Function at 0x40be10
Capabilities:
Get hostname
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b72
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x49c068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x355], cl
mov dword [ebp - 4], 2
xorps xmm0, xmm0
push 8
mov dword [ebp - 0x250], 0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
call fcn.0042b3f0
lea ecx, [ebp - 0x250]
mov dword [eax + 4], 0
mov dword [ebp - 0x250], eax
mov dword [eax], ecx
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
push 0x200
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.0042de70
mov dword [ebp - 0x270], pe_nt_image_headers32
mov byte [ebp - 4], 4
xorps xmm0, xmm0
push 8
mov dword [ebp - 0x26c], 0
movups xmmword [ebp - 0x268], xmm0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
call fcn.0042b3f0
lea ecx, [ebp - 0x26c]
add esp, 0x14
mov dword [eax + 4], 0
mov dword [ebp - 0x26c], eax
mov dword [eax], ecx
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0xf
mov byte [ebp - 0x268], 0
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0x378]
test eax, eax
je 0x40bf6f
lea edx, [ebp - 0x234]
call fcn.00426710
mov esi, eax
lea eax, [ebp - 0x26c]
cmp eax, esi
je 0x40bfc0
mov ecx, eax
call fcn.00406820
push esi
jmp 0x40bfb5
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x378], 0
push 0x4929f2
movups xmmword [ebp - 0x374], xmm0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x360], 0
call fcn.00408cd0
lea ecx, [ebp - 0x26c]
call fcn.00406820
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00406a60
lea ecx, [ebp - 0x378]
call fcn.00406820
mov eax, dword [ebp - 0x378]
push 8
push eax
mov dword [ebp - 0x378], 0
call fcn.0042b3d0
add esp, 8
push 0
call fcn.00442130
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x274], edx
push eax
call fcn.0043ecc0
lea eax, [ebp - 0x34c]
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x34]
push 0x14
push eax
call fcn.004406d0
lea eax, [ebp - 0x34c]
push eax
push str._Y_m_d_H_M_S
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.004406d0
add esp, 0x2c
lea eax, [ebp + 0x18]
lea ecx, [ebp - 0x250]
push eax
call fcn.004056b0
mov edx, dword [ebp - 0x238]
mov eax, edx
mov ecx, dword [ebp - 0x23c]
sub eax, ecx
cmp eax, 1
jb 0x40c082
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
mov word [eax + ecx], 0x5c
jmp 0x40c0a3
push 1
push 0x493b28
mov byte [ebp - 0x350], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x350]
push 1
call fcn.00409060
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x378]
call fcn.004058a0
push eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 6
call fcn.004056b0
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 5
call fcn.00406820
mov eax, dword [ebp - 0x378]
push 8
push eax
mov dword [ebp - 0x378], 0
call fcn.0042b3d0
add esp, 8
mov dword [ebp - 0x378], 0
xorps xmm0, xmm0
mov dword [ebp - 0x364], 0
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x360], 0
movups xmmword [ebp - 0x374], xmm0
push 1
push 0x493b2c
call fcn.00408cd0
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x250]
call fcn.004056b0
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 5
call fcn.00406820
mov eax, dword [ebp - 0x378]
push 8
push eax
mov dword [ebp - 0x378], 0
call fcn.0042b3d0
xorps xmm0, xmm0
mov dword [ebp - 0x378], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x364], 0
add esp, 8
mov dword [ebp - 0x360], 0
movups xmmword [ebp - 0x374], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c197
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x378]
call fcn.00408cd0
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x250]
call fcn.004056b0
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 5
call fcn.00406820
mov eax, dword [ebp - 0x378]
push 8
push eax
mov dword [ebp - 0x378], 0
call fcn.0042b3d0
add esp, 8
mov dword [ebp - 0x378], 0
xorps xmm0, xmm0
mov dword [ebp - 0x364], 0
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x360], 0
movups xmmword [ebp - 0x374], xmm0
push 0x13
push str._emotetdetector.txt
call fcn.00408cd0
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x250]
call fcn.004056b0
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 5
call fcn.00406820
mov eax, dword [ebp - 0x378]
push 8
push eax
mov dword [ebp - 0x378], 0
call fcn.0042b3d0
push 0xb0
lea eax, [ebp - 0x328]
push 0
push eax
call fcn.0042de70
cmp dword [ebp - 0x238], 0x10
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x328]
cmovae eax, dword [ebp - 0x24c]
add esp, 8
push eax
call fcn.0040ddf0
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x40c
cmp ax, cx
jne 0x40c748
call fcn.00426a40
test al, al
jne 0x40c748
mov edx, str._Emotet_Detector_v
lea ecx, [ebp - 0x328]
call fcn.00407d70
mov edx, 0x492a50
mov ecx, eax
call fcn.00407d70
mov edx, 0x493b44
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str.Temps_d
lea ecx, [ebp - 0x328]
call fcn.00407d70
lea edx, [ebp - 0x34]
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str._____________________________________________________n
lea ecx, [ebp - 0x328]
call fcn.00407d70
push eax
call fcn.00408020
mov ecx, dword [ebp + 0x10]
mov eax, 0x4d4873ed
sub ecx, dword [ebp + 0xc]
add esp, 0xc
imul ecx
lea ecx, [ebp - 0x328]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40c68f
mov edx, str._Rsultat___nEmotet_d
call fcn.00407d70
push eax
call fcn.00408020
mov edi, dword [ebp + 0x10]
mov eax, 0x4d4873ed
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
mov dword [ebp - 0x350], 0
imul ecx
add esp, 4
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40c669
mov dword [ebp - 0x354], 0
mov ecx, edi
mov eax, 0x4d4873ed
sub ecx, esi
imul ecx
mov ecx, dword [ebp - 0x350]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jb 0x40c403
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c3d9
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x354]
sub edi, esi
add eax, esi
mov dword [ebp - 0x35c], eax
mov eax, 0x4d4873ed
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jb 0x40c46f
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c44e
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov edx, str._Processus_Emotet___n
lea ecx, [ebp - 0x328]
call fcn.00407d70
mov edx, str._____Nom_du_processus:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x354]
lea edx, [eax + 4]
add edx, esi
cmp dword [eax + esi + 0x18], 0x10
jb 0x40c4a1
mov edx, dword [edx]
push dword [eax + esi + 0x14]
call fcn.0040eeb0
mov edi, dword [ebp + 0x10]
add esp, 4
mov esi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x37c], eax
sub ecx, esi
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x350], eax
jb 0x40c520
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c4fc
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x354]
sub edi, esi
add eax, esi
mov dword [ebp - 0x380], eax
mov eax, 0x4d4873ed
imul edi
mov edi, dword [ebp - 0x350]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40c592
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c571
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov eax, dword [ebp - 0x354]
mov edx, 0x493944
mov ecx, dword [ebp - 0x37c]
push dword [eax + esi + 0x1c]
call fcn.00407d70
mov edx, str._____PID_____________:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
call fcn.00405440
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Emplacement_____:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x380]
cmp dword [eax + 0x38], 0x10
lea edx, [eax + 0x24]
jb 0x40c5ea
mov edx, dword [edx]
push dword [eax + 0x34]
call fcn.0040eeb0
add esp, 4
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Cl_de_registre_:
mov ecx, eax
call fcn.00407d70
mov ecx, dword [ebp - 0x35c]
cmp dword [ecx + 0x54], 0x10
lea edx, [ecx + 0x40]
jb 0x40c61e
mov edx, dword [edx]
push dword [ecx + 0x50]
mov ecx, eax
call fcn.0040eeb0
push eax
call fcn.00408020
mov esi, dword [ebp + 0xc]
inc edi
add dword [ebp - 0x354], 0xd4
mov eax, 0x4d4873ed
mov dword [ebp - 0x350], edi
add esp, 8
mov edi, dword [ebp + 0x10]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x350], eax
jb 0x40c394
mov edx, str._____________________________________________________n
lea ecx, [ebp - 0x328]
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
lea ecx, [ebp - 0x328]
mov edx, str.Veuillez_supprimer_le_s__fichier_s__d
jmp 0x40c694
mov edx, str._Rsultat___nEmotet_na_pas
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
lea ecx, [ebp - 0x324]
call fcn.0040e720
test eax, eax
jne 0x40c6da
mov eax, dword [ebp - 0x328]
lea ecx, [ebp - 0x328]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004025b0
cmp byte [ebp - 0x355], 0
jne 0x40cbd6
mov edx, str.Le_rapport_a
mov ecx, 0x49d4f8
call fcn.00407d70
push eax
call fcn.00408020
mov edx, 0x493c54
mov ecx, 0x49d4f8
call fcn.00407d70
cmp dword [ebp - 0x238], 0x10
lea edx, [ebp - 0x24c]
push dword [ebp - 0x23c]
cmovae edx, dword [ebp - 0x24c]
mov ecx, eax
call fcn.0040eeb0
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str.Merci_davoir_utilis
jmp 0x40cbc3
mov edx, str._Emotet_Detector_v
lea ecx, [ebp - 0x328]
call fcn.00407d70
mov edx, 0x492a50
mov ecx, eax
call fcn.00407d70
mov edx, 0x493b44
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str.Scan_time:
lea ecx, [ebp - 0x328]
call fcn.00407d70
lea edx, [ebp - 0x34]
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str._____________________________________________________n
lea ecx, [ebp - 0x328]
call fcn.00407d70
push eax
call fcn.00408020
mov ecx, dword [ebp + 0x10]
mov eax, 0x4d4873ed
sub ecx, dword [ebp + 0xc]
add esp, 0xc
imul ecx
lea ecx, [ebp - 0x328]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40cb13
mov edx, str._Result___nDetected_Emotet_process._n
call fcn.00407d70
push eax
call fcn.00408020
mov edi, dword [ebp + 0x10]
mov eax, 0x4d4873ed
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
mov dword [ebp - 0x354], 0
imul ecx
add esp, 4
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40caed
mov dword [ebp - 0x350], 0
nop word [eax + eax]
mov ecx, edi
mov eax, 0x4d4873ed
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x354], eax
jb 0x40c887
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c863
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x350]
mov ecx, edi
add eax, esi
sub ecx, esi
mov dword [ebp - 0x37c], eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x354], eax
jb 0x40c8fc
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c8d8
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x350]
sub edi, esi
add eax, esi
mov dword [ebp - 0x380], eax
mov eax, 0x4d4873ed
imul edi
mov edi, dword [ebp - 0x354]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40c96e
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c94d
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov edx, str._Emotet_Process___n
lea ecx, [ebp - 0x328]
call fcn.00407d70
mov edx, str._____Process_Name__:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x350]
lea edx, [eax + 4]
add edx, esi
cmp dword [eax + esi + 0x18], 0x10
jb 0x40c9a0
mov edx, dword [edx]
push dword [eax + esi + 0x14]
call fcn.0040eeb0
mov ecx, dword [ebp + 0x10]
add esp, 4
mov esi, dword [ebp + 0xc]
sub ecx, esi
mov dword [ebp - 0x35c], eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40ca16
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40c9f5
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov eax, dword [ebp - 0x350]
mov edx, 0x493944
mov ecx, dword [ebp - 0x35c]
push dword [eax + esi + 0x1c]
call fcn.00407d70
mov edx, str._____Process_ID____:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
call fcn.00405440
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Image_Path____:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x380]
cmp dword [eax + 0x38], 0x10
lea edx, [eax + 0x24]
jb 0x40ca6e
mov edx, dword [edx]
push dword [eax + 0x34]
call fcn.0040eeb0
add esp, 4
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Registry_Key__:
mov ecx, eax
call fcn.00407d70
mov ecx, dword [ebp - 0x37c]
cmp dword [ecx + 0x54], 0x10
lea edx, [ecx + 0x40]
jb 0x40caa2
mov edx, dword [edx]
push dword [ecx + 0x50]
mov ecx, eax
call fcn.0040eeb0
push eax
call fcn.00408020
mov esi, dword [ebp + 0xc]
inc edi
add dword [ebp - 0x350], 0xd4
mov eax, 0x4d4873ed
mov dword [ebp - 0x354], edi
add esp, 8
mov edi, dword [ebp + 0x10]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x354], eax
jb 0x40c820
mov edx, str._____________________________________________________n
lea ecx, [ebp - 0x328]
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
lea ecx, [ebp - 0x328]
mov edx, str.Please_remove_or_isolate_the_suspicious_execution_file.
jmp 0x40cb18
mov edx, str._Result___nEmotet_was_not_detected.
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
lea ecx, [ebp - 0x324]
call fcn.0040e720
test eax, eax
jne 0x40cb5e
mov eax, dword [ebp - 0x328]
lea ecx, [ebp - 0x328]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004025b0
cmp byte [ebp - 0x355], 0
jne 0x40cbd6
mov edx, str.Report_has_exported_to_following_file.
mov ecx, 0x49d4f8
call fcn.00407d70
push eax
call fcn.00408020
mov edx, 0x493c54
mov ecx, 0x49d4f8
call fcn.00407d70
cmp dword [ebp - 0x238], 0x10
lea edx, [ebp - 0x24c]
push dword [ebp - 0x23c]
cmovae edx, dword [ebp - 0x24c]
mov ecx, eax
call fcn.0040eeb0
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
mov edx, str.Thank_you_for_using_our_tool._n
mov ecx, 0x49d4f8
call fcn.00407d70
push eax
call fcn.00408020
add esp, 0x10
mov eax, dword [ebp - 0x328]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x32c], eax
lea ecx, [ebp - 0x324]
call fcn.0040da90
mov eax, dword [ebp - 0x328]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x32c], eax
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0xb
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00429ab0
add esp, 4
lea ecx, [ebp - 0x26c]
call fcn.00406820
mov eax, dword [ebp - 0x26c]
push 8
push eax
mov dword [ebp - 0x26c], 0
call fcn.0042b3d0
add esp, 8
lea ecx, [ebp - 0x250]
call fcn.00406820
mov eax, dword [ebp - 0x250]
push 8
push eax
mov dword [ebp - 0x250], 0
call fcn.0042b3d0
add esp, 8
lea ecx, [ebp + 8]
call fcn.00406720
mov eax, dword [ebp + 8]
push 8
push eax
mov dword [ebp + 8], 0
call fcn.0042b3d0
add esp, 8
lea ecx, [ebp + 0x18]
call fcn.00406820
mov eax, dword [ebp + 0x18]
push 8
push eax
mov dword [ebp + 0x18], 0
call fcn.0042b3d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b3c0
mov esp, ebp
pop ebp
ret