Function at 0x4054f0
Capabilities:
Access the windows event log
Get cpu information
Get disk information
Get disk size
Get file size
Get hostname
Get memory capacity
Get session user name
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578503
mov eax, dword fs:[0]
push eax
mov eax, 0xa690
call fcn.0054d370
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, 0x5e9970
xor ebx, ebx
mov dword [ebp - 0xa69c], eax
push str.User_Name
mov ecx, edi
mov dword [0x5eb8b0], ebx
call fcn.004071a5
mov esi, eax
mov dword [ebp - 0xa674], 0x100
push 0x202
push dword [esi]
call fcn.00560abc
pop ecx
pop ecx
lea ecx, [ebp - 0xa674]
mov dword [esi], eax
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.Host_Name
mov ecx, edi
call fcn.004071a5
mov esi, eax
mov edi, 0xc8
xor eax, eax
mov dword [ebp - 0xa674], edi
mov word [ebp - 0x5f0], ax
lea eax, [ebp - 0xa674]
push eax
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5f0]
push edi
push eax
call fcn.0056063b
pop ecx
pop ecx
lea eax, [ebp - 0x5f0]
mov ecx, esi
push eax
call fcn.004072d9
mov esi, 0x5e9970
push str.OS_Version
mov ecx, esi
call fcn.004071a5
mov edx, dword [0x5ebafc]
mov ecx, eax
mov eax, dword [0x5ebb00]
push 9
pop edi
cmp edx, 5
jne 0x405621
cmp eax, 1
jne 0x4055f6
push str.Windows_XP
jmp 0x4056c9
cmp eax, 2
jne 0x405619
cmp byte [0x5ebc12], 1
jne 0x405612
mov eax, str.Windows_XP_x64
cmp word [0x5ebc1c], di
je 0x405671
mov eax, str.Windows_2003
jmp 0x405671
push eax
push 5
jmp 0x4056d5
cmp edx, 6
jne 0x405674
test eax, eax
jne 0x405636
mov eax, str.Windows_Vista
mov edx, str.Windows_2008
jmp 0x405667
cmp eax, 1
jne 0x405647
mov eax, str.Windows_7
mov edx, str.Windows_2008_R2
jmp 0x405667
cmp eax, 2
jne 0x405658
mov eax, str.Windows_8
mov edx, str.Windows_2012
jmp 0x405667
cmp eax, 3
jne 0x4056d3
mov eax, str.Windows_8.1
mov edx, str.Windows_2012_R2
cmp byte [0x5ebc12], 1
cmovne eax, edx
push eax
jmp 0x4056c9
cmp edx, 0xa
jne 0x4056d3
mov eax, dword [0x5ebc14]
cmp eax, 0x55f0
jb 0x40568c
push str.Windows_11
jmp 0x4056c9
cmp byte [0x5ebc12], 1
jne 0x40569c
push str.Windows_10
jmp 0x4056c9
cmp dword [0x5ebc40], 0x711
jae 0x4056af
push str.Windows_Server_2016
jmp 0x4056c9
cmp eax, 0x4563
jne 0x4056bd
push str.Windows_Server_2019
jmp 0x4056c9
cmp eax, 0x4f7c
jb 0x4056e3
push str.Windows_Server_2022
push ecx
call fcn.00407286
pop ecx
pop ecx
jmp 0x4056e3
push eax
push edx
push str.Windows_NT__d._d
push ecx
call fcn.00407286
add esp, 0x10
push str.Service_Pack
mov ecx, esi
call fcn.004071a5
mov edi, eax
cmp word [0x5ebb0c], bx
je 0x405710
push 0x58a49c
mov esi, 0x5ebb0c
push esi
call fcn.005602ba
pop ecx
pop ecx
test eax, eax
jne 0x405715
mov esi, 0x58a4a0
push esi
mov ecx, edi
call fcn.004072d9
mov edi, 0x5e9970
push str.Machine_Domain
mov ecx, edi
call fcn.004071a5
mov esi, eax
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00419049
pop ecx
pop ecx
push 0x64
pop ecx
test al, al
jne 0x405799
lea eax, [ebp - 0xa664]
push eax
push ecx
push ebx
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x405780
mov eax, dword [ebp - 0xa664]
push dword [eax + 8]
push 0x58a4e0
push esi
call fcn.00407286
add esp, 0xc
push dword [ebp - 0xa664]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x405799
push str._none_
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00552893
add esp, 0xc
lea eax, [ebp - 0x25f0]
mov ecx, esi
push eax
call fcn.004072d9
push str.Logon_Domain
mov ecx, edi
call fcn.004071a5
push str.Logon_Server
mov ecx, edi
mov esi, eax
call fcn.004071a5
lea eax, [ebp - 0xa698]
push eax
push 1
push ebx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov ecx, esi
test eax, eax
jne 0x4057ef
mov eax, dword [ebp - 0xa698]
push dword [eax + 4]
call fcn.004072d9
mov eax, dword [ebp - 0xa698]
mov eax, dword [eax + 0xc]
jmp 0x4057fe
push str._none_
call fcn.004072d9
mov eax, str._none_
push eax
lea ecx, [esi + 8]
call fcn.004072d9
push str.System_Type
mov ecx, 0x5e9970
call fcn.004071a5
mov esi, eax
xor eax, eax
mov word [ebp - 0x25f0], ax
lea eax, [ebp - 0xa688]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059ac
lea eax, [ebp - 0xa674]
mov dword [ebp - 0xa674], 0x2000
push eax
lea eax, [ebp - 0x25f0]
push eax
xor eax, eax
push eax
push eax
push str.ProductType
push dword [ebp - 0xa688]
call ebx
mov edi, str.WinNT
test eax, eax
jne 0x4058df
lea eax, [ebp - 0x25f0]
push str.LanmanNT
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x405899
push str.Domain_Controller
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push str.ServerNT
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x4058b7
push str.Server
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push edi
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x4058d1
push str.Workstation
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push eax
mov ecx, esi
call fcn.004072d9
lea eax, [ebp - 0x25f0]
push edi
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
je 0x405942
lea eax, [ebp - 0xa668]
mov edi, str.Stand_alone
push eax
push 0x65
xor eax, eax
push eax
call sub.NETAPI32.dll_NetServerGetInfo
test eax, eax
jne 0x405933
mov ecx, dword [ebp - 0xa668]
mov edx, dword [ecx + 0x10]
test dword [eax*8 + 0x58a230], edx
jne 0x405926
inc eax
cmp eax, 2
jb 0x405915
jmp 0x40592d
mov edi, dword [eax*8 + 0x58a234]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
push edi
push str.___s
push esi
call fcn.0040434c
add esp, 0xc
lea eax, [ebp - 0xa674]
mov dword [ebp - 0xa674], 0x208
push eax
lea eax, [ebp - 0x460]
push eax
xor eax, eax
push eax
push eax
push str.ProductSuite
push dword [ebp - 0xa688]
call ebx
test eax, eax
jne 0x40599e
lea edi, [ebp - 0x460]
cmp word [ebp - 0x460], ax
je 0x40599e
xor ebx, ebx
push edi
push str.___s
push esi
call fcn.0040434c
push ebx
push edi
call fcn.0054efda
add esp, 0x14
lea edi, [eax + 2]
cmp word [edi], bx
jne 0x405980
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059b8
push str.Workstation
mov ecx, esi
call fcn.004072d9
lea eax, [ebp - 0xa5f4]
push eax
call fcn.00416513
mov ebx, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0xa680], ebx
pop ecx
cmp dword [ebp - 0xa5f4], eax
jbe 0x405a17
lea esi, [ebx + 0x1ec0]
push str._none_
lea eax, [esi - 0x208]
push 0x104
push eax
call fcn.00552893
push str._none_
push 0x6a4
push esi
call fcn.00552893
add esp, 0x18
add esi, 0x2c08
inc edi
cmp edi, dword [ebp - 0xa5f4]
jb 0x4059df
lea eax, [ebp - 0xa688]
push eax
push 0x20019
xor eax, eax
push eax
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d27
xor ecx, ecx
mov dword [ebp - 0xa678], 0x104
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0xa678]
mov esi, ecx
push eax
lea eax, [ebp - 0x258]
mov dword [ebp - 0xa664], esi
push eax
push ecx
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x405d1b
mov edi, 0xd48
xor ebx, ebx
lea eax, [ebp - 0xa66c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405cdd
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 4
push eax
lea eax, [ebp - 0xa690]
push eax
push ebx
push ebx
push str.EnableDHCP
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405cd1
cmp dword [ebp - 0xa690], 0
lea eax, [ebp - 0xa678]
push eax
lea eax, [ebp - 0x3338]
mov dword [ebp - 0xa678], edi
push eax
push ebx
mov ecx, str.IPAddress
mov eax, str.DhcpIPAddress
push ebx
cmove eax, ecx
push eax
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405cd1
mov eax, dword [ebp - 0xa678]
mov ecx, 0x6a2
shr eax, 1
mov dword [ebp - 0xa678], eax
cmp eax, ecx
jb 0x405b40
mov dword [ebp - 0xa678], ecx
mov ecx, 0xd44
mov eax, ecx
jmp 0x405b4c
add eax, eax
mov ecx, eax
cmp ecx, edi
jae 0x406fd6
xor edx, edx
add eax, 2
mov word [ebp + ecx - 0x3338], dx
cmp eax, edi
jae 0x406fd6
xor ecx, ecx
lea esi, [ebp - 0x3338]
mov word [ebp + eax - 0x3338], cx
cmp word [ebp - 0x3338], cx
je 0x405ccb
push esi
call fcn.00552a19
cmp dword [ebp - 0xa5f4], 0
pop ecx
mov dword [ebp - 0xa668], eax
jbe 0x405caf
mov edi, dword [ebp - 0xa680]
push eax
lea eax, [edi + 0x20]
push esi
push eax
call fcn.005602fa
add esp, 0xc
test eax, eax
jne 0x405bc6
mov eax, dword [ebp - 0xa668]
movzx eax, word [edi + eax*2 + 0x20]
push eax
call fcn.0055fcb0
pop ecx
test eax, eax
je 0x405be1
inc ebx
add edi, 0x2c08
cmp ebx, dword [ebp - 0xa5f4]
jae 0x405caf
mov eax, dword [ebp - 0xa668]
jmp 0x405b9e
xor ebx, ebx
cmp dword [ebp - 0xa690], ebx
je 0x405c16
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x208
push eax
lea eax, [edi + 0x1cb8]
push eax
push ebx
push ebx
push str.DhcpServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [ebp - 0xa678], 0x2000
mov word [ebp - 0x25f0], ax
lea eax, [ebp - 0xa678]
push eax
lea eax, [ebp - 0x25f0]
push eax
push ebx
push ebx
push str.NameServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x25f0], 0
jne 0x405c92
cmp dword [ebp - 0xa690], 0
je 0x405cb1
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x2000
push eax
lea eax, [ebp - 0x25f0]
push eax
push ebx
push ebx
push str.DhcpNameServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x25f0], 0
je 0x405cb1
lea eax, [ebp - 0x25f0]
push eax
lea eax, [edi + 0x1ec0]
push 0x6a4
push eax
call fcn.00552893
add esp, 0xc
jmp 0x405cb1
xor ebx, ebx
push ebx
push esi
call fcn.0054efda
pop ecx
pop ecx
lea esi, [eax + 2]
cmp word [esi], bx
jne 0x405b7e
mov edi, 0xd48
mov esi, dword [ebp - 0xa664]
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x104
push eax
lea eax, [ebp - 0x258]
inc esi
push eax
push esi
push dword [ebp - 0xa688]
mov dword [ebp - 0xa664], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x405a80
mov ebx, dword [ebp - 0xa680]
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Network_Card
mov ecx, 0x5e9970
call fcn.004071a5
mov edi, eax
mov eax, 0x58840c
push eax
mov ecx, edi
call fcn.004072d9
xor eax, eax
mov esi, eax
cmp dword [ebp - 0xa5f4], eax
jbe 0x405d95
add ebx, 0x1ab8
test esi, esi
je 0x405d6d
push eax
push SysReAllocString
push 0x588d58
mov ecx, edi
call fcn.004071e4
push ebx
push 0x58a4e0
push edi
call fcn.0040434c
add esp, 0xc
mov ecx, edi
call fcn.00407375
inc esi
add ebx, 0x2c08
push 0
pop eax
cmp esi, dword [ebp - 0xa5f4]
jb 0x405d57
push str.IP_Address
mov ecx, 0x5e9970
call fcn.004071a5
mov ebx, eax
mov edi, 0x58840c
push edi
mov ecx, ebx
call fcn.004072d9
xor ecx, ecx
mov esi, ecx
cmp dword [ebp - 0xa5f4], ecx
jbe 0x405e10
mov edi, dword [ebp - 0xa680]
add edi, 0x20
test esi, esi
je 0x405de0
push ecx
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
xor ecx, ecx
cmp word [edi], cx
mov eax, str._none_
push ecx
cmovne eax, edi
mov ecx, ebx
push SysReAllocString
push eax
call fcn.004071e4
inc esi
add edi, 0x2c08
push 0
pop ecx
cmp esi, dword [ebp - 0xa5f4]
jb 0x405dc8
mov edi, 0x58840c
push str.Subnet_Mask
mov ecx, 0x5e9970
call fcn.004071a5
mov ebx, eax
push edi
mov ecx, ebx
call fcn.004072d9
xor ecx, ecx
mov esi, ecx
cmp dword [ebp - 0xa5f4], ecx
jbe 0x405e89
mov edi, dword [ebp - 0xa680]
add edi, 0xd6a
test esi, esi
je 0x405e59
push ecx
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
xor ecx, ecx
cmp word [edi], cx
mov eax, str._none_
push ecx
cmovne eax, edi
mov ecx, ebx
push SysReAllocString
push eax
call fcn.004071e4
inc esi
add edi, 0x2c08
push 0
pop ecx
cmp esi, dword [ebp - 0xa5f4]
jb 0x405e41
mov edi, 0x58840c
mov ebx, 0x5e9970
push str.Default_Gateway
mov ecx, ebx
call fcn.004071a5
cmp dword [ebp - 0xa5f4], 0
mov edx, eax
je 0x405edb
mov esi, dword [ebp - 0xa680]
movzx ecx, byte [esi + 0x1ab7]
movzx eax, byte [esi + 0x1ab4]
push ecx
movzx ecx, byte [esi + 0x1ab6]
push ecx
movzx ecx, byte [esi + 0x1ab5]
push ecx
push eax
push str._d._d._d._d
push edx
call fcn.00407286
add esp, 0x18
jmp 0x405ee9
push edi
mov ecx, edx
call fcn.004072d9
mov esi, dword [ebp - 0xa680]
push str.MAC_Address
mov ecx, ebx
call fcn.004071a5
mov ebx, eax
push edi
mov ecx, ebx
mov dword [ebp - 0xa664], ebx
call fcn.004072d9
xor eax, eax
mov edi, eax
mov dword [ebp - 0xa668], edi
cmp dword [ebp - 0xa5f4], eax
jbe 0x405f8f
add esi, 0x10
test edi, edi
je 0x405f32
push eax
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
xor eax, eax
cmp byte [esi], 0
mov ebx, eax
jbe 0x405f74
lea edi, [esi + 1]
movzx eax, byte [edi]
test ebx, ebx
push eax
mov ecx, 0x58840c
mov eax, 0x58a818
cmove eax, ecx
push eax
push 0x58a81c
push dword [ebp - 0xa664]
call fcn.0040434c
movzx eax, byte [esi]
add esp, 0x10
inc ebx
inc edi
cmp ebx, eax
jb 0x405f3c
mov edi, dword [ebp - 0xa668]
xor eax, eax
mov ebx, dword [ebp - 0xa664]
inc edi
add esi, 0x2c08
mov dword [ebp - 0xa668], edi
cmp edi, dword [ebp - 0xa5f4]
jb 0x405f1a
push str.Network_Speed
mov ecx, 0x5e9970
call fcn.004071a5
mov ebx, eax
mov eax, 0x58840c
push eax
mov ecx, ebx
call fcn.004072d9
xor ecx, ecx
mov esi, ecx
cmp dword [ebp - 0xa5f4], ecx
jbe 0x406001
mov edi, dword [ebp - 0xa680]
add edi, 0xc
test esi, esi
je 0x405fd8
push ecx
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
push edi
call fcn.00404249
push eax
push dword [edi]
push str._u__sb_s
push ebx
call fcn.0040434c
add esp, 0x14
add edi, 0x2c08
inc esi
push 0
pop ecx
cmp esi, dword [ebp - 0xa5f4]
jb 0x405fc2
push str.Network_Type
mov ecx, 0x5e9970
call fcn.004071a5
mov ecx, 0x58840c
mov dword [ebp - 0xa668], eax
push ecx
mov ecx, eax
call fcn.004072d9
xor edx, edx
mov ebx, edx
cmp dword [ebp - 0xa5f4], edx
jbe 0x4061aa
mov ecx, dword [ebp - 0xa680]
add ecx, 8
mov dword [ebp - 0xa664], ecx
mov edi, ecx
mov eax, dword [edi]
dec eax
cmp eax, 0x1f
ja case.default.0x406050
jmp dword [eax*4 + 0x406fdc]
mov esi, str.Other
jmp 0x406166
mov esi, str.Regular1822
jmp 0x406166
mov esi, str.HDH1822
jmp 0x406166
mov esi, str.ddn_x25
jmp 0x406166
mov esi, str.RFC877_x25
jmp 0x406166
mov esi, str.Ethernet
jmp 0x406166
mov esi, str.ISO88023_CSMACD
jmp 0x406166
mov esi, str.ISO88024_TokenBus
jmp 0x406166
mov esi, str.TokenRing
jmp 0x406166
mov esi, str.ISO88026_man
jmp 0x406166
mov esi, str.StarLan
jmp 0x406166
mov esi, str.Proteon_10Mbit
jmp 0x406166
mov esi, str.Proteon_80Mbit
jmp 0x406166
mov esi, str.HyperChannel
jmp 0x406166
mov esi, str.FDDI
jmp 0x406166
mov esi, str.LAPB
jmp 0x406166
mov esi, str.SDLC
jmp 0x406166
mov esi, str.ds1__T_1_
jmp 0x406166
mov esi, str.e1__T_1
jmp 0x406166
mov esi, str.BasicISDN
jmp 0x406166
mov esi, str.PrimaryISDN
jmp 0x406166
mov esi, str.PropPointToPointSerial
jmp 0x406166
mov esi, 0x58aa6c
jmp 0x406166
mov esi, str.Loopback
jmp 0x406166
mov esi, str.EON__CLNP_over_IP_
jmp 0x406166
mov esi, str.Ethernet_3Mbit
jmp 0x406166
mov esi, str.NSIP__XNS_over_IP_
jmp 0x406166
mov esi, str.SLIP
jmp 0x406166
mov esi, str.ULTRA
jmp 0x406166
mov esi, str.ds3__T_3_
jmp 0x406166
mov esi, str.sip__SMDS_
jmp 0x406166
mov esi, str.Frame_Relay
jmp 0x406166
mov esi, str._unknown_
test ebx, ebx
je 0x406180
mov ecx, dword [ebp - 0xa668]
push edx
push SysReAllocString
push 0x588d58
call fcn.004071e4
push esi
push 0x58a4e0
push dword [ebp - 0xa668]
call fcn.0040434c
add esp, 0xc
add edi, 0x2c08
inc ebx
push 0
pop edx
cmp ebx, dword [ebp - 0xa5f4]
jb 0x406044
mov edi, dword [ebp - 0xa680]
mov ecx, 0x5e9970
push str.DHCP_Server
call fcn.004071a5
mov ebx, eax
mov eax, 0x58840c
push eax
mov ecx, ebx
call fcn.004072d9
xor eax, eax
mov esi, eax
cmp dword [ebp - 0xa5f4], eax
jbe 0x406217
add edi, 0x1cb8
test esi, esi
je 0x4061f6
push eax
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
push edi
push 0x58a4e0
push ebx
call fcn.0040434c
add esp, 0xc
add edi, 0x2c08
inc esi
push 0
pop eax
cmp esi, dword [ebp - 0xa5f4]
jb 0x4061e0
push str.DNS_Server
mov ecx, 0x5e9970
call fcn.004071a5
mov ebx, eax
mov eax, 0x58840c
push eax
mov ecx, ebx
call fcn.004072d9
xor ecx, ecx
mov esi, ecx
cmp dword [ebp - 0xa5f4], ecx
jbe 0x406284
mov edi, dword [ebp - 0xa680]
add edi, 0x1ec0
test esi, esi
je 0x406263
push ecx
push SysReAllocString
push 0x588d58
mov ecx, ebx
call fcn.004071e4
push edi
push 0x58a4e0
push ebx
call fcn.0040434c
add esp, 0xc
add edi, 0x2c08
inc esi
push 0
pop ecx
cmp esi, dword [ebp - 0xa5f4]
jb 0x40624d
push dword [ebp - 0xa680]
call fcn.00419175
mov ecx, 0x5e9970
mov dword [esp], 0x58ab98
call fcn.004071a5
mov edi, eax
lea eax, [ebp - 0x460]
push 0x104
push eax
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.004043db
mov ecx, eax
mov dword [ebp - 0xa674], eax
add esp, 0x10
sub ecx, 1
je 0x4062f9
sub ecx, 1
je 0x4062f2
dec ecx
sub ecx, 1
je 0x4062eb
push eax
push str._d_Core
push edi
call fcn.00407286
add esp, 0xc
jmp 0x406306
push str.Quad
jmp 0x4062ff
push str.Dual
jmp 0x4062ff
mov eax, 0x58840c
push eax
mov ecx, edi
call fcn.004072d9
xor ebx, ebx
cmp word [ebp - 0x460], bx
je 0x406339
push ebx
mov esi, SysReAllocString
lea eax, [ebp - 0x460]
push esi
push eax
mov ecx, edi
call fcn.004071e4
push ebx
push esi
push 0x58a49c
mov ecx, edi
call fcn.004071e4
jmp 0x406473
lea eax, [ebp - 0xa688]
push eax
push 0x20019
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406473
lea eax, [ebp - 0xa664]
mov dword [ebp - 0xa66c], ebx
push eax
lea eax, [ebp - 0xa66c]
mov dword [ebp - 0xa664], 4
push eax
push ebx
push ebx
push str.MHz
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406467
mov ebx, dword [ebp - 0xa66c]
cmp ebx, 0x3de
jb 0x4063db
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
shr ebx, 0x1f
push ecx
push ecx
addsd xmm0, qword [ebx*8 + 0x58af70]
divsd xmm0, qword [0x58af68]
movsd qword [esp], xmm0
push str._.1f_GHz
push edi
call fcn.0040434c
add esp, 0x10
jmp 0x406465
xor edx, edx
mov eax, ebx
push 0xa
pop ecx
div ecx
mov esi, ebx
xor edx, edx
imul ecx, eax, 0xa
mov eax, ebx
push 0x64
sub esi, ecx
pop ecx
div ecx
push 0x21
mov eax, edx
xor edx, edx
pop ecx
div ecx
cmp esi, 5
lea eax, [esi - 0xa]
mov ebx, edx
cmovl eax, esi
mov dword [ebp - 0xa668], eax
cmp ebx, 0x10
jl 0x406415
sub ebx, ecx
push ebx
call fcn.00560b3f
push dword [ebp - 0xa668]
mov esi, eax
call fcn.00560b3f
pop ecx
pop ecx
cmp eax, esi
jl 0x406444
mov ecx, dword [ebp - 0xa66c]
xor edx, edx
sub ecx, ebx
push 0x64
mov eax, ecx
pop esi
div esi
cmp edx, 0x63
jne 0x406450
mov ecx, dword [ebp - 0xa66c]
sub ecx, dword [ebp - 0xa668]
push ecx
push str._d_MHz
push edi
mov dword [ebp - 0xa66c], ecx
call fcn.0040434c
add esp, 0xc
xor ebx, ebx
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push SysReAllocString
lea eax, [ebp - 0x25f0]
mov ecx, edi
push eax
call fcn.004071e4
push str.Memory
mov ecx, 0x5e9970
call fcn.004071a5
push 0x40
pop edi
push edi
mov esi, eax
lea eax, [ebp - 0xa660]
push ebx
push eax
call fcn.0054ee80
add esp, 0xc
mov dword [ebp - 0xa660], edi
lea eax, [ebp - 0xa660]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0xa658]
mov eax, dword [ebp - 0xa654]
add ecx, 0xffc00
adc eax, ebx
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push str._I64d_MB
push esi
call fcn.00407286
add esp, 0x10
mov ecx, 0x5e9970
push str.Boot_Time
call fcn.004071a5
mov dword [ebp - 0xa690], eax
xor eax, eax
push str.System
push ebx
mov word [ebp - 0x25f0], ax
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov edi, eax
lea eax, [ebp - 0xa668]
push eax
lea eax, [ebp - 0xa664]
push eax
push 0x8000
lea eax, [ebp - 0xa5f0]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
jmp 0x4065a7
mov ecx, dword [ebp - 0xa664]
lea esi, [ebp - 0xa5f0]
mov eax, esi
mov edx, esi
add eax, ecx
cmp edx, eax
jae 0x40658a
mov eax, dword [esi + 0x14]
lea edx, [esi + 0x38]
and eax, 0xfffffff
cmp eax, 0x1779
jne 0x40657c
push str.eventlog
push edx
call fcn.00552def
pop ecx
pop ecx
test eax, eax
je 0x40661b
mov ecx, dword [ebp - 0xa664]
add esi, dword [esi]
lea eax, [ebp - 0xa5f0]
add eax, ecx
cmp esi, eax
jb 0x40654f
lea eax, [ebp - 0xa668]
push eax
lea eax, [ebp - 0xa664]
push eax
push 0x8000
lea eax, [ebp - 0xa5f0]
push eax
xor eax, eax
push eax
push 9
push edi
call ebx
test eax, eax
jne 0x406539
xor ebx, ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
cmp word [ebp - 0x25f0], 0
mov esi, 0x3e8
mov edi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
jne 0x4066f4
lea eax, [ebp - 0xa67c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x406686
lea eax, [ebp - 0xa684]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x406686
push dword [ebp - 0xa680]
push dword [ebp - 0xa684]
push dword [ebp - 0xa678]
push dword [ebp - 0xa67c]
call fcn.0054d750
jmp 0x406690
mov ecx, dword [esi + 0xc]
xor eax, eax
add ecx, 0xb6109100
adc eax, 2
xor ebx, ebx
push ebx
push 0x989680
push eax
push ecx
call fcn.0054d800
mov dword [ebp - 0xa670], eax
lea eax, [ebp - 0xa684]
push eax
lea eax, [ebp - 0xa670]
mov dword [ebp - 0xa66c], edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0xa610]
push eax
lea eax, [ebp - 0xa684]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0xa610]
push eax
lea eax, [ebp - 0x25f0]
push eax
call fcn.004052fe
pop ecx
pop ecx
jmp 0x4065b2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
div esi
mov esi, eax
lea eax, [ebp - 0xa600]
push eax
call edi
lea eax, [ebp - 0xa670]
push eax
lea eax, [ebp - 0xa600]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
or eax, 0xffffffff
mul esi
mov ecx, eax
mov eax, 0xff676980
mul esi
add ecx, edx
add dword [ebp - 0xa670], eax
lea eax, [ebp - 0xa600]
adc dword [ebp - 0xa66c], ecx
push eax
lea eax, [ebp - 0xa670]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0xa600]
push eax
lea eax, [ebp - 0x25f0]
push eax
call fcn.004052fe
pop ecx
pop ecx
lea eax, [ebp - 0x25f0]
push eax
push 0x58a4e0
push dword [ebp - 0xa690]
call fcn.00407286
add esp, 0xc
mov ecx, 0x5e9970
push str.Snapshot_Time
call fcn.004071a5
mov esi, eax
lea eax, [ebp - 0xa620]
push eax
call edi
push 0x104
lea eax, [ebp - 0x25f0]
mov edi, 0x400
push eax
push ebx
lea eax, [ebp - 0xa620]
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x20
mov dword [ebp - 0xa674], eax
lea ecx, [ebp - 0x25f0]
lea eax, [ecx + eax*2]
pop ecx
push 0x104
push eax
push ebx
mov word [eax - 2], cx
lea eax, [ebp - 0xa620]
push eax
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
add dword [ebp - 0xa674], eax
lea eax, [ebp - 0x25f0]
push eax
push 0x58a4e0
push esi
call fcn.00407286
add esp, 0xc
mov ebx, 0x5e9970
mov ecx, ebx
push str.IE_Version
call fcn.004071a5
mov edi, eax
mov esi, 0x1000
push esi
lea eax, [ebp - 0x25f0]
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_Explorer_svcVersion
call fcn.00404efe
add esp, 0xc
test al, al
jne 0x4067eb
push esi
lea eax, [ebp - 0x25f0]
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_ExplorerVersion
call fcn.00404efe
add esp, 0xc
test al, al
jne 0x4067eb
lea ecx, [ebp - 0x25f0]
mov eax, esi
mov edx, str._none_
jmp 0x406846
lea eax, [ebp - 0x25f0]
push eax
call fcn.00552a19
mov esi, eax
mov dword [esp], 0x104
lea eax, [ebp - 0x460]
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsMinorVersion
call fcn.00404efe
lea eax, [ebp - 0x460]
push 0x58aeb0
push eax
call fcn.005602ba
add esp, 0x14
test eax, eax
jne 0x406830
mov word [ebp - 0x460], ax
lea ecx, [ebp - 0x25f0]
mov eax, 0x1000
lea ecx, [ecx + esi*2]
sub eax, esi
lea edx, [ebp - 0x460]
push edx
push eax
push ecx
call fcn.00552893
add esp, 0xc
lea eax, [ebp - 0x25f0]
mov ecx, edi
push eax
call fcn.004072d9
push 0x58aeb4
mov ecx, ebx
call fcn.004071a5
push str.Free_Space
mov ecx, 0x5e9970
mov ebx, eax
call fcn.004071a5
lea eax, [ebp - 0x460]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x460], 0
lea edi, [ebp - 0x460]
je 0x406abb
push edi
call fcn.00552a19
lea edx, [ebp - 0x460]
mov ecx, edi
sub ecx, edx
mov edx, 0x104
sar ecx, 1
sub edx, ecx
inc eax
cmp edx, eax
cmovb eax, edx
push eax
push edi
call fcn.0056063b
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x406aa0
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0054ee80
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x104
mov esi, eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0xa668]
push eax
push eax
push eax
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov dword [ebp - 0xa684], eax
mov dword [ebp - 0xa680], eax
mov dword [ebp - 0xa694], eax
mov dword [ebp - 0xa690], eax
mov dword [ebp - 0xa670], eax
mov dword [ebp - 0xa66c], eax
lea eax, [ebp - 0xa670]
push eax
lea eax, [ebp - 0xa694]
push eax
lea eax, [ebp - 0xa684]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 0xa690]
mov ecx, dword [ebp - 0xa694]
mov dword [ebp - 0xa664], eax
call fcn.0054d840
mov edx, dword [ebp - 0xa66c]
mov ecx, dword [ebp - 0xa670]
movsd qword [ebp - 0xa67c], xmm0
call fcn.0054d840
push dword [ebx]
movsd qword [ebp - 0xa5f8], xmm0
lea esi, [ebx + 8]
call fcn.00552a19
pop ecx
test eax, eax
je 0x4069d4
xor eax, eax
mov ecx, ebx
push eax
push SysReAllocString
push 0x588d58
call fcn.004071e4
xor eax, eax
mov ecx, esi
push eax
push SysReAllocString
push 0x588d58
call fcn.004071e4
cmp dword [ebp - 0xa664], 0
je 0x406a85
movsd xmm0, qword [ebp - 0xa67c]
push 0x400
push 2
push ecx
push ecx
movsd qword [esp], xmm0
push 0x20
pop eax
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004042a0
xor edx, edx
lea ecx, [ebp - 0x258]
push ecx
mov ecx, 0x588d78
cmp word [eax], dx
mov edx, str.bytes
cmove ecx, edx
push ecx
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push str._s__s__s_s__s
push ebx
call fcn.0040434c
movsd xmm0, qword [ebp - 0xa5f8]
add esp, 0x34
push 0x400
push 2
push ecx
push ecx
movsd qword [esp], xmm0
push 0x20
pop eax
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004042a0
xor edx, edx
lea ecx, [ebp - 0x258]
push ecx
mov ecx, 0x588d78
cmp word [eax], dx
mov edx, str.bytes
cmove ecx, edx
push ecx
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push str._s__s__s_s__s
push esi
call fcn.0040434c
add esp, 0x34
jmp 0x406aa0
push edi
push str._s__unrecognized_
push ebx
call fcn.0040434c
push edi
push str._s__unrecognized_
push esi
call fcn.0040434c
add esp, 0x18
xor eax, eax
push eax
push edi
call fcn.0054efda
pop ecx
pop ecx
lea edi, [eax + 2]
xor eax, eax
cmp word [edi], ax
jne 0x4068a2
jmp 0x406abd
xor eax, eax
mov esi, dword [0x5ebc68]
mov edi, eax
push eax
mov dword [ebp - 0xa680], eax
lea ecx, [esi + 0x65c]
call fcn.00405340
mov ebx, eax
test ebx, ebx
je 0x406fbc
mov edx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebx + 4]
movzx eax, word [ecx]
sub eax, 0x30
sub eax, 0
je 0x406f47
sub eax, 1
je 0x406edc
sub eax, 1
je 0x406dca
sub eax, 1
je 0x406d96
sub eax, 1
je 0x406c83
sub eax, 1
je 0x406b9c
sub eax, 1
jne 0x406f99
mov byte [ebp - 0xa689], al
lea eax, [ebp - 0xa689]
push eax
lea eax, [ecx + 2]
mov ecx, 0x5ebc54
push 0x588d58
push eax
lea eax, [ebp - 0xa690]
push eax
call fcn.004186de
mov eax, dword [ebp - 0xa690]
test eax, eax
je 0x406b60
mov eax, dword [eax]
jmp 0x406b62
xor eax, eax
push 0xfff
push eax
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00560250
mov ecx, dword [ebp - 0xa690]
add esp, 0x10
test ecx, ecx
je 0x406f79
call fcn.00403761
xor eax, eax
mov dword [ebp - 0xa690], eax
jmp 0x406f79
push 0x104
lea eax, [ebp - 0x258]
push eax
lea eax, [ecx + 2]
push eax
call edx
xor eax, eax
push 0x250
push eax
lea eax, [ebp - 0x2840]
push eax
call fcn.0054ee80
add esp, 0xc
lea eax, [ebp - 0x2840]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406c74
lea eax, [ebp - 0xa5f8]
push eax
lea eax, [ebp - 0x282c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0xa610]
push eax
lea eax, [ebp - 0xa5f8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
lea eax, [ebp - 0x25f0]
push eax
xor eax, eax
push eax
lea eax, [ebp - 0xa610]
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x20
mov dword [ebp - 0xa674], eax
lea ecx, [ebp - 0x25f0]
lea eax, [ecx + eax*2]
pop ecx
push 0x104
push eax
mov word [eax - 2], cx
xor eax, eax
push eax
lea eax, [ebp - 0xa610]
push eax
push 2
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
add dword [ebp - 0xa674], eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406f79
push str._none_
push 0x1000
jmp 0x406f6a
push 0x104
lea eax, [ebp - 0x258]
push eax
lea eax, [ecx + 2]
push eax
call edx
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406c74
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xa664], eax
lea ecx, [eax + 1]
push ecx
call fcn.0041917f
pop ecx
mov edi, eax
xor eax, eax
push eax
lea eax, [ebp - 0xa664]
push eax
push dword [ebp - 0xa664]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xa664]
xor eax, eax
push esi
mov byte [edi + ecx], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
lea eax, [ebp - 0x26f0]
push edi
lea ecx, [ebp - 0x26f4]
mov dword [ebp - 0x26f4], eax
call fcn.0040705c
push dword [ebp - 0x26f4]
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x258]
push eax
push dword [ebx]
lea eax, [ebp - 0xa668]
push dword [ebp - 0xa69c]
push eax
call fcn.00417f14
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x26f0]
add esp, 0x14
cmp dword [ebp - 0x26f4], eax
je 0x406d5e
push dword [ebp - 0x26f4]
call fcn.00560aa1
pop ecx
push edi
call fcn.00419175
push 0xffffffffffffffff
push dword [ebp - 0xa668]
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00560250
push dword [ebp - 0xa668]
call fcn.00560aa1
mov edi, dword [ebp - 0xa680]
add esp, 0x18
jmp 0x406f79
push str._none_
mov esi, 0x1000
lea eax, [ebp - 0x25f0]
push esi
push eax
call fcn.00552893
add esp, 0xc
lea eax, [ebp - 0x25f0]
push esi
push eax
mov eax, dword [ebx + 4]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x406f79
push 0x104
lea eax, [ebp - 0x258]
push eax
lea eax, [ecx + 2]
push eax
call edx
push str.rt__ccsUNICODE
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0xa66c]
push eax
call fcn.005608fa
add esp, 0xc
test eax, eax
jne 0x406c74
push dword [ebp - 0xa66c]
mov word [ebp - 0x25f0], ax
mov esi, 0x3e7
lea eax, [ebp - 0x2dc0]
push esi
push eax
call fcn.00560839
add esp, 0xc
test eax, eax
je 0x406ea1
push 0xa
pop edi
lea eax, [ebp - 0x2dc0]
push eax
call fcn.00552a19
pop ecx
mov ecx, eax
sub ecx, 1
js 0x406e60
lea edx, [ebp - 0x2dc0]
lea edx, [edx + ecx*2]
cmp word [edx], di
jne 0x406e60
mov eax, 0x3e8
push 0x587ee4
sub eax, ecx
push eax
push edx
call fcn.00552893
add esp, 0xc
push 0xffffffffffffffff
lea eax, [ebp - 0x2dc0]
push eax
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00560177
add esp, 0x10
test eax, eax
jne 0x406e9b
push dword [ebp - 0xa66c]
lea eax, [ebp - 0x2dc0]
push esi
push eax
call fcn.00560839
add esp, 0xc
test eax, eax
jne 0x406e28
mov edi, dword [ebp - 0xa680]
lea eax, [ebp - 0x25f0]
push eax
call fcn.00552a19
pop ecx
cmp eax, 0xfff
jne 0x406ecb
push 0x58af60
lea eax, [ebp - 0x5f8]
push 4
push eax
call fcn.00552893
add esp, 0xc
push dword [ebp - 0xa66c]
call fcn.00560a66
pop ecx
jmp 0x406f79
push 0x104
lea eax, [ebp - 0x258]
push eax
lea eax, [ecx + 2]
push eax
call edx
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0xa67c]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0040535d
add esp, 0x14
test al, al
je 0x406c74
movzx eax, word [ebp - 0xa676]
push eax
movzx eax, word [ebp - 0xa678]
push eax
movzx eax, word [ebp - 0xa67a]
push eax
movzx eax, word [ebp - 0xa67c]
push eax
lea eax, [ebp - 0x25f0]
push str._u._u._u._u
push eax
call fcn.004041d2
add esp, 0x18
jmp 0x406f79
mov esi, 0x1000
lea eax, [ebp - 0x25f0]
push esi
push eax
lea eax, [ecx + 2]
push eax
call fcn.00404efe
add esp, 0xc
test al, al
jne 0x406f79
push str._none_
push esi
lea eax, [ebp - 0x25f0]
push eax
call fcn.00552893
add esp, 0xc
push dword [ebx]
mov ecx, 0x5e9970
call fcn.004071a5
lea ecx, [ebp - 0x25f0]
push ecx
mov ecx, eax
call fcn.004072d9
mov esi, dword [0x5ebc68]
inc edi
lea ecx, [esi + 0x65c]
push edi
mov dword [ebp - 0xa680], edi
call fcn.00405340
mov edx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x406ae7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d24a
leave
ret
call fcn.0054d669
nop
push edi
pushal
inc eax
add byte [ecx + 0x60], ah
inc eax
add byte [ebx + 0x60], ch
inc eax
add byte [ebp + 0x60], dh
inc eax
add byte [edi + 0x60], bh
inc eax
add byte [ecx - 0x6cffbfa0], cl
pushal
inc eax
add byte [ebp - 0x58ffbfa0], bl
pushal
inc eax
add byte [ecx - 0x44ffbfa0], dh
pushal
inc eax
add ch, al
pushal
inc eax
add bh, cl
pushal
inc eax
add cl, bl
pushal
inc eax
add bl, ah
pushal
inc eax
add dl, ch
pushal
inc eax
add cl, dh
pushal
inc eax
add al, bh
pushal
inc eax
add bh, bh
pushal
inc eax
add byte [esi], al
popal
inc eax
add byte [0x14004061], cl
popal
inc eax
add byte [ebx], bl
popal
inc eax
add byte [edx], ah
popal
inc eax
add byte [ecx], ch
popal
inc eax
add byte [eax], dh
popal
inc eax
add byte [edi], dh
popal
inc eax
add byte [esi], bh
popal
inc eax
add byte [ebp + 0x61], al
inc eax
add byte [ecx + 0x40], cl
add byte [ebx + 0x61], dl
inc eax
add byte [edx + 0x61], bl
inc eax
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp