mov edi, ecx
cmp byte [esi + 9], 0
je 0x4d876e
mov ecx, eax
call fcn.004d9b03
mov eax, dword [esp + 8]
cmp byte [esi], 2
je 0x4d8785
movzx edx, byte [esi + 1]
mov ecx, eax
and edx, 1
call fcn.004d9bd4
mov eax, dword [esp + 8]
cmp byte [esi + 0xb], 0
je 0x4d8960
lea esi, [esp + 0x58]
mov ecx, esi
call fcn.004db114
cmp dword [esi], 2
je 0x4d891b
mov eax, dword [esp + 0x70]
movq xmm0, qword [esp + 0x68]
movsd xmm2, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
lea esi, [esp + 0x80]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004db134
cmp dword [esi], 2
je 0x4d891b
mov eax, dword [esp + 0x98]
movq xmm0, qword [esp + 0x90]
movsd xmm2, qword [esp + 0x80]
movsd xmm1, qword [esp + 0x88]
lea esi, [esp + 0x9c]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004db189
cmp dword [esi], 2
je 0x4d891b
mov eax, dword [esp + 0xb4]
movq xmm0, qword [esp + 0xac]
movsd xmm2, qword [esp + 0x9c]
movsd xmm1, qword [esp + 0xa4]
lea esi, [esp + 0xc0]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004db1fa
cmp dword [esi], 2
je 0x4d891b
mov eax, dword [esp + 0xd8]
movq xmm0, qword [esp + 0xd0]
movsd xmm2, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
lea esi, [esp + 0xe4]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004db28b
cmp dword [esi], 2
je 0x4d891b
mov eax, dword [esp + 0xfc]
movq xmm0, qword [esp + 0xf4]
movsd xmm2, qword [esp + 0xe4]
movsd xmm1, qword [esp + 0xec]
lea esi, [esp + 0x124]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004db2e6
mov eax, dword [esi]
cmp eax, 2
jne 0x4d9984
xor ebx, ebx
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0xe4]
mov edx, dword [esi + 0xe8]
call fcn.004d7f2f
mov ecx, dword [esi + 0xe0]
mov edx, dword [esi + 0xe4]
call fcn.004d7ff1
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], edi
mov eax, esi
mov dword [esi + 0xe8], ebx
mov esi, dword [esp + 0xb8]
jmp 0x4d897b
cmp byte [esi + 0xa], 0
je 0x4d897b
mov ecx, dword [eax + 0xe4]
mov edx, dword [eax + 0xe8]
call fcn.004d9ee5
mov eax, dword [esp + 8]
cmp byte [esi + 6], 0
lea edi, [eax + 0x20]
je 0x4d89e5
lea eax, [esp + 0x124]
and dword [eax], 0
push eax
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x4d9356
mov edx, dword [esp + 8]
lea esi, [esp + 0x28]
mov eax, dword [edx + 0x3c]
mov ebx, dword [edx + 0x38]
lea ecx, [eax + 0x10]
movdqa xmm0, xmmword [eax]
mov dword [esi], ecx
mov ecx, dword [edx + 0x30]
lea ecx, [ecx + eax + 1]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
pmovmskb eax, xmm0
lea ecx, [edx + 0x30]
not eax
mov dword [esp + 0x10], ecx
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ebx
mov ecx, esi
call fcn.004d7a9a
test eax, eax
je 0x4d89fb
mov byte [edx + 0x68], 0
jmp 0x4d89d4
cmp byte [esi + 5], 0
je 0x4d9356
mov ecx, edi
call fcn.004da108
jmp 0x4d9356
lea esi, [esp + 0x168]
mov dword [esp + 0x100], edi
mov ecx, esi
call fcn.00420e15
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
mov esi, dword [esi + 4]
lea edi, [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [edi - 0xc], esi
mov dword [edi - 0x10], edx
mov dword [edi - 4], ecx
mov ecx, dword [esp + 0x124]
mov dword [edi - 8], eax
lea eax, [esp + 0xc0]
and dword [edi], 0
and dword [edi + 4], 0
and dword [edi + 8], 0
mov dword [edi + 0xc], 0x559580
and dword [eax], 0
mov dword [eax + 4], 4
and dword [eax + 8], 0
mov edx, dword [ecx]
lea eax, [ecx + 8]
add ecx, 0x18
mov dword [esp + 0x78], eax
push 4
pop eax
mov dword [esp + 0x50], eax
xor esi, esi
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x54], edx
imul ebx, esi, 0x548
add ebx, ecx
cmp edx, esi
je 0x4d8d2b
mov eax, dword [ebx + 0x498]
or eax, dword [ebx + 0x49c]
jne 0x4d8aae
mov eax, dword [ebx + 0x4a0]
or eax, dword [ebx + 0x4a4]
je 0x4d8c94
cmp dword [ebx + 0x47c], 2
je 0x4d8c94
cmp dword [ebx + 0x410], 0
je 0x4d8c94
mov dword [esp + 4], esi
push 0x14
pop ecx
push 2
pop edx
call fcn.004d4b9e
mov esi, eax
mov eax, dword [ebx]
movzx edx, byte [ebx + 9]
movzx ecx, byte [ebx + 0xa]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 4]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 5]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 6]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 7]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x7c], eax
movzx eax, byte [ebx + 0xb]
mov dword [esi], edi
mov edi, dword [esp + 0x18]
mov word [esi + 4], di
mov edi, dword [esp + 0x1c]
mov word [esi + 6], di
mov edi, dword [esp + 0x24]
mov word [esi + 8], di
mov edi, dword [esp + 0x20]
mov word [esi + 0xa], di
mov edi, dword [esp + 0x7c]
mov word [esi + 0xc], di
mov word [esi + 0xe], dx
mov word [esi + 0x10], cx
mov word [esi + 0x12], ax
push 0xa
pop ecx
call fcn.004d7907
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
mov edi, edx
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
movq xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [edx + 8], xmm1
movq qword [edx], xmm0
push 0xa
pop eax
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], eax
push eax
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.004d7c45
add esp, 0x10
mov esi, edx
mov edx, dword [esp + 0x44]
mov edi, eax
lea eax, [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x84], eax
push 0x4d8246
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0x24], esi
push esi
mov dword [esp + 0x24], edi
push edi
call fcn.004478cd
add esp, 0x10
mov edi, dword [esp + 0x44]
test eax, eax
je 0x4d8c0f
test edi, edi
je 0x4d8c0f
shl edx, 4
sub edi, edx
mov edx, dword [esp + 0x5c]
test edx, edx
je 0x4d8c74
mov ecx, dword [esp + 0x58]
call fcn.004d4b89
jmp 0x4d8c74
cmp dword [esp + 0x3c], 0
je 0x4d8ca0
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov edx, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0044775d
pop ecx
pop ecx
and dl, 1
shl eax, 4
movzx ecx, dl
mov edx, dword [esp + 0x44]
sub dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
mov edi, edx
sub edi, eax
neg eax
mov dword [edx + eax - 0x10], esi
mov edx, dword [esp + 0x24]
mov dword [edi - 0xc], edx
mov dword [edi - 8], ecx
and dword [edi - 4], 0
inc dword [esp + 0x40]
mov eax, dword [edi - 4]
inc eax
cmp eax, 1
mov dword [edi - 4], eax
jle 0x4d8cb6
push 0xa
pop ecx
mov edx, dword [esp + 0x14]
call fcn.004d4b89
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 4]
add ebx, 0x548
inc esi
jmp 0x4d8a86
lea ecx, [esp + 0x38]
lea edx, [esp + 0x28]
call fcn.00510030
mov edi, dword [esp + 0x44]
jmp 0x4d8c1a
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 0xc0]
jne 0x4d8ce3
lea ecx, [esp + 0xc0]
call fcn.0040386b
mov edi, dword [esp + 0xc4]
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x4c]
jmp 0x4d8ceb
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 4]
shl edx, 4
mov dword [edi + edx], ebx
inc ebx
push 0xa
pop eax
mov esi, dword [esp + 0x14]
mov dword [edi + edx + 4], eax
mov dword [esp + 0x50], edi
mov dword [edi + edx + 8], esi
mov dword [edi + edx + 0xc], eax
mov edx, dword [esp + 0x54]
mov esi, ebx
mov eax, dword [esp + 0xc8]
inc eax
mov dword [esp + 0xc], eax
mov dword [esp + 0xc8], eax
jmp 0x4d8a7e
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0xc4]
mov eax, dword [esp + 0xc0]
shl edi, 4
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], esi
add edi, esi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x4d923b
mov eax, dword [esi + 8]
lea ecx, [esi + 0x10]
test eax, eax
je 0x4d9239
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
mov edx, dword [esi + 4]
cmp dword [esp + 0x40], 0
mov dword [esp + 4], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edi
je 0x4d8e03
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push edi
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.004d7c45
add esp, 0x10
lea ecx, [esp + 0x9c]
mov esi, edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe4]
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x38]
push 0x4db0e0
lea edi, [esp + 0x5c]
push edi
push esi
push eax
call fcn.004478cd
add esp, 0x10
mov ecx, dword [esp + 0x44]
shl edx, 4
sub ecx, edx
test eax, eax
cmove ecx, eax
lea eax, [ecx - 0x10]
test ecx, ecx
cmove eax, ecx
jmp 0x4d8e05
xor eax, eax
lea ecx, [eax + 0xc]
test eax, eax
mov edx, 0x580058
cmove ecx, edx
cmp dword [ecx], 1
jg 0x4d91fd
mov eax, dword [esp + 0x78]
imul ebx, ebx, 0x548
xor esi, esi
lea eax, [eax + ebx + 0x1c]
cmp esi, 0x101
je 0x4d8e3d
cmp word [eax + esi*2], 0
je 0x4d8e44
inc esi
jmp 0x4d8e2b
mov esi, 0x101
jmp 0x4d8e5a
mov ecx, eax
mov edx, 0x101
push 0x558e3c
push esi
call fcn.004326d6
pop ecx
pop ecx
mov esi, edx
lea ecx, [esp + 0x58]
mov edx, eax
push esi
call fcn.00417b10
pop eax
cmp dword [esp + 0x5c], 0
je 0x4d91fd
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x60]
movsd xmm0, qword [esp + 0x58]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [esp + 0x88], eax
movsd qword [esp + 0x80], xmm0
push eax
push dword [esp + 0x88]
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.004d7b8d
add esp, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x80]
mov edi, edx
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0xe4], eax
lea eax, [esp + 0xe4]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
push 0x4d82d6
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x20], edi
push edi
push dword [esp + 0x20]
call fcn.004478cd
add esp, 0x10
mov ecx, edx
mov edx, dword [esi + 0x3c]
test eax, eax
je 0x4d9024
test edx, edx
je 0x4d9024
shl ecx, 7
mov eax, dword [esp + 0x88]
mov esi, dword [esp + 0x78]
mov edi, 0xffffffff
sub edx, ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
mov eax, dword [edx - 0x68]
mov ecx, dword [edx - 0x64]
mov dword [edx - 0x5c], ecx
mov dword [edx - 0x60], eax
mov eax, dword [esi + ebx + 0x504]
mov ecx, dword [esi + ebx + 0x500]
mov dword [edx - 0x68], ecx
mov dword [edx - 0x64], eax
mov eax, dword [edx - 0x54]
mov ecx, dword [edx - 0x58]
mov dword [edx - 0x50], ecx
mov dword [edx - 0x4c], eax
movsd xmm0, qword [esi + ebx + 0x4b8]
movsd qword [edx - 0x58], xmm0
movsd xmm0, qword [edx - 0x48]
movsd xmm1, qword [edx - 0x38]
movsd qword [edx - 0x40], xmm0
mov eax, dword [esi + ebx + 0x4c0]
mov ecx, dword [esi + ebx + 0x4c4]
add eax, dword [esi + ebx + 0x4c8]
adc ecx, dword [esi + ebx + 0x4cc]
cmovb ecx, edi
cmovb eax, edi
mov dword [edx - 0x44], ecx
mov dword [edx - 0x48], eax
movsd qword [edx - 0x30], xmm1
mov ecx, dword [esi + ebx + 0x508]
mov eax, dword [esi + ebx + 0x50c]
add ecx, dword [esi + ebx + 0x510]
adc eax, dword [esi + ebx + 0x514]
cmovb eax, edi
cmovb ecx, edi
mov dword [edx - 0x38], ecx
mov dword [edx - 0x34], eax
lea ecx, [esp + 0x58]
movsd xmm0, qword [edx - 0x28]
movsd qword [edx - 0x20], xmm0
movsd xmm0, qword [esi + ebx + 0x4d8]
movsd qword [edx - 0x28], xmm0
movsd xmm0, qword [edx - 0x18]
movsd qword [edx - 0x10], xmm0
movq xmm0, qword [esi + ebx + 0x520]
movq qword [edx - 0x18], xmm0
mov byte [edx - 8], 1
call fcn.004a2940
jmp 0x4d91fd
cmp dword [esi + 0x34], 0
je 0x4d921d
mov ecx, dword [esp + 0x78]
mov esi, 0xffffffff
mov eax, dword [ecx + ebx + 0x4c0]
mov edi, dword [ecx + ebx + 0x4c4]
movsd xmm0, qword [ecx + ebx]
add eax, dword [ecx + ebx + 0x4c8]
movsd qword [esp + 0x140], xmm0
adc edi, dword [ecx + ebx + 0x4cc]
cmovb edi, esi
cmovb eax, esi
mov esi, dword [ecx + ebx + 0x50c]
mov dword [esp + 0x1c], edi
mov edi, dword [ecx + ebx + 0x508]
mov dword [esp + 0x24], eax
mov eax, 0xffffffff
add edi, dword [ecx + ebx + 0x510]
adc esi, dword [ecx + ebx + 0x514]
cmovb esi, eax
cmovb edi, eax
mov eax, dword [ecx + ebx + 0x500]
mov dword [esp + 0xdc], eax
mov eax, dword [ecx + ebx + 0x504]
mov dword [esp + 0x118], eax
mov eax, dword [ecx + ebx + 0x4b8]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + ebx + 0x4bc]
mov dword [esp + 0x11c], eax
mov eax, dword [ecx + ebx + 0x4d8]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + ebx + 0x4dc]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + ebx + 0x520]
mov dword [esp + 0x20], eax
mov eax, dword [ecx + ebx + 0x524]
mov ebx, dword [esp + 8]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x80]
mov ecx, dword [ebx + 0x30]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x114], eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0044775d
pop ecx
pop ecx
and dl, 1
shl eax, 7
movq xmm0, qword [esp + 0x140]
movzx ecx, dl
mov edx, dword [ebx + 0x3c]
sub dword [ebx + 0x34], ecx
mov ebx, dword [esp + 0x10c]
mov ecx, edx
sub ecx, eax
neg eax
mov dword [edx + eax - 0x80], ebx
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x118]
mov ebx, dword [esp + 0x24]
mov dword [ecx - 0x7c], eax
mov eax, dword [esp + 0x114]
mov dword [ecx - 0x78], eax
mov eax, dword [esp + 0xdc]
movq qword [ecx - 0x70], xmm0
mov dword [ecx - 0x64], edx
mov dword [ecx - 0x68], eax
mov dword [ecx - 0x5c], edx
mov dword [ecx - 0x60], eax
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x4c]
mov dword [ecx - 0x54], edx
mov dword [ecx - 0x58], eax
mov dword [ecx - 0x4c], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx - 0x50], eax
mov dword [ecx - 0x48], ebx
mov dword [ecx - 0x44], edx
mov dword [ecx - 0x3c], edx
mov dword [ecx - 0x40], ebx
mov dword [ecx - 0x34], esi
mov dword [ecx - 0x38], edi
mov dword [ecx - 0x30], edi
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x7c]
mov dword [ecx - 0x2c], esi
mov esi, dword [esp + 0x20]
mov dword [ecx - 0x24], edx
mov dword [ecx - 0x28], edi
mov dword [ecx - 0x1c], edx
mov edx, dword [esp + 0x54]
mov dword [ecx - 0x20], edi
mov dword [ecx - 0x18], esi
mov dword [ecx - 0x14], edx
mov dword [ecx - 0xc], edx
mov dword [ecx - 0x10], esi
mov byte [ecx - 8], 1
mov ecx, dword [esp + 8]
inc dword [ecx + 0x38]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0xa0]
call fcn.004d4b89
mov esi, dword [esp + 4]
mov edi, dword [esp + 0xc]
jmp 0x4d8d54
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x100]
call fcn.005101aa
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x3c]
jmp 0x4d902e
mov esi, ecx
sub edi, esi
add esi, 8
shr edi, 4
sub edi, 1
jb 0x4d9257
mov ecx, dword [esi - 4]
mov edx, dword [esi]
call fcn.004d4b89
add esi, 0x10
jmp 0x4d9243
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x104]
call fcn.00440a8e
push dword [esp + 0x124]
call sub.iphlpapi.dll_FreeMibTable
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4d92e9
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4d92e0
mov edi, dword [esp + 0x44]
movdqa xmm0, xmmword [edi]
lea ebx, [edi + 0x10]
pmovmskb eax, xmm0
not eax
sub edx, 1
jae 0x4d92b1
jmp 0x4d92dc
movdqa xmm0, xmmword [ebx]
add edi, 0xffffff00
add ebx, 0x10
pmovmskb eax, xmm0
not eax
test ax, ax
je 0x4d929e
bsf ecx, eax
lea esi, [eax - 1]
mov dword [esp + 4], edx
and esi, eax
shl ecx, 4
mov eax, edi
sub eax, ecx
mov ecx, dword [eax - 0x10]
mov edx, dword [eax - 0xc]
call fcn.004d4b89
mov edx, dword [esp + 4]
mov eax, esi
jmp 0x4d9297
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
call fcn.004d802f
mov edx, dword [esp + 8]
lea esi, [esp + 0x28]
mov eax, dword [edx + 0x3c]
lea ecx, [eax + 0x10]
movdqa xmm0, xmmword [eax]
mov dword [esi], ecx
mov ecx, dword [edx + 0x30]
lea ecx, [ecx + eax + 1]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0x38]
mov dword [esi + 8], eax
pmovmskb eax, xmm0
not eax
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ecx
mov ecx, esi
call fcn.004d7aab
test eax, eax
je 0x4d934f
cmp byte [eax - 8], 0
mov edi, eax
jne 0x4d931a
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x3c]
sub edx, edi
sar edx, 7
call fcn.004d8467
mov ecx, dword [edi - 0x80]
mov edx, dword [edi - 0x7c]
call fcn.004c2719
jmp 0x4d931a
mov esi, dword [esp + 0xb8]
movzx edx, word [esi + 2]
cmp dl, 2
je 0x4d9371
movzx eax, byte [esi + 4]
mov ecx, dword [esp + 8]
shl eax, 0x10
or edx, eax
call fcn.004da269
cmp byte [esi + 7], 0
je 0x4d94aa
mov eax, dword [esp + 8]
lea edi, [eax + 0xec]
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
test eax, eax
mov dword [esp + 0xe4], eax
je 0x4d94c7
lea esi, [esp + 0xc0]
lea ebx, [esp + 0x30]
mov dword [esp + 4], edi
and dword [esi], 0
mov dword [esi + 4], 8
and dword [esi + 8], 0
and dword [ebx - 8], 0
push 0x20
pop edi
mov ecx, edi
lea eax, [esp + 0xe4]
mov dword [ebx - 4], edi
mov dword [ebx], eax
call fcn.004d7b60
lea ecx, [esp + 0x9c]
mov edx, edi
push ebx
push edi
push 0
push 1
push eax
push 0
call fcn.004d6d33
add esp, 0x18
lea ecx, [esp + 0x9c]
call fcn.004d7ea8
mov ecx, esi
mov edx, eax
call fcn.004d7d60
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x80]
mov eax, dword [edx + 8]
movq xmm0, qword [edx]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea ecx, [esp + 0x58]
lea edx, [esp + 0x80]
call fcn.004d7cf7
cmp dword [esp + 0x5c], 0
je 0x4d9491
mov edi, dword [esp + 0x60]
movq xmm0, qword [esp + 0x58]
lea ecx, [esp + 0xc0]
movq qword [esp + 0x28], xmm0
mov dword [esp + 0x30], edi
mov edx, edi
mov esi, dword [esp + 0x2c]
call fcn.004d7d60
mov ebx, dword [esp + 0xc8]
imul ecx, edi, 0x50
imul eax, ebx, 0x50
add eax, dword [esp + 0xc4]
push ecx
push esi
push eax
call fcn.005010b0
add esp, 0xc
and dword [esp + 0x30], 0
add ebx, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0xc8], ebx
call fcn.004d4b1a
jmp 0x4d941c
lea ecx, [esp + 0x80]
call fcn.004d6cd5
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 4]
jmp 0x4d94e2
cmp byte [esi + 8], 0
mov eax, dword [esp + 8]
je 0x4d9504
mov ecx, dword [eax + 0xf0]
mov edx, dword [eax + 0xf4]
call fcn.004da85f
jmp 0x4d9500
and dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 8
and dword [esp + 0xc8], 0
mov ecx, edi
call fcn.004d4b1a
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
mov dword [edi + 8], eax
movq qword [edi], xmm0
mov eax, dword [esp + 8]
cmp byte [esi + 0xc], 0
je 0x4d9838
lea esi, [esp + 0xbc]
lea edx, [esp + 0xe0]
lea ecx, [esp + 0xc0]
add eax, 0xf8
lea edi, [esp + 0x58]
lea ebx, [esp + 0x80]
and dword [esi], 0
and dword [edx], 0
lea esi, [esp + 0x120]
lea edx, [esp + 0x14c]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [ecx + 8], 0
mov dword [esp + 0x1c], eax
and dword [esi], 0
and dword [edx], 0
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0xe8]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xcc]
push eax
push 2
push 0
push 0
call sub.netapi32.dll_NetUserEnum
test eax, eax
mov dword [esp + 0x18], eax
je 0x4d95a2
cmp dword [esp + 0x18], 0xea
jne 0x4d97ac
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xe0]
lea eax, [ecx + eax*4]
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x14]
je 0x4d97ac
mov edx, ecx
add ecx, 4
mov eax, dword [edx]
test eax, eax
je 0x4d95b7
and dword [esp + 0xe4], 0
and dword [esp + 0x80], 0
and dword [esp + 0x58], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
push edi
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0xf0]
push ecx
push 1
push 0
push eax
push 0x558ff0
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x4d963d
and dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 4
and dword [esp + 0xa4], 0
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x4d971e
push eax
call sub.netapi32.dll_NetApiBufferFree
jmp 0x4d971e
mov edi, dword [esp + 0x80]
test edi, edi
push 4
pop ebx
je 0x4d9681
xor edx, edx
cmp edi, 0xaaaaaab
setb al
jae 0x4d9ae5
imul ecx, edi, 0xc
test ecx, ecx
js 0x4d9ae5
mov dl, al
mov dword [esp + 4], ecx
shl edx, 2
mov esi, edx
call fcn.004946d6
mov ebx, eax
test eax, eax
je 0x4d9aec
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], ebx
and dword [esp + 0xa4], 0
cmp dword [esp + 0xe4], 0
je 0x4d971e
mov eax, dword [esp + 0x80]
xor esi, esi
xor edi, edi
mov dword [esp + 4], eax
cmp dword [esp + 4], edi
je 0x4d9623
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x4d971e
mov edx, dword [eax + edi*4]
lea ecx, [esp + 0x28]
call fcn.004d67ee
cmp esi, dword [esp + 0x9c]
jne 0x4d96f6
lea ecx, [esp + 0x9c]
mov edx, esi
call fcn.004c0712
mov ebx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov ecx, dword [esp + 0x30]
imul eax, esi, 0xc
inc edi
mov dword [ebx + eax + 8], ecx
movq xmm0, qword [esp + 0x28]
movq qword [ebx + eax], xmm0
mov esi, dword [esp + 0xa4]
inc esi
mov dword [esp + 0xa4], esi
jmp 0x4d96b0
mov eax, dword [esp + 0xc]
lea ebx, [esp + 0x80]
mov ecx, ebx
mov edx, dword [eax]
call fcn.004d67ee
mov edx, dword [esp + 0x84]
lea edi, [esp + 0x58]
mov ecx, edi
push dword [esp + 0x88]
call fcn.00417ce0
pop eax
mov ecx, edi
call fcn.004d683a
mov ecx, dword [esp + 0x88]
lea esi, [esp + 0x34]
movq xmm0, qword [esp + 0x80]
movsd xmm1, qword [esp + 0x9c]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0xa4]
movq qword [esi], xmm0
movsd qword [esi + 0xc], xmm1
mov dword [esi + 0x14], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x30], 0
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x28]
call fcn.004da8b7
mov ecx, dword [esp + 0x10]
jmp 0x4d95b7
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x4d97c5
push eax
call sub.netapi32.dll_NetApiBufferFree
and dword [esp + 0xbc], 0
cmp dword [esp + 0x18], 0xea
je 0x4d955f
lea eax, [esp + 0x124]
and dword [esp + 0xe4], 0
lea ecx, [esp + 0xe4]
and dword [eax], 0
push ecx
push eax
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x4d9840
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0xfc]
mov edx, dword [esi + 0x100]
call fcn.004d7ebe
mov ecx, dword [esi + 0xf8]
mov edx, dword [esi + 0xfc]
call fcn.004d801b
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x1c]
movq xmm0, qword [esp + 0xc0]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x124]
xor eax, eax
mov dword [esp + 0xc], esi
cmp eax, esi
je 0x4d97f7
lea edi, [eax + 1]
shl eax, 3
and dword [esp + 0x9c], 0
lea ecx, [esp + 0x9c]
add eax, dword [esp + 0xe4]
push ecx
push eax
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x4d988f
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4d990e
push eax
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x4d990e
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4d990e
cmp dword [eax + 0x24], 3
je 0x4d990e
mov edx, dword [eax + 0x10]
lea ecx, [esp + 0x80]
mov dword [esp + 0x10], edi
call fcn.004d67ee
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0xc4]
mov esi, dword [esp + 0x88]
imul edi, dword [esp + 0xc8], 0x24
mov dword [esp + 4], ecx
test edi, edi
je 0x4d9915
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
lea ebx, [eax + 0x24]
push esi
push dword [esp + 8]
call fcn.0043c53d
pop ecx
pop edx
add edi, 0xffffffdc
test al, al
mov eax, ebx
je 0x4d98d4
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 4]
call fcn.004c2719
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, edi
jmp 0x4d984d
mov edx, dword [esp + 4]
lea edi, [esp + 0x58]
mov ecx, edi
push esi
call fcn.00417ce0
pop eax
mov ecx, edi
call fcn.004d683a
mov ecx, dword [esp + 0x88]
movq xmm0, qword [esp + 0x80]
lea esi, [esp + 0x34]
mov dword [esi + 8], ecx
movq qword [esi], xmm0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x30], 0
and dword [esp + 0x40], 0
mov dword [esp + 0x44], 4
and dword [esp + 0x48], 0
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x28]
call fcn.004da8b7
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jmp 0x4d9878
movsd xmm0, qword [esp + 0x138]
movsd xmm2, qword [esp + 0x128]
movsd xmm1, qword [esp + 0x130]
lea esi, [esp + 0x14c]
lea edi, [esp + 0x80]
mov ecx, edi
mov edx, esi
movsd qword [esi + 0x14], xmm0
movsd qword [esi + 0xc], xmm1
movsd qword [esi + 4], xmm2
mov dword [esi], eax
push 1
call fcn.004db38a
pop eax
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x18]
movq xmm0, qword [esi + 0x10]
movsd xmm2, qword [esi]
movsd xmm1, qword [esi + 8]
cmp edi, 2
mov dword [esp + 0x40], eax
movq qword [esp + 0x38], xmm0
movsd qword [esp + 0x30], xmm1
movsd qword [esp + 0x28], xmm2
jne 0x4d9a0c
lea ecx, [esp + 0x28]
call fcn.004d7f61
xor ebx, ebx
push 4
pop edi
jmp 0x4d891d
movss xmm0, dword [esp + 0x80]
movss xmm1, dword [esp + 0x88]
movss dword [esp + 4], xmm0
movss dword [esp + 0x10], xmm1
push 8
pop ecx
call fcn.00441781
mov dword [edx + 4], 0x72657475
mov dword [edx], 0x706d6f43
mov dword [esp + 0xc], eax
mov esi, edx
movsd xmm1, qword [esp + 0x154]
movsd xmm0, qword [esp + 0x14c]
mov eax, dword [esp + 0x164]
movsd qword [esp + 0x60], xmm1
movsd xmm1, qword [esp + 0x15c]
movsd qword [esp + 0x58], xmm0
mov dword [esp + 0x70], eax
movsd qword [esp + 0x68], xmm1
push 0x38
pop ecx
push 4
pop edx
call fcn.004d4b9e
movss xmm0, dword [esp + 0x10]
mov dword [eax], edi
mov edi, eax
movss dword [eax + 4], xmm0
movss xmm0, dword [esp + 4]
movss dword [eax + 8], xmm0
movss dword [eax + 0xc], xmm0
mov eax, dword [esp + 0xc]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], 8
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
movsd qword [edi + 0x1c], xmm0
movsd qword [edi + 0x24], xmm1
movq xmm0, qword [esp + 0x68]
movq qword [edi + 0x2c], xmm0
mov eax, dword [esp + 0x70]
mov dword [edi + 0x34], eax
jmp 0x4d891d
call fcn.00416990
ud2
mov ecx, dword [esp + 4]
mov edx, esi
call fcn.0050d210
ud2
push 8
pop edx
mov ecx, 0xa0
jmp 0x4d9af2