Function at 0x44e48e
Capabilities:
Parse pe header

Disassembly:
push 0x6b4
mov eax, 0x5c8393
call fcn.0058ecca
mov edi, ecx
push str.UTF_8
lea esi, [ebp - 0xc0]
call fcn.0040820f
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esi
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00403820
mov byte [ebp - 4], 2
push ebx
push 1
call fcn.00409da6
mov byte [ebp - 4], 3
push dword [edi]
lea eax, [ebp - 0x88]
push eax
call fcn.00488a10
pop ecx
pop ecx
mov byte [ebp - 4], 4
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.00407c88
mov byte [ebp - 4], 5
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xc0]
call fcn.0040396a
mov esi, eax
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0xc0]
call fcn.004098e5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.004084b5
cmp esi, 1
je 0x44e536
cmp esi, ebx
jne 0x44fadd
push 0x682340
lea esi, [ebp - 0xc0]
call fcn.0040820f
mov byte [ebp - 4], 6
mov eax, esi
push eax
lea eax, [ebp - 0x80]
call fcn.00403992
mov edi, eax
mov byte [ebp - 4], 3
push ebx
push 1
call fcn.00409da6
cmp edi, ebx
je 0x44fadd
push str.Setting
lea esi, [ebp - 0xf4]
call fcn.0040820f
mov byte [ebp - 4], 7
mov eax, esi
push eax
lea eax, [ebp - 0xc0]
push eax
push edi
call fcn.004032c8
mov byte [ebp - 4], 9
push ebx
push 1
call fcn.00409da6
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xc8], ebx
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
lea edi, [ebp - 0xc8]
lea esi, [ebp - 0xa4]
call fcn.0042c4a9
test al, al
je 0x44facd
call fcn.004180b5
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov edi, str.name
push edi
lea esi, [ebp - 0x6a4]
call fcn.0040820f
mov byte [ebp - 4], 0xa
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.DeepLook
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push ebx
push 1
call fcn.00409da6
mov ebx, str.Value
cmp byte [ebp - 0x81], 0
je 0x44e6c7
push ebx
lea esi, [ebp - 0x6c0]
call fcn.0040820f
mov byte [ebp - 4], 0xb
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44e6c7
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44e69b
mov eax, dword [eax + 0x40]
jmp 0x44e69e
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.checkCert
push eax
call fcn.004085b5
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x404]
call fcn.0040820f
mov byte [ebp - 4], 0xd
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.DeepExploit
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44e786
push ebx
lea esi, [ebp - 0x164]
call fcn.0040820f
mov byte [ebp - 4], 0xe
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44e786
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44e75a
mov eax, dword [eax + 0x40]
jmp 0x44e75d
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.checkInjector2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x66c]
call fcn.0040820f
mov byte [ebp - 4], 0x10
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.ExcludeDriver
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44e845
push ebx
lea esi, [ebp - 0x19c]
call fcn.0040820f
mov byte [ebp - 4], 0x11
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44e845
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44e819
mov eax, dword [eax + 0x40]
jmp 0x44e81c
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.TTDriver2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x43c]
call fcn.0040820f
mov byte [ebp - 4], 0x13
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.DeepDive
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44e904
push ebx
lea esi, [ebp - 0x1d4]
call fcn.0040820f
mov byte [ebp - 4], 0x14
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44e904
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44e8d8
mov eax, dword [eax + 0x40]
jmp 0x44e8db
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.checkExe
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x58c]
call fcn.0040820f
mov byte [ebp - 4], 0x16
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.DeepScript
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44e9c3
push ebx
lea esi, [ebp - 0x20c]
call fcn.0040820f
mov byte [ebp - 4], 0x17
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44e9c3
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44e997
mov eax, dword [eax + 0x40]
jmp 0x44e99a
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.checkScript3
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x474]
call fcn.0040820f
mov byte [ebp - 4], 0x19
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.ExcludeKeygens
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44ea82
push ebx
lea esi, [ebp - 0x244]
call fcn.0040820f
mov byte [ebp - 4], 0x1a
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44ea82
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44ea56
mov eax, dword [eax + 0x40]
jmp 0x44ea59
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.TTKeygen2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x634]
call fcn.0040820f
mov byte [ebp - 4], 0x1c
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push 0x68b2a8
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44eb48
push ebx
lea esi, [ebp - 0x27c]
call fcn.0040820f
mov byte [ebp - 4], 0x1d
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44eb48
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44eb15
mov eax, dword [eax + 0x40]
jmp 0x44eb18
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
xor ecx, ecx
test eax, eax
sete cl
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
push str.TTScanAll2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x4ac]
call fcn.0040820f
mov byte [ebp - 4], 0x1f
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.ExtensionList
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44ed5c
push ebx
lea esi, [ebp - 0x2b4]
call fcn.0040820f
mov byte [ebp - 4], 0x20
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44ed5c
lea eax, [ebp - 0x94]
push eax
call fcn.0040855f
mov byte [ebp - 4], 0x21
push str.item
lea esi, [ebp - 0x5c4]
call fcn.0040820f
mov byte [ebp - 4], 0x22
mov eax, esi
push eax
lea eax, [ebp - 0xf4]
push eax
push dword [ebp - 0x88]
call fcn.004032c8
mov byte [ebp - 4], 0x24
xor ebx, ebx
push ebx
push 1
call fcn.00409da6
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xd0], ebx
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd0], eax
lea edi, [ebp - 0xd0]
lea esi, [ebp - 0x9c]
call fcn.0042c4a9
test al, al
je 0x44eceb
call fcn.004180b5
mov eax, dword [eax]
cmp dword [eax + 0x54], 8
jb 0x44ec7e
mov eax, dword [eax + 0x40]
jmp 0x44ec81
add eax, 0x40
push eax
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x94]
call fcn.004116ea
mov byte [ebp - 4], 0x25
push 0x689428
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x26
lea edi, [ebp - 0x94]
call fcn.00408619
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xd4]
call fcn.004085f6
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xd8]
call fcn.004085f6
lea esi, [ebp - 0x9c]
call fcn.0041a3a5
jmp 0x44ec39
push 0x689428
lea ebx, [ebp - 0x94]
call fcn.00417419
push ecx
mov eax, esp
mov dword [ebp - 0x88], esp
mov ecx, ebx
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 0x27
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.TTExtensions
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x28
push 0x6def68
mov byte [ebp - 4], 0x24
call fcn.004326fc
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0xf4]
push eax
call fcn.00408ca7
mov byte [ebp - 4], 9
mov ecx, ebx
call fcn.004085f6
mov ebx, str.Value
mov edi, str.name
push edi
lea esi, [ebp - 0x2ec]
call fcn.0040820f
mov byte [ebp - 4], 0x29
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.FileSize
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44ee1b
push ebx
lea esi, [ebp - 0x4e4]
call fcn.0040820f
mov byte [ebp - 4], 0x2a
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44ee1b
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44edef
mov eax, dword [eax + 0x40]
jmp 0x44edf2
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.TTSizeLimit2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x324]
call fcn.0040820f
mov byte [ebp - 4], 0x2c
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel1
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44eeda
push ebx
lea esi, [ebp - 0x110]
call fcn.0040820f
mov byte [ebp - 4], 0x2d
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44eeda
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44eeae
mov eax, dword [eax + 0x40]
jmp 0x44eeb1
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.AllowDownloads2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x35c]
call fcn.0040820f
mov byte [ebp - 4], 0x2f
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel2
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44ef99
push ebx
lea esi, [ebp - 0x51c]
call fcn.0040820f
mov byte [ebp - 4], 0x30
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44ef99
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44ef6d
mov eax, dword [eax + 0x40]
jmp 0x44ef70
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesInvalidCert3
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x394]
call fcn.0040820f
mov byte [ebp - 4], 0x32
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel3
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f058
push ebx
lea esi, [ebp - 0x5fc]
call fcn.0040820f
mov byte [ebp - 4], 0x33
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f058
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f02c
mov eax, dword [eax + 0x40]
jmp 0x44f02f
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesArchiveExe2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x34
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x3cc]
call fcn.0040820f
mov byte [ebp - 4], 0x35
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel4
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f117
push ebx
lea esi, [ebp - 0x554]
call fcn.0040820f
mov byte [ebp - 4], 0x36
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f117
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f0eb
mov eax, dword [eax + 0x40]
jmp 0x44f0ee
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesSuspFolders2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x12c]
call fcn.0040820f
mov byte [ebp - 4], 0x38
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel5
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f1d6
push ebx
lea esi, [ebp - 0x148]
call fcn.0040820f
mov byte [ebp - 4], 0x39
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f1d6
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f1aa
mov eax, dword [eax + 0x40]
jmp 0x44f1ad
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesCmdDownloads2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x180]
call fcn.0040820f
mov byte [ebp - 4], 0x3b
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel6
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f295
push ebx
lea esi, [ebp - 0x1b8]
call fcn.0040820f
mov byte [ebp - 4], 0x3c
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f295
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f269
mov eax, dword [eax + 0x40]
jmp 0x44f26c
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesScriptExe2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x1f0]
call fcn.0040820f
mov byte [ebp - 4], 0x3e
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel7
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f354
push ebx
lea esi, [ebp - 0x228]
call fcn.0040820f
mov byte [ebp - 4], 0x3f
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f354
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f328
mov eax, dword [eax + 0x40]
jmp 0x44f32b
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesMSHTA2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x260]
call fcn.0040820f
mov byte [ebp - 4], 0x41
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel8
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f413
push ebx
lea esi, [ebp - 0x298]
call fcn.0040820f
mov byte [ebp - 4], 0x42
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f413
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f3e7
mov eax, dword [eax + 0x40]
jmp 0x44f3ea
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesWMIC2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x43
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x2d0]
call fcn.0040820f
mov byte [ebp - 4], 0x44
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel9
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f4d2
push ebx
lea esi, [ebp - 0x308]
call fcn.0040820f
mov byte [ebp - 4], 0x45
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f4d2
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f4a6
mov eax, dword [eax + 0x40]
jmp 0x44f4a9
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesFakeSystem2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x340]
call fcn.0040820f
mov byte [ebp - 4], 0x47
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel10
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f591
push ebx
lea esi, [ebp - 0x378]
call fcn.0040820f
mov byte [ebp - 4], 0x48
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f591
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f565
mov eax, dword [eax + 0x40]
jmp 0x44f568
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesAcrobat2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x3b0]
call fcn.0040820f
mov byte [ebp - 4], 0x4a
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel11
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f650
push ebx
lea esi, [ebp - 0x3e8]
call fcn.0040820f
mov byte [ebp - 4], 0x4b
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f650
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f624
mov eax, dword [eax + 0x40]
jmp 0x44f627
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesShellCode2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x420]
call fcn.0040820f
mov byte [ebp - 4], 0x4d
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel12
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f70f
push ebx
lea esi, [ebp - 0x458]
call fcn.0040820f
mov byte [ebp - 4], 0x4e
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f70f
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f6e3
mov eax, dword [eax + 0x40]
jmp 0x44f6e6
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesUncommon2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x4f
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x490]
call fcn.0040820f
mov byte [ebp - 4], 0x50
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel13
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f7ce
push ebx
lea esi, [ebp - 0x4c8]
call fcn.0040820f
mov byte [ebp - 4], 0x51
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f7ce
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f7a2
mov eax, dword [eax + 0x40]
jmp 0x44f7a5
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesSyskey2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x52
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x500]
call fcn.0040820f
mov byte [ebp - 4], 0x53
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel14
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f88d
push ebx
lea esi, [ebp - 0x538]
call fcn.0040820f
mov byte [ebp - 4], 0x54
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f88d
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f861
mov eax, dword [eax + 0x40]
jmp 0x44f864
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesCipher2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x55
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x570]
call fcn.0040820f
mov byte [ebp - 4], 0x56
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel15
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44f94c
push ebx
lea esi, [ebp - 0x5a8]
call fcn.0040820f
mov byte [ebp - 4], 0x57
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44f94c
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f920
mov eax, dword [eax + 0x40]
jmp 0x44f923
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesPublic2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x5e0]
call fcn.0040820f
mov byte [ebp - 4], 0x59
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel16
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44fa0b
push ebx
lea esi, [ebp - 0x618]
call fcn.0040820f
mov byte [ebp - 4], 0x5a
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp dword [ebp - 0x88], 0
je 0x44fa0b
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x54], 8
jb 0x44f9df
mov eax, dword [eax + 0x40]
jmp 0x44f9e2
add eax, 0x40
push eax
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesMSC2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 9
call fcn.00432745
push edi
lea esi, [ebp - 0x650]
call fcn.0040820f
mov byte [ebp - 4], 0x5c
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.0040338d
push str.Kernel17
add eax, 0x3c
call fcn.0041f63e
pop ecx
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
cmp byte [ebp - 0x81], 0
je 0x44fabb
push ebx
lea esi, [ebp - 0x688]
call fcn.0040820f
mov byte [ebp - 4], 0x5d
mov eax, esi
push eax
mov eax, dword [ebp - 0x8c]
call fcn.00403256
mov edi, eax
mov byte [ebp - 4], 9
push 0
push 1
call fcn.00409da6
test edi, edi
je 0x44fabb
cmp dword [edi + 0x54], 8
jb 0x44fa8f
mov edi, dword [edi + 0x40]
jmp 0x44fa92
add edi, 0x40
push edi
call fcn.005818e3
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x90], esp
push str.RulesCPL2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 9
call fcn.00432745
lea esi, [ebp - 0xa4]
call fcn.0041a3a5
xor ebx, ebx
jmp 0x44e5bb
mov byte [ebp - 4], 3
lea eax, [ebp - 0xc0]
push eax
call fcn.00408ca7
mov dword [ebp - 4], 2
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x80]
push eax
call fcn.004038cd
call fcn.0058ed26
ret