Function at 0x1006c6f0
Capabilities:
Check for software breakpoints
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183eb8
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2fdc
call fcn.10140530
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2f98], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2f9c], ecx
mov dword [ebp - 0x2f94], edx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2fa8], ecx
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x2f90], ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2fc8], edx
cmp eax, ecx
je 0x1006e72e
mov esi, eax
movzx eax, byte [esi]
push eax
call fcn.1012af01
add esp, 4
cmp eax, 0x4d
jne 0x1006c921
movzx ecx, byte [esi + 1]
push ecx
call fcn.1012af01
add esp, 4
cmp eax, 0x5a
jne 0x1006c921
mov edi, dword [esi + 0x3c]
cmp byte [esi + 4], 0
jne 0x1006c7ab
cmp byte [esi + 5], 0
je 0x1006c7d0
mov dword [ebp - 0x2f90], 1
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006c7d0
cmp byte [eax], 0
jne 0x1006c7d0
push 0x10156754
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp dword [ebp - 0x2f90], eax
je 0x1006c7e2
cmp ebx, eax
je 0x1006d37d
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x2f], eax
mov byte [ebp - 0x2b], al
mov dword [ebp - 0x2fb8], eax
cmp dword [ebp - 0x2f9c], eax
je 0x1006c839
mov edx, dword [ebp - 0x2f9c]
push edx
call fcn.1012b0ca
add esp, 4
mov esi, eax
push 0
push edi
mov edi, dword [ebp - 0x2f9c]
push edi
call fcn.1012b1f9
add esp, 0xc
push edi
push 6
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.1012a83e
push 0
push esi
push edi
call fcn.1012b1f9
add esp, 0x1c
jmp 0x1006c887
mov dword [ebp - 0x2fa0], 0
push 1
push 0
push 0
push 0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov dword [ebp - 0x2fac], eax
push 0
push 0
push edi
push 0
call esi
lea ecx, [ebp - 0x2fa0]
mov edx, 6
lea esi, [ebp - 0x30]
xor edi, edi
call fcn.1005aa20
push edi
push edi
mov ecx, dword [ebp - 0x2fac]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dl, byte [ebp - 0x2c]
mov byte [ebp - 0x2fb8], dl
mov al, byte [ebp - 0x2b]
mov byte [ebp - 0x2fb7], al
movzx ecx, byte [ebp - 0x30]
push ecx
call fcn.1012af01
add esp, 4
cmp eax, 0x50
jne 0x1006c8f8
movzx edx, byte [ebp - 0x2f]
push edx
call fcn.1012af01
add esp, 4
cmp eax, 0x45
jne 0x1006c8f8
cmp byte [ebp - 0x2e], 0
jne 0x1006c8f8
cmp byte [ebp - 0x2d], 0
jne 0x1006c8f8
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006c8e4
cmp byte [eax], 0
jne 0x1006c8e4
push 0x10156754
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 1
test ebx, ebx
je 0x1006c8f8
mov dword [ebx], 1
mov eax, dword [ebp - 0x2fb8]
cmp eax, 0x14c
je 0x1006c916
cmp eax, 0x8664
je 0x1006c916
test ebx, ebx
je 0x1006c916
mov dword [ebx], 0
mov ebx, dword [ebp - 0x2f98]
jmp 0x1006d37f
mov al, byte [esi]
cmp al, 0xd7
jne 0x1006c957
cmp byte [esi + 1], 0xcd
jne 0x1006c957
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006c948
cmp byte [eax], 0
jne 0x1006c948
push 0x1016aca4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 2
jmp 0x1006e72e
cmp al, 0x50
jne 0x1006cd92
cmp byte [esi + 1], 0x4b
jne 0x1006cd92
cmp byte [esi + 2], 3
jne 0x1006cd92
cmp byte [esi + 3], 4
jne 0x1006cd92
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006c998
cmp byte [eax], 0
jne 0x1006c998
push 0x10158008
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 3
mov ebx, esi
lea esi, [ebx + 0x1e]
cmp byte [esi], 0x5b
jne 0x1006ca09
cmp byte [ebx + 0x1f], 0x43
jne 0x1006ca09
push 0x13
push str._Content_Types_.xml
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006ca09
mov ecx, dword [ebp - 0x2fa8]
call fcn.1006c280
mov esi, eax
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006c9f4
test esi, esi
je 0x1006c9e8
push 0x1016aca8
jmp 0x1006c9ed
push str.OOXML
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
neg esi
sbb esi, esi
and esi, 0xe
add esi, 0x11
mov dword [ebp - 0x2f90], esi
jmp 0x1006e72e
cmp byte [esi], 0x6d
jne 0x1006ca4d
cmp byte [ebx + 0x1f], 0x69
jne 0x1006ca4d
push 0x2f
push str.mimetypeapplication_vnd.oasis.opendocument.text
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006ca4d
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006ca3e
push 0x1016ace4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x17
jmp 0x1006e72e
cmp byte [esi], 0x69
jne 0x1006cad9
cmp byte [ebx + 0x1f], 0x6e
jne 0x1006ca95
push 9
push str.index.xml
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006ca95
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006ca86
push str.PAGES
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x1c
jmp 0x1006e72e
cmp byte [esi], 0x69
jne 0x1006cad9
cmp byte [ebx + 0x1f], 0x6e
jne 0x1006cad9
push 0xa
push str.index.apxl
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006cad9
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006caca
push str.NUMBERS
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x1c
jmp 0x1006e72e
cmp byte [esi], 0x70
jne 0x1006cb1d
cmp byte [ebx + 0x1f], 0x72
jne 0x1006cb1d
push 0x11
push str.presentation.apxl
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006cb1d
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cb0e
push 0x1016ad24
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x1c
jmp 0x1006e72e
cmp byte [esi], 0x4d
jne 0x1006cb3c
cmp byte [ebx + 0x1f], 0x45
jne 0x1006cb3c
push 9
push str.META_INF_
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
je 0x1006cb67
cmp byte [esi], 0x6f
jne 0x1006cc36
cmp byte [ebx + 0x1f], 0x72
jne 0x1006cc36
push 4
push str.org_
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006cc36
lea eax, [ebx + 0x45]
cmp byte [eax], 0x69
jne 0x1006cbae
cmp byte [ebx + 0x46], 0x6d
jne 0x1006cbae
push 9
push str.images_PK
push eax
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006cbae
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cb9f
push str.EPUB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x26
jmp 0x1006e72e
xor edi, edi
mov dword [ebp - 0x2fe0], edi
mov eax, dword [ebp - 0x2fa8]
test eax, eax
je 0x1006cbd8
cmp byte [eax], 0
je 0x1006cbd8
push 0x2e
push eax
call fcn.10129030
add esp, 8
mov edi, eax
mov dword [ebp - 0x2fe0], edi
test edi, edi
je 0x1006cc11
cmp byte [esi], 0x4d
jne 0x1006cc11
cmp byte [ebx + 0x1f], 0x45
jne 0x1006cc11
push 9
push str.META_INF_
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006cc11
push str..APK
push edi
call fcn.10135887
add esp, 8
test eax, eax
je 0x1006cd6d
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cc27
push 0x10158744
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x24
jmp 0x1006e72e
cmp byte [esi], 0x6d
jne 0x1006cc59
cmp byte [ebx + 0x1f], 0x69
jne 0x1006cc59
push 0x18
push str.mimetypeapplication_epub
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
je 0x1006cb89
cmp byte [esi], 0x41
jne 0x1006cc7c
cmp byte [ebx + 0x1f], 0x6e
jne 0x1006cc7c
push 0xf
push str.AndroidManifest
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
je 0x1006cd6d
cmp dword [ebp + 0x10], 0x100
jbe 0x1006d37f
mov byte [ebp - 0x18c], 0
push 0x13f
push 0
lea eax, [ebp - 0x18b]
push eax
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x2fc0], 0
mov edi, dword [ebp - 0x2f9c]
test edi, edi
je 0x1006cd01
push edi
call fcn.1012b0ca
add esp, 4
mov esi, eax
push 2
push 0xffffff00
push edi
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x1006cd4e
push edi
push 0x100
push 1
lea ecx, [ebp - 0x18c]
push ecx
call fcn.1012a83e
mov dword [ebp - 0x2fc0], eax
push 0
push esi
push edi
call fcn.1012b1f9
add esp, 0x1c
jmp 0x1006cd4e
push 1
push 0
push 0
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
mov dword [ebp - 0x2fa0], eax
push 2
push 0
push 0xffffff00
push 0
call ebx
lea ecx, [ebp - 0x2fc0]
mov edx, 0x100
lea esi, [ebp - 0x18c]
xor edi, edi
call fcn.1005aa20
push edi
push edi
mov edx, dword [ebp - 0x2fa0]
push edx
push edi
call ebx
mov ebx, dword [ebp - 0x2f98]
mov eax, dword [ebp - 0x2fc0]
mov ecx, str.META_INF_
lea edx, [ebp - 0x18c]
call fcn.10063770
cmp eax, 0xffffffff
je 0x1006d37f
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cd83
push 0x1016ad30
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x25
jmp 0x1006e72e
mov ebx, esi
mov dword [ebp - 0x2fe8], esi
mov al, byte [esi]
cmp al, 0x20
je 0x1006e709
cmp al, 9
je 0x1006e709
cmp al, 0xa0
je 0x1006e709
cmp al, 0xd
je 0x1006e709
cmp al, 0xa
je 0x1006e709
push 5
mov eax, str.begin
mov ecx, esi
call fcn.1005a0e0
add esp, 4
test eax, eax
jne 0x1006ce1c
mov al, byte [esi + 5]
cmp al, 0x20
je 0x1006cde8
cmp al, 9
je 0x1006cde8
cmp al, 0xa0
jne 0x1006ce1c
test edi, edi
je 0x1006cdf2
mov dword [edi], 1
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006ce0d
cmp byte [eax], 0
jne 0x1006ce0d
push str.UUENCODED
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 4
jmp 0x1006e72e
push str.Standard_Jet_DB
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebx + 4]
mov eax, str.Standard_Jet_DB
call fcn.1005a0e0
add esp, 4
test eax, eax
jne 0x1006ce66
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006ce57
cmp byte [eax], 0
jne 0x1006ce57
push str.JETDB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 5
jmp 0x1006e72e
cmp byte [ebx], 0x52
jne 0x1006cea7
cmp byte [ebx + 1], 0x61
jne 0x1006cea7
cmp byte [ebx + 2], 0x72
jne 0x1006cea7
cmp byte [ebx + 3], 0x21
jne 0x1006cea7
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006ce98
cmp byte [eax], 0
jne 0x1006ce98
push 0x101580c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 6
jmp 0x1006e72e
push 0
push str.wscript
push ebx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006cef0
test edi, edi
je 0x1006cec6
mov dword [edi], 1
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cee1
cmp byte [eax], 0
jne 0x1006cee1
push str.WSCRIPT
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 9
jmp 0x1006e72e
cmp byte [ebx], 0x58
jne 0x1006cf3b
cmp byte [ebx + 1], 0x35
jne 0x1006cf3b
cmp byte [ebx + 2], 0x4f
jne 0x1006cf3b
cmp byte [ebx + 3], 0x21
jne 0x1006cf3b
test edi, edi
je 0x1006cf11
mov dword [edi], 1
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cf2c
cmp byte [eax], 0
jne 0x1006cf2c
push str.EICAR
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0xb
jmp 0x1006e72e
push 0
push str.autorun
push ebx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006cf84
test edi, edi
je 0x1006cf5a
mov dword [edi], 1
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cf75
cmp byte [eax], 0
jne 0x1006cf75
push 0x10158258
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0xd
jmp 0x1006e72e
mov al, byte [ebx]
cmp al, 0x4d
jne 0x1006cfc6
cmp byte [ebx + 1], 0x53
jne 0x1006cfc6
cmp byte [ebx + 2], 0x43
jne 0x1006cfc6
cmp byte [ebx + 3], 0x46
jne 0x1006cfc6
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cfb7
cmp byte [eax], 0
jne 0x1006cfb7
push 0x101580c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0xe
jmp 0x1006e72e
cmp al, 0x7b
jne 0x1006d005
lea ecx, [ebx + 1]
mov eax, 0x101580c8
call fcn.1005a140
test eax, eax
jne 0x1006d005
mov eax, dword [ebp - 0x2f94]
test eax, eax
je 0x1006cff6
cmp byte [eax], 0
jne 0x1006cff6
push 0x10158004
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0xf
jmp 0x1006e72e
cmp byte [ebx], 0xd0
jne 0x1006d37f
cmp byte [ebx + 1], 0xcf
jne 0x1006d37f
cmp byte [ebx + 2], 0x11
jne 0x1006d37f
cmp byte [ebx + 3], 0xe0
jne 0x1006d37f
cmp byte [ebx + 4], 0xa1
jne 0x1006d37f
cmp byte [ebx + 5], 0xb1
jne 0x1006d37f
cmp byte [ebx + 6], 0x1a
jne 0x1006d37f
cmp byte [ebx + 7], 0xe1
jne 0x1006d37f
cmp dword [ebp + 0x10], 0x400
jbe 0x1006d33b
mov byte [ebp - 0x68c], 0
push 0x4ff
push 0
lea eax, [ebp - 0x68b]
push eax
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x2fbc], 0
mov edi, dword [ebp - 0x2f9c]
test edi, edi
je 0x1006d0d9
push edi
call fcn.1012b0ca
add esp, 4
mov esi, eax
push 2
push 0xfffffc00
push edi
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x1006d11d
push edi
push 0x400
push 1
lea ecx, [ebp - 0x68c]
push ecx
call fcn.1012a83e
mov dword [ebp - 0x2fbc], eax
push 0
push esi
push edi
call fcn.1012b1f9
add esp, 0x1c
jmp 0x1006d11d
push 1
push 0
push 0
xor edi, edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
mov dword [ebp - 0x2fa0], eax
push 2
push edi
push 0xfffffc00
push edi
call ebx
lea ecx, [ebp - 0x2fbc]
mov edx, 0x400
lea esi, [ebp - 0x68c]
call fcn.1005aa20
push edi
push edi
mov edx, dword [ebp - 0x2fa0]
push edx
push edi
call ebx
xor edi, edi
mov bl, 0x6f
mov dword [ebp - 0x2fe4], edi
cmp edi, dword [ebp - 0x2fbc]
jae 0x1006d33b
lea esi, [ebp + edi - 0x68c]
mov al, byte [esi]
cmp al, 0x50
jne 0x1006d1a4
cmp byte [ebp + edi - 0x68b], 0
jne 0x1006d335
cmp byte [ebp + edi - 0x68a], bl
jne 0x1006d335
push 0x13
push str.PowerPoint_Document
push esi
call fcn.1012c093
add esp, 0xc
test eax, eax
jne 0x1006d335
mov dword [ebp - 0x2f90], 0x12
mov esi, dword [ebp - 0x2f94]
test esi, esi
je 0x1006d341
cmp byte [esi], al
jne 0x1006d341
push 0x1016adb4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006d341
cmp al, 0x42
jne 0x1006d20d
cmp byte [ebp + edi - 0x68b], 0
jne 0x1006d335
cmp byte [ebp + edi - 0x68a], bl
jne 0x1006d335
push 4
push 0x1016adb8
push esi
call fcn.1012b138
add esp, 0xc
test eax, eax
jne 0x1006d335
mov dword [ebp - 0x2f90], 0x13
mov esi, dword [ebp - 0x2f94]
test esi, esi
je 0x1006d341
cmp byte [esi], 0
jne 0x1006d341
push 0x1016adc4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006d341
cmp al, 0x57
jne 0x1006d283
mov al, byte [ebp + edi - 0x68b]
test al, al
jne 0x1006d232
cmp byte [ebp + edi - 0x68a], bl
jne 0x1006d335
push 8
push 0x1016adc8
jmp 0x1006d1ca
cmp al, bl
jne 0x1006d335
push 0xd
push str.Word.Document
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d335
mov dword [ebp - 0x2f90], 0x14
mov esi, dword [ebp - 0x2f94]
test esi, esi
je 0x1006d341
cmp byte [esi], al
jne 0x1006d341
push 0x1016adec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006d341
cmp al, 0x4d
jne 0x1006d335
cmp byte [ebp + edi - 0x68b], 0x69
jne 0x1006d335
mov edx, str.Microsoft_Excel
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1006d2c0
test al, al
je 0x1006d2bc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1006d2c0
add ecx, 2
add edx, 2
test al, al
jne 0x1006d2a0
xor eax, eax
jmp 0x1006d2c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006d1db
mov edx, str.Microsoft_Excel_2003_Worksheet
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1006d2f4
test al, al
je 0x1006d2f0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1006d2f4
add ecx, 2
add edx, 2
test al, al
jne 0x1006d2d4
xor eax, eax
jmp 0x1006d2f9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006d1db
mov ecx, str.Microsoft_Excel_2003
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006d32b
test dl, dl
je 0x1006d324
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006d32b
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006d308
xor eax, eax
jmp 0x1006d1d3
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x1006d1d3
inc edi
jmp 0x1006d121
mov esi, dword [ebp - 0x2f94]
cmp dword [ebp - 0x2f90], 0
jne 0x1006c916
mov dword [ebp - 0x2f90], 0x16
test esi, esi
je 0x1006c916
cmp byte [esi], 0
jne 0x1006c916
push 0x1015676c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [ebp - 0x2f98]
jmp 0x1006d37f
mov ebx, esi
cmp dword [ebp - 0x2f90], 0
jne 0x1006d3c6
cmp byte [ebx], 0x89
jne 0x1006d3c6
cmp byte [ebx + 1], 0x50
jne 0x1006d3c6
cmp byte [ebx + 2], 0x4e
jne 0x1006d3c6
mov edi, dword [ebp - 0x2f94]
cmp byte [ebx + 3], 0x47
jne 0x1006d3cc
mov dword [ebp - 0x2f90], 0x19
test edi, edi
je 0x1006d3cc
cmp byte [edi], 0
jne 0x1006d3cc
push 0x10158000
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006d3cc
mov edi, dword [ebp - 0x2f94]
mov esi, dword [ebp - 0x2f90]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x37
jne 0x1006d421
cmp byte [ebx + 1], 0x7a
jne 0x1006d421
cmp byte [ebx + 2], 0xbc
jne 0x1006d421
cmp byte [ebx + 3], 0xaf
jne 0x1006d421
cmp byte [ebx + 4], 0x27
jne 0x1006d421
cmp byte [ebx + 5], 0x1c
jne 0x1006d421
test edi, edi
je 0x1006d412
cmp byte [edi], 0
jne 0x1006d412
push 0x10158048
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x20
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
lea ecx, [ebx + 7]
cmp byte [ecx], 0
je 0x1006d467
push 7
mov eax, str.ACE
call fcn.1005a0e0
add esp, 4
test eax, eax
jne 0x1006d467
test edi, edi
je 0x1006d458
cmp byte [edi], al
jne 0x1006d458
push 0x10157fd0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x21
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x1f
jne 0x1006d49e
cmp byte [ebx + 1], 0x8b
jne 0x1006d49e
test edi, edi
je 0x1006d48f
cmp byte [edi], 0
jne 0x1006d48f
push 0x1015800c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x22
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x42
jne 0x1006d4db
cmp byte [ebx + 1], 0x5a
jne 0x1006d4db
cmp byte [ebx + 2], 0x68
jne 0x1006d4db
test edi, edi
je 0x1006d4cc
cmp byte [edi], 0
jne 0x1006d4cc
push str.BZIP2
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x23
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
lea eax, [ebx + 0x3c]
cmp byte [eax], 0x42
jne 0x1006d528
cmp byte [ebx + 0x3d], 0x4f
jne 0x1006d528
push 8
push str.BOOKMOBI
push eax
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d528
test edi, edi
je 0x1006d519
cmp byte [edi], al
jne 0x1006d519
push str.MOBI
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x27
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x7f
jne 0x1006d56b
cmp byte [ebx + 1], 0x45
jne 0x1006d56b
cmp byte [ebx + 2], 0x4c
jne 0x1006d56b
cmp byte [ebx + 3], 0x46
jne 0x1006d56b
test edi, edi
je 0x1006d55c
cmp byte [edi], 0
jne 0x1006d55c
push 0x1016ae54
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x28
jmp 0x1006e72e
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x47
jne 0x1006d5aa
cmp byte [ebx + 1], 0x49
jne 0x1006d5aa
cmp byte [ebx + 2], 0x46
jne 0x1006d5aa
cmp byte [ebx + 3], 0x38
jne 0x1006d5aa
mov esi, 0x2a
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d5aa
cmp byte [edi], 0
jne 0x1006d5aa
push 0x10157ff8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x42
jne 0x1006d5dd
cmp byte [ebx + 1], 0x4d
jne 0x1006d5dd
mov esi, 0x2b
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d5dd
cmp byte [edi], 0
jne 0x1006d5dd
push 0x10157ffc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0xff
jne 0x1006d625
cmp byte [ebx + 1], 0xd8
jne 0x1006d625
cmp byte [ebx + 2], 0xff
jne 0x1006d625
mov al, byte [ebx + 3]
cmp al, 0xdb
je 0x1006d605
cmp al, 0xe0
je 0x1006d605
cmp al, 0xe1
jne 0x1006d625
mov esi, 0x2c
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d625
cmp byte [edi], 0
jne 0x1006d625
push 0x10158040
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0xce
jne 0x1006d664
cmp byte [ebx + 1], 0xfa
jne 0x1006d664
cmp byte [ebx + 2], 0xed
jne 0x1006d664
cmp byte [ebx + 3], 0xfe
jne 0x1006d664
mov esi, 0x2d
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d664
cmp byte [edi], 0
jne 0x1006d664
push str.MachoI32
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0xcf
jne 0x1006d6a3
cmp byte [ebx + 1], 0xfa
jne 0x1006d6a3
cmp byte [ebx + 2], 0xed
jne 0x1006d6a3
cmp byte [ebx + 3], 0xfe
jne 0x1006d6a3
mov esi, 0x2e
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d6a3
cmp byte [edi], 0
jne 0x1006d6a3
push str.MachoI64
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx + 3], 0xce
jne 0x1006d6e2
cmp byte [ebx + 2], 0xfa
jne 0x1006d6e2
cmp byte [ebx + 1], 0xed
jne 0x1006d6e2
cmp byte [ebx], 0xfe
jne 0x1006d6e2
mov esi, 0x2f
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d6e2
cmp byte [edi], 0
jne 0x1006d6e2
push str.MachoP32
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx + 3], 0xcf
jne 0x1006d721
cmp byte [ebx + 2], 0xfa
jne 0x1006d721
cmp byte [ebx + 1], 0xed
jne 0x1006d721
cmp byte [ebx], 0xfe
jne 0x1006d721
mov esi, 0x30
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d721
cmp byte [edi], 0
jne 0x1006d721
push str.MachoP64
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0xca
jne 0x1006d760
cmp byte [ebx + 1], 0xfe
jne 0x1006d760
cmp byte [ebx + 2], 0xba
jne 0x1006d760
cmp byte [ebx + 3], 0xbe
jne 0x1006d760
mov esi, 0x31
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d760
cmp byte [edi], 0
jne 0x1006d760
push str.MachoUni
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 3
jne 0x1006d7b7
cmp byte [ebx + 1], 0
jne 0x1006d7b7
cmp byte [ebx + 2], 8
jne 0x1006d7b7
cmp byte [ebx + 3], 0
jne 0x1006d7b7
cmp byte [ebx + 8], 1
jne 0x1006d7b7
cmp byte [ebx + 9], 0
jne 0x1006d7b7
cmp byte [ebx + 0xa], 0x1c
jne 0x1006d7b7
cmp byte [ebx + 0xb], 0
jne 0x1006d7b7
mov esi, 0x32
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d7b7
cmp byte [edi], 0
jne 0x1006d7b7
push str.AXML
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x64
jne 0x1006d808
cmp byte [ebx + 1], 0x65
jne 0x1006d808
cmp byte [ebx + 2], 0x78
jne 0x1006d808
cmp byte [ebx + 3], 0xa
jne 0x1006d808
cmp byte [ebx + 4], 0x30
jne 0x1006d808
cmp byte [ebx + 5], 0x33
jne 0x1006d808
cmp byte [ebx + 7], 0
jne 0x1006d808
mov esi, 0x33
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d808
cmp byte [edi], 0
jne 0x1006d808
push 0x1016ae9c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x49
jne 0x1006d859
cmp byte [ebx + 1], 0x54
jne 0x1006d859
cmp byte [ebx + 2], 0x53
jne 0x1006d859
cmp byte [ebx + 3], 0x46
jne 0x1006d859
cmp byte [ebx + 5], 0
jne 0x1006d859
cmp byte [ebx + 6], 0
jne 0x1006d859
cmp byte [ebx + 7], 0
jne 0x1006d859
mov esi, 0x34
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d859
cmp byte [edi], 0
jne 0x1006d859
push 0x1016aea0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
push 0xb
push str.__PS_Adobe_
push ebx
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d8ab
push 6
push str._EPSF_
lea eax, [ebx + 0xe]
push eax
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d8ab
mov esi, 0x35
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d8ab
cmp byte [edi], al
jne 0x1006d8ab
push 0x1016aeb8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
cmp byte [ebx], 0x46
jne 0x1006d8f0
cmp byte [ebx + 1], 0x4f
jne 0x1006d8f0
cmp byte [ebx + 2], 0x52
jne 0x1006d8f0
cmp byte [ebx + 3], 0x4d
jne 0x1006d8f0
cmp byte [ebx + 4], 0
jne 0x1006d8f0
mov esi, 0x36
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d8f0
cmp byte [edi], 0
jne 0x1006d8f0
push 0x1016aebc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
push 7
push str.ftyp3gp
lea ecx, [ebx + 4]
push ecx
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d92e
mov esi, 0x37
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d92e
cmp byte [edi], al
jne 0x1006d92e
push 0x1016aec8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
push 7
push str.ftypM4A
lea edx, [ebx + 4]
push edx
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d96c
mov esi, 0x38
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d96c
cmp byte [edi], al
jne 0x1006d96c
push 0x1016aed4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
push 7
push str.ftypM4V
lea eax, [ebx + 4]
push eax
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006d9aa
mov esi, 0x39
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006d9aa
cmp byte [edi], al
jne 0x1006d9aa
push 0x1016aee0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006da0f
lea esi, [ebx + 4]
push 8
push str.ftypMSNV
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
je 0x1006d9ed
push 8
push str.ftypisom
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
je 0x1006d9ed
push 8
push str.ftypmp42
push esi
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006da0f
mov esi, 0x3a
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006da15
cmp byte [edi], 0
jne 0x1006da15
push 0x1016af08
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006da15
mov esi, dword [ebp - 0x2f90]
test esi, esi
jne 0x1006e0b2
push 6
push str.ftypqt
lea ecx, [ebx + 4]
push ecx
call fcn.101293e6
add esp, 0xc
test eax, eax
jne 0x1006da53
mov esi, 0x3b
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006da53
cmp byte [edi], al
jne 0x1006da53
push 0x1016af14
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x4d
jne 0x1006da92
cmp byte [ebx + 1], 0x54
jne 0x1006da92
cmp byte [ebx + 2], 0x68
jne 0x1006da92
cmp byte [ebx + 3], 0x64
jne 0x1006da92
mov esi, 0x3c
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006da92
cmp byte [edi], 0
jne 0x1006da92
push 0x1016af18
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x38
jne 0x1006dad1
cmp byte [ebx + 1], 0x42
jne 0x1006dad1
cmp byte [ebx + 2], 0x50
jne 0x1006dad1
cmp byte [ebx + 3], 0x53
jne 0x1006dad1
mov esi, 0x3d
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dad1
cmp byte [edi], 0
jne 0x1006dad1
push 0x1016af1c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x7e
jne 0x1006db10
cmp byte [ebx + 1], 0x42
jne 0x1006db10
cmp byte [ebx + 2], 0x4b
jne 0x1006db10
cmp byte [ebx + 3], 0
jne 0x1006db10
mov esi, 0x3e
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006db10
cmp byte [edi], 0
jne 0x1006db10
push 0x1016af20
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x53
jne 0x1006db79
cmp byte [ebx + 1], 0x49
jne 0x1006db79
cmp byte [ebx + 2], 0x54
jne 0x1006db79
cmp byte [ebx + 3], 0x21
jne 0x1006db79
cmp byte [ebx + 4], 0
jne 0x1006db79
cmp byte [ebx + 6], 0
jne 0x1006db79
cmp byte [ebx + 0xa], 0x72
jne 0x1006db79
cmp byte [ebx + 0xb], 0x4c
jne 0x1006db79
cmp byte [ebx + 0xc], 0x61
jne 0x1006db79
cmp byte [ebx + 0xd], 0x75
jne 0x1006db79
cmp byte [ebx + 0xe], 2
jne 0x1006db79
mov esi, 0x3f
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006db79
cmp byte [edi], 0
jne 0x1006db79
push 0x10157fd8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0
jne 0x1006dc06
mov eax, str.APPLaust_
mov dword [ebp - 0x2fcc], eax
cmp byte [eax], 0
je 0x1006db9d
inc eax
jmp 0x1006db8f
sub eax, str.APPLaust_
push eax
lea ecx, [ebx + 0x41]
mov eax, str.APPLaust_
call fcn.1005a0e0
add esp, 4
test eax, eax
jne 0x1006dc06
mov eax, str.StuffIt
mov dword [ebp - 0x2fd0], eax
cmp byte [eax], 0
je 0x1006dbca
inc eax
jmp 0x1006dbbc
sub eax, str.StuffIt
push eax
lea ecx, [ebx + 0x80]
mov eax, str.StuffIt
call fcn.1005a0e0
add esp, 4
test eax, eax
jne 0x1006dc06
mov esi, 0x40
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dc06
cmp byte [edi], al
jne 0x1006dc06
push 0x10157ff0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x42
jne 0x1006dc3f
cmp byte [ebx + 1], 0x5a
jne 0x1006dc3f
cmp byte [ebx + 2], 0x68
jne 0x1006dc3f
mov esi, 0x41
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dc3f
cmp byte [edi], 0
jne 0x1006dc3f
push 0x10157fd4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x49
jne 0x1006dc78
cmp byte [ebx + 1], 0x44
jne 0x1006dc78
cmp byte [ebx + 2], 0x33
jne 0x1006dc78
mov esi, 0x42
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dc78
cmp byte [edi], 0
jne 0x1006dc78
push 0x10157ff4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
mov al, byte [ebx]
cmp al, 0x43
je 0x1006dc8a
cmp al, 0x46
jne 0x1006dcb6
cmp byte [ebx + 1], 0x57
jne 0x1006dcb6
cmp byte [ebx + 2], 0x53
jne 0x1006dcb6
mov esi, 0x43
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dcb6
cmp byte [edi], 0
jne 0x1006dcb6
push 0x10157fb0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006dd25
cmp byte [ebx + 1], 0x49
jne 0x1006dd25
cmp byte [ebx + 2], 0x46
jne 0x1006dd25
cmp byte [ebx + 3], 0x46
jne 0x1006dd25
cmp byte [ebx + 8], 0x57
jne 0x1006dd25
cmp byte [ebx + 9], 0x41
jne 0x1006dd25
cmp byte [ebx + 0xa], 0x56
jne 0x1006dd25
cmp byte [ebx + 0xb], 0x45
jne 0x1006dd25
cmp byte [ebx + 0xc], 0x66
jne 0x1006dd25
cmp byte [ebx + 0xd], 0x6d
jne 0x1006dd25
cmp byte [ebx + 0xe], 0x74
jne 0x1006dd25
cmp byte [ebx + 0xf], 0x20
jne 0x1006dd25
mov esi, 0x44
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dd25
cmp byte [edi], 0
jne 0x1006dd25
push 0x1016af24
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006dd94
cmp byte [ebx + 1], 0x49
jne 0x1006dd94
cmp byte [ebx + 2], 0x46
jne 0x1006dd94
cmp byte [ebx + 3], 0x46
jne 0x1006dd94
cmp byte [ebx + 8], 0x41
jne 0x1006dd94
cmp byte [ebx + 9], 0x56
jne 0x1006dd94
cmp byte [ebx + 0xa], 0x49
jne 0x1006dd94
cmp byte [ebx + 0xb], 0x20
jne 0x1006dd94
cmp byte [ebx + 0xc], 0x4c
jne 0x1006dd94
cmp byte [ebx + 0xd], 0x49
jne 0x1006dd94
cmp byte [ebx + 0xe], 0x53
jne 0x1006dd94
cmp byte [ebx + 0xf], 0x54
jne 0x1006dd94
mov esi, 0x45
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dd94
cmp byte [edi], 0
jne 0x1006dd94
push 0x10158044
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006de03
cmp byte [ebx + 1], 0x49
jne 0x1006de03
cmp byte [ebx + 2], 0x46
jne 0x1006de03
cmp byte [ebx + 3], 0x46
jne 0x1006de03
cmp byte [ebx + 8], 0x43
jne 0x1006de03
cmp byte [ebx + 9], 0x44
jne 0x1006de03
cmp byte [ebx + 0xa], 0x44
jne 0x1006de03
cmp byte [ebx + 0xb], 0x41
jne 0x1006de03
cmp byte [ebx + 0xc], 0x66
jne 0x1006de03
cmp byte [ebx + 0xd], 0x6d
jne 0x1006de03
cmp byte [ebx + 0xe], 0x74
jne 0x1006de03
cmp byte [ebx + 0xf], 0x20
jne 0x1006de03
mov esi, 0x46
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006de03
cmp byte [edi], 0
jne 0x1006de03
push 0x1016af28
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006de72
cmp byte [ebx + 1], 0x49
jne 0x1006de72
cmp byte [ebx + 2], 0x46
jne 0x1006de72
cmp byte [ebx + 3], 0x46
jne 0x1006de72
cmp byte [ebx + 8], 0x51
jne 0x1006de72
cmp byte [ebx + 9], 0x4c
jne 0x1006de72
cmp byte [ebx + 0xa], 0x43
jne 0x1006de72
cmp byte [ebx + 0xb], 0x4d
jne 0x1006de72
cmp byte [ebx + 0xc], 0x66
jne 0x1006de72
cmp byte [ebx + 0xd], 0x6d
jne 0x1006de72
cmp byte [ebx + 0xe], 0x74
jne 0x1006de72
cmp byte [ebx + 0xf], 0x20
jne 0x1006de72
mov esi, 0x47
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006de72
cmp byte [edi], 0
jne 0x1006de72
push 0x1016af2c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006dee1
cmp byte [ebx + 1], 0x49
jne 0x1006dee1
cmp byte [ebx + 2], 0x46
jne 0x1006dee1
cmp byte [ebx + 3], 0x46
jne 0x1006dee1
cmp byte [ebx + 8], 0x52
jne 0x1006dee1
cmp byte [ebx + 9], 0x4d
jne 0x1006dee1
cmp byte [ebx + 0xa], 0x49
jne 0x1006dee1
cmp byte [ebx + 0xb], 0x44
jne 0x1006dee1
cmp byte [ebx + 0xc], 0x64
jne 0x1006dee1
cmp byte [ebx + 0xd], 0x61
jne 0x1006dee1
cmp byte [ebx + 0xe], 0x74
jne 0x1006dee1
cmp byte [ebx + 0xf], 0x61
jne 0x1006dee1
mov esi, 0x48
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dee1
cmp byte [edi], 0
jne 0x1006dee1
push 0x1016af30
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006df38
cmp byte [ebx + 1], 0x49
jne 0x1006df38
cmp byte [ebx + 2], 0x46
jne 0x1006df38
cmp byte [ebx + 3], 0x46
jne 0x1006df38
cmp byte [ebx + 8], 0x57
jne 0x1006df38
cmp byte [ebx + 9], 0x45
jne 0x1006df38
cmp byte [ebx + 0xa], 0x42
jne 0x1006df38
cmp byte [ebx + 0xb], 0x50
jne 0x1006df38
mov esi, 0x49
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006df38
cmp byte [edi], 0
jne 0x1006df38
push str.WEBP
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x52
jne 0x1006df77
cmp byte [ebx + 1], 0x49
jne 0x1006df77
cmp byte [ebx + 2], 0x46
jne 0x1006df77
cmp byte [ebx + 3], 0x46
jne 0x1006df77
mov esi, 0x4a
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006df77
cmp byte [edi], 0
jne 0x1006df77
push 0x1016af3c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
mov al, byte [ebx]
cmp al, 0x49
jne 0x1006dfa5
cmp byte [ebx + 1], 0x20
jne 0x1006df90
cmp byte [ebx + 2], al
je 0x1006dfcf
cmp al, 0x49
jne 0x1006dfa5
cmp byte [ebx + 1], al
jne 0x1006dfa5
cmp byte [ebx + 2], 0x2a
jne 0x1006dfa5
cmp byte [ebx + 3], 0
je 0x1006dfcf
cmp al, 0x4d
jne 0x1006dfef
cmp byte [ebx + 1], al
jne 0x1006dfba
cmp byte [ebx + 2], 0
jne 0x1006dfba
cmp byte [ebx + 3], 0x2a
je 0x1006dfcf
cmp al, 0x4d
jne 0x1006dfef
cmp byte [ebx + 1], al
jne 0x1006dfef
cmp byte [ebx + 2], 0
jne 0x1006dfef
cmp byte [ebx + 3], 0x2b
jne 0x1006dfef
mov esi, 0x4b
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006dfef
cmp byte [edi], 0
jne 0x1006dfef
push 0x1016af40
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
cmp byte [ebx], 0x4c
jne 0x1006e02e
cmp byte [ebx + 1], 0x5a
jne 0x1006e02e
cmp byte [ebx + 2], 0x49
jne 0x1006e02e
cmp byte [ebx + 3], 0x50
jne 0x1006e02e
mov esi, 0x4c
mov dword [ebp - 0x2f90], esi
test edi, edi
je 0x1006e02e
cmp byte [edi], 0
jne 0x1006e02e
push str.LZIP
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jne 0x1006e0b2
mov esi, dword [str._PDF_]
mov dx, word [0x10157fb8]
mov word [ebp - 0x34], dx
lea ecx, [ebp - 0x48]
mov eax, dword [ebx]
mov dword [ebp - 0x48], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x44], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x3c], edx
xor edx, edx
mov dword [ebp - 0x2fdc], edx
mov dword [ebp - 0x2fd4], ecx
cmp edx, 0xb
jae 0x1006e082
mov al, byte [ecx]
cmp al, 0x20
je 0x1006e07e
cmp al, 9
jne 0x1006e082
inc ecx
inc edx
jmp 0x1006e063
cmp dword [ecx], esi
jne 0x1006e0b2
mov al, byte [ebp - 0x34]
cmp al, byte [ecx + 4]
jne 0x1006e0b2
test edi, edi
je 0x1006e0a3
cmp byte [edi], 0
jne 0x1006e0a3
push 0x10157fbc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x10
jmp 0x1006e72e
mov eax, dword [ebp - 0x2f90]
test eax, eax
jne 0x1006e37f
cmp byte [ebx], 0x30
jne 0x1006e112
cmp byte [ebx + 1], 0x26
jne 0x1006e112
cmp byte [ebx + 2], 0xb2
jne 0x1006e112
cmp byte [ebx + 3], 0x75
jne 0x1006e112
cmp byte [ebx + 4], 0x8e
jne 0x1006e112
cmp byte [ebx + 5], 0x66
jne 0x1006e112
cmp byte [ebx + 6], 0xcf
jne 0x1006e112
cmp byte [ebx + 7], 0x11
jne 0x1006e112
test edi, edi
je 0x1006e103
cmp byte [edi], al
jne 0x1006e103
push 0x1016af44
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0xa
jmp 0x1006e72e
test eax, eax
jne 0x1006e37f
cmp dword [ebp + 0x10], 0x8006
jbe 0x1006e37f
mov byte [ebp - 0x28], al
mov dword [ebp - 0x27], eax
mov byte [ebp - 0x23], al
mov dword [ebp - 0x2fac], eax
cmp dword [ebp - 0x2f9c], eax
je 0x1006e197
mov ecx, dword [ebp - 0x2f9c]
push ecx
call fcn.1012b0ca
add esp, 4
mov esi, eax
push 0
push 0x8001
mov edx, dword [ebp - 0x2f9c]
push edx
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x1006e1e1
mov eax, dword [ebp - 0x2f9c]
push eax
push 5
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.1012a83e
mov dword [ebp - 0x2fac], eax
push 0
push esi
mov edx, dword [ebp - 0x2f9c]
push edx
call fcn.1012b1f9
add esp, 0x1c
jmp 0x1006e1e1
push 1
push 0
push 0
xor edi, edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
mov dword [ebp - 0x2fa0], eax
push edi
push edi
push 0x8001
push edi
call ebx
lea ecx, [ebp - 0x2fac]
lea edx, [edi + 5]
lea esi, [ebp - 0x28]
call fcn.1005aa20
push edi
push edi
mov eax, dword [ebp - 0x2fa0]
push eax
push edi
call ebx
mov edi, dword [ebp - 0x2f94]
mov ebx, dword [ebp - 0x2f98]
mov ecx, str.BEA01
lea eax, [ebp - 0x28]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e210
test dl, dl
je 0x1006e20c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e210
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e1f0
xor eax, eax
jmp 0x1006e215
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.BOOT2
lea eax, [ebp - 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e245
test dl, dl
je 0x1006e241
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e245
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e225
xor eax, eax
jmp 0x1006e24a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.CD001
lea eax, [ebp - 0x28]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e280
test dl, dl
je 0x1006e27c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e280
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e260
xor eax, eax
jmp 0x1006e285
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.CDW02
lea eax, [ebp - 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e2b5
test dl, dl
je 0x1006e2b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e2b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e295
xor eax, eax
jmp 0x1006e2ba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.NSR02
lea eax, [ebp - 0x28]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e2f0
test dl, dl
je 0x1006e2ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e2f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e2d0
xor eax, eax
jmp 0x1006e2f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.NSR03
lea eax, [ebp - 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e321
test dl, dl
je 0x1006e31d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e321
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e301
xor eax, eax
jmp 0x1006e326
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006e35b
mov ecx, str.TEA01
lea eax, [ebp - 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1006e352
test dl, dl
je 0x1006e34e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1006e352
add eax, 2
add ecx, 2
test dl, dl
jne 0x1006e332
xor eax, eax
jmp 0x1006e357
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1006e37f
test edi, edi
je 0x1006e370
cmp byte [edi], 0
jne 0x1006e370
push 0x101580d0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2f90], 0x29
jmp 0x1006e72e
cmp dword [ebp - 0x2f90], 0
jne 0x1006e72e
mov dword [ebp - 0x2fc4], ebx
mov ecx, dword [ebp - 0x2fa8]
push ecx
lea edx, [ebp - 0x2fc8]
push edx
lea ecx, [ebp - 0x2fc4]
call fcn.1007a320
add esp, 8
mov al, byte [ebx]
test al, al
je 0x1006e72e
cmp al, 0x3c
jne 0x1006e45d
mov eax, str.__xml_version
mov ecx, ebx
call fcn.1005a140
test eax, eax
jne 0x1006e3fe
push eax
push str._office:document
push ebx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006e45d
mov dword [ebp - 0x2f90], 0x18
test edi, edi
je 0x1006e45d
cmp byte [edi], 0
jne 0x1006e45d
push str.ODFXML
jmp 0x1006e456
mov eax, 0x1016af9c
mov ecx, ebx
call fcn.1005a140
test eax, eax
je 0x1006e43e
mov eax, str.__DOCTYPE
mov ecx, ebx
call fcn.1005a140
test eax, eax
je 0x1006e43e
mov eax, str._html
mov ecx, ebx
call fcn.1005a140
test eax, eax
je 0x1006e43e
mov eax, str._meta
mov ecx, ebx
call fcn.1005a140
test eax, eax
jne 0x1006e45d
mov dword [ebp - 0x2f90], 0x1a
test edi, edi
je 0x1006e45d
cmp byte [edi], 0
jne 0x1006e45d
push str.HTML
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
mov dword [ebp - 0x2fec], ebx
xor edi, edi
mov dword [ebp - 0x2ff4], edi
xor esi, esi
mov dword [ebp - 0x2ff0], esi
cmp esi, dword [ebp - 0x2fc8]
jae 0x1006e4cf
mov eax, dword [ebp - 0x2f98]
mov al, byte [eax + esi]
cmp al, 9
je 0x1006e4b4
cmp al, 0xa
je 0x1006e4b4
cmp al, 0xd
je 0x1006e4b4
cmp al, 0x92
je 0x1006e4b4
cmp al, 0x95
je 0x1006e4b4
cmp al, 0x20
jb 0x1006e4a5
cmp al, 0x7e
jbe 0x1006e4b4
mov dword [ebp - 0x2fec], 0
jmp 0x1006e72e
movzx eax, al
call fcn.1005ecc0
test eax, eax
je 0x1006e4c7
inc edi
mov dword [ebp - 0x2ff4], edi
cmp edi, 0x10
ja 0x1006e4cf
inc esi
jmp 0x1006e472
test ebx, ebx
je 0x1006e72e
mov byte [ebp - 0x2f8c], 0
push 0x28ff
push 0
lea ecx, [ebp - 0x2f8b]
push ecx
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x2fa4], 0
mov edi, dword [ebp - 0x2f9c]
test edi, edi
je 0x1006e548
push edi
call fcn.1012b0ca
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.1012b1f9
add esp, 0xc
push edi
push 0x2800
push 1
lea edx, [ebp - 0x2f8c]
push edx
call fcn.1012a83e
mov dword [ebp - 0x2fa4], eax
push 0
push esi
push edi
call fcn.1012b1f9
add esp, 0x1c
jmp 0x1006e587
push 1
push 0
push 0
xor edi, edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
mov dword [ebp - 0x2fc4], eax
push edi
push edi
push edi
push edi
call ebx
lea ecx, [ebp - 0x2fa4]
mov edx, 0x2800
lea esi, [ebp - 0x2f8c]
call fcn.1005aa20
push edi
push edi
mov eax, dword [ebp - 0x2fc4]
push eax
push edi
call ebx
xor ebx, ebx
mov dword [ebp - 0x2fd8], ebx
mov dword [ebp - 0x2fb0], ebx
lea ecx, [ebp - 0x2f8c]
mov dword [ebp - 0x2f9c], ecx
mov edx, dword [ebp - 0x2fa8]
push edx
lea eax, [ebp - 0x2fa4]
push eax
lea ecx, [ebp - 0x2f9c]
call fcn.1007a320
add esp, 8
xor eax, eax
mov esi, dword [ebp - 0x2fa4]
mov dword [ebp - 0x2fb4], eax
cmp eax, esi
jae 0x1006e5fb
lea edx, [ebp + eax - 0x2f8c]
mov cl, byte [edx]
cmp cl, 0xa
je 0x1006e653
cmp cl, 0xd
je 0x1006e653
sub esi, eax
push esi
push edx
lea ecx, [ebp - 0x2f8c]
push ecx
call fcn.10130710
add esp, 0xc
mov dword [ebp - 0x2fa4], esi
xor edi, edi
mov dword [ebp - 0x2fb4], edi
cmp edi, dword [ebp - 0x2fa4]
jae 0x1006e697
cmp byte [ebp + edi - 0x2f8c], 0xa
jne 0x1006e659
lea eax, [edi + 1]
cmp eax, 0xffffffff
je 0x1006e691
lea esi, [ebp + eax - 0x2f8c]
mov al, byte [esi]
cmp al, 0xd
je 0x1006e697
cmp al, 0xa
je 0x1006e697
test ebx, ebx
jne 0x1006e661
mov eax, str.Date:
mov ecx, esi
call fcn.1005a140
test eax, eax
jne 0x1006e661
mov ebx, 1
mov dword [ebp - 0x2fd8], ebx
jmp 0x1006e688
inc eax
jmp 0x1006e5c5
test edi, edi
jne 0x1006e691
xor eax, eax
jmp 0x1006e621
cmp dword [ebp - 0x2fb0], 0
jne 0x1006e684
mov eax, str.From:
mov ecx, esi
call fcn.1005a140
test eax, eax
jne 0x1006e684
mov dword [ebp - 0x2fb0], 1
test ebx, ebx
je 0x1006e691
cmp dword [ebp - 0x2fb0], 0
jne 0x1006e697
inc edi
jmp 0x1006e5fd
mov esi, dword [ebp - 0x2f94]
test esi, esi
je 0x1006e72e
cmp byte [esi], 0
jne 0x1006e72e
test ebx, ebx
je 0x1006e6d3
cmp dword [ebp - 0x2fb0], 0
je 0x1006e6d3
mov dword [ebp - 0x2f90], 0x1d
push 0x101580cc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006e72e
mov eax, str._ping_info_
mov ecx, dword [ebp - 0x2f98]
call fcn.1005a140
test eax, eax
jne 0x1006e6f1
mov dword [ebp - 0x2f90], eax
mov byte [esi], al
jmp 0x1006e72e
mov dword [ebp - 0x2f90], 0x1b
push 0x1016afe8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1006e72e
inc esi
jmp 0x1006cd94
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x2f90]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.10127db1
mov esp, ebp
pop ebp
ret