Function at 0x417bd0
Capabilities:
Check if file exists
Delete file
Encode data using base64
Get file attributes
Parse credit card information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x7c], 0
push edi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], ecx
xor edi, edi
mov ecx, dword [ebp + 0x14]
mov eax, edx
push 0x45771c
shr ecx, 0xa
lea edx, [ebp - 0x68]
and ecx, 0xffffff01
mov dword [ebp - 0x5c], eax
push 0x457638
xor ebx, ebx
mov dword [ebp - 0x90], ecx
mov ecx, dword [eax + 0x10]
xorps xmm0, xmm0
push 0xa
push ebx
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x94], 0
movups xmmword [ebp - 0xa4], xmm0
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edi
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x33], bl
call fcn.00403a60
mov ecx, eax
add esp, 0x10
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4197cf
lea eax, [ebp - 0x32]
push eax
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x18]
call fcn.00428aa0
add esp, 4
test al, al
je 0x4197cf
mov ecx, dword [ebp - 0x60]
push ebx
test ecx, ecx
je 0x4197d1
mov eax, dword [ebp - 0x18]
movups xmm0, xmmword [str._r_n_r_n_r_n_r_n]
movups xmmword [eax + ecx*2], xmm0
lea ecx, [eax + ecx*2]
mov eax, dword [0x44c6ec]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x60]
inc eax
mov edx, dword [ebp - 0x18]
add ecx, 4
mov dword [ebp - 0x28], eax
sub eax, ecx
add eax, eax
mov dword [0x457638], ebx
add dword [esi + 0x58], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x60], ecx
adc dword [esi + 0x5c], ebx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x8c]
push eax
mov dword [ebp - 0xc], edx
call fcn.00416cd0
add esp, 8
test al, al
je 0x419700
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp - 0x5c]
test ecx, ecx
je 0x417dce
mov ax, word [esi + 4]
sub ax, word [esi + 6]
movzx edi, ax
mov eax, dword [0x4576bc]
mov word [ecx + 0x43e], ax
add eax, eax
mov ecx, dword [ebp + 8]
push eax
push dword [0x4574cc]
push ecx
call fcn.0043c9e0
movzx ecx, word [esi + 6]
add esp, 0xc
mov eax, dword [esi + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [eax + ecx*2]
push eax
push ebx
push 0xfde9
call esi
cmp eax, 0xf3
jle 0x417d92
mov ebx, dword [ebp - 0x5c]
movzx ecx, word [ebx + 6]
add edi, 0xffff
push 0
push 0
push 0
push 0
movzx eax, di
push eax
mov eax, dword [ebx + 0x10]
lea eax, [eax + ecx*2]
push eax
push 0
push 0xfde9
call esi
cmp eax, 0xf3
jg 0x417d63
xor ebx, ebx
mov esi, dword [0x4576bc]
movzx eax, di
add eax, eax
push eax
mov eax, dword [ebp - 0x5c]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
call fcn.0043c9e0
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
movzx esi, ax
add esp, 0xc
mov eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x417e42
movzx eax, word [esi + 4]
cmp dword [esi], ebx
jge 0x417e28
sub ax, word [esi + 6]
mov edi, dword [0x4576b4]
movzx esi, di
add esi, esi
movzx ebx, ax
push esi
push dword [0x4574d0]
push dword [ebp + 8]
call fcn.0043c9e0
add esp, 0xc
lea eax, [ebx*2 + 2]
push eax
mov eax, dword [ebp - 0x5c]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0043c9e0
lea eax, [ebx + edi]
add esp, 0xc
movzx esi, ax
xor ebx, ebx
jmp 0x417e42
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x10]
push dword [ebp + 8]
call fcn.0043c9e0
movzx esi, word [esi + 4]
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, 0x5c
cmp word [eax + 2], 0x3f
jne 0x417e55
mov word [eax + 2], cx
mov ecx, dword [ebp + 8]
sub ecx, 2
movzx eax, si
lea eax, [ecx + eax*2]
mov dword [ebp - 0x18], eax
mov ecx, eax
test si, si
je 0x417eca
mov edx, eax
nop dword [eax]
movzx edi, word [eax]
cmp edi, 0x5c
je 0x417e7f
mov ecx, edx
cmp edi, 0x2f
jne 0x417e94
lea eax, [edx - 2]
add esi, 0xffff
mov dword [ebp - 0x18], eax
mov edx, eax
mov ecx, eax
test si, si
jne 0x417e70
test si, si
je 0x417eca
mov edx, ecx
nop dword [eax + eax]
movzx edi, word [eax]
mov ecx, edx
cmp edi, 0x5c
je 0x417eca
cmp edi, 0x2f
je 0x417eca
cmp edi, 0x2e
je 0x417ed0
lea eax, [edx - 2]
add esi, 0xffff
inc ebx
mov dword [ebp - 0x18], eax
mov edx, eax
mov ecx, eax
test si, si
jne 0x417ea0
cmp word [eax], 0x2e
jne 0x417ed8
add esi, 0xffff
jmp 0x417ee6
lea eax, [ebx + 1]
add esi, ebx
movzx eax, ax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x18], eax
movq xmm0, qword [str..inf]
add esi, 4
mov ebx, dword [ebp + 0x18]
movq qword [eax], xmm0
mov eax, dword [ebp - 0x18]
mov cx, word [0x44c6fc]
mov word [eax + 8], cx
test ebx, ebx
jne 0x417f37
test byte [ebp + 0x14], 2
jne 0x417f37
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417f37
push 0x8109
mov edx, esi
mov ecx, edi
call fcn.00404280
movzx esi, word [0x457638]
add esp, 4
push 0
push 0xa000080
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x41976b
push 0
lea eax, [ebp - 0x28]
push eax
push 2
push 0x44e5a7
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [eax], 0
mov eax, dword [ebp + 0x10]
je 0x417f8d
cmp dword [eax], 0x8000
jae 0x417faf
push 0x200016
push 0
push dword [0x45764c]
mov dword [eax], 0x100000
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x419768
mov eax, dword [ebp - 0x80]
add eax, eax
push eax
push 0
push dword [0x45764c]
call edi
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x419768
test ebx, ebx
je 0x417fe9
mov ecx, dword [ebp - 0x7c]
add ecx, ecx
push ecx
push 0
push dword [0x45764c]
call edi
mov dword [ebp - 0x48], eax
test eax, eax
je 0x419768
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x50], edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x64], eax
test ebx, ebx
je 0x4181bd
movzx edi, word [ebx + 0x43e]
movzx ecx, word [ebx + 0x440]
mov word [ebx + 0x43c], si
sub esi, edi
lea edx, [esi - 4]
mov esi, ecx
cmp dx, cx
movzx eax, dx
mov ecx, dword [ebp + 8]
cmovbe esi, eax
movzx eax, si
mov dword [ebx + 0x434], eax
add eax, eax
push eax
mov eax, edi
add ebx, 0x34
lea eax, [ecx + eax*2]
push eax
push ebx
call fcn.0043c9e0
mov ecx, dword [ebp + 0x18]
xor edx, edx
add esp, 0xc
xor edi, edi
mov eax, dword [ecx + 0x434]
mov word [ecx + eax*2 + 0x34], dx
mov esi, dword [ecx + 8]
cmp dword [ecx + 0x20], edx
jbe 0x4180e1
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi]
and eax, 0x3fffffff
add eax, eax
push eax
push dword [esi + 4]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi]
shr eax, 0x1e
cmp eax, 1
jne 0x4180b4
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x28]
push 0
push eax
mov eax, dword [ecx + 0x438]
add eax, eax
push eax
lea eax, [ecx + 0x234]
push eax
jmp 0x4180cc
cmp eax, 2
jne 0x4180d5
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x434]
add eax, eax
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x18]
inc edi
add esi, 8
cmp edi, dword [ecx + 0x20]
jb 0x418073
mov edx, dword [ebp - 0x3c]
movq xmm0, qword [str._r_n_r_n_]
movq qword [edx], xmm0
lea esi, [edx + 0xa]
movzx eax, word [0x44c708]
mov word [edx + 8], ax
mov eax, dword [ecx + 0x434]
add eax, eax
push eax
push ebx
push esi
call fcn.0043c9e0
mov edx, dword [ebp + 0x18]
add esp, 0xc
movups xmm0, xmmword [str..Reg.Delete__r_n]
mov ecx, dword [edx + 0x434]
movups xmmword [esi + ecx*2], xmm0
movq xmm0, qword [0x44c71c]
lea edi, [esi + ecx*2]
movq qword [edi + 0x10], xmm0
mov eax, dword [0x44c724]
mov dword [edi + 0x18], eax
add edi, 0x1c
mov eax, dword [ebp - 0x44]
movq xmm0, qword [str._r_n_r_n_]
sub eax, ecx
mov ecx, dword [ebp - 0x48]
sub eax, 0x13
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
movq qword [ecx], xmm0
lea esi, [ecx + 0xa]
movzx eax, word [0x44c708]
mov word [ecx + 8], ax
mov eax, dword [edx + 0x434]
add eax, eax
push eax
push ebx
push esi
call fcn.0043c9e0
mov eax, dword [ebp + 0x18]
add esp, 0xc
movups xmm0, xmmword [str..Reg.Backup__r_n]
mov ebx, dword [ebp - 0x30]
mov ecx, dword [eax + 0x434]
movups xmmword [esi + ecx*2], xmm0
movq xmm0, qword [0x44c73c]
lea edx, [esi + ecx*2]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c744]
mov dword [edx + 0x18], eax
add edx, 0x1c
mov eax, dword [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0x50], edx
sub eax, 0x13
jmp 0x418215
push 0
lea eax, [ebp - 0x28]
push eax
push 0x308
push str._r_n_Version__r_n_tSignature__Windows_NT___r_n_r_n_r_n_Optional_Components__r_n_tMyRegTweaks_r_n_r_n_r_n_DefaultInstall__r_n_tAddReg______AddReg.Section_r_n_tDelReg______DelReg.Section_r_n_t_BackupReg__BackupReg.Section_r_n_r_n_r_n_MyRegTweaks__r_n_tOptionDesc___Registry_Entries__r_n_tTip__________Registry_Entries__r_n_tModes_______0_1_2_3_r_n_tAddReg______AddReg.Section_r_n_tDelReg______DelReg.Section_r_n_r_n_r_n_AddReg.Section__r_n
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x3c]
movups xmm0, xmmword [str._r_n_r_n_DelReg.Section__r_n]
mov ebx, dword [ebp - 0x44]
add ebx, 0xffffffea
movups xmmword [ecx], xmm0
lea edi, [ecx + 0x2c]
mov dword [ebp - 0x30], ebx
movups xmm0, xmmword [0x44c5dc]
mov dword [ebp - 0x2c], edi
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x44c5ec]
movq qword [ecx + 0x20], xmm0
mov eax, dword [0x44c5f4]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x64]
mov esi, dword [ebp - 0x8c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x78], eax
test eax, eax
je 0x4187cb
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x4196ea
movzx eax, word [esi + 0x12]
test al, 1
jne 0x4183a8
test al, 2
jne 0x41830c
cmp dword [ebp - 0x78], 1
jbe 0x41830c
test byte [esi + 0x26], 1
jne 0x41830c
mov eax, dword [ebp - 0x20]
movzx edi, byte [esi + 0x11]
mov esi, dword [esi + 4]
sub esi, edi
mov dword [ebp - 0x40], edi
movzx ecx, byte [eax + 0x25]
mov eax, dword [eax + 0x14]
mov edi, dword [ebp - 0x20]
lea edx, [eax + ecx*2]
mov eax, dword [ebp - 0x20]
mov al, byte [eax + 0x10]
cmp al, byte [edi + 0x24]
mov edi, dword [ebp - 0x40]
jne 0x418309
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
sub eax, ecx
cmp esi, eax
ja 0x418309
add esi, esi
movzx eax, word [esi + edx]
cmp eax, 0x5c
je 0x4182b4
cmp eax, 0x5d
jne 0x418309
mov eax, dword [ebp - 0x20]
cmp esi, 0xfffe
mov ecx, 0xfffe
mov eax, dword [eax]
mov dword [0x45641c], edx
lea eax, [eax + edi*2]
mov dword [0x456414], eax
movzx eax, si
cmova eax, ecx
movzx eax, ax
mov word [0x456410], ax
mov word [0x456418], ax
cmp ax, cx
jae 0x418343
push 1
push 0x456410
push 0x456418
call dword [0x457674]
movzx eax, al
test eax, eax
jne 0x418773
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0xc]
cmp dword [ebp - 8], eax
jae 0x418338
mov edi, dword [ebp - 0x24]
mov ecx, edi
mov edx, dword [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
call fcn.00417b50
add esp, 0x10
test al, al
je 0x419700
mov edx, dword [ebp - 4]
mov dword [ebp - 0x38], edx
jmp 0x4183f1
push 1
push 0x456410
push 0x456418
call dword [0x457674]
test al, al
je 0x418309
movzx edx, word [0x456418]
mov eax, dword [0x45641c]
mov ecx, edx
shr ecx, 1
sub esi, edx
lea eax, [eax + ecx*2]
movzx ecx, word [0x456410]
mov dword [0x45641c], eax
mov eax, dword [0x456414]
shr ecx, 1
lea eax, [eax + ecx*2]
mov dword [0x456414], eax
cmp esi, 0xfffe
jae 0x41839f
mov word [0x456410], si
mov word [0x456418], si
test esi, esi
jne 0x418343
jmp 0x418773
cmp ebx, dword [esi + 0xc]
jae 0x4183ec
mov eax, dword [ebp - 0x44]
lea eax, [eax*4 + 0x40096]
push eax
push dword [ebp - 0x3c]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x419765
sub edi, dword [ebp - 0x3c]
sar edi, 1
mov dword [ebp - 0x3c], eax
lea edi, [eax + edi*2]
mov eax, dword [ebp - 0x44]
add ebx, eax
mov dword [ebp - 0x2c], edi
add eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], eax
mov edx, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], edx
movzx ecx, byte [esi + 0x10]
mov eax, dword [ecx*8 + 0x4566f4]
add eax, eax
push eax
push dword [ecx*8 + 0x4566f0]
push edx
call fcn.0043c9e0
movzx eax, byte [esi + 0x10]
add esp, 0xc
mov edi, dword [ebp - 0x20]
mov ecx, dword [eax*8 + 0x4566f4]
mov eax, dword [ebp - 0x18]
lea edx, [eax + ecx*2]
lea esi, [edx - 2]
mov dword [ebp - 0x18], esi
movzx ecx, byte [edi + 0x11]
mov eax, dword [edi]
lea ecx, [eax + ecx*2]
mov dword [ebp - 0xc], ecx
cmp word [ecx], 0x5d
je 0x41845d
movzx eax, byte [edi + 0x10]
cmp dword [eax*8 + 0x4566f4], 8
jbe 0x41845d
mov dword [ebp - 0x18], edx
mov eax, 0x5c
mov word [edx], ax
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
movzx eax, byte [edi + 0x11]
mov edx, dword [edi + 4]
sub edx, eax
je 0x4184d4
movzx eax, word [ecx]
cmp eax, 0x22
je 0x418475
cmp eax, 0x25
jne 0x418487
add esi, 2
mov dword [ebp - 0x18], esi
mov ax, word [ecx]
mov word [esi], ax
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
add esi, 2
mov dword [ebp - 0x18], esi
mov ax, word [ecx]
mov word [esi], ax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add ecx, 2
mov esi, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
cmp word [esi], 0x5c
jne 0x4184cc
cmp word [ecx], 0x5c
jne 0x4184cc
mov edi, ecx
cmp edx, 1
jbe 0x4184cc
lea ecx, [edi + 2]
dec eax
dec edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
mov edi, ecx
cmp word [ecx], 0x5c
je 0x4184b4
sub edx, 1
jne 0x418468
mov edi, dword [ebp - 0x20]
cmp word [esi], 0x5c
jne 0x4184ec
nop word [eax + eax]
sub esi, 2
mov dword [ebp - 0x18], esi
cmp word [esi], 0x5c
je 0x4184e0
add esi, 2
mov eax, 0x22
mov dword [ebp - 0x18], esi
mov word [esi], ax
mov eax, dword [ebp - 0x18]
add eax, 2
mov ebx, eax
mov dword [ebp - 0x18], eax
sub ebx, dword [ebp - 0x38]
sar ebx, 1
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0x4c], ebx
je 0x418696
mov esi, dword [ebp - 0x58]
cmp esi, ebx
jae 0x41855d
mov ebx, dword [ebp - 0x64]
lea eax, [ebx*4 + 0x40096]
push eax
push dword [ebp - 0x48]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x419765
mov ecx, dword [ebp - 0x50]
add esi, ebx
sub ecx, dword [ebp - 0x48]
sar ecx, 1
add ebx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x64], ebx
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x50], ecx
mov eax, dword [edi]
mov esi, dword [ebp - 0x74]
movzx ecx, byte [edi + 0x11]
mov bl, byte [esi + 0x11]
lea edx, [eax + ecx*2]
mov al, byte [esi + 0x10]
cmp al, byte [edi + 0x10]
jne 0x4185ed
mov eax, dword [ebp - 0x20]
mov esi, dword [esi + 4]
movzx edi, bl
sub esi, edi
mov eax, dword [eax + 4]
sub eax, ecx
cmp esi, eax
ja 0x4185ed
add esi, esi
movzx eax, word [esi + edx]
cmp eax, 0x5c
je 0x418598
cmp eax, 0x5d
jne 0x4185ed
mov ecx, dword [ebp - 0x74]
cmp esi, 0xfffe
mov eax, dword [ecx]
mov ecx, 0xfffe
mov dword [0x45641c], edx
lea eax, [eax + edi*2]
mov dword [0x456414], eax
movzx eax, si
cmova eax, ecx
movzx eax, ax
mov word [0x456410], ax
mov word [0x456418], ax
cmp ax, cx
jae 0x418630
push 1
push 0x456410
push 0x456418
call dword [0x457674]
movzx eax, al
test eax, eax
jne 0x418690
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
lea esi, [ebx + ebx]
push esi
push edi
push eax
call fcn.0043c9e0
mov eax, dword [ebp - 0x50]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x74], esi
mov dword [eax], 0xa000d
add eax, 4
mov dword [ebp - 0x50], eax
mov eax, 0xfffffffe
sub eax, ebx
add dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x18]
jmp 0x41869c
push 1
push 0x456410
push 0x456418
call dword [0x457674]
test al, al
je 0x4185ed
movzx edx, word [0x456418]
mov eax, dword [0x45641c]
mov ecx, edx
shr ecx, 1
sub esi, edx
lea eax, [eax + ecx*2]
movzx ecx, word [0x456410]
mov dword [0x45641c], eax
mov eax, dword [0x456414]
shr ecx, 1
lea eax, [eax + ecx*2]
mov dword [0x456414], eax
cmp esi, 0xfffe
jae 0x41868c
mov word [0x456410], si
mov word [0x456418], si
test esi, esi
jne 0x418630
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x20]
movzx ecx, word [esi + 0x12]
test cl, 1
je 0x4186dd
movups xmm0, xmmword [str.___0x10_r_n]
mov edi, dword [ebp - 0x2c]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x18]
mov cx, word [0x44c75c]
lea edi, [edi + ebx*2]
add edi, 0x12
mov dword [ebp - 0x2c], edi
mov word [eax + 0x10], cx
mov eax, 0xfffffff7
sub eax, ebx
mov ebx, dword [ebp - 0x30]
add ebx, eax
mov dword [ebp - 0x30], ebx
jmp 0x418779
test cl, 2
jne 0x418715
movups xmm0, xmmword [str.___0x10_r_n]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x18]
mov cx, word [0x44c75c]
mov word [eax + 0x10], cx
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*2]
add eax, 0x12
mov dword [ebp - 4], eax
mov eax, 0xfffffff7
sub eax, ebx
mov ebx, dword [ebp - 0x30]
add dword [ebp - 8], eax
jmp 0x418776
mov ecx, dword [esi + 8]
mov eax, dword [esi]
add ecx, ecx
mov edx, dword [ebp - 0xc]
add eax, 0xfffffffe
sub ecx, edx
add eax, ecx
sar eax, 1
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418743
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418743
cmp ecx, 0xa
jne 0x418728
test eax, eax
je 0x418770
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418762
cmp ecx, 0xa
je 0x418762
cmp ecx, 9
je 0x418762
cmp ecx, 0x20
jne 0x41888a
add edx, 2
sub eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
jne 0x418747
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x70]
mov eax, dword [esi + 8]
push 0
add eax, eax
add dword [ecx + 0x58], eax
push dword [ecx + 0x68]
adc dword [ecx + 0x5c], 0
push dword [ecx + 0x5c]
push dword [ecx + 0x58]
call fcn.0043d1d0
mov ecx, dword [ebp - 0x70]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x4c], edx
cmp edx, dword [ecx + 0x44]
jb 0x4187b5
ja 0x4187ad
cmp eax, dword [ecx + 0x40]
jbe 0x4187b5
call fcn.004031a0
mov ecx, dword [ebp - 0x70]
add esi, 0x14
sub dword [ebp - 0x78], 1
mov dword [ebp - 0x20], esi
jne 0x418235
mov eax, dword [ebp - 0x88]
mov esi, dword [ebp - 0x24]
mov dword [0x457638], eax
lea eax, [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x33], 1
mov eax, dword [eax]
sub eax, dword [ebp - 8]
add eax, eax
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push esi
call edi
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x44]
sub eax, ebx
add eax, eax
push eax
push dword [ebp - 0x3c]
push esi
call edi
mov ebx, dword [ebp + 0x18]
push 0
test ebx, ebx
je 0x419755
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x64]
mov dword [eax], 0xa000d
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x58]
add eax, 0xfffffffe
sub ecx, eax
add ecx, ecx
push ecx
push dword [ebp - 0x48]
push esi
call edi
mov esi, dword [ebx + 0xc]
xor edi, edi
cmp dword [ebx + 0x24], edi
jbe 0x419733
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi]
and eax, 0x3fffffff
add eax, eax
push eax
push dword [esi + 4]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi]
shr eax, 0x1e
cmp eax, 1
jne 0x419705
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x438]
add eax, eax
push eax
lea eax, [ebx + 0x234]
jmp 0x41971c
movzx ecx, word [edx]
cmp ecx, 0x3b
je 0x4196c2
cmp ecx, 0x22
je 0x4188a4
cmp ecx, 0x40
jne 0x4196c2
mov eax, dword [ebp - 4]
lea esi, [ebx + ebx]
push esi
push edi
push eax
mov dword [ebp - 0x18], eax
call fcn.0043c9e0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub dword [ebp - 8], ebx
add ecx, esi
mov eax, dword [0x445f9c]
mov bl, 1
mov dword [ebp - 4], ecx
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov cx, word [0x445fa0]
mov word [eax + 4], cx
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add edi, 6
sub dword [ebp - 8], 3
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
cmp word [edx], 0x22
jne 0x418a06
mov eax, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0xc], edx
movzx ebx, word [edx]
cmp ebx, 0x22
mov dword [ebp - 0x40], ebx
sete byte [ebp - 0x31]
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, eax
je 0x4189c8
mov ebx, edx
mov esi, eax
nop
movzx edi, word [edx]
mov ecx, esi
cmp edi, 0x22
je 0x4189c2
cmp edi, 0xd
je 0x4189c2
cmp edi, 0xa
je 0x4189c2
mov esi, edi
cmp edi, 0x5c
jne 0x418966
add eax, 0xffffffff
mov ecx, eax
mov dword [ebp - 0x14], eax
je 0x4189c2
lea edx, [ebx + 2]
mov dword [ebp - 0xc], edx
movzx edi, word [edx]
mov esi, edi
cmp edi, 0x5c
je 0x418966
cmp edi, 0x22
jne 0x4189c2
cmp si, 0x22
je 0x418972
cmp si, 0x25
jne 0x41898a
mov edx, dword [ebp - 0x10]
mov word [edx], si
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add eax, 2
dec dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov ax, word [edx]
mov edx, dword [ebp - 0x10]
mov word [edx], ax
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add edi, 2
mov eax, dword [ebp - 0x14]
add edx, 2
dec dword [ebp - 8]
mov ebx, edx
add eax, 0xffffffff
mov dword [ebp - 0x10], edi
mov ecx, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edx
mov esi, ecx
mov dword [ebp - 0x14], eax
jne 0x418920
jmp 0x4189c5
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x40]
test ecx, ecx
je 0x418d12
cmp word [edx], 0x22
jne 0x418d12
cmp bx, 0x22
mov bl, byte [ebp - 0x31]
je 0x418a06
mov eax, dword [0x448b5c]
mov dword [edi], eax
mov eax, dword [ebp - 4]
mov cx, word [0x448b60]
mov word [eax + 4], cx
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 4]
add ecx, 0xfffffffd
add edi, 6
jmp 0x418a17
mov dword [edi - 2], 0x20002c
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 4]
dec ecx
add edi, 2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], ecx
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418a41
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x418a26
cmp ecx, 9
je 0x418a26
cmp word [edx], 0x3d
jne 0x418d15
nop dword [eax + eax]
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x418a6b
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x418a50
cmp ecx, 9
je 0x418a50
movzx ecx, word [edx]
cmp ecx, 0x2d
jne 0x418b82
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418a92
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x418a77
cmp ecx, 9
je 0x418a77
movzx ecx, word [edx]
cmp ecx, 0x3b
je 0x418ab0
cmp ecx, 0xd
je 0x418acb
cmp ecx, 0xa
jne 0x418d15
jmp 0x418acb
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418acb
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418acb
cmp ecx, 0xa
jne 0x418ab0
mov eax, dword [ebp - 0x18]
sub edi, eax
mov esi, dword [ebp - 0x30]
sar edi, 1
add edi, 2
cmp esi, edi
jae 0x418b23
mov eax, dword [ebp - 0x44]
lea eax, [eax*4 + 0x40096]
push eax
push dword [ebp - 0x3c]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x419765
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x3c]
sar ecx, 1
mov dword [ebp - 0x3c], eax
lea ecx, [eax + ecx*2]
mov eax, dword [ebp - 0x44]
add esi, eax
mov dword [ebp - 0x2c], ecx
add eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
jmp 0x418b26
mov ecx, dword [ebp - 0x2c]
sub edi, 4
lea esi, [edi + edi]
push esi
push eax
push ecx
call fcn.0043c9e0
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
mov edx, dword [ebp - 0x30]
add ecx, esi
sub edx, edi
test bl, bl
je 0x418b5e
mov eax, dword [str.___r_n]
sub edx, 4
mov dword [ecx], eax
mov eax, dword [0x44c764]
mov dword [ecx + 4], eax
mov eax, 8
jmp 0x418b6c
mov dword [ecx], 0xa000d
sub edx, 2
mov eax, 4
add ecx, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
jmp 0x418d15
cmp ecx, 0x22
jne 0x418e28
test bl, bl
je 0x418bae
mov eax, dword [0x44c76c]
mov dword [edi], eax
mov ax, word [0x44c770]
mov word [edi + 4], ax
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
add ecx, 0xfffffffe
add esi, 4
jmp 0x418bce
movq xmm0, qword [str.0x0___]
movq qword [edi], xmm0
mov eax, dword [0x44c77c]
mov dword [edi + 8], eax
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
add ecx, 0xfffffffa
add esi, 0xc
mov eax, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], eax
xor bh, bh
mov dword [ebp - 4], eax
mov bl, 0x96
mov eax, dword [ebp - 0x14]
add eax, 0xffffffff
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
je 0x418d04
mov edi, eax
mov edx, dword [ebp - 0xc]
add edx, 2
mov dword [ebp - 0xc], edx
movzx esi, word [edx]
cmp esi, 0x22
je 0x418d53
cmp esi, 0xd
je 0x418d09
cmp esi, 0xa
je 0x418d09
mov ecx, esi
cmp esi, 0x5c
jne 0x418c46
lea eax, [edi - 1]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x418d09
add edx, 2
mov dword [ebp - 0xc], edx
movzx esi, word [edx]
mov ecx, esi
cmp esi, 0x5c
je 0x418c46
cmp esi, 0x22
jne 0x418d12
cmp cx, 0x22
je 0x418c52
cmp cx, 0x25
jne 0x418c70
mov edx, dword [ebp - 0x10]
mov word [edx], cx
mov eax, dword [ebp - 4]
dec dword [ebp - 8]
add eax, 2
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
test bl, bl
je 0x418c70
dec bl
mov ax, word [edx]
mov edx, dword [ebp - 0x10]
mov word [edx], ax
mov ecx, dword [ebp - 4]
dec dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
add bl, 0xff
jne 0x418cf0
test bh, bh
jne 0x418cd4
mov esi, dword [ebp - 0x1c]
mov bh, 1
push 0x134
push esi
lea eax, [esi + 0xc]
push eax
call fcn.00429d30
movq xmm0, qword [str._r_n_t___]
add esp, 0xc
movq qword [esi - 2], xmm0
mov eax, dword [0x44c6c0]
mov dword [esi + 6], eax
mov ax, word [0x44c6c4]
mov word [esi + 0xa], ax
mov ecx, dword [ebp - 4]
add ecx, 0xc
sub dword [ebp - 8], 6
mov dword [ebp - 4], ecx
movups xmm0, xmmword [str.__r_n_t___]
mov bl, 0x96
movups xmmword [ecx], xmm0
mov eax, dword [ebp - 4]
add eax, 0x10
sub dword [ebp - 8], 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov edi, eax
jne 0x418bf1
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
jmp 0x418d0c
mov esi, dword [ebp - 0x1c]
cmp word [edx], 0x22
je 0x418d56
mov edi, dword [ebp - 0x10]
test eax, eax
je 0x418d3b
nop dword [eax]
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418d3b
cmp ecx, 0xa
je 0x418d3b
add edx, 2
sub eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
jne 0x418d20
mov ecx, dword [ebp - 0x18]
sub edi, ecx
mov ebx, dword [ebp - 0x4c]
sar edi, 1
add dword [ebp - 8], edi
mov edi, dword [ebp - 0x38]
mov dword [ebp - 4], ecx
jmp 0x418743
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
cmp bl, 0x96
jne 0x418d70
cmp esi, edi
je 0x418d70
sub edi, 0x10
add dword [ebp - 8], 8
mov dword [ebp - 4], edi
nop dword [eax]
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x418d8b
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x418d70
cmp ecx, 9
je 0x418d70
movzx ecx, word [edx]
cmp ecx, 0x3b
je 0x418da3
cmp ecx, 0xd
je 0x418dbe
cmp ecx, 0xa
jne 0x418d15
jmp 0x418dbe
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x418dbe
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418dbe
cmp ecx, 0xa
jne 0x418da3
mov eax, dword [0x448b74]
mov dword [edi], eax
mov eax, dword [ebp - 4]
mov cx, word [0x448b78]
mov word [eax + 4], cx
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 3
add eax, 6
cmp byte [ebp - 0x90], 0
mov dword [ebp - 4], eax
jne 0x418dfa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
jmp 0x418743
push 0
push 0x3fffffe
push dword [ebp + 0x14]
sub eax, esi
lea edx, [ebp - 8]
sar eax, 1
lea ecx, [ebp - 4]
push eax
call fcn.0040d7c0
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
jmp 0x418743
cmp eax, 6
jbe 0x418feb
cmp dword [edx], 0x770064
jne 0x418feb
cmp dword [edx + 4], 0x72006f
jne 0x418feb
cmp dword [edx + 8], 0x3a0064
jne 0x418feb
movups xmm0, xmmword [str.0x10001__0x]
movups xmmword [edi], xmm0
mov eax, dword [0x44c794]
mov dword [edi + 0x10], eax
mov ax, word [0x44c798]
mov word [edi + 0x14], ax
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, 0xc
mov eax, dword [ebp - 0x14]
add edi, 0x16
sub dword [ebp - 8], 0xb
mov ebx, edx
add eax, 0xfffffffa
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov edi, eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x6c], ebx
je 0x418ec9
mov esi, edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x418eb2
mov ebx, esi
mov dword [ebp - 0x6c], ebx
cmp ecx, 9
jne 0x418ec9
lea edx, [esi + 2]
add eax, 0xffffffff
mov ebx, edx
mov dword [ebp - 0xc], edx
mov edi, eax
mov dword [ebp - 0x14], eax
mov esi, edx
mov dword [ebp - 0x6c], ebx
jne 0x418ea0
mov dword [ebp - 0x40], 0
mov ecx, ebx
test edi, edi
je 0x418f51
mov ecx, edi
mov dword [ebp - 0x1c], ecx
jmp 0x418ee3
mov ecx, dword [ebp - 0x1c]
movzx esi, word [edx]
cmp esi, 0x30
jb 0x418ef0
cmp esi, 0x39
jbe 0x418f0b
cmp esi, 0x41
jb 0x418efa
cmp esi, 0x46
jbe 0x418f0b
mov edi, ecx
mov ecx, ebx
cmp esi, 0x61
jb 0x418f25
mov edi, dword [ebp - 0x1c]
cmp esi, 0x66
ja 0x418f25
inc dword [ebp - 0x40]
lea edx, [ebx + 2]
add eax, 0xffffffff
mov dword [ebp - 0xc], edx
mov edi, eax
mov dword [ebp - 0x14], eax
mov ebx, edx
mov dword [ebp - 0x1c], edi
mov ecx, edx
jne 0x418ee0
mov ebx, dword [ebp - 0x6c]
test edi, edi
je 0x418f51
mov edi, ecx
nop
movzx esi, word [edx]
cmp esi, 0x20
je 0x418f3f
mov ecx, edi
cmp esi, 9
jne 0x418f51
lea edx, [edi + 2]
sub eax, 1
mov dword [ebp - 0xc], edx
mov edi, edx
mov dword [ebp - 0x14], eax
mov ecx, edx
jne 0x418f30
mov edi, dword [ebp - 0x40]
test edi, edi
je 0x418d12
cmp edi, 8
ja 0x418d12
movzx esi, word [edx]
cmp esi, 0x3b
je 0x418f80
cmp esi, 0xd
je 0x418f9b
cmp esi, 0xa
jne 0x418d12
jmp 0x418f9b
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418f9b
add ecx, 2
mov dword [ebp - 0xc], ecx
movzx edx, word [ecx]
cmp edx, 0xd
je 0x418f9b
cmp edx, 0xa
jne 0x418f80
cmp word [ebx], 0x30
jne 0x418fb0
cmp edi, 1
jbe 0x418fb0
add ebx, 2
dec edi
cmp word [ebx], 0x30
je 0x418fa1
mov edx, dword [ebp - 0x10]
lea esi, [edi + edi]
push esi
push ebx
push edx
call fcn.0043c9e0
mov eax, dword [ebp - 4]
add esp, 0xc
sub dword [ebp - 8], edi
add eax, esi
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov dword [eax], 0xa000d
add dword [ebp - 4], 4
sub dword [ebp - 8], 2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
jmp 0x418743
cmp eax, 4
jbe 0x418d15
cmp dword [edx], 0x650068
jne 0x418d15
cmp word [edx + 4], 0x78
jne 0x418d15
add edx, 6
add eax, 0xfffffffd
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
movzx ecx, word [edx]
cmp ecx, 0x3a
jne 0x41905d
movups xmm0, xmmword [str.0x1___r_n_t]
dec eax
lea ecx, [edx + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], ecx
movups xmmword [edi], xmm0
mov eax, dword [0x44c7ac]
mov dword [edi + 0x10], eax
mov ax, word [0x44c7b0]
mov word [edi + 0x14], ax
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff5
mov dword [ebp - 0x54], 3
add edi, 0x16
jmp 0x419404
cmp eax, 4
jbe 0x418d15
cmp ecx, 0x28
jne 0x418d15
lea ecx, [edx + 2]
mov dword [ebp - 0x40], 0
dec eax
mov dword [ebp - 0x6c], ecx
xor esi, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x54], esi
mov edx, ecx
mov dword [ebp - 0xc], edx
test eax, eax
je 0x418d3b
mov ebx, ecx
movzx ecx, word [edx]
cmp ecx, 0x41
jb 0x4190bd
cmp ecx, 0x46
jbe 0x4190b5
mov edi, ebx
cmp ecx, 0x61
jb 0x4190e9
cmp ecx, 0x66
ja 0x4190e9
shl esi, 4
add esi, 0xffffffa9
jmp 0x4190cf
shl esi, 4
add esi, 0xffffffc9
jmp 0x4190cf
mov edi, ebx
cmp ecx, 0x30
jb 0x4190e9
cmp ecx, 0x39
ja 0x4190e9
shl esi, 4
add esi, 0xffffffd0
inc dword [ebp - 0x40]
lea edx, [ebx + 2]
add esi, ecx
mov dword [ebp - 0xc], edx
sub eax, 1
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x14], eax
mov ebx, edx
mov edi, edx
jne 0x419094
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x418d12
cmp ebx, 8
ja 0x418d12
cmp word [edx], 0x29
jne 0x418d12
cmp word [edx + 2], 0x3a
jne 0x418d12
lea ecx, [edi + 4]
sub eax, 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
je 0x41913f
mov edx, ecx
movzx ecx, word [ecx]
cmp ecx, 0x20
je 0x41912f
cmp ecx, 9
jne 0x41913f
lea ecx, [edx + 2]
sub eax, 1
mov dword [ebp - 0xc], ecx
mov edx, ecx
mov dword [ebp - 0x14], eax
jne 0x419122
cmp esi, 0xb
ja case.default.0x419148
jmp dword [esi*4 + 0x4197f8]
movups xmm0, xmmword [str.0x20001___r_n_t]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movq xmm0, qword [0x44c7c4]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c7cc]
mov dword [edx + 0x18], eax
mov ax, word [0x44c7d0]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff1
add edi, 0x1e
jmp 0x419404
mov edx, dword [ebp - 0x10]
movq xmm0, qword [str.0x0___]
movq qword [edx], xmm0
mov eax, dword [0x44c77c]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add ecx, 0xfffffffa
add eax, 0xc
jmp 0x4192a1
mov edx, dword [ebp - 0x10]
movups xmm0, xmmword [str.0x20000___]
movups xmmword [edx], xmm0
mov eax, dword [0x44c7e4]
jmp 0x419292
mov edx, dword [ebp - 0x10]
movups xmm0, xmmword [str.0x1___r_n_t]
movups xmmword [edx], xmm0
mov eax, dword [0x44c7ac]
mov dword [edx + 0x10], eax
mov ax, word [0x44c7b0]
mov word [edx + 0x14], ax
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff5
add edi, 0x16
jmp 0x419404
movups xmm0, xmmword [str.0x40001__00_00_00_00]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x44c7fc]
movups xmmword [edx + 0x10], xmm0
movq xmm0, qword [0x44c80c]
movq qword [edx + 0x20], xmm0
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff7
add edi, 0x12
jmp 0x419404
movups xmm0, xmmword [str.0x50001__00_00_00_00]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x44c828]
movups xmmword [edx + 0x10], xmm0
movq xmm0, qword [0x44c838]
jmp 0x41921b
movups xmm0, xmmword [str.0x60001___r_n_t]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movq xmm0, qword [0x44c854]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c85c]
mov dword [edx + 0x18], eax
mov ax, word [0x44c860]
jmp 0x419177
mov edx, dword [ebp - 0x10]
movups xmm0, xmmword [str.0x10000___]
movups xmmword [edx], xmm0
mov eax, dword [0x44c874]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add ecx, 0xfffffff6
add eax, 0x14
cmp byte [ebp - 0x32], 0
lea edx, [ebp - 0x14]
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 4]
lea ecx, [ebp - 0xc]
push eax
je 0x4192dc
call fcn.004175c0
add esp, 0x10
test al, al
jne 0x4192ec
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
jmp 0x418d15
call fcn.00417010
add esp, 0x10
test al, al
je 0x418b74
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x38]
jmp 0x418743
movups xmm0, xmmword [str.0x80001___r_n_t]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movq xmm0, qword [0x44c88c]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c894]
mov dword [edx + 0x18], eax
mov ax, word [0x44c898]
jmp 0x419177
movups xmm0, xmmword [str.0x90001___r_n_t]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movq xmm0, qword [0x44c8ac]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c8b4]
mov dword [edx + 0x18], eax
mov ax, word [0x44c8b8]
jmp 0x419177
movups xmm0, xmmword [str.0xA0001___r_n_t]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movq xmm0, qword [0x44c8cc]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x44c8d4]
mov dword [edx + 0x18], eax
mov ax, word [0x44c8d8]
jmp 0x419177
movups xmm0, xmmword [str.0xB0001__00_00_00_00_00_00_00_00]
mov edx, dword [ebp - 0x10]
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x44c8f0]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [0x44c900]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [0x44c910]
movups xmmword [edx + 0x30], xmm0
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff7
add edi, 0x12
jmp 0x419404
mov edx, dword [ebp - 0x10]
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x6c]
mov dword [edx], 0x780030
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.0043c9e0
mov eax, dword [ebp - 4]
add ebx, 2
movups xmm0, xmmword [str.___r_n_t]
sub dword [ebp - 8], ebx
add esp, 0xc
lea eax, [eax + ebx*2]
mov dword [ebp - 4], eax
movups xmmword [eax], xmm0
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
add eax, 0xfffffff8
add edi, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov edx, eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x14]
mov bl, 0x32
mov dword [ebp - 8], edx
test eax, eax
je 0x419619
mov edx, dword [ebp - 0xc]
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x41942f
cmp ecx, 9
jne 0x41943d
add edx, 2
sub eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
jne 0x419422
cmp word [edx], 0x5c
jne 0x4194cb
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x419462
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x419447
cmp ecx, 9
je 0x419447
cmp word [edx], 0x3b
mov ecx, eax
jne 0x41948d
nop word [eax + eax]
add eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, eax
je 0x41948d
add edx, 2
mov dword [ebp - 0xc], edx
movzx esi, word [edx]
cmp esi, 0xd
je 0x4194a0
cmp esi, 0xa
jne 0x419470
movzx esi, word [edx]
cmp esi, 0xd
je 0x4194a0
cmp esi, 0xa
jne 0x418d15
jmp 0x4194b0
cmp word [edx + 2], 0xa
jne 0x4194b0
add edx, 2
lea eax, [ecx - 1]
mov dword [ebp - 0xc], edx
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x4194cb
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x4194b0
cmp ecx, 9
je 0x4194b0
test eax, eax
je 0x41963c
movzx ecx, word [edx]
cmp ecx, 0x30
jb 0x4194e0
cmp ecx, 0x39
jbe 0x4194fc
cmp ecx, 0x41
jb 0x4194ea
cmp ecx, 0x46
jbe 0x4194fc
cmp ecx, 0x61
jb 0x41963c
cmp ecx, 0x66
ja 0x41963c
mov word [edi], cx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
dec eax
mov edx, dword [ebp - 4]
add ecx, 2
dec dword [ebp - 8]
add edx, 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edx
test eax, eax
jne 0x41955b
movzx eax, word [ecx]
cmp eax, 0x30
jb 0x41952c
cmp eax, 0x39
jbe 0x41955b
cmp eax, 0x41
jb 0x419536
cmp eax, 0x46
jbe 0x41955b
cmp eax, 0x61
jb 0x419540
cmp eax, 0x66
jbe 0x41955b
mov ax, word [edx - 2]
mov ecx, 0x30
mov word [edx], ax
mov eax, dword [ebp - 4]
mov word [eax - 2], cx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
jmp 0x419571
mov ax, word [ecx]
mov word [edx], ax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add edx, 2
dec eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
dec esi
add edi, 2
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
test eax, eax
je 0x4195a0
movzx ecx, word [edx]
cmp ecx, 0x20
je 0x419592
cmp ecx, 9
jne 0x4195a0
add edx, 2
sub eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
jne 0x419585
movzx ecx, word [edx]
cmp ecx, 0x3b
je 0x419616
cmp ecx, 0xd
je 0x419616
cmp ecx, 0xa
je 0x419616
cmp ecx, 0x2c
jne 0x418d15
mov eax, ecx
mov word [edi], ax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add edx, 2
mov edi, dword [ebp - 4]
dec eax
dec dword [ebp - 8]
add edi, 2
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
add bl, 0xff
jne 0x41960e
movq xmm0, qword [str._r_n_t]
mov bl, 0x32
movq qword [edi], xmm0
mov eax, dword [ebp - 4]
mov ecx, dword [0x448b6c]
mov dword [eax + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
add edi, 0xc
sub dword [ebp - 8], 6
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edi
test eax, eax
jne 0x419422
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, dword [ebp - 0x54]
sub eax, ebx
sar eax, 1
cmp ecx, 4
je 0x419697
cmp ecx, 5
je 0x419697
cmp ecx, 0xb
jne 0x419667
lea edi, [ebx + 0x2e]
lea eax, [edx - 0x17]
jmp 0x41969d
movzx ecx, word [edx]
cmp ecx, 0x3b
je 0x419652
cmp ecx, 0xd
je 0x419652
cmp ecx, 0xa
jne 0x418d15
cmp word [edi - 2], 0x2c
mov edx, dword [ebp - 0x10]
jne 0x419619
add edi, 0xfffffffe
inc dword [ebp - 8]
mov dword [ebp - 4], edi
jmp 0x419619
test eax, eax
jne 0x419674
sub edi, 0x10
add dword [ebp - 8], 8
jmp 0x4196a0
cmp eax, 0x96
jae 0x4196a3
add eax, eax
push eax
lea eax, [ebx - 0xc]
push ebx
push eax
call fcn.00429d30
mov edi, dword [ebp - 4]
add esp, 0xc
sub edi, 0xc
add dword [ebp - 8], 6
jmp 0x4196a0
lea edi, [ebx + 0x16]
lea eax, [edx - 0xb]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
mov ebx, dword [ebp - 0x4c]
mov dword [edi], 0xa000d
add dword [ebp - 4], 4
sub dword [ebp - 8], 2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x38]
jmp 0x418743
sub eax, 1
mov dword [ebp - 0x14], eax
je 0x418743
add edx, 2
mov dword [ebp - 0xc], edx
movzx ecx, word [edx]
cmp ecx, 0xd
je 0x418743
cmp ecx, 0xa
jne 0x4196c2
jmp 0x418743
push dword [ebp - 0x24]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
push dword [ebp + 8]
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
call eax
mov ebx, dword [ebp + 0x18]
jmp 0x41976b
cmp eax, 2
jne 0x419726
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x434]
add eax, eax
push eax
lea eax, [ebx + 0x34]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
add esi, 8
cmp edi, dword [ebx + 0x24]
jb 0x418846
mov esi, dword [ebp - 0x24]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
xor edi, edi
test byte [ebp + 0x14], 1
je 0x41976b
mov eax, dword [ebp - 0x5c]
push dword [eax + 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call eax
jmp 0x41976b
lea eax, [ebp - 0x28]
push eax
push 0x3a
push str._r_n_r_n_BackupReg.Section__r_n_r_n_r_n
push esi
call edi
jmp 0x419736
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x8c]
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x3c]
push 0
push dword [0x45764c]
call esi
test ebx, ebx
je 0x4197ac
push dword [ebp - 0x48]
push 0
push dword [0x45764c]
call esi
test edi, edi
je 0x4197c5
cmp edi, 0xffffffff
je 0x4197c5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x33]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, esi
call fcn.00403330
push dword [ebp - 0x68]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret