Function at 0x4075f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x4d93ac]
mov dword [esp + 0x24], 0
mov dword [esp], eax
mov ecx, dword [0x4dde94]
mov byte [esp + 0x24], 1
mov eax, dword [ecx + 0x138]
test eax, eax
je 0x407680
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x16]
push ecx
mov ecx, dword [esp + 0x16]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x14]
push str.__02d__02d__02d:_02d:_02d_
push edx
call fcn.004883fa
add esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4076f0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x407731
lea ecx, [esp + 0xc]
push 0x4d5530
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0048fe06
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push ecx
mov bl, 2
push eax
push edx
mov byte [esp + 0x3c], bl
call fcn.0048fda0
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 3
call fcn.0048fcaa
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048fb71
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0048fb71
jmp 0x407731
lea eax, [esp + 0x38]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
call fcn.0048fda0
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 4
call fcn.0048fcaa
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 1
call fcn.0048fb71
mov eax, dword [esp + 0x38]
mov ecx, dword [0x4dde94]
push eax
call fcn.00438870
push 0x4d5530
lea ecx, [esp + 0x3c]
call fcn.0048ff4d
mov ecx, dword [0x4d93ac]
mov dword [esp + 0x10], ecx
mov bl, 5
test edi, edi
mov byte [esp + 0x30], bl
jne 0x4077b3
mov edx, dword [0x4dde94]
push str.CollectorText.txt
lea eax, [esp + 0x40]
push 0x4ddfc8
mov esi, dword [edx + 0x308]
push eax
add esi, 0x98
call fcn.0048fe06
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.0048fcaa
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048fb71
mov ecx, dword [0x4dde94]
mov ecx, dword [ecx + 0x308]
test ecx, ecx
je 0x40786b
call fcn.004082f0
jmp 0x40786b
mov eax, dword [0x4dde94]
cmp edi, 0xb
jne 0x4077cc
mov ecx, dword [eax + 0x124]
test ecx, ecx
jne 0x40781b
jmp 0x40799b
cmp edi, 0xc
jne 0x4077e0
mov ecx, dword [eax + 0x130]
test ecx, ecx
jne 0x40781b
jmp 0x40799b
cmp edi, 0xd
jne 0x4077f4
mov ecx, dword [eax + 0x12c]
test ecx, ecx
jne 0x40781b
jmp 0x40799b
cmp edi, 0xe
jne 0x407808
mov ecx, dword [eax + 0x134]
test ecx, ecx
jne 0x40781b
jmp 0x40799b
cmp edi, 0xf
jne 0x40781b
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x40799b
mov esi, dword [eax + 0x308]
push str.CollectorOutput.txt
lea edx, [esp + 0x40]
push 0x4ddfc8
push edx
add esi, 0xd4
call fcn.0048fe06
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0048fcaa
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.0048fb71
mov eax, dword [0x4dde94]
mov ecx, dword [eax + 0x308]
test ecx, ecx
je 0x40786b
call fcn.00408380
mov ecx, dword [0x4dde94]
mov eax, dword [ecx + 0x308]
test eax, eax
je 0x40793d
mov ecx, esi
call fcn.0048f183
cmp eax, 0x100000
jl 0x4078d3
test edi, edi
jne 0x4078a6
push 0xffffffffffffffff
push edi
push 0xef5b
call fcn.00412c60
add esp, 0xc
jmp 0x40799b
cmp edi, 1
push 0xffffffffffffffff
push 0
jne 0x4078c1
push 0xef5c
call fcn.00412c60
add esp, 0xc
jmp 0x40799b
push 0xef5d
call fcn.00412c60
add esp, 0xc
jmp 0x40799b
mov edx, dword [0x4dde94]
mov ecx, dword [edx + 0x13c]
test ecx, ecx
je 0x407905
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push eax
mov eax, dword [esi + 0x1c]
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push ecx
jmp 0x407927
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esp + 0x38]
mov edx, dword [esi + 0x1c]
push ecx
push 0
push 0xc2
push edx
call edi
jmp 0x40799b
lea ecx, [esp + 0x18]
call fcn.00490da4
mov eax, dword [esp + 0x10]
push 0
push 0x3041
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.00490eb6
test eax, eax
je 0x40798e
mov edx, dword [esp + 0x18]
push 0
push 0
lea ecx, [esp + 0x20]
call dword [edx + 0x28]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0049100d
lea ecx, [esp + 0x18]
call fcn.004910d1
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00490df9
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0048fb71
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.0048fb71
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8