Function at 0x48db52
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x18c
push ebx
push esi
lea eax, [ebp + 0x74]
push edi
push eax
mov dword [ebp + 0x50], ecx
call fcn.0043e425
mov al, byte [ebp + 0x7c]
xor ebx, ebx
cmp al, 1
pop ecx
mov byte [ebp + 0x4b], al
jne 0x48db7c
mov byte [ebp + 0x4b], bl
lea ecx, [ebp + 0x10]
sete byte [ebp + 0x7c]
call fcn.00444a10
lea ecx, [ebp + 0x1c]
call fcn.00444a10
lea eax, [ebp + 0x74]
push eax
call fcn.0043e425
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x48dba4
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0044785b
add esp, 0xc
cmp byte [ebp + 0x7c], 0
je 0x48dbc4
mov eax, dword [ebp + 0x10]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ee8
movsx eax, byte [ebp + 0x7c]
mov dword [ebp + 0x18], eax
lea edi, [eax + eax]
mov eax, dword [ebp + 0x10]
add eax, edi
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
je 0x48dbf6
mov esi, 0x80070057
jmp 0x48dd7f
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004478ae
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x48dc20
cmp si, 0x3b
jne 0x48dc24
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x4b], 0
mov byte [ebp + 0x57], 0
jne 0x48dd9b
push dword [ebp + 0x1c]
push str.WINVER
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
jne 0x48dc60
push dword [ebp + 0x1c]
push 0x4cb700
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48dd9b
mov byte [ebp + 0x57], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.0043e425
mov eax, dword [ebp + 0x74]
xor esi, esi
xor edi, edi
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], ebx
jne 0x48dc83
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x48dca8
lea ecx, [eax + 2]
cmp word [ecx], bx
mov byte [ebp + 0x57], 1
jne 0x48dca3
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x57], 0x2a
jmp 0x48dca8
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, bx
mov dword [ebp + 0xc], ecx
jne 0x48dcbf
cmp byte [ebp + 0x57], 0
je 0x48dd43
mov dword [ebp + 0x7c], ebx
cmp word [eax], 0x2a
je 0x48dcce
cmp byte [ebp + 0x57], 0x2a
jne 0x48dd1b
mov eax, dword [ebp + 0x50]
cmp byte [eax + 0x92], 0
push 0x12
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
jne 0x48dd02
test byte [eax + 9], 0xf
jne 0x48dd02
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00455d03
jmp 0x48dd15
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004549e1
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 1
push ebx
push ebx
push dword [ebp + 0x3c]
push eax
call fcn.00408027
add esp, 0x14
lea ecx, [ebp + 0x7c]
mov esi, eax
mov edi, edx
call fcn.0043e48d
cmp byte [ebp + 0x57], 0
jne 0x48dd43
cmp word [ebp + 0xc], bx
jne 0x48dd68
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], edi
call fcn.0044124c
cmp byte [ebp + 0x57], 0
mov esi, eax
mov edi, edx
je 0x48dd68
movzx eax, word [ebp + 0x20]
shld edi, esi, 0x10
cdq
shl esi, 0x10
or esi, eax
or edi, edx
push str.0x_I64X
push dword [ebp + 0x38]
push edi
push esi
push dword [ebp + 0x50]
call fcn.0044702d
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x1c]
call fcn.0043e48d
lea ecx, [ebp + 0x10]
call fcn.0043e48d
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x1c]
push str.ispe
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48ddc4
push dword [ebp + 0x38]
call fcn.0040a541
push eax
push dword [ebp + 0x50]
call fcn.004470b2
add esp, 0xc
jmp 0x48dd7d
cmp si, bx
je 0x48ddd3
cmp si, 0x2c
jne 0x48dbec
cmp byte [ebp + 0x4b], 0
je 0x48dde3
cmp byte [ebp + 0x4b], 2
jne 0x48e393
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044df7a
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x44]
je 0x48ddfc
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.0043e425
push dword [ebp + 0x1c]
push str.FVER
call fcn.0043f8c3
add esp, 0xc
test al, al
je 0x48df16
lea ecx, [ebp + 0x60]
call fcn.00444a10
push dword [ebp + 0x74]
mov dword [ebp + 0x5c], ebx
call fcn.004130a1
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.0043e9e8
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x48de82
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004478ae
mov eax, dword [ebp + 0x64]
mov di, word [eax]
mov eax, dword [ebp + 0x7c]
add esp, 0x10
mov dword [ebp + 0x38], ebx
cmp word [eax], bx
je 0x48dea1
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0048dada
pop ecx
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp + 0x38]
push eax
mov ax, di
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00408027
mov ecx, dword [ebp + 0x50]
add esp, 0x14
push dword [ebp + 0x60]
push esi
call fcn.0044414b
cmp di, bx
je 0x48deee
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x64]
call fcn.0044414b
mov esi, dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
call fcn.0043e48d
lea ecx, [ebp + 0x5c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x44]
call fcn.0043e48d
jmp 0x48dd7f
push dword [ebp + 0x1c]
push str.FTIME
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e151
push dword [ebp + 0x74]
call fcn.004130a1
pop ecx
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
call fcn.00444a10
lea ecx, [ebp + 0x60]
call fcn.00444a10
lea ecx, [ebp + 0x4c]
call fcn.00444a10
lea eax, [edi + esi]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x3c], ebx
jmp 0x48dff5
push 6
lea eax, [ebp + 0x68]
push eax
push str._local
call fcn.00446a34
add esp, 0xc
test al, al
je 0x48df8e
cmp byte [ebp + 0x7c], 0
je 0x48df88
sub dword [ebp + 0x68], 2
mov eax, dword [ebp + 0x68]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x48dff2
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4c9a94
call fcn.00446a34
add esp, 0xc
test al, al
je 0x48dfab
or byte [ebp + 0x7c], 4
jmp 0x48dff2
push 4
lea eax, [ebp + 0x68]
push eax
push str._ws1
call fcn.00446a34
add esp, 0xc
test al, al
je 0x48dfc8
or byte [ebp + 0x7c], 8
jmp 0x48dff2
push 5
lea eax, [ebp + 0x68]
push eax
push str._link
call fcn.00446a34
add esp, 0xc
test al, al
je 0x48dfe8
mov dword [ebp + 0x3c], 1
jmp 0x48dff2
lea eax, [ebp + 0x68]
push eax
call fcn.00409168
pop ecx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
je 0x48df5f
cmp byte [ebp + 0x7c], 0
je 0x48e00a
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48e03b
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], si
jne 0x48e058
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x3c], ebx
lea esi, [ebp - 0xa0]
je 0x48e0a0
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.00405a2a
cmp dword [ebp + 0x64], ebx
je 0x48e093
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x4c]
call fcn.00402cb5
jmp 0x48e0b3
lea eax, [ebp - 0xa0]
push eax
push ebx
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x48e108
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0044843b
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x50]
call fcn.0044843b
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x50]
call fcn.0044843b
add esp, 0x30
lea ecx, [ebp + 0x4c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
jmp 0x48e315
mov ecx, dword [ebp + 0x50]
mov esi, 0x4bfa2c
push esi
push dword [ebp + 0x58]
call fcn.0044414b
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x60]
call fcn.0044414b
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x4c]
call fcn.0044414b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
jmp 0x48df04
push dword [ebp + 0x1c]
push str.FATTR
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e38b
push dword [ebp + 0x74]
call fcn.004130a1
cmp byte [ebp + 0x7c], 0
pop ecx
mov edi, eax
je 0x48e17e
mov word [esi], 0x26
lea ecx, [ebp + 0x64]
call fcn.00444a10
lea ecx, [ebp + 0x58]
call fcn.00444a10
lea ecx, [ebp + 0x60]
call fcn.00444a10
lea ecx, [ebp + 0x4c]
call fcn.00444a10
lea ecx, [ebp + 0x5c]
call fcn.00444a10
push 0x2c
mov dword [ebp + 0x68], esi
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48e26d
cmp byte [ebp + 0x7c], 0
je 0x48e1d6
mov word [eax], 0x26
jmp 0x48e1db
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48e26d
cmp byte [ebp + 0x7c], 0
je 0x48e201
mov word [eax], 0x26
jmp 0x48e206
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48e26d
cmp byte [ebp + 0x7c], 0
je 0x48e22c
mov word [eax], 0x26
jmp 0x48e231
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48e26d
cmp byte [ebp + 0x7c], 0
je 0x48e257
mov word [eax], 0x26
jmp 0x48e25c
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044785b
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x48e327
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x64]
mov esi, dword [ebp + 0x50]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.004470b2
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x58]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.004470b2
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x60]
and eax, edi
push eax
push esi
call fcn.004470b2
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x4c]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.004470b2
push dword [ebp - 0x18]
lea eax, [ebp - 0x7c]
push str.0x_lX
push eax
mov word [ebp - 0x7c], bx
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0044414b
lea ecx, [ebp + 0x5c]
call fcn.0043e48d
lea ecx, [ebp + 0x4c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp + 0x64]
call fcn.0043e48d
lea ecx, [ebp + 0x44]
call fcn.0043e48d
jmp 0x48dd7d
mov edi, dword [ebp + 0x50]
mov esi, 0x4bfa2c
push esi
push dword [ebp + 0x64]
mov ecx, edi
call fcn.0044414b
push esi
push dword [ebp + 0x58]
mov ecx, edi
call fcn.0044414b
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0044414b
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.0044414b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.0043e48d
lea ecx, [ebp + 0x4c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp + 0x64]
jmp 0x48df04
lea ecx, [ebp + 0x44]
call fcn.0043e48d
cmp byte [ebp + 0x4b], 0
jne 0x48dd7d
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044df7a
lea eax, [ebp + 0x74]
push eax
call fcn.0043e425
mov esi, dword [ebp + 0x1c]
push esi
push str.DROPFILE
call fcn.0043f8c3
add esp, 0xc
test al, al
je 0x48e4a3
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
call fcn.00451370
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.00444a10
lea ecx, [ebp + 0x4c]
call fcn.00444a10
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x48e434
cmp byte [ebp + 0x7c], 0
je 0x48e41d
mov word [eax], 0x26
jmp 0x48e422
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0044785b
add esp, 0xc
lea ecx, [ebp + 0x64]
call fcn.00444a10
lea ecx, [ebp + 0x28]
call fcn.00444a10
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp word [esi], bx
je 0x48e451
lea eax, [ebp + 0x28]
mov ecx, dword [ebp + 0x30]
or ecx, dword [ebp + 0x34]
je 0x48e469
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x30]
call fcn.004049a5
add esp, 0xc
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x60]
call fcn.0044414b
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x50]
push esi
call fcn.0044414b
lea ecx, [ebp + 0x28]
call fcn.0043e48d
lea ecx, [ebp + 0x64]
call fcn.0043e48d
lea ecx, [ebp + 0x4c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
jmp 0x48e315
push esi
push str.FPOS
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e6ad
push dword [ebp + 0x74]
call fcn.004130a1
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
push dword [ebp + 0x64]
call fcn.00410df6
add esp, 0xc
lea ecx, [ebp + 0x40]
call fcn.00444a10
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x64]
call fcn.0041343b
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x40]
mov esi, dword [ebp + 0x44]
pop ecx
pop ecx
push 0x26
mov dword [ebp + 0x64], eax
pop edi
je 0x48e503
mov word [esi], di
lea ecx, [ebp + 0x2c]
call fcn.00444a10
lea ecx, [ebp + 0x68]
call fcn.00444a10
lea ecx, [ebp + 0x58]
call fcn.00444a10
lea ecx, [ebp + 0x60]
call fcn.00444a10
lea ecx, [ebp + 0x4c]
call fcn.00444a10
lea ecx, [ebp + 0x5c]
call fcn.00444a10
lea ecx, [ebp + 0x28]
call fcn.00444a10
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e567
mov word [eax], di
jmp 0x48e56c
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e592
mov word [eax], di
jmp 0x48e597
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e5bd
mov word [eax], di
jmp 0x48e5c2
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e5e4
mov word [eax], di
jmp 0x48e5e9
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e60b
mov word [eax], di
jmp 0x48e610
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48e648
test bl, bl
je 0x48e632
mov word [eax], di
jmp 0x48e637
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0044785b
add esp, 0xc
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push dword [ebp + 0x68]
push dword [ebp + 0x2c]
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call fcn.0043ce63
add esp, 0x24
lea ecx, [ebp + 0x28]
mov esi, eax
call fcn.0043e48d
lea ecx, [ebp + 0x5c]
call fcn.0043e48d
lea ecx, [ebp + 0x4c]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp + 0x68]
call fcn.0043e48d
lea ecx, [ebp + 0x2c]
call fcn.0043e48d
lea ecx, [ebp + 0x40]
jmp 0x48df04
push esi
push str.PPID
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e6f0
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
call fcn.00451370
pop ecx
pop ecx
push dword [ebp + 0x44]
push dword [ebp + 0x20]
call fcn.00404e15
pop ecx
push eax
push dword [ebp + 0x50]
call fcn.004470b2
add esp, 0xc
jmp 0x48e31a
push esi
push str.ISADMIN
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e70b
push dword [ebp + 0x44]
call fcn.0049aaa7
jmp 0x48e6df
push esi
push str.fvar
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
jne 0x48eb12
push 5
push esi
push 0x4cb650
call dword [sym.imp.shlwapi.dll_StrCmpNIW]
test eax, eax
je 0x48eb12
push esi
push str.PWIN
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e8ac
lea ecx, [ebp + 0x40]
call fcn.00444a10
lea ecx, [ebp + 0x64]
call fcn.00444a10
mov eax, dword [ebp + 0x44]
push ebx
mov dword [ebp + 0x3c], eax
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00439759
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0044785b
add esp, 0x1c
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.004059e1
test eax, eax
pop ecx
pop ecx
je 0x48e7ac
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004059e1
test eax, eax
pop ecx
pop ecx
je 0x48e7c5
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x34], eax
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x34]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], 3
mov dword [ebp + 0x18], ebx
call fcn.004059e1
pop ecx
pop ecx
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call dword [sym.imp.user32.dll_WindowFromPoint]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x48e876
cmp dword [ebp + 0x14], 3
jne 0x48e80f
cmp dword [ebp + 0x18], 0
jne 0x48e80f
mov eax, dword [ebp + 0x64]
cmp word [eax], 0
je 0x48e876
mov ebx, dword [sym.imp.user32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x48e82f
push dword [ebp + 0x5c]
call dword [sym.imp.user32.dll_GetParent]
test eax, eax
je 0x48e838
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x48e81c
cmp dword [ebp + 0x14], 3
jne 0x48e844
cmp dword [ebp + 0x18], 0
je 0x48e876
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
push ebx
call dword [sym.imp.user32.dll_ClientToScreen]
push dword [ebp + 0x14]
sub edi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x20]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.user32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x48e876
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x40]
push dword [ebp + 0x7c]
push dword [ebp + 0x50]
call fcn.0041046b
push dword [ebp + 0x64]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.0041046b
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0043e48d
lea ecx, [ebp + 0x40]
call fcn.0043e48d
xor ebx, ebx
jmp 0x48e31a
push esi
push str.PEBIT
call fcn.0043f8c3
test al, al
pop ecx
pop ecx
je 0x48e31a
mov eax, dword [ebp + 0x44]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x3c], eax
call fcn.00444a10
lea ecx, [ebp + 0x64]
call fcn.00444a10
push ebx
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00439759
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0044785b
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
push 0xd
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4bfa2c
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0xc], ebx
call fcn.0041a299
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], bx
je 0x48eab5
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x48e954
cmp cx, 0x2f
je 0x48e954
push edx
call fcn.004ac5b9
test eax, eax
pop ecx
je 0x48e977
jmp 0x48e957
mov word [eax], bx
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.00444b34
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.00444a7c
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x60], ebx
call fcn.00405a2a
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], esi
je 0x48eaad
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x7c], ebx
call fcn.00444a2e
mov edi, dword [ebp + 0x38]
push esi
push ebx
push edi
call fcn.004acf60
add esp, 0xc
push ebx
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
push dword [ebp + 0x60]
call esi
test eax, eax
je 0x48eaa5
cmp dword [ebp + 0x7c], 0x40
jb 0x48eaa5
cmp word [edi], 0x5a4d
jne 0x48eaa5
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x48ea1f
push ebx
push ebx
push eax
push dword [ebp + 0x60]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0043f790
add esp, 0x10
push ebx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x48eaa5
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0x34], edi
jne 0x48ea75
cmp edi, 0x8664
jne 0x48ea54
mov dword [ebp + 0x58], 0x4cb61c
jmp 0x48eaa5
cmp ecx, eax
jne 0x48ea75
cmp edi, 0x14c
je 0x48ea9e
cmp ecx, eax
jne 0x48ea75
cmp edi, 0x200
jne 0x48ea75
mov dword [ebp + 0x58], str.ia64
jmp 0x48eaa5
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x48eaa5
cmp edi, 0x137
je 0x48ea9e
cmp ecx, eax
jne 0x48eaa5
cmp edi, 0x1b0
je 0x48ea9e
cmp ecx, eax
jne 0x48eaa5
cmp edi, 0xe7
jne 0x48eaa5
mov dword [ebp + 0x58], 0x4cb608
lea ecx, [ebp + 0x38]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.00402cb5
push dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x40]
call fcn.0044414b
cmp dword [ebp + 0x34], ebx
jg 0x48eae1
jl 0x48eacf
cmp dword [ebp + 0x30], ebx
ja 0x48eae1
mov ecx, dword [ebp + 0x50]
push str._0x000000000001
push dword [ebp + 0x64]
call fcn.0044414b
jmp 0x48eafa
push str.0x_012I64X
push dword [ebp + 0x64]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x50]
call fcn.0044702d
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.0043e48d
lea ecx, [ebp + 0x64]
call fcn.0043e48d
lea ecx, [ebp + 0x40]
jmp 0x48e315
mov esi, dword [ebp + 0x1c]
cmp word [esi + 8], 0x2b
lea ecx, [ebp + 0x28]
setne bl
dec bl
and ebx, 0x2b
call fcn.00444a10
lea ecx, [ebp + 0x60]
call fcn.00444a10
mov eax, dword [ebp + 0x44]
xor edi, edi
test bl, bl
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], 0x4bfa2c
mov dword [ebp + 0x64], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x7f], 0
je 0x48eb6e
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4ca88c
call fcn.00446a34
add esp, 0xc
test al, al
je 0x48eb6e
mov byte [ebp + 0x7f], 1
mov eax, dword [ebp + 0x4c]
push 0x3b
mov dword [ebp + 0x38], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.004478ae
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, di
je 0x48ebc1
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x48ebc1
push edi
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00439759
mov eax, dword [ebp + 0x28]
add esp, 0x10
cmp word [eax], di
je 0x48ebc1
mov dword [ebp + 0x64], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.0041347b
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x68], edi
je 0x48ed81
lea ecx, [ebp + 0x58]
call fcn.00444a10
mov eax, dword [ebp + 0x4c]
cmp word [eax], di
mov dword [ebp + 0x5c], edi
je 0x48ec0d
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00447dd3
pop ecx
pop ecx
mov al, byte [ebp + 0x7f]
neg al
lea ecx, [ebp + 0x2c]
sbb eax, eax
and eax, 0x4dbd30
push eax
call fcn.00438d5b
cmp byte [ebp + 0x7f], 0
je 0x48ec58
mov ecx, dword [ebp + 0x50]
push edi
push 0xffffffffffffffff
push edi
push dword [ebp + 0x74]
call fcn.00410c6f
cmp eax, edi
mov dword [ebp + 0x74], edi
je 0x48ec4f
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edi
jmp 0x48ec70
mov dword [ebp + 0x68], 1
jmp 0x48ec70
lea eax, [ebp + 0x30]
push eax
add esi, 0xa
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0045b4b3
add esp, 0x10
cmp dword [ebp + 0x34], edi
jl 0x48ed28
jg 0x48ec84
cmp dword [ebp + 0x30], edi
jb 0x48ed28
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x48ece0
mov eax, dword [0x4db1f4]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x48ecc5
push edi
push 0x4db1f4
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0043f92c
mov eax, dword [0x4db1f4]
add esp, 0x10
cmp eax, edi
jne 0x48ecc5
or eax, 0xffffffff
mov dword [0x4db1f4], eax
cmp eax, 0xffffffff
je 0x48ed28
push dword [ebp + 0x20]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
jmp 0x48ed25
mov eax, dword [0x4db200]
cmp eax, edi
jne 0x48ed12
push edi
push 0x4db200
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableW
call fcn.0043f92c
mov eax, dword [0x4db200]
add esp, 0x10
cmp eax, edi
jne 0x48ed12
or eax, 0xffffffff
mov dword [0x4db200], eax
cmp eax, 0xffffffff
je 0x48ed28
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x2c], edi
je 0x48ed36
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [ebp + 0x40], edi
jne 0x48ed49
cmp dword [ebp + 0x68], edi
jg 0x48ed49
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x5c]
call fcn.0043e48d
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp + 0xc]
call fcn.0043e48d
lea ecx, [ebp + 0x60]
call fcn.0043e48d
lea ecx, [ebp + 0x28]
call fcn.0043e48d
lea ecx, [ebp + 0x44]
call fcn.0043e48d
mov esi, dword [ebp + 0x68]
jmp 0x48dd7f
push 0x1000
lea ecx, [ebp + 0x7c]
call fcn.00444a2e
lea ecx, [ebp + 0x3c]
call fcn.00444a10
push edi
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00439759
mov eax, dword [ebp + 0x4c]
add esp, 0x10
cmp word [eax], di
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], 0x4c92c0
mov esi, 0x2000
mov ebx, str.Kernel32.DLL
je 0x48ee3c
mov eax, dword [0x4db1f8]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x48edfa
push edi
push 0x4db1f8
push ebx
push str.GetFirmwareEnvironmentVariableExW
call fcn.0043f92c
mov eax, dword [0x4db1f8]
add esp, 0x10
cmp eax, edi
jne 0x48edfa
or eax, 0xffffffff
mov dword [0x4db1f8], eax
cmp eax, 0xffffffff
je 0x48ee3c
lea ecx, [ebp + 0x20]
push ecx
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
cmp eax, edi
mov dword [ebp + 0x58], eax
je 0x48ee33
push dword [ebp + 0x20]
lea eax, [ebp - 0x120]
push 0x4bfb04
push eax
mov dword [ebp + 0x40], eax
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0xc
jmp 0x48ee7a
mov dword [ebp + 0x40], str.FAIL
jmp 0x48ee7a
push edi
push 0x4db1fc
push ebx
push str.GetFirmwareEnvironmentVariableW
mov dword [ebp + 0x68], 0x78
call fcn.0043f92c
mov eax, dword [0x4db1fc]
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x58], edi
je 0x48ee7a
cmp eax, 0xffffffff
je 0x48ee7a
push esi
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x58], eax
mov ecx, dword [ebp + 0x50]
movsx ebx, byte [ecx + 9]
mov eax, dword [ebp + 0x3c]
mov cx, word [eax]
or ebx, dword [ebp + 0x18]
cmp cx, 0x26
mov dword [ebp + 0x5c], eax
jne 0x48ee98
or ebx, 2
jmp 0x48eeb7
cmp cx, 0x24
je 0x48eeaf
cmp cx, 0x5e
je 0x48eeaf
cmp cx, 0x2e
jne 0x48eeb7
or ebx, 4
jmp 0x48eeb1
xor ebx, ebx
add eax, 2
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x58], edi
je 0x48ef29
cmp dword [ebp + 0x58], esi
jbe 0x48eec4
mov dword [ebp + 0x58], esi
cmp ebx, edi
jne 0x48ef21
mov esi, dword [ebp + 0x58]
mov edi, dword [ebp + 0x7c]
and dword [ebp + 0x7c], 0
inc esi
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x64], edi
call fcn.00444a55
mov dword [ebp + 0x18], edi
mov edi, dword [ebp + 0x7c]
add edi, 0xfffffff6
dec esi
test esi, esi
jle 0x48ef12
mov dword [ebp + 0x2c], esi
mov esi, dword [ebp + 0x18]
movzx eax, byte [esi]
push eax
add edi, 0xa
push 0x4c50c0
push edi
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x2c]
jne 0x48eef6
and word [edi - 2], 0
lea ecx, [ebp + 0x64]
call fcn.0043e48d
xor edi, edi
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], eax
jmp 0x48ef37
cmp dword [ebp + 0x68], edi
jg 0x48ef37
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
test bl, 3
je 0x48ef57
push edi
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x2c]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.00451899
add esp, 0x18
jmp 0x48ef65
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x5c]
call fcn.0044414b
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x48ef79
push dword [ebp + 0x40]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0044414b
lea ecx, [ebp + 0x3c]
call fcn.0043e48d
lea ecx, [ebp + 0x7c]
jmp 0x48ed54