Function at 0x30048670
Capabilities:
Accept command line arguments
Get common file path
Get disk information
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x400
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x408]
push 0
push eax
mov dword [ebp - 0x414], 0x400
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x300486d1
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x300486ee
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x300486f7
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x40c], eax
test ecx, ecx
je 0x30048729
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048729
push ebx
popfd
test eax, eax
je 0x30048758
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048736
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
mov dword [ebp - 0x414], 0x400
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048795
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x300487b2
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x300487bb
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x418], eax
test ecx, ecx
je 0x300487ed
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x300487ed
push ebx
popfd
test eax, eax
je 0x30048822
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048800
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x43c]
add esp, 0xc
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x30048894
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x43c]
call esi
push dword [ebp - 0x43c]
call edi
mov eax, dword [ebp - 0x408]
push 0x400
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call ebx
test eax, eax
jne 0x30048900
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x464]
push eax
push 0
push str.RegisteredOwner
push dword [ebp - 0x440]
call esi
push dword [ebp - 0x440]
call edi
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048910
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004892d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048936
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x428], eax
test ecx, ecx
je 0x30048968
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048968
push ebx
popfd
test eax, eax
je 0x30048997
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048975
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x428]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30048a03
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0
push str.RegisteredOrganization
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048a10
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048a2d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048a36
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x42c], eax
test ecx, ecx
je 0x30048a68
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048a68
push ebx
popfd
test eax, eax
je 0x30048a97
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048a75
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x42c]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30048b03
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x474]
push eax
push 0
push str.ProductName
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048b10
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048b2d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048b36
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x424], eax
test ecx, ecx
je 0x30048b68
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048b68
push ebx
popfd
test eax, eax
je 0x30048b97
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048b75
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x424]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048bc8
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048be5
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048bee
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x41c], eax
test ecx, ecx
je 0x30048c20
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048c20
push ebx
popfd
test eax, eax
je 0x30048c52
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048c30
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x41c]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048c83
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048ca0
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048ca9
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x420], eax
test ecx, ecx
je 0x30048cdb
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048cdb
push ebx
popfd
test eax, eax
je 0x30048d0a
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048ce8
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x420]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftCryptography
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30048d76
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048d80
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048d9d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048da6
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x438], eax
test ecx, ecx
je 0x30048dd8
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048dd8
push ebx
popfd
test eax, eax
je 0x30048e07
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048de5
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x438]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x450]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0x30205880
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [0x3026e7e0]
test ecx, ecx
je 0x30048e4d
mov dword [ebp - 0x450], ecx
jmp 0x30048e53
mov ecx, dword [ebp - 0x450]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x408]
push ecx
push str._04x__04x
push eax
call fcn.3001dcb0
lea ecx, [ebp - 0x408]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048e78
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048e95
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048e9e
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x430], eax
test ecx, ecx
je 0x30048ed0
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30048ed0
push ebx
popfd
test eax, eax
je 0x30048f02
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30048ee0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x430]
call fcn.3016a610
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.30160f00
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x400
push eax
push 0x30205880
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
lea eax, [ebp - 0x408]
push 0x7d
push eax
call fcn.3015ffb0
add esp, 8
test eax, eax
je 0x30048f47
mov byte [eax], 0
lea eax, [ebp - 0x408]
push 0x7b
push eax
call fcn.3015ffb0
add esp, 8
test eax, eax
je 0x30048f6e
lea ecx, [eax + 1]
call fcn.3001eb40
mov ecx, eax
mov dword [ebp - 0x434], ecx
jmp 0x30048fd6
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30048f82
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30048f8b
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 1
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x434], ecx
test eax, eax
je 0x30048fbc
mov dword [eax + 0x34], esi
mov dword [eax + 0xbf4], edi
test ebx, ebx
je 0x30048fbc
push ebx
popfd
test ecx, ecx
je 0x30048fd6
push 1
push 0x301f62ee
push ecx
call fcn.3016a610
mov ecx, dword [ebp - 0x434]
add esp, 0xc
mov edx, dword [ebp - 0x454]
mov eax, dword [edx + 0x3c]
push dword [eax + edx + 0x50]
push str.MainExeSize
push edx
push str.MainExeBase
push dword [ebp - 0x438]
push str.MachineGUID
push ecx
push str.SystemVolumeGUID
push dword [ebp - 0x430]
push str.SystemVolumeSerialNumber
push dword [0x302713a8]
push str.OSMinor
push dword [0x302713a4]
push str.OSMajor
push dword [ebp - 0x424]
push str.ProductName
push dword [ebp - 0x42c]
push str.RegisteredOrganization
push dword [ebp - 0x428]
push str.RegisteredOwner
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.CommandLine
push dword [ebp - 0x420]
mov esi, dword [ebp - 0x40c]
push str.TempPath
push dword [ebp - 0x41c]
push str.WindowsPath
push dword [ebp - 0x410]
push str.InstallDate
push dword [ebp - 0x418]
push str.ComputerName
push esi
push str.UserName
push str.ssissssssiisssph
push 0
push 1
push str.__environ__
push str.__notification__
push 8
call fcn.30046ef0
add esp, 0x98
pushfd
mov ebx, dword fs:[0x18]
pop dword [ebp - 0x410]
test ebx, ebx
jne 0x300490bf
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x300490c8
mov edi, dword [ebx + 0x34]
mov ebx, dword [ebx + 0xbf4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x300490f8
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x300490f8
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x410]
test eax, eax
jne 0x30049111
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004911a
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0x418]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x30049149
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x30049149
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x410]
test eax, eax
jne 0x30049162
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004916b
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0x41c]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004919a
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x3004919a
push eax
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x300491b5
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x300491c4
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x420]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x300491f3
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x300491f3
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x3004920e
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x3004921d
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x424]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004924c
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x3004924c
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x30049267
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x30049276
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x428]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x300492a5
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x300492a5
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x300492c0
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x300492cf
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x42c]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x300492fe
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x300492fe
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x30049319
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x30049328
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x430]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x30049357
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x30049357
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x30049372
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x30049381
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x434]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x300493b0
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x300493b0
push edi
popfd
pushfd
mov eax, dword fs:[0x18]
pop edi
test eax, eax
jne 0x300493cb
or ebx, 0xffffffff
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x300493da
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x438]
push 0
push dword [0x30271450]
call esi
mov eax, dword fs:[0x18]
test eax, eax
je 0x30049409
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 0x34], ebx
mov dword [eax + 0xbf4], ecx
test edi, edi
je 0x30049409
push edi
popfd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret