Function at 0x48f2e5
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x18c
push ebx
push esi
lea eax, [ebp + 0x74]
push edi
push eax
mov dword [ebp + 0x50], ecx
call fcn.0043e7bd
mov al, byte [ebp + 0x7c]
xor ebx, ebx
cmp al, 1
pop ecx
mov byte [ebp + 0x4b], al
jne 0x48f30f
mov byte [ebp + 0x4b], bl
lea ecx, [ebp + 0x10]
sete byte [ebp + 0x7c]
call fcn.00444f6c
lea ecx, [ebp + 0x1c]
call fcn.00444f6c
lea eax, [ebp + 0x74]
push eax
call fcn.0043e7bd
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x48f337
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00447e0d
add esp, 0xc
cmp byte [ebp + 0x7c], 0
je 0x48f357
mov eax, dword [ebp + 0x10]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ef7
movsx eax, byte [ebp + 0x7c]
mov dword [ebp + 0x18], eax
lea edi, [eax + eax]
mov eax, dword [ebp + 0x10]
add eax, edi
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
je 0x48f389
mov esi, 0x80070057
jmp 0x48f512
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00447e60
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x48f3b3
cmp si, 0x3b
jne 0x48f3b7
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x4b], 0
mov byte [ebp + 0x57], 0
jne 0x48f52e
push dword [ebp + 0x1c]
push str.WINVER
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x48f3f3
push dword [ebp + 0x1c]
push 0x4cd870
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48f52e
mov byte [ebp + 0x57], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.0043e7bd
mov eax, dword [ebp + 0x74]
xor esi, esi
xor edi, edi
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], ebx
jne 0x48f416
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x48f43b
lea ecx, [eax + 2]
cmp word [ecx], bx
mov byte [ebp + 0x57], 1
jne 0x48f436
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x57], 0x2a
jmp 0x48f43b
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, bx
mov dword [ebp + 0xc], ecx
jne 0x48f452
cmp byte [ebp + 0x57], 0
je 0x48f4d6
mov dword [ebp + 0x7c], ebx
cmp word [eax], 0x2a
je 0x48f461
cmp byte [ebp + 0x57], 0x2a
jne 0x48f4ae
mov eax, dword [ebp + 0x50]
cmp byte [eax + 0x92], 0
push 0x12
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
jne 0x48f495
test byte [eax + 9], 0xf
jne 0x48f495
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004566ef
jmp 0x48f4a8
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004553cd
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 1
push ebx
push ebx
push dword [ebp + 0x3c]
push eax
call fcn.00408203
add esp, 0x14
lea ecx, [ebp + 0x7c]
mov esi, eax
mov edi, edx
call fcn.0043e825
cmp byte [ebp + 0x57], 0
jne 0x48f4d6
cmp word [ebp + 0xc], bx
jne 0x48f4fb
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], edi
call fcn.00441641
cmp byte [ebp + 0x57], 0
mov esi, eax
mov edi, edx
je 0x48f4fb
movzx eax, word [ebp + 0x20]
shld edi, esi, 0x10
cdq
shl esi, 0x10
or esi, eax
or edi, edx
push str.0x_I64X
push dword [ebp + 0x38]
push edi
push esi
push dword [ebp + 0x50]
call fcn.004475df
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x1c]
call fcn.0043e825
lea ecx, [ebp + 0x10]
call fcn.0043e825
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x1c]
push str.ispe
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48f557
push dword [ebp + 0x38]
call fcn.0040a71d
push eax
push dword [ebp + 0x50]
call fcn.00447664
add esp, 0xc
jmp 0x48f510
cmp si, bx
je 0x48f566
cmp si, 0x2c
jne 0x48f37f
cmp byte [ebp + 0x4b], 0
je 0x48f576
cmp byte [ebp + 0x4b], 2
jne 0x48fb26
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044e827
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x44]
je 0x48f58f
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.0043e7bd
push dword [ebp + 0x1c]
push str.FVER
call fcn.0043fc58
add esp, 0xc
test al, al
je 0x48f6a9
lea ecx, [ebp + 0x60]
call fcn.00444f6c
push dword [ebp + 0x74]
mov dword [ebp + 0x5c], ebx
call fcn.004132c6
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.0043ed64
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x48f615
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e60
mov eax, dword [ebp + 0x64]
mov di, word [eax]
mov eax, dword [ebp + 0x7c]
add esp, 0x10
mov dword [ebp + 0x38], ebx
cmp word [eax], bx
je 0x48f634
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0048f26d
pop ecx
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp + 0x38]
push eax
mov ax, di
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00408203
mov ecx, dword [ebp + 0x50]
add esp, 0x14
push dword [ebp + 0x60]
push esi
call fcn.00444692
cmp di, bx
je 0x48f681
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x64]
call fcn.00444692
mov esi, dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
call fcn.0043e825
lea ecx, [ebp + 0x5c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x44]
call fcn.0043e825
jmp 0x48f512
push dword [ebp + 0x1c]
push str.FTIME
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48f8e4
push dword [ebp + 0x74]
call fcn.004132c6
pop ecx
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
call fcn.00444f6c
lea ecx, [ebp + 0x60]
call fcn.00444f6c
lea ecx, [ebp + 0x4c]
call fcn.00444f6c
lea eax, [edi + esi]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x3c], ebx
jmp 0x48f788
push 6
lea eax, [ebp + 0x68]
push eax
push str._local
call fcn.00446fac
add esp, 0xc
test al, al
je 0x48f721
cmp byte [ebp + 0x7c], 0
je 0x48f71b
sub dword [ebp + 0x68], 2
mov eax, dword [ebp + 0x68]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x48f785
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4cbbfc
call fcn.00446fac
add esp, 0xc
test al, al
je 0x48f73e
or byte [ebp + 0x7c], 4
jmp 0x48f785
push 4
lea eax, [ebp + 0x68]
push eax
push str._ws1
call fcn.00446fac
add esp, 0xc
test al, al
je 0x48f75b
or byte [ebp + 0x7c], 8
jmp 0x48f785
push 5
lea eax, [ebp + 0x68]
push eax
push str._link
call fcn.00446fac
add esp, 0xc
test al, al
je 0x48f77b
mov dword [ebp + 0x3c], 1
jmp 0x48f785
lea eax, [ebp + 0x68]
push eax
call fcn.00409344
pop ecx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
je 0x48f6f2
cmp byte [ebp + 0x7c], 0
je 0x48f79d
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f7ce
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], si
jne 0x48f7eb
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x3c], ebx
lea esi, [ebp - 0xa0]
je 0x48f833
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.00405c00
cmp dword [ebp + 0x64], ebx
je 0x48f826
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x4c]
call fcn.00402cc5
jmp 0x48f846
lea eax, [ebp - 0xa0]
push eax
push ebx
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x48f89b
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.00448a19
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x50]
call fcn.00448a19
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x50]
call fcn.00448a19
add esp, 0x30
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x58]
jmp 0x48faa8
mov ecx, dword [ebp + 0x50]
mov esi, 0x4c1a3c
push esi
push dword [ebp + 0x58]
call fcn.00444692
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x60]
call fcn.00444692
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x4c]
call fcn.00444692
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x58]
jmp 0x48f697
push dword [ebp + 0x1c]
push str.FATTR
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48fb1e
push dword [ebp + 0x74]
call fcn.004132c6
cmp byte [ebp + 0x7c], 0
pop ecx
mov edi, eax
je 0x48f911
mov word [esi], 0x26
lea ecx, [ebp + 0x64]
call fcn.00444f6c
lea ecx, [ebp + 0x58]
call fcn.00444f6c
lea ecx, [ebp + 0x60]
call fcn.00444f6c
lea ecx, [ebp + 0x4c]
call fcn.00444f6c
lea ecx, [ebp + 0x5c]
call fcn.00444f6c
push 0x2c
mov dword [ebp + 0x68], esi
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48fa00
cmp byte [ebp + 0x7c], 0
je 0x48f969
mov word [eax], 0x26
jmp 0x48f96e
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48fa00
cmp byte [ebp + 0x7c], 0
je 0x48f994
mov word [eax], 0x26
jmp 0x48f999
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48fa00
cmp byte [ebp + 0x7c], 0
je 0x48f9bf
mov word [eax], 0x26
jmp 0x48f9c4
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48fa00
cmp byte [ebp + 0x7c], 0
je 0x48f9ea
mov word [eax], 0x26
jmp 0x48f9ef
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447e0d
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x48faba
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x64]
mov esi, dword [ebp + 0x50]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.00447664
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x58]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.00447664
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x60]
and eax, edi
push eax
push esi
call fcn.00447664
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x4c]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.00447664
push dword [ebp - 0x18]
lea eax, [ebp - 0x7c]
push str.0x_lX
push eax
mov word [ebp - 0x7c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.00444692
lea ecx, [ebp + 0x5c]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x58]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0043e825
lea ecx, [ebp + 0x44]
call fcn.0043e825
jmp 0x48f510
mov edi, dword [ebp + 0x50]
mov esi, 0x4c1a3c
push esi
push dword [ebp + 0x64]
mov ecx, edi
call fcn.00444692
push esi
push dword [ebp + 0x58]
mov ecx, edi
call fcn.00444692
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.00444692
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.00444692
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x58]
call fcn.0043e825
lea ecx, [ebp + 0x64]
jmp 0x48f697
lea ecx, [ebp + 0x44]
call fcn.0043e825
cmp byte [ebp + 0x4b], 0
jne 0x48f510
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044e827
lea eax, [ebp + 0x74]
push eax
call fcn.0043e7bd
mov esi, dword [ebp + 0x1c]
push esi
push str.DROPFILE
call fcn.0043fc58
add esp, 0xc
test al, al
je 0x48fc36
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
call fcn.00451c15
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.00444f6c
lea ecx, [ebp + 0x4c]
call fcn.00444f6c
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x48fbc7
cmp byte [ebp + 0x7c], 0
je 0x48fbb0
mov word [eax], 0x26
jmp 0x48fbb5
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00447e0d
add esp, 0xc
lea ecx, [ebp + 0x64]
call fcn.00444f6c
lea ecx, [ebp + 0x28]
call fcn.00444f6c
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp word [esi], bx
je 0x48fbe4
lea eax, [ebp + 0x28]
mov ecx, dword [ebp + 0x30]
or ecx, dword [ebp + 0x34]
je 0x48fbfc
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x30]
call fcn.004049bb
add esp, 0xc
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x60]
call fcn.00444692
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x50]
push esi
call fcn.00444692
lea ecx, [ebp + 0x28]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
jmp 0x48faa8
push esi
push str.FPOS
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48fe40
push dword [ebp + 0x74]
call fcn.004132c6
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043e7bd
push dword [ebp + 0x64]
call fcn.0041101b
add esp, 0xc
lea ecx, [ebp + 0x40]
call fcn.00444f6c
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x64]
call fcn.00413660
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x40]
mov esi, dword [ebp + 0x44]
pop ecx
pop ecx
push 0x26
mov dword [ebp + 0x64], eax
pop edi
je 0x48fc96
mov word [esi], di
lea ecx, [ebp + 0x2c]
call fcn.00444f6c
lea ecx, [ebp + 0x68]
call fcn.00444f6c
lea ecx, [ebp + 0x58]
call fcn.00444f6c
lea ecx, [ebp + 0x60]
call fcn.00444f6c
lea ecx, [ebp + 0x4c]
call fcn.00444f6c
lea ecx, [ebp + 0x5c]
call fcn.00444f6c
lea ecx, [ebp + 0x28]
call fcn.00444f6c
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fcfa
mov word [eax], di
jmp 0x48fcff
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fd25
mov word [eax], di
jmp 0x48fd2a
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fd50
mov word [eax], di
jmp 0x48fd55
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fd77
mov word [eax], di
jmp 0x48fd7c
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fd9e
mov word [eax], di
jmp 0x48fda3
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fddb
test bl, bl
je 0x48fdc5
mov word [eax], di
jmp 0x48fdca
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447e0d
add esp, 0xc
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push dword [ebp + 0x68]
push dword [ebp + 0x2c]
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call fcn.0043d1fe
add esp, 0x24
lea ecx, [ebp + 0x28]
mov esi, eax
call fcn.0043e825
lea ecx, [ebp + 0x5c]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x58]
call fcn.0043e825
lea ecx, [ebp + 0x68]
call fcn.0043e825
lea ecx, [ebp + 0x2c]
call fcn.0043e825
lea ecx, [ebp + 0x40]
jmp 0x48f697
push esi
push str.PPID
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48fe83
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
call fcn.00451c15
pop ecx
pop ecx
push dword [ebp + 0x44]
push dword [ebp + 0x20]
call fcn.00404e2b
pop ecx
push eax
push dword [ebp + 0x50]
call fcn.00447664
add esp, 0xc
jmp 0x48faad
push esi
push str.ISADMIN
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48fe9e
push dword [ebp + 0x44]
call fcn.0049c395
jmp 0x48fe72
push esi
push str.fvar
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x4902a5
push 5
push esi
push 0x4cd7c0
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x4902a5
push esi
push str.PWIN
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x49003f
lea ecx, [ebp + 0x40]
call fcn.00444f6c
lea ecx, [ebp + 0x64]
call fcn.00444f6c
mov eax, dword [ebp + 0x44]
push ebx
mov dword [ebp + 0x3c], eax
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00439af7
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00447e0d
add esp, 0x1c
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.00405bdb
test eax, eax
pop ecx
pop ecx
je 0x48ff3f
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00405bdb
test eax, eax
pop ecx
pop ecx
je 0x48ff58
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x34], eax
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x34]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], 3
mov dword [ebp + 0x18], ebx
call fcn.00405bdb
pop ecx
pop ecx
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x490009
cmp dword [ebp + 0x14], 3
jne 0x48ffa2
cmp dword [ebp + 0x18], 0
jne 0x48ffa2
mov eax, dword [ebp + 0x64]
cmp word [eax], 0
je 0x490009
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x48ffc2
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x48ffcb
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x48ffaf
cmp dword [ebp + 0x14], 3
jne 0x48ffd7
cmp dword [ebp + 0x18], 0
je 0x490009
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x14]
sub edi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x20]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x490009
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x40]
push dword [ebp + 0x7c]
push dword [ebp + 0x50]
call fcn.00410676
push dword [ebp + 0x64]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.00410676
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0043e825
lea ecx, [ebp + 0x40]
call fcn.0043e825
xor ebx, ebx
jmp 0x48faad
push esi
push str.PEBIT
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x48faad
mov eax, dword [ebp + 0x44]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x3c], eax
call fcn.00444f6c
lea ecx, [ebp + 0x64]
call fcn.00444f6c
push ebx
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00439af7
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00447e0d
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
push 0xd
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4c1a3c
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0xc], ebx
call fcn.0041a4ff
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], bx
je 0x490248
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x4900e7
cmp cx, 0x2f
je 0x4900e7
push edx
call fcn.004ade73
test eax, eax
pop ecx
je 0x49010a
jmp 0x4900ea
mov word [eax], bx
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.00445090
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.00444fd8
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x60], ebx
call fcn.00405c00
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], esi
je 0x490240
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x7c], ebx
call fcn.00444f8a
mov edi, dword [ebp + 0x38]
push esi
push ebx
push edi
call fcn.004ae820
add esp, 0xc
push ebx
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push dword [ebp + 0x60]
call esi
test eax, eax
je 0x490238
cmp dword [ebp + 0x7c], 0x40
jb 0x490238
cmp word [edi], 0x5a4d
jne 0x490238
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x4901b2
push ebx
push ebx
push eax
push dword [ebp + 0x60]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0043fb25
add esp, 0x10
push ebx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x490238
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0x34], edi
jne 0x490208
cmp edi, 0x8664
jne 0x4901e7
mov dword [ebp + 0x58], 0x4cd78c
jmp 0x490238
cmp ecx, eax
jne 0x490208
cmp edi, 0x14c
je 0x490231
cmp ecx, eax
jne 0x490208
cmp edi, 0x200
jne 0x490208
mov dword [ebp + 0x58], str.ia64
jmp 0x490238
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x490238
cmp edi, 0x137
je 0x490231
cmp ecx, eax
jne 0x490238
cmp edi, 0x1b0
je 0x490231
cmp ecx, eax
jne 0x490238
cmp edi, 0xe7
jne 0x490238
mov dword [ebp + 0x58], 0x4cd778
lea ecx, [ebp + 0x38]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.00402cc5
push dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x40]
call fcn.00444692
cmp dword [ebp + 0x34], ebx
jg 0x490274
jl 0x490262
cmp dword [ebp + 0x30], ebx
ja 0x490274
mov ecx, dword [ebp + 0x50]
push str._0x000000000001
push dword [ebp + 0x64]
call fcn.00444692
jmp 0x49028d
push str.0x_012I64X
push dword [ebp + 0x64]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x50]
call fcn.004475df
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0043e825
lea ecx, [ebp + 0x40]
jmp 0x48faa8
mov esi, dword [ebp + 0x1c]
cmp word [esi + 8], 0x2b
lea ecx, [ebp + 0x28]
setne bl
dec bl
and ebx, 0x2b
call fcn.00444f6c
lea ecx, [ebp + 0x60]
call fcn.00444f6c
mov eax, dword [ebp + 0x44]
xor edi, edi
test bl, bl
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], 0x4c1a3c
mov dword [ebp + 0x64], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x7f], 0
je 0x490301
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4cc9f4
call fcn.00446fac
add esp, 0xc
test al, al
je 0x490301
mov byte [ebp + 0x7f], 1
mov eax, dword [ebp + 0x4c]
push 0x3b
mov dword [ebp + 0x38], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.00447e60
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, di
je 0x490354
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x490354
push edi
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00439af7
mov eax, dword [ebp + 0x28]
add esp, 0x10
cmp word [eax], di
je 0x490354
mov dword [ebp + 0x64], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.004136a0
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x68], edi
je 0x490514
lea ecx, [ebp + 0x58]
call fcn.00444f6c
mov eax, dword [ebp + 0x4c]
cmp word [eax], di
mov dword [ebp + 0x5c], edi
je 0x4903a0
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004483b1
pop ecx
pop ecx
mov al, byte [ebp + 0x7f]
neg al
lea ecx, [ebp + 0x2c]
sbb eax, eax
and eax, 0x4ddd50
push eax
call fcn.004390f8
cmp byte [ebp + 0x7f], 0
je 0x4903eb
mov ecx, dword [ebp + 0x50]
push edi
push 0xffffffffffffffff
push edi
push dword [ebp + 0x74]
call fcn.00410e94
cmp eax, edi
mov dword [ebp + 0x74], edi
je 0x4903e2
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edi
jmp 0x490403
mov dword [ebp + 0x68], 1
jmp 0x490403
lea eax, [ebp + 0x30]
push eax
add esi, 0xa
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0045be83
add esp, 0x10
cmp dword [ebp + 0x34], edi
jl 0x4904bb
jg 0x490417
cmp dword [ebp + 0x30], edi
jb 0x4904bb
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x490473
mov eax, dword [0x4dd204]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x490458
push edi
push 0x4dd204
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0043fcc1
mov eax, dword [0x4dd204]
add esp, 0x10
cmp eax, edi
jne 0x490458
or eax, 0xffffffff
mov dword [0x4dd204], eax
cmp eax, 0xffffffff
je 0x4904bb
push dword [ebp + 0x20]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
jmp 0x4904b8
mov eax, dword [0x4dd210]
cmp eax, edi
jne 0x4904a5
push edi
push 0x4dd210
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableW
call fcn.0043fcc1
mov eax, dword [0x4dd210]
add esp, 0x10
cmp eax, edi
jne 0x4904a5
or eax, 0xffffffff
mov dword [0x4dd210], eax
cmp eax, 0xffffffff
je 0x4904bb
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x2c], edi
je 0x4904c9
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x40], edi
jne 0x4904dc
cmp dword [ebp + 0x68], edi
jg 0x4904dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x5c]
call fcn.0043e825
lea ecx, [ebp + 0x58]
call fcn.0043e825
lea ecx, [ebp + 0xc]
call fcn.0043e825
lea ecx, [ebp + 0x60]
call fcn.0043e825
lea ecx, [ebp + 0x28]
call fcn.0043e825
lea ecx, [ebp + 0x44]
call fcn.0043e825
mov esi, dword [ebp + 0x68]
jmp 0x48f512
push 0x1000
lea ecx, [ebp + 0x7c]
call fcn.00444f8a
lea ecx, [ebp + 0x3c]
call fcn.00444f6c
push edi
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00439af7
mov eax, dword [ebp + 0x4c]
add esp, 0x10
cmp word [eax], di
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], 0x4cb3e8
mov esi, 0x2000
mov ebx, str.Kernel32.DLL
je 0x4905cf
mov eax, dword [0x4dd208]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x49058d
push edi
push 0x4dd208
push ebx
push str.GetFirmwareEnvironmentVariableExW
call fcn.0043fcc1
mov eax, dword [0x4dd208]
add esp, 0x10
cmp eax, edi
jne 0x49058d
or eax, 0xffffffff
mov dword [0x4dd208], eax
cmp eax, 0xffffffff
je 0x4905cf
lea ecx, [ebp + 0x20]
push ecx
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
cmp eax, edi
mov dword [ebp + 0x58], eax
je 0x4905c6
push dword [ebp + 0x20]
lea eax, [ebp - 0x120]
push 0x4c1b20
push eax
mov dword [ebp + 0x40], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x49060d
mov dword [ebp + 0x40], str.FAIL
jmp 0x49060d
push edi
push 0x4dd20c
push ebx
push str.GetFirmwareEnvironmentVariableW
mov dword [ebp + 0x68], 0x78
call fcn.0043fcc1
mov eax, dword [0x4dd20c]
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x58], edi
je 0x49060d
cmp eax, 0xffffffff
je 0x49060d
push esi
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x58], eax
mov ecx, dword [ebp + 0x50]
movsx ebx, byte [ecx + 9]
mov eax, dword [ebp + 0x3c]
mov cx, word [eax]
or ebx, dword [ebp + 0x18]
cmp cx, 0x26
mov dword [ebp + 0x5c], eax
jne 0x49062b
or ebx, 2
jmp 0x49064a
cmp cx, 0x24
je 0x490642
cmp cx, 0x5e
je 0x490642
cmp cx, 0x2e
jne 0x49064a
or ebx, 4
jmp 0x490644
xor ebx, ebx
add eax, 2
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x58], edi
je 0x4906bc
cmp dword [ebp + 0x58], esi
jbe 0x490657
mov dword [ebp + 0x58], esi
cmp ebx, edi
jne 0x4906b4
mov esi, dword [ebp + 0x58]
mov edi, dword [ebp + 0x7c]
and dword [ebp + 0x7c], 0
inc esi
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x64], edi
call fcn.00444fb1
mov dword [ebp + 0x18], edi
mov edi, dword [ebp + 0x7c]
add edi, 0xfffffff6
dec esi
test esi, esi
jle 0x4906a5
mov dword [ebp + 0x2c], esi
mov esi, dword [ebp + 0x18]
movzx eax, byte [esi]
push eax
add edi, 0xa
push 0x4c7158
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x2c]
jne 0x490689
and word [edi - 2], 0
lea ecx, [ebp + 0x64]
call fcn.0043e825
xor edi, edi
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], eax
jmp 0x4906ca
cmp dword [ebp + 0x68], edi
jg 0x4906ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
test bl, 3
je 0x4906ea
push edi
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x2c]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.0045213e
add esp, 0x18
jmp 0x4906f8
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x5c]
call fcn.00444692
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x49070c
push dword [ebp + 0x40]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.00444692
lea ecx, [ebp + 0x3c]
call fcn.0043e825
lea ecx, [ebp + 0x7c]
jmp 0x4904e7