Function at 0x4d47cf
Capabilities:
Enumerate pe sections
Get disk information
Get logon sessions
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
lea esi, [esp + 0x188]
mov dword [esp + 8], ecx
mov dword [esp + 0xb8], edx
mov ecx, esi
call fcn.0041f7e9
mov eax, dword [esi]
mov edx, 0xe8
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
lea esi, [esp + 0x28]
mov ecx, esi
mov dword [esp + 0x18], eax
push 0x1f4
call fcn.004a01ab
pop eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esi]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x7c], eax
push 9
pop ecx
call fcn.00440a54
mov ebx, edx
mov dword [esp + 0x1c], eax
mov dword [edx], 0x61746f54
mov dword [edx + 4], 0x5043206c
mov byte [edx + 8], 0x55
push 8
pop edx
mov ecx, 0xa0
call fcn.004912aa
test eax, eax
mov dword [esp + 4], eax
je 0x4d5dfa
lea edi, [esp + 0x178]
mov ecx, edi
call fcn.0041f7e9
mov eax, dword [edi + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x50], eax
mov eax, dword [edi]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xdc], eax
call fcn.004cd5c0
mov edi, edx
lea esi, [esp + 0x28]
mov edx, eax
mov ecx, esi
push 0x19db1de
push 0xd53e8000
push edi
call fcn.004cd640
add esp, 0xc
mov eax, dword [esi]
xor edi, edi
or eax, dword [esi + 4]
mov esi, 0
jne 0x4d48fe
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
call sub.kernel32.dll_GetTickCount64
push 0
push 0x3e8
push edx
push eax
call fcn.004fc820
xor ecx, ecx
sub edi, eax
sbb esi, edx
cmovb esi, ecx
cmovb edi, ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
and dword [eax + 0x44], 0
and dword [eax + 0x40], 0
and dword [eax + 0x48], 0
and dword [eax + 0x50], 0
and dword [eax + 0x94], 0
and dword [eax + 0x90], 0
and dword [eax + 0x9c], 0
and dword [eax + 0x98], 0
and dword [eax + 0xa4], 0
and dword [eax + 0xa0], 0
and dword [eax + 0xac], 0
and dword [eax + 0xa8], 0
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ebx
mov dword [eax + 0x60], 9
and dword [eax + 0x64], 0
xor ebx, ebx
inc ebx
mov dword [eax + 0x68], ebx
and dword [eax + 0x6c], 0
and dword [eax + 0x70], 0
mov dword [eax + 0x74], ebx
and dword [eax + 0x78], 0
and dword [eax + 0x80], 0
mov dword [eax + 0x84], 8
and dword [eax + 0x88], 0
mov byte [eax + 0x8c], 0
and dword [eax + 0xe0], 0
push 4
pop ecx
mov edx, dword [esp + 4]
mov dword [eax + 0xe4], ecx
and dword [eax + 0xe8], 0
mov dword [eax + 0xec], 2
mov dword [eax + 0xf0], edx
mov edx, dword [esp + 0xdc]
and dword [eax + 0xf4], 0
and dword [eax + 0xcc], 0
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x4c]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x50]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x54]
mov dword [eax + 0x2c], edx
and dword [eax + 0x30], 0
and dword [eax + 0x34], 0
and dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0x547e30
mov dword [eax + 0xdc], esi
mov esi, dword [esp + 0xb8]
mov dword [eax + 0xd8], edi
and dword [eax + 0xf8], 0
mov dword [eax + 0xfc], ecx
and dword [eax + 0x100], 0
mov edi, ecx
cmp byte [esi + 9], 0
je 0x4d4a6f
mov ecx, eax
call fcn.004d5e04
mov eax, dword [esp + 8]
cmp byte [esi], 2
je 0x4d4a86
movzx edx, byte [esi + 1]
mov ecx, eax
and edx, 1
call fcn.004d5ed5
mov eax, dword [esp + 8]
cmp byte [esi + 0xb], 0
je 0x4d4c61
lea esi, [esp + 0x58]
mov ecx, esi
call fcn.004d73ea
cmp dword [esi], 2
je 0x4d4c1c
mov eax, dword [esp + 0x70]
movq xmm0, qword [esp + 0x68]
movsd xmm2, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
lea esi, [esp + 0x80]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004d740a
cmp dword [esi], 2
je 0x4d4c1c
mov eax, dword [esp + 0x98]
movq xmm0, qword [esp + 0x90]
movsd xmm2, qword [esp + 0x80]
movsd xmm1, qword [esp + 0x88]
lea esi, [esp + 0x9c]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004d745f
cmp dword [esi], 2
je 0x4d4c1c
mov eax, dword [esp + 0xb4]
movq xmm0, qword [esp + 0xac]
movsd xmm2, qword [esp + 0x9c]
movsd xmm1, qword [esp + 0xa4]
lea esi, [esp + 0xc0]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004d74cf
cmp dword [esi], 2
je 0x4d4c1c
mov eax, dword [esp + 0xd8]
movq xmm0, qword [esp + 0xd0]
movsd xmm2, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
lea esi, [esp + 0xe4]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004d7560
cmp dword [esi], 2
je 0x4d4c1c
mov eax, dword [esp + 0xfc]
movq xmm0, qword [esp + 0xf4]
movsd xmm2, qword [esp + 0xe4]
movsd xmm1, qword [esp + 0xec]
lea esi, [esp + 0x124]
lea edx, [esp + 0x28]
mov ecx, esi
mov dword [edx + 0x18], eax
movq qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
call fcn.004d75bb
mov eax, dword [esi]
cmp eax, 2
jne 0x4d5c85
xor ebx, ebx
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0xe4]
mov edx, dword [esi + 0xe8]
call fcn.004d43c7
mov ecx, dword [esi + 0xe0]
mov edx, dword [esi + 0xe4]
call fcn.004d449d
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], edi
mov eax, esi
mov dword [esi + 0xe8], ebx
mov esi, dword [esp + 0xb8]
jmp 0x4d4c7c
cmp byte [esi + 0xa], 0
je 0x4d4c7c
mov ecx, dword [eax + 0xe4]
mov edx, dword [eax + 0xe8]
call fcn.004d61e6
mov eax, dword [esp + 8]
cmp byte [esi + 6], 0
lea edi, [eax + 0x20]
je 0x4d4ce6
lea eax, [esp + 0x124]
and dword [eax], 0
push eax
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x4d5657
mov edx, dword [esp + 8]
lea esi, [esp + 0x28]
mov eax, dword [edx + 0x3c]
mov ebx, dword [edx + 0x38]
lea ecx, [eax + 0x10]
movdqa xmm0, xmmword [eax]
mov dword [esi], ecx
mov ecx, dword [edx + 0x30]
lea ecx, [ecx + eax + 1]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
pmovmskb eax, xmm0
lea ecx, [edx + 0x30]
not eax
mov dword [esp + 0x10], ecx
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ebx
mov ecx, esi
call fcn.004d3dd4
test eax, eax
je 0x4d4cfc
mov byte [edx + 0x68], 0
jmp 0x4d4cd5
cmp byte [esi + 5], 0
je 0x4d5657
mov ecx, edi
call fcn.004d6409
jmp 0x4d5657
lea esi, [esp + 0x168]
mov dword [esp + 0x100], edi
mov ecx, esi
call fcn.0041f7e9
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
mov esi, dword [esi + 4]
lea edi, [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [edi - 0xc], esi
mov dword [edi - 0x10], edx
mov dword [edi - 4], ecx
mov ecx, dword [esp + 0x124]
mov dword [edi - 8], eax
lea eax, [esp + 0xc0]
and dword [edi], 0
and dword [edi + 4], 0
and dword [edi + 8], 0
mov dword [edi + 0xc], 0x547e30
and dword [eax], 0
mov dword [eax + 4], 4
and dword [eax + 8], 0
mov edx, dword [ecx]
lea eax, [ecx + 8]
add ecx, 0x18
mov dword [esp + 0x78], eax
push 4
pop eax
mov dword [esp + 0x50], eax
xor esi, esi
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x54], edx
imul ebx, esi, 0x548
add ebx, ecx
cmp edx, esi
je 0x4d502c
mov eax, dword [ebx + 0x498]
or eax, dword [ebx + 0x49c]
jne 0x4d4daf
mov eax, dword [ebx + 0x4a0]
or eax, dword [ebx + 0x4a4]
je 0x4d4f95
cmp dword [ebx + 0x47c], 2
je 0x4d4f95
cmp dword [ebx + 0x410], 0
je 0x4d4f95
mov dword [esp + 4], esi
push 0x14
pop ecx
push 2
pop edx
call fcn.004d1057
mov esi, eax
mov eax, dword [ebx]
movzx edx, byte [ebx + 9]
movzx ecx, byte [ebx + 0xa]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 4]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 5]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 6]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 7]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x7c], eax
movzx eax, byte [ebx + 0xb]
mov dword [esi], edi
mov edi, dword [esp + 0x18]
mov word [esi + 4], di
mov edi, dword [esp + 0x1c]
mov word [esi + 6], di
mov edi, dword [esp + 0x24]
mov word [esi + 8], di
mov edi, dword [esp + 0x20]
mov word [esi + 0xa], di
mov edi, dword [esp + 0x7c]
mov word [esi + 0xc], di
mov word [esi + 0xe], dx
mov word [esi + 0x10], cx
mov word [esi + 0x12], ax
push 0xa
pop ecx
call fcn.004bce04
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
mov edi, edx
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
movq xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [edx + 8], xmm1
movq qword [edx], xmm0
push 0xa
pop eax
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], eax
push eax
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.004d40dd
add esp, 0x10
mov esi, edx
mov edx, dword [esp + 0x44]
mov edi, eax
lea eax, [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x84], eax
push 0x4d4648
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0x24], esi
push esi
mov dword [esp + 0x24], edi
push edi
call fcn.0049fe8d
add esp, 0x10
mov edi, dword [esp + 0x44]
test eax, eax
je 0x4d4f10
test edi, edi
je 0x4d4f10
shl edx, 4
sub edi, edx
mov edx, dword [esp + 0x5c]
test edx, edx
je 0x4d4f75
mov ecx, dword [esp + 0x58]
call fcn.004bd0bc
jmp 0x4d4f75
cmp dword [esp + 0x3c], 0
je 0x4d4fa1
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov edx, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0049fe0e
pop ecx
pop ecx
and dl, 1
shl eax, 4
movzx ecx, dl
mov edx, dword [esp + 0x44]
sub dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
mov edi, edx
sub edi, eax
neg eax
mov dword [edx + eax - 0x10], esi
mov edx, dword [esp + 0x24]
mov dword [edi - 0xc], edx
mov dword [edi - 8], ecx
and dword [edi - 4], 0
inc dword [esp + 0x40]
mov eax, dword [edi - 4]
inc eax
cmp eax, 1
mov dword [edi - 4], eax
jle 0x4d4fb7
push 0xa
pop ecx
mov edx, dword [esp + 0x14]
call fcn.004bd0bc
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 4]
add ebx, 0x548
inc esi
jmp 0x4d4d87
lea ecx, [esp + 0x38]
lea edx, [esp + 0x28]
call fcn.0050dbee
mov edi, dword [esp + 0x44]
jmp 0x4d4f1b
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 0xc0]
jne 0x4d4fe4
lea ecx, [esp + 0xc0]
call fcn.00403351
mov edi, dword [esp + 0xc4]
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x4c]
jmp 0x4d4fec
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 4]
shl edx, 4
mov dword [edi + edx], ebx
inc ebx
push 0xa
pop eax
mov esi, dword [esp + 0x14]
mov dword [edi + edx + 4], eax
mov dword [esp + 0x50], edi
mov dword [edi + edx + 8], esi
mov dword [edi + edx + 0xc], eax
mov edx, dword [esp + 0x54]
mov esi, ebx
mov eax, dword [esp + 0xc8]
inc eax
mov dword [esp + 0xc], eax
mov dword [esp + 0xc8], eax
jmp 0x4d4d7f
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0xc4]
mov eax, dword [esp + 0xc0]
shl edi, 4
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], esi
add edi, esi
mov dword [esp + 0xc], edi
cmp esi, edi
je 0x4d553c
mov eax, dword [esi + 8]
lea ecx, [esi + 0x10]
test eax, eax
je 0x4d553a
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
mov edx, dword [esi + 4]
cmp dword [esp + 0x40], 0
mov dword [esp + 4], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edi
je 0x4d5104
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push edi
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.004d40dd
add esp, 0x10
lea ecx, [esp + 0x9c]
mov esi, edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe4]
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x38]
push 0x4d73b6
lea edi, [esp + 0x5c]
push edi
push esi
push eax
call fcn.0049fe8d
add esp, 0x10
mov ecx, dword [esp + 0x44]
shl edx, 4
sub ecx, edx
test eax, eax
cmove ecx, eax
lea eax, [ecx - 0x10]
test ecx, ecx
cmove eax, ecx
jmp 0x4d5106
xor eax, eax
lea ecx, [eax + 0xc]
test eax, eax
mov edx, 0x56e780
cmove ecx, edx
cmp dword [ecx], 1
jg 0x4d54fe
mov eax, dword [esp + 0x78]
imul ebx, ebx, 0x548
xor esi, esi
lea eax, [eax + ebx + 0x1c]
cmp esi, 0x101
je 0x4d513e
cmp word [eax + esi*2], 0
je 0x4d5145
inc esi
jmp 0x4d512c
mov esi, 0x101
jmp 0x4d515b
mov ecx, eax
mov edx, 0x101
push 0x547634
push esi
call fcn.004312f7
pop ecx
pop ecx
mov esi, edx
lea ecx, [esp + 0x58]
mov edx, eax
push esi
call fcn.00416470
pop eax
cmp dword [esp + 0x5c], 0
je 0x4d54fe
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x60]
movsd xmm0, qword [esp + 0x58]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [esp + 0x88], eax
movsd qword [esp + 0x80], xmm0
push eax
push dword [esp + 0x88]
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.004d4025
add esp, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x80]
mov edi, edx
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0xe4], eax
lea eax, [esp + 0xe4]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
push 0x4d45ba
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x20], edi
push edi
push dword [esp + 0x20]
call fcn.0049fe8d
add esp, 0x10
mov ecx, edx
mov edx, dword [esi + 0x3c]
test eax, eax
je 0x4d5325
test edx, edx
je 0x4d5325
shl ecx, 7
mov eax, dword [esp + 0x88]
mov esi, dword [esp + 0x78]
mov edi, 0xffffffff
sub edx, ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
mov eax, dword [edx - 0x68]
mov ecx, dword [edx - 0x64]
mov dword [edx - 0x5c], ecx
mov dword [edx - 0x60], eax
mov eax, dword [esi + ebx + 0x504]
mov ecx, dword [esi + ebx + 0x500]
mov dword [edx - 0x68], ecx
mov dword [edx - 0x64], eax
mov eax, dword [edx - 0x54]
mov ecx, dword [edx - 0x58]
mov dword [edx - 0x50], ecx
mov dword [edx - 0x4c], eax
movsd xmm0, qword [esi + ebx + 0x4b8]
movsd qword [edx - 0x58], xmm0
movsd xmm0, qword [edx - 0x48]
movsd xmm1, qword [edx - 0x38]
movsd qword [edx - 0x40], xmm0
mov eax, dword [esi + ebx + 0x4c0]
mov ecx, dword [esi + ebx + 0x4c4]
add eax, dword [esi + ebx + 0x4c8]
adc ecx, dword [esi + ebx + 0x4cc]
cmovb ecx, edi
cmovb eax, edi
mov dword [edx - 0x44], ecx
mov dword [edx - 0x48], eax
movsd qword [edx - 0x30], xmm1
mov ecx, dword [esi + ebx + 0x508]
mov eax, dword [esi + ebx + 0x50c]
add ecx, dword [esi + ebx + 0x510]
adc eax, dword [esi + ebx + 0x514]
cmovb eax, edi
cmovb ecx, edi
mov dword [edx - 0x38], ecx
mov dword [edx - 0x34], eax
lea ecx, [esp + 0x58]
movsd xmm0, qword [edx - 0x28]
movsd qword [edx - 0x20], xmm0
movsd xmm0, qword [esi + ebx + 0x4d8]
movsd qword [edx - 0x28], xmm0
movsd xmm0, qword [edx - 0x18]
movsd qword [edx - 0x10], xmm0
movq xmm0, qword [esi + ebx + 0x520]
movq qword [edx - 0x18], xmm0
mov byte [edx - 8], 1
call fcn.0043f733
jmp 0x4d54fe
cmp dword [esi + 0x34], 0
je 0x4d551e
mov ecx, dword [esp + 0x78]
mov esi, 0xffffffff
mov eax, dword [ecx + ebx + 0x4c0]
mov edi, dword [ecx + ebx + 0x4c4]
movsd xmm0, qword [ecx + ebx]
add eax, dword [ecx + ebx + 0x4c8]
movsd qword [esp + 0x140], xmm0
adc edi, dword [ecx + ebx + 0x4cc]
cmovb edi, esi
cmovb eax, esi
mov esi, dword [ecx + ebx + 0x50c]
mov dword [esp + 0x1c], edi
mov edi, dword [ecx + ebx + 0x508]
mov dword [esp + 0x24], eax
mov eax, 0xffffffff
add edi, dword [ecx + ebx + 0x510]
adc esi, dword [ecx + ebx + 0x514]
cmovb esi, eax
cmovb edi, eax
mov eax, dword [ecx + ebx + 0x500]
mov dword [esp + 0xdc], eax
mov eax, dword [ecx + ebx + 0x504]
mov dword [esp + 0x118], eax
mov eax, dword [ecx + ebx + 0x4b8]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + ebx + 0x4bc]
mov dword [esp + 0x11c], eax
mov eax, dword [ecx + ebx + 0x4d8]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + ebx + 0x4dc]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + ebx + 0x520]
mov dword [esp + 0x20], eax
mov eax, dword [ecx + ebx + 0x524]
mov ebx, dword [esp + 8]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x80]
mov ecx, dword [ebx + 0x30]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x114], eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0049fe0e
pop ecx
pop ecx
and dl, 1
shl eax, 7
movq xmm0, qword [esp + 0x140]
movzx ecx, dl
mov edx, dword [ebx + 0x3c]
sub dword [ebx + 0x34], ecx
mov ebx, dword [esp + 0x10c]
mov ecx, edx
sub ecx, eax
neg eax
mov dword [edx + eax - 0x80], ebx
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x118]
mov ebx, dword [esp + 0x24]
mov dword [ecx - 0x7c], eax
mov eax, dword [esp + 0x114]
mov dword [ecx - 0x78], eax
mov eax, dword [esp + 0xdc]
movq qword [ecx - 0x70], xmm0
mov dword [ecx - 0x64], edx
mov dword [ecx - 0x68], eax
mov dword [ecx - 0x5c], edx
mov dword [ecx - 0x60], eax
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x4c]
mov dword [ecx - 0x54], edx
mov dword [ecx - 0x58], eax
mov dword [ecx - 0x4c], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx - 0x50], eax
mov dword [ecx - 0x48], ebx
mov dword [ecx - 0x44], edx
mov dword [ecx - 0x3c], edx
mov dword [ecx - 0x40], ebx
mov dword [ecx - 0x34], esi
mov dword [ecx - 0x38], edi
mov dword [ecx - 0x30], edi
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x7c]
mov dword [ecx - 0x2c], esi
mov esi, dword [esp + 0x20]
mov dword [ecx - 0x24], edx
mov dword [ecx - 0x28], edi
mov dword [ecx - 0x1c], edx
mov edx, dword [esp + 0x54]
mov dword [ecx - 0x20], edi
mov dword [ecx - 0x18], esi
mov dword [ecx - 0x14], edx
mov dword [ecx - 0xc], edx
mov dword [ecx - 0x10], esi
mov byte [ecx - 8], 1
mov ecx, dword [esp + 8]
inc dword [ecx + 0x38]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0xa0]
call fcn.004bd0bc
mov esi, dword [esp + 4]
mov edi, dword [esp + 0xc]
jmp 0x4d5055
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x100]
call fcn.0050da70
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x3c]
jmp 0x4d532f
mov esi, ecx
sub edi, esi
add esi, 8
shr edi, 4
sub edi, 1
jb 0x4d5558
mov ecx, dword [esi - 4]
mov edx, dword [esi]
call fcn.004bd0bc
add esi, 0x10
jmp 0x4d5544
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x104]
call fcn.0043fa10
push dword [esp + 0x124]
call sub.iphlpapi.dll_FreeMibTable
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4d55ea
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4d55e1
mov edi, dword [esp + 0x44]
movdqa xmm0, xmmword [edi]
lea ebx, [edi + 0x10]
pmovmskb eax, xmm0
not eax
sub edx, 1
jae 0x4d55b2
jmp 0x4d55dd
movdqa xmm0, xmmword [ebx]
add edi, 0xffffff00
add ebx, 0x10
pmovmskb eax, xmm0
not eax
test ax, ax
je 0x4d559f
bsf ecx, eax
lea esi, [eax - 1]
mov dword [esp + 4], edx
and esi, eax
shl ecx, 4
mov eax, edi
sub eax, ecx
mov ecx, dword [eax - 0x10]
mov edx, dword [eax - 0xc]
call fcn.004bd0bc
mov edx, dword [esp + 4]
mov eax, esi
jmp 0x4d5598
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
call fcn.004d44c7
mov edx, dword [esp + 8]
lea esi, [esp + 0x28]
mov eax, dword [edx + 0x3c]
lea ecx, [eax + 0x10]
movdqa xmm0, xmmword [eax]
mov dword [esi], ecx
mov ecx, dword [edx + 0x30]
lea ecx, [ecx + eax + 1]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0x38]
mov dword [esi + 8], eax
pmovmskb eax, xmm0
not eax
mov word [esi + 0xc], ax
mov dword [esi + 0x10], ecx
mov ecx, esi
call fcn.004d3de5
test eax, eax
je 0x4d5650
cmp byte [eax - 8], 0
mov edi, eax
jne 0x4d561b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x3c]
sub edx, edi
sar edx, 7
call fcn.00445fbe
mov ecx, dword [edi - 0x80]
mov edx, dword [edi - 0x7c]
call fcn.0049160f
jmp 0x4d561b
mov esi, dword [esp + 0xb8]
movzx edx, word [esi + 2]
cmp dl, 2
je 0x4d5672
movzx eax, byte [esi + 4]
mov ecx, dword [esp + 8]
shl eax, 0x10
or edx, eax
call fcn.004d656a
cmp byte [esi + 7], 0
je 0x4d57ab
mov eax, dword [esp + 8]
lea edi, [eax + 0xec]
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
test eax, eax
mov dword [esp + 0xe4], eax
je 0x4d57c8
lea esi, [esp + 0xc0]
lea ebx, [esp + 0x30]
mov dword [esp + 4], edi
and dword [esi], 0
mov dword [esi + 4], 8
and dword [esi + 8], 0
and dword [ebx - 8], 0
push 0x20
pop edi
mov ecx, edi
lea eax, [esp + 0xe4]
mov dword [ebx - 4], edi
mov dword [ebx], eax
call fcn.004d3f5f
lea ecx, [esp + 0x9c]
mov edx, edi
push ebx
push edi
push 0
push 1
push eax
push 0
call fcn.004d1200
add esp, 0x18
lea ecx, [esp + 0x9c]
call fcn.004d4340
mov ecx, esi
mov edx, eax
call fcn.004d41da
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x80]
mov eax, dword [edx + 8]
movq xmm0, qword [edx]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea ecx, [esp + 0x58]
lea edx, [esp + 0x80]
call fcn.004d418f
cmp dword [esp + 0x5c], 0
je 0x4d5792
mov edi, dword [esp + 0x60]
movq xmm0, qword [esp + 0x58]
lea ecx, [esp + 0xc0]
movq qword [esp + 0x28], xmm0
mov dword [esp + 0x30], edi
mov edx, edi
mov esi, dword [esp + 0x2c]
call fcn.004d41da
mov ebx, dword [esp + 0xc8]
imul ecx, edi, 0x50
imul eax, ebx, 0x50
add eax, dword [esp + 0xc4]
push ecx
push esi
push eax
call fcn.004fea40
add esp, 0xc
and dword [esp + 0x30], 0
add ebx, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0xc8], ebx
call fcn.004d0fe8
jmp 0x4d571d
lea ecx, [esp + 0x80]
call fcn.004d1b83
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 4]
jmp 0x4d57e3
cmp byte [esi + 8], 0
mov eax, dword [esp + 8]
je 0x4d5805
mov ecx, dword [eax + 0xf0]
mov edx, dword [eax + 0xf4]
call fcn.004d6b60
jmp 0x4d5801
and dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 8
and dword [esp + 0xc8], 0
mov ecx, edi
call fcn.004d0fe8
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
mov dword [edi + 8], eax
movq qword [edi], xmm0
mov eax, dword [esp + 8]
cmp byte [esi + 0xc], 0
je 0x4d5b39
lea esi, [esp + 0xbc]
lea edx, [esp + 0xe0]
lea ecx, [esp + 0xc0]
add eax, 0xf8
lea edi, [esp + 0x58]
lea ebx, [esp + 0x80]
and dword [esi], 0
and dword [edx], 0
lea esi, [esp + 0x120]
lea edx, [esp + 0x14c]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [ecx + 8], 0
mov dword [esp + 0x1c], eax
and dword [esi], 0
and dword [edx], 0
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0xe8]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xcc]
push eax
push 2
push 0
push 0
call sub.netapi32.dll_NetUserEnum
test eax, eax
mov dword [esp + 0x18], eax
je 0x4d58a3
cmp dword [esp + 0x18], 0xea
jne 0x4d5aad
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xe0]
lea eax, [ecx + eax*4]
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x14]
je 0x4d5aad
mov edx, ecx
add ecx, 4
mov eax, dword [edx]
test eax, eax
je 0x4d58b8
and dword [esp + 0xe4], 0
and dword [esp + 0x80], 0
and dword [esp + 0x58], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
push edi
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0xf0]
push ecx
push 1
push 0
push eax
push 0x5477e4
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x4d593e
and dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 4
and dword [esp + 0xa4], 0
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x4d5a1f
push eax
call sub.netapi32.dll_NetApiBufferFree
jmp 0x4d5a1f
mov edi, dword [esp + 0x80]
test edi, edi
push 4
pop ebx
je 0x4d5982
xor edx, edx
cmp edi, 0xaaaaaab
setb al
jae 0x4d5de6
imul ecx, edi, 0xc
test ecx, ecx
js 0x4d5de6
mov dl, al
mov dword [esp + 4], ecx
shl edx, 2
mov esi, edx
call fcn.004912aa
mov ebx, eax
test eax, eax
je 0x4d5ded
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], ebx
and dword [esp + 0xa4], 0
cmp dword [esp + 0xe4], 0
je 0x4d5a1f
mov eax, dword [esp + 0x80]
xor esi, esi
xor edi, edi
mov dword [esp + 4], eax
cmp dword [esp + 4], edi
je 0x4d5924
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x4d5a1f
mov edx, dword [eax + edi*4]
lea ecx, [esp + 0x28]
call fcn.004d281f
cmp esi, dword [esp + 0x9c]
jne 0x4d59f7
lea ecx, [esp + 0x9c]
mov edx, esi
call fcn.004d4216
mov ebx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov ecx, dword [esp + 0x30]
imul eax, esi, 0xc
inc edi
mov dword [ebx + eax + 8], ecx
movq xmm0, qword [esp + 0x28]
movq qword [ebx + eax], xmm0
mov esi, dword [esp + 0xa4]
inc esi
mov dword [esp + 0xa4], esi
jmp 0x4d59b1
mov eax, dword [esp + 0xc]
lea ebx, [esp + 0x80]
mov ecx, ebx
mov edx, dword [eax]
call fcn.004d281f
mov edx, dword [esp + 0x84]
lea edi, [esp + 0x58]
mov ecx, edi
push dword [esp + 0x88]
call fcn.00416640
pop eax
mov ecx, edi
call fcn.004d286b
mov ecx, dword [esp + 0x88]
lea esi, [esp + 0x34]
movq xmm0, qword [esp + 0x80]
movsd xmm1, qword [esp + 0x9c]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0xa4]
movq qword [esi], xmm0
movsd qword [esi + 0xc], xmm1
mov dword [esi + 0x14], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x30], 0
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x28]
call fcn.0042366e
mov ecx, dword [esp + 0x10]
jmp 0x4d58b8
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x4d5ac6
push eax
call sub.netapi32.dll_NetApiBufferFree
and dword [esp + 0xbc], 0
cmp dword [esp + 0x18], 0xea
je 0x4d5860
lea eax, [esp + 0x124]
and dword [esp + 0xe4], 0
lea ecx, [esp + 0xe4]
and dword [eax], 0
push ecx
push eax
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x4d5b41
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0xfc]
mov edx, dword [esi + 0x100]
call fcn.004d4356
mov ecx, dword [esi + 0xf8]
mov edx, dword [esi + 0xfc]
call fcn.004d4489
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x1c]
movq xmm0, qword [esp + 0xc0]
mov dword [ecx + 8], eax
movq qword [ecx], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x124]
xor eax, eax
mov dword [esp + 0xc], esi
cmp eax, esi
je 0x4d5af8
lea edi, [eax + 1]
shl eax, 3
and dword [esp + 0x9c], 0
lea ecx, [esp + 0x9c]
add eax, dword [esp + 0xe4]
push ecx
push eax
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x4d5b90
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4d5c0f
push eax
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x4d5c0f
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4d5c0f
cmp dword [eax + 0x24], 3
je 0x4d5c0f
mov edx, dword [eax + 0x10]
lea ecx, [esp + 0x80]
mov dword [esp + 0x10], edi
call fcn.004d281f
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0xc4]
mov esi, dword [esp + 0x88]
imul edi, dword [esp + 0xc8], 0x24
mov dword [esp + 4], ecx
test edi, edi
je 0x4d5c16
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
lea ebx, [eax + 0x24]
push esi
push dword [esp + 8]
call fcn.004d45ee
pop ecx
pop edx
add edi, 0xffffffdc
test al, al
mov eax, ebx
je 0x4d5bd5
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 4]
call fcn.0049160f
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, edi
jmp 0x4d5b4e
mov edx, dword [esp + 4]
lea edi, [esp + 0x58]
mov ecx, edi
push esi
call fcn.00416640
pop eax
mov ecx, edi
call fcn.004d286b
mov ecx, dword [esp + 0x88]
movq xmm0, qword [esp + 0x80]
lea esi, [esp + 0x34]
mov dword [esi + 8], ecx
movq qword [esi], xmm0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x30], 0
and dword [esp + 0x40], 0
mov dword [esp + 0x44], 4
and dword [esp + 0x48], 0
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x28]
call fcn.0042366e
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jmp 0x4d5b79
movsd xmm0, qword [esp + 0x138]
movsd xmm2, qword [esp + 0x128]
movsd xmm1, qword [esp + 0x130]
lea esi, [esp + 0x14c]
lea edi, [esp + 0x80]
mov ecx, edi
mov edx, esi
movsd qword [esi + 0x14], xmm0
movsd qword [esi + 0xc], xmm1
movsd qword [esi + 4], xmm2
mov dword [esi], eax
push 1
call fcn.004d765f
pop eax
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x18]
movq xmm0, qword [esi + 0x10]
movsd xmm2, qword [esi]
movsd xmm1, qword [esi + 8]
cmp edi, 2
mov dword [esp + 0x40], eax
movq qword [esp + 0x38], xmm0
movsd qword [esp + 0x30], xmm1
movsd qword [esp + 0x28], xmm2
jne 0x4d5d0d
lea ecx, [esp + 0x28]
call fcn.004d43f9
xor ebx, ebx
push 4
pop edi
jmp 0x4d4c1e
movss xmm0, dword [esp + 0x80]
movss xmm1, dword [esp + 0x88]
movss dword [esp + 4], xmm0
movss dword [esp + 0x10], xmm1
push 8
pop ecx
call fcn.00440a54
mov dword [edx + 4], 0x72657475
mov dword [edx], 0x706d6f43
mov dword [esp + 0xc], eax
mov esi, edx
movsd xmm1, qword [esp + 0x154]
movsd xmm0, qword [esp + 0x14c]
mov eax, dword [esp + 0x164]
movsd qword [esp + 0x60], xmm1
movsd xmm1, qword [esp + 0x15c]
movsd qword [esp + 0x58], xmm0
mov dword [esp + 0x70], eax
movsd qword [esp + 0x68], xmm1
push 0x38
pop ecx
push 4
pop edx
call fcn.004d1057
movss xmm0, dword [esp + 0x10]
mov dword [eax], edi
mov edi, eax
movss dword [eax + 4], xmm0
movss xmm0, dword [esp + 4]
movss dword [eax + 8], xmm0
movss dword [eax + 0xc], xmm0
mov eax, dword [esp + 0xc]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], 8
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
movsd qword [edi + 0x1c], xmm0
movsd qword [edi + 0x24], xmm1
movq xmm0, qword [esp + 0x68]
movq qword [edi + 0x2c], xmm0
mov eax, dword [esp + 0x70]
mov dword [edi + 0x34], eax
jmp 0x4d4c1e
call fcn.004152f0
ud2
mov ecx, dword [esp + 4]
mov edx, esi
call fcn.0050aba0
ud2
push 8
pop edx
mov ecx, 0xa0
jmp 0x4d5df3