Function at 0x410f40
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b8e6
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_enter_
push str.stealth_manager
mov dword [ebp - 0xb4], edi
call fcn.00402590
push 0x47e570
lea edx, [edi + 0x58]
lea ecx, [ebp - 0x2c]
call fcn.00407760
push 0x4928d4
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00405f30
push 0x47e570
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00403970
add esp, 0x18
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x410fdf
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x41100b
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
push str.libs_
lea edx, [ebp - 0x74]
mov dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 0x10
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41215c
test al, 0x10
je 0x41215c
push 0x4865d8
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xad], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00407760
add esp, 4
push str.PocoCrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411150
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb8], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4110db
mov eax, dword [ecx]
jmp 0x4110dd
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x41111c
mov eax, dword [ecx]
jmp 0x41111e
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 8
call fcn.00410540
add esp, 0x30
test al, al
jne 0x41117e
push str.Update_poco_crypto_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x10
push 0
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xad]
jmp 0x41118b
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0xad], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x4111a1
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x4111c9
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x41122f
push 0x48662c
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa6], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.00407760
add esp, 4
push str.PocoFoundation.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411322
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4112ad
mov eax, dword [ecx]
jmp 0x4112af
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4112ee
mov eax, dword [ecx]
jmp 0x4112f0
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0xe
call fcn.00410540
add esp, 0x30
test al, al
jne 0x41134a
push str.Update_poco_foundation_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa6]
jmp 0x411351
mov byte [ebp - 0xa6], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x411367
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x41138f
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x4113f5
push 0x486690
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa7], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x12
call fcn.00407760
add esp, 4
push str.PocoJSON.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4114e8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x411473
mov eax, dword [ecx]
jmp 0x411475
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4114b4
mov eax, dword [ecx]
jmp 0x4114b6
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x14
call fcn.00410540
add esp, 0x30
test al, al
jne 0x411510
push str.Update_poco_json_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa7]
jmp 0x411517
mov byte [ebp - 0xa7], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x41152d
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x411555
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x4115bb
push 0x4866e4
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa8], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
call fcn.00407760
add esp, 4
push str.PocoNet.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4116ae
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x411639
mov eax, dword [ecx]
jmp 0x41163b
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x41167a
mov eax, dword [ecx]
jmp 0x41167c
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x1a
call fcn.00410540
add esp, 0x30
test al, al
jne 0x4116d6
push str.Update_poco_net_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa8]
jmp 0x4116dd
mov byte [ebp - 0xa8], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x4116f3
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x41171b
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x411781
push 0x486730
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa9], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.00407760
add esp, 4
push str.PocoNetSSL.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411874
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4117ff
mov eax, dword [ecx]
jmp 0x411801
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411840
mov eax, dword [ecx]
jmp 0x411842
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x20
call fcn.00410540
add esp, 0x30
test al, al
jne 0x41189c
push str.Update_poco_netssl_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa9]
jmp 0x4118a3
mov byte [ebp - 0xa9], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x4118b9
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x4118e1
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x411947
push 0x486784
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xaa], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x24
call fcn.00407760
add esp, 4
push str.PocoUtil.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411a3a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4119c5
mov eax, dword [ecx]
jmp 0x4119c7
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411a06
mov eax, dword [ecx]
jmp 0x411a08
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x26
call fcn.00410540
add esp, 0x30
test al, al
jne 0x411a62
push str.Update_poco_util_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xaa]
jmp 0x411a69
mov byte [ebp - 0xaa], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x411a7f
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x411aa7
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x411b0d
push 0x4867d8
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xab], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x2a
call fcn.00407760
add esp, 4
push str.PocoXML.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411c00
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x411b8b
mov eax, dword [ecx]
jmp 0x411b8d
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411bcc
mov eax, dword [ecx]
jmp 0x411bce
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x2c
call fcn.00410540
add esp, 0x30
test al, al
jne 0x411c28
push str.Update_poco_xml_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xab]
jmp 0x411c2f
mov byte [ebp - 0xab], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x411c45
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x411c6d
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x411cd3
push 0x486824
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xac], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x30
call fcn.00407760
add esp, 4
push str.libcrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x411dc6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x411d51
mov eax, dword [ecx]
jmp 0x411d53
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x33
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411d92
mov eax, dword [ecx]
jmp 0x411d94
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x32
call fcn.00410540
add esp, 0x30
test al, al
jne 0x411dee
push str.Update_libcrypto_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xac]
jmp 0x411df5
mov byte [ebp - 0xac], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x411e0b
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x411e33
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 4], 5
jmp 0x411e99
push 0x486878
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa5], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x36
call fcn.00407760
add esp, 4
push str.libssl.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2c]
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
je 0x411f15
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete bl
jmp 0x411fc2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411f46
mov eax, dword [ecx]
jmp 0x411f48
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x411f87
mov eax, dword [ecx]
jmp 0x411f89
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x38
call fcn.00410540
add esp, 0x30
test al, al
jne 0x411fc0
push str.Update_libssl_dll
push str.stealth_manager
call fcn.00402590
add esp, 8
jmp 0x411eee
mov bl, 1
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0xa5], bl
cmp edx, 0x10
jb 0x411fde
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x412058
mov ecx, dword [ebp - 0x44]
inc edx
push 1
call fcn.004024a0
add esp, 4
jmp 0x412058
mov bh, byte [ebp - 0xac]
movzx eax, bl
push eax
mov bl, byte [ebp - 0xad]
movzx eax, bh
push eax
movzx eax, byte [ebp - 0xab]
push eax
movzx eax, byte [ebp - 0xaa]
push eax
movzx eax, byte [ebp - 0xa9]
push eax
movzx eax, byte [ebp - 0xa8]
push eax
movzx eax, byte [ebp - 0xa7]
push eax
movzx eax, byte [ebp - 0xa6]
push eax
movzx eax, bl
push eax
push str.__d___d___d___d___d___d___d___d___d_
push str.stealth_manager
mov dword [ebp - 4], 5
call fcn.00402590
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_exit_
push str.stealth_manager
call fcn.00402590
add esp, 0x38
test bl, bl
je 0x412118
cmp byte [ebp - 0xa6], 0
je 0x412118
cmp byte [ebp - 0xa7], 0
je 0x412118
cmp byte [ebp - 0xa8], 0
je 0x412118
cmp byte [ebp - 0xa9], 0
je 0x412118
cmp byte [ebp - 0xaa], 0
je 0x412118
cmp byte [ebp - 0xab], 0
je 0x412118
test bh, bh
je 0x412118
cmp byte [ebp - 0xa5], 0
je 0x412118
mov bl, 1
jmp 0x41211a
xor bl, bl
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x412130
mov ecx, dword [ebp - 0x5c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp edx, 0x10
jb 0x412158
mov ecx, dword [ebp - 0x74]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov al, bl
jmp 0x41219c
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x412172
mov ecx, dword [ebp - 0x5c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp edx, 0x10
jb 0x41219a
mov ecx, dword [ebp - 0x74]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret