Function at 0x44b030
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Hash data using fnv
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497330
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x4b7180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
cmp dword [eax + 8], 0
je 0x44d238
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x44d238
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], vtable.std::_Func_impl_no_alloc_class__lambda_702c41efecad5351a2fad07605b88e4f___void___.0
mov dword [ebp - 0xb8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x48], 0
push eax
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.004528a0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x44b0e8
mov edx, dword [ecx]
lea eax, [ebp - 0xdc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0xb8], 0
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
mov dword [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x44d209
mov dword [ebp - 0xb0], 0
lea eax, [ebp - 0xb0]
push eax
push 0x49a4a0
push 1
push 0
push 0x49a4b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44d1eb
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0xb0]
push 0xc
call fcn.0046de66
mov esi, eax
add esp, 4
mov dword [ebp - 0x80], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x44b18c
push str.ROOTCIMV2
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x44d256
jmp 0x44b18e
xor esi, esi
mov byte [ebp - 4], 4
mov dword [ebp - 0x80], esi
test esi, esi
je 0x44d260
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x44b1bb
mov dword [ebp - 0xa8], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi]
lea ecx, [ebp - 0xa8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
push edi
call dword [eax + 0xc]
or ebx, 0xffffffff
mov byte [ebp - 4], 4
mov edi, eax
mov ecx, ebx
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x44b21e
mov ecx, dword [esi]
test ecx, ecx
je 0x44b1fc
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44b213
push eax
call fcn.0046e2ff
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0046de58
add esp, 8
test edi, edi
js 0x44d1cd
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0xa8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x44d1cd
lea eax, [ebp - 0xa8]
push str.os_architecture
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa0], eax
call fcn.00432210
cmp dword [ebp - 0x18], 7
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov edx, 0x811c9dc5
mov eax, dword [ebp - 0x1c]
cmova esi, edi
xor ecx, ecx
add eax, eax
je 0x44b294
mov ebx, eax
nop
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44b280
or ebx, 0xffffffff
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
test eax, eax
jne 0x44b2c3
mov eax, dword [esi + 4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44b2fa
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x44b2f0
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edi
call fcn.0046de58
add esp, 8
mov edi, dword [ebp - 0xac]
cmp edi, dword [esi + 4]
je 0x44b45b
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d26a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.OSArchitecture
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.00404180
test al, al
jne 0x44b347
push 0xe
push str.OSArchitecture
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 8
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d274
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 9
call fcn.00404180
test al, al
jne 0x44b389
push 0x15
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0xa
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d27e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44b3e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b3ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b41d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x3c], 8
jne 0x44b44d
mov edx, dword [ebp - 0x34]
test edx, edx
jne 0x44b42f
xor ecx, ecx
jmp 0x44b443
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b434
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.os_installdate
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44b495
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44b484
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44b4b8
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44b4f2
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44b4e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44b65a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d288
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.InstallDate
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x10
call fcn.00404180
test al, al
jne 0x44b539
push 0xb
push str.InstallDate
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x11
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d292
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x12
call fcn.00404180
test al, al
jne 0x44b57b
push 0x15
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x13
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d29c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44b5d6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x17
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b5f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b612
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44b649
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44b62a
xor ecx, ecx
jmp 0x44b63f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b630
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.os_name
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44b694
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44b683
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44b6b7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44b6f1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44b6e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44b85a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.Caption
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x19
call fcn.00404180
test al, al
jne 0x44b738
push 7
push str.Caption
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x1a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1b
call fcn.00404180
test al, al
jne 0x44b77a
push 0x15
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x1c
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2ba
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x1f
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44b7d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x20
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b7f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x21
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b811
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44b849
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44b829
xor ecx, ecx
jmp 0x44b83f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b830
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.os_virtmem
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44b894
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44b883
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44b8b7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44b8f1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44b8e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44ba5a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.TotalVirtualMemorySize
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x22
call fcn.00404180
test al, al
jne 0x44b938
push 0x16
push str.TotalVirtualMemorySize
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x23
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x24
call fcn.00404180
test al, al
jne 0x44b97a
push 0x15
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x25
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2d8
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x28
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44b9d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x29
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b9f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2a
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ba11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44ba49
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44ba29
xor ecx, ecx
jmp 0x44ba3f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ba30
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.os_mem
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44ba94
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44ba83
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44bab7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44baf1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44bae7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44bc5a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2e2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.TotalVisibleMemorySize
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x2b
call fcn.00404180
test al, al
jne 0x44bb38
push 0x16
push str.TotalVisibleMemorySize
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x2c
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2ec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x2d
call fcn.00404180
test al, al
jne 0x44bb7a
push 0x15
push str.Win32_OperatingSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x2e
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d2f6
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x31
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44bbd5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x32
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44bbf3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x33
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44bc11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44bc49
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44bc29
xor ecx, ecx
jmp 0x44bc3f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44bc30
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.cpu_name
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44bc94
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44bc83
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44bcb7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44bcf1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44bce7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44be5a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d300
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.Name
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x34
call fcn.00404180
test al, al
jne 0x44bd38
push 4
push str.Name
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x35
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d30a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_Processor
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x36
call fcn.00404180
test al, al
jne 0x44bd7a
push 0xf
push str.Win32_Processor
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x37
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d314
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x3a
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44bdd5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3b
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44bdf3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3c
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44be11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44be49
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44be29
xor ecx, ecx
jmp 0x44be3f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44be30
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.pc_vendor
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44be94
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44be83
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44beb7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44bef1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44bee7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44c05a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d31e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.Vendor
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x3d
call fcn.00404180
test al, al
jne 0x44bf38
push 6
push str.Vendor
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x3e
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d328
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_ComputerSystemProduct
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x3f
call fcn.00404180
test al, al
jne 0x44bf7a
push 0x1b
push str.Win32_ComputerSystemProduct
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x40
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d332
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x41
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x43
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44bfd5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x44
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44bff3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x45
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c011
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44c049
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44c029
xor ecx, ecx
jmp 0x44c03f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c030
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.pc_version
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44c094
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44c083
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44c0b7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44c0f1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c0e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44c25a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d33c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.Version
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x46
call fcn.00404180
test al, al
jne 0x44c138
push 7
push str.Version
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x47
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d346
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_ComputerSystemProduct
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x48
call fcn.00404180
test al, al
jne 0x44c17a
push 0x1b
push str.Win32_ComputerSystemProduct
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x49
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d350
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x4c
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44c1d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4d
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c1f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4e
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c211
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44c249
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44c229
xor ecx, ecx
jmp 0x44c23f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c230
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.gpu_name
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44c294
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44c283
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
test edi, edi
jne 0x44c2b7
mov edi, dword [esi + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44c2f1
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c2e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44c45a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d35a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.Name
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x4f
call fcn.00404180
test al, al
jne 0x44c338
push 4
push str.Name
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x50
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d364
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_VideoController
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x51
call fcn.00404180
test al, al
jne 0x44c37a
push 0x15
push str.Win32_VideoController
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x52
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d36e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x53
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x55
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44c3d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x56
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c3f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x57
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c411
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x8c], 8
jne 0x44c449
mov edx, dword [ebp - 0x84]
test edx, edx
jne 0x44c429
xor ecx, ecx
jmp 0x44c43f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c430
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [edi + 0x20]
push edx
call fcn.004044b0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.gpu_ram
lea ecx, [ebp - 0x2c]
call fcn.00432210
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 7
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x44c494
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x44c483
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov edi, dword [eax + 4]
mov dword [ebp - 0xac], edi
test edi, edi
jne 0x44c4c3
mov edi, dword [esi + 4]
mov dword [ebp - 0xac], edi
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44c4fd
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c4f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edx
call fcn.0046de58
add esp, 8
cmp edi, dword [esi + 4]
je 0x44cc9f
mov ecx, dword [0x4bcddc]
cmp dword [ecx - 0xc], 0
je 0x44cc9f
add ecx, 0xfffffff0
call fcn.00404360
lea esi, [eax + 0x10]
mov dword [ebp - 0x9c], esi
mov byte [ebp - 4], 0x58
mov edi, dword [eax + 4]
test edi, edi
js 0x44d3eb
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edi
or eax, ecx
jge 0x44c559
push edi
lea ecx, [ebp - 0x9c]
call fcn.00404450
mov esi, dword [ebp - 0x9c]
lea eax, [edi + 1]
push eax
push esi
call fcn.0047d535
add esp, 8
cmp edi, dword [esi - 8]
jg 0x44d3eb
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 0xc], eax
jl 0x44c797
push str.INTEL
push esi
call fcn.0046f693
add esp, 8
test eax, eax
je 0x44c797
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x44c797
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d378
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.TotalPhysicalMemory
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x59
call fcn.00404180
test al, al
jne 0x44c5e2
push 0x13
push str.TotalPhysicalMemory
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x5a
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d382
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_ComputerSystem
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x5b
call fcn.00404180
test al, al
jne 0x44c624
push 0x14
push str.Win32_ComputerSystem
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x5c
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d38c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x78], edi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x5d
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x5f
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x44c67c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x60
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c69a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x61
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c6b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x3c], 8
jne 0x44c78f
push dword [ebp - 0x34]
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
movlpd qword [ebp - 0x84], xmm0
call fcn.00432210
sub esp, 8
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x184]
push eax
call fcn.0044e220
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x44c72d
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44c723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d396
push ecx
push edx
call fcn.0046de58
add esp, 8
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x184]
call fcn.0044e520
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + eax - 0x178]
mov eax, ecx
shr eax, 2
test al, 1
jne 0x44c784
test cl, 6
jne 0x44c784
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
shrd ecx, eax, 1
shr eax, 1
push eax
mov eax, dword [ebp - 0xac]
push ecx
push str._llu
push dword [eax + 0x20]
call fcn.00404720
add esp, 0x10
lea ecx, [ebp - 0x184]
call fcn.0044d9f0
lea eax, [ebp - 0x3c]
jmp 0x44cc7d
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d39b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push str.PNPDeviceID
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x65
call fcn.00404180
test al, al
jne 0x44c7d5
push 0xb
push str.PNPDeviceID
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x66
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.Win32_VideoController
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x67
call fcn.00404180
test al, al
jne 0x44c817
push 0x15
push str.Win32_VideoController
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x68
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3af
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x78], edi
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x69
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x6b
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x44c86f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x6c
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c88d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x6d
mov eax, ebx
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c8ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x24], 8
jne 0x44cc7a
mov edi, dword [ebp - 0x1c]
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
push edi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x6e
call fcn.00404180
test al, al
jne 0x44c90a
test edi, edi
jne 0x44c8ec
xor ecx, ecx
jmp 0x44c900
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c8f1
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x70]
call fcn.004044b0
mov byte [ebp - 4], 0x6f
mov edi, dword [ebp - 0x70]
mov edx, dword [edi - 0xc]
mov dword [ebp - 0xa4], edx
test edx, edx
js 0x44d3eb
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x44c945
push edx
lea ecx, [ebp - 0x70]
call fcn.00404450
mov edi, dword [ebp - 0x70]
mov edx, dword [ebp - 0xa4]
lea eax, [edx + 1]
push eax
push edi
call fcn.0047c24e
mov eax, dword [ebp - 0xa4]
add esp, 8
cmp eax, dword [edi - 8]
jg 0x44d3eb
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
cmp dword [edi - 0xc], ecx
je 0x44cc5f
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3c3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x70
xor esi, esi
mov dword [ebp - 0xa4], esi
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3cd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x71
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3d7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318_
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x72
call fcn.00404180
test al, al
jne 0x44c9fb
push 0x4a
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318_
lea ecx, [ebp - 0x74]
call fcn.004044b0
mov byte [ebp - 4], 0x73
mov dword [ebp - 0x78], reloc.OLEAUT32.dll_SysReAllocString
nop word [eax + eax]
push esi
lea eax, [ebp - 0x98]
push str._04d
push eax
call fcn.00404720
add esp, 0xc
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x80]
push eax
call fcn.0042f140
add esp, 4
mov byte [ebp - 4], 0x74
lea edx, [ebp - 0x78]
push str.MatchingDeviceId
push dword [eax]
lea ecx, [ebp - 0x30]
call fcn.00423910
add esp, 8
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x75
call fcn.00404960
mov byte [ebp - 4], 0x74
mov eax, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ca81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x73
mov eax, ebx
mov edx, dword [ebp - 0x80]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ca9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x94]
mov ebx, dword [esi - 0xc]
test ebx, ebx
js 0x44d3eb
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x44cad3
push ebx
lea ecx, [ebp - 0x94]
call fcn.00404450
mov esi, dword [ebp - 0x94]
lea eax, [ebx + 1]
push eax
push esi
call fcn.0047c24e
add esp, 8
cmp ebx, dword [esi - 8]
jg 0x44d3eb
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
cmp dword [esi - 0xc], eax
je 0x44cb13
cmp dword [edi - 0xc], eax
jl 0x44cb13
push esi
push edi
call fcn.0046f693
add esp, 8
test eax, eax
je 0x44cb13
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x44cb31
inc dword [ebp - 0xa4]
or ebx, 0xffffffff
cmp dword [esi - 0xc], 0
je 0x44cbff
mov esi, dword [ebp - 0xa4]
jmp 0x44ca10
cmp dword [esi - 0xc], 0
je 0x44cbfc
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa4], 0
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x80]
call fcn.0042f140
add esp, 4
lea ecx, [ebp - 0xa4]
push ecx
push 0x20019
push 0
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x80]
or ebx, 0xffffffff
mov dword [ebp - 0x30], eax
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44cb98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x44cbff
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x80]
movlpd qword [ebp - 0x34], xmm0
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x80], 8
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.HardwareInformation.qwMemorySize
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44cbff
mov eax, dword [ebp - 0x78]
cmp eax, 0xb
je 0x44cbde
cmp eax, 3
jne 0x44cbff
push dword [ebp - 0x30]
mov eax, dword [ebp - 0xac]
push dword [ebp - 0x34]
push str._llu
push dword [eax + 0x20]
call fcn.00404720
add esp, 0x10
jmp 0x44cbff
or ebx, 0xffffffff
mov byte [ebp - 4], 0x71
mov eax, ebx
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cc1d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x70
mov eax, ebx
mov edx, dword [ebp - 0x98]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cc3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x6f
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44cc59
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x9c]
mov byte [ebp - 4], 0x6d
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x44cc7a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44cc9f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.dsk_mbsec
lea ecx, [ebp - 0x2c]
call fcn.00432210
cmp dword [ebp - 0x18], 7
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov edx, 0x811c9dc5
mov eax, dword [ebp - 0x1c]
cmova esi, edi
xor ecx, ecx
add eax, eax
je 0x44cce4
mov ebx, eax
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44ccd0
or ebx, 0xffffffff
mov esi, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004533d0
mov eax, dword [eax + 4]
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x44cd0d
mov eax, dword [esi + 4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44cd44
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x44cd3a
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edi
call fcn.0046de58
add esp, 8
mov edi, dword [ebp - 0x78]
cmp edi, dword [esi + 4]
je 0x44cf98
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3e1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x94], eax
push str.WHERE_Name____Total_
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x76
call fcn.00404180
test al, al
jne 0x44cd97
push 0x15
push str.WHERE_Name____Total_
lea ecx, [ebp - 0x94]
call fcn.004044b0
mov byte [ebp - 4], 0x77
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3f5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
push str.DiskBytesPersec
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x78
call fcn.00404180
test al, al
jne 0x44cde2
push 0xf
push str.DiskBytesPersec
lea ecx, [ebp - 0x98]
call fcn.004044b0
mov byte [ebp - 4], 0x79
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d3ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9c], eax
push str.Win32_PerfRawData_PerfDisk_PhysicalDisk
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x7a
call fcn.00404180
test al, al
jne 0x44ce2d
push 0x27
push str.Win32_PerfRawData_PerfDisk_PhysicalDisk
lea ecx, [ebp - 0x9c]
call fcn.004044b0
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x7b
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x7d
mov eax, ebx
mov edx, dword [ebp - 0x9c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ce76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x7e
mov eax, ebx
mov edx, dword [ebp - 0x98]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ce97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x7f
mov eax, ebx
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ceb8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x24], 8
jne 0x44cf8a
push dword [ebp - 0x1c]
xorps xmm0, xmm0
lea ecx, [ebp - 0x44]
movlpd qword [ebp - 0x84], xmm0
call fcn.00432210
sub esp, 8
mov byte [ebp - 4], 0x80
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x184]
push eax
call fcn.0044e220
mov byte [ebp - 4], 0x82
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x44cf2d
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44cf23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d409
push ecx
push edx
call fcn.0046de58
add esp, 8
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x184]
call fcn.0044e520
mov eax, dword [ebp - 0x184]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + eax - 0x178]
mov eax, ecx
shr eax, 2
test al, 1
jne 0x44cf7f
test cl, 6
jne 0x44cf7f
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
shrd ecx, eax, 0x17
shr eax, 0x17
push eax
push ecx
push str._llu
push dword [edi + 0x20]
call fcn.00404720
add esp, 0x10
lea ecx, [ebp - 0x184]
call fcn.0044d9f0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.dsk_iosec
lea ecx, [ebp - 0x2c]
call fcn.00432210
cmp dword [ebp - 0x18], 7
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x2c]
mov edx, 0x811c9dc5
mov eax, dword [ebp - 0x1c]
cmova esi, edi
xor ecx, ecx
add eax, eax
je 0x44cfd6
mov ebx, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44cfc2
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004533d0
mov esi, dword [eax + 4]
test esi, esi
jne 0x44cffd
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x18]
cmp eax, 7
jbe 0x44d034
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x44d02a
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d40e
push ecx
push edi
call fcn.0046de58
add esp, 8
mov eax, dword [ebp - 0x90]
cmp esi, dword [eax + 4]
je 0x44d1cd
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d413
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x94], eax
push str.WHERE_Name____Total_
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x83
call fcn.00404180
test al, al
jne 0x44d08a
push 0x15
push str.WHERE_Name____Total_
lea ecx, [ebp - 0x94]
call fcn.004044b0
mov byte [ebp - 4], 0x84
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d41d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
push str.DiskTransfersPersec
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x85
call fcn.00404180
test al, al
jne 0x44d0d5
push 0x13
push str.DiskTransfersPersec
lea ecx, [ebp - 0x98]
call fcn.004044b0
mov byte [ebp - 4], 0x86
call fcn.00404e10
mov ecx, eax
test ecx, ecx
je 0x44d427
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9c], eax
push str.Win32_PerfRawData_PerfDisk_PhysicalDisk
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x87
call fcn.00404180
test al, al
jne 0x44d120
push 0x27
push str.Win32_PerfRawData_PerfDisk_PhysicalDisk
lea ecx, [ebp - 0x9c]
call fcn.004044b0
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x88
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0044d440
mov byte [ebp - 4], 0x8a
mov eax, ebx
mov edx, dword [ebp - 0x9c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44d169
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x8b
mov eax, ebx
mov edx, dword [ebp - 0x98]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44d18a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x8c
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44d1a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [ebp - 0x24], 3
jne 0x44d1c3
push dword [ebp - 0x1c]
push 0x4a7e30
push dword [esi + 0x20]
call fcn.00404720
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x44d1eb
mov dword [ebp - 0xa8], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb0]
test ecx, ecx
je 0x44d209
mov dword [ebp - 0xb0], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x8d
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x44d431
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x44d238
mov edx, dword [ecx]
lea eax, [ebp - 0x6c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046de4a
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.0046dae0
push 0x8007000e
call fcn.0046dae0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
call fcn.004734cf
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80070057
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
call fcn.004734cf
call fcn.004734cf
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
push 0x80004005
call fcn.00404bf0
call fcn.004563f2
int3