Function at 0x908840
Capabilities:
Check for software breakpoints
Parse pe header

Disassembly:
push ecx
cmp dword [esp + 0x24], 1
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, eax
jne 0x908876
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf204
push ecx
mov dword [eax], 0x9a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [edi], 0x3e8
jbe 0x9089e2
push 0
push esi
mov ecx, str.4D5A
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9088f8
push 0x4e
push esi
mov ecx, str.54686973206973206120547275655479706520666F6E742C206E6F7420612070726F6772616D2E
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9088f8
push 0x80
push esi
mov ecx, str.4E45
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9088f8
push 0xed
push esi
mov ecx, str.464F4E54444952
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9088f8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf278
push eax
mov dword [edx], 0x14f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [edi], 0x3e8
jbe 0x9089e2
push 0
push esi
mov ecx, str.4D5A
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x3b
push esi
mov ecx, str.0040000000504500004C
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x139
push esi
mov ecx, str.72737263000000
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x15f
push esi
mov ecx, str.402E697473
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x1ee
push esi
mov ecx, str.560053005F00560045005200530049004F004E005F0049004E0046004F
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x24a
push esi
mov ecx, str.53007400720069006E006700460069006C00650049006E0066006F
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x286
push esi
mov ecx, str.460069006C006500560065007200730069006F006E
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
push 0x2ea
push esi
mov ecx, str.460069006C0065004400650073006300720069007000740069006F006E000000000043006F006D00700069006C00650064
call fcn.009049b0
add esp, 8
test eax, eax
je 0x9089e2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf200
push edx
mov dword [ecx], 0x14e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [edi]
cmp edi, 0x21
jbe 0x908a5a
mov cl, byte [esi]
test cl, cl
jne 0x908aa8
cmp byte [esi + 1], cl
jne 0x908a5a
cmp byte [esi + 2], 1
jne 0x908a5a
cmp byte [esi + 3], cl
jne 0x908a5a
cmp byte [esi + 5], cl
jne 0x908a5a
cmp byte [esi + 9], cl
jne 0x908a5a
cmp byte [esi + 0xb], cl
jne 0x908a5a
cmp byte [esi + 0xd], cl
jne 0x908a5a
cmp byte [esi + 0x11], cl
jne 0x908a5a
cmp byte [esi + 0x14], cl
jne 0x908a5a
cmp byte [esi + 0x15], cl
jne 0x908a5a
cmp byte [esi + 0x19], cl
jne 0x908a5a
cmp byte [esi + 0x1b], cl
jne 0x908a5a
cmp byte [esi + 0x1d], cl
jne 0x908a5a
cmp byte [esi + 0x21], cl
jne 0x908a5a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf3b4
push ecx
mov dword [eax], 5
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov cl, byte [esi]
test cl, cl
jne 0x908aa8
cmp byte [esi + 1], 0xbf
jne 0x908aa8
cmp byte [esi + 2], cl
jne 0x908aa8
cmp byte [esi + 3], cl
jne 0x908aa8
cmp byte [esi + 6], 0x54
jne 0x908aa8
cmp byte [esi + 7], 0x43
jne 0x908aa8
cmp byte [esi + 8], 0x53
jne 0x908aa8
cmp byte [esi + 9], 0x4f
jne 0x908aa8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf3b8
push eax
mov dword [edx], 7
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp cl, 0x30
jne 0x908ac5
cmp byte [esi + 4], 6
jne 0x908ac5
cmp byte [esi + 5], 9
jne 0x908ac5
cmp byte [esi + 6], 0x2a
jne 0x908ac5
cmp byte [esi + 7], 0x86
je 0x908adf
mov bl, byte [esi + 5]
cmp bl, 6
jne 0x908aff
cmp byte [esi + 6], 9
jne 0x908aff
cmp byte [esi + 7], 0x2a
jne 0x908aff
cmp byte [esi + 8], 0x86
jne 0x908aff
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf3bc
push edx
mov dword [ecx], 0xc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dl, byte [esi + 2]
cmp dl, 0x43
jne 0x908b37
cmp byte [esi + 3], 0x54
jne 0x908b37
cmp byte [esi + 4], 5
jne 0x908b37
test bl, bl
jne 0x908b37
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf3c0
push ecx
mov dword [eax], 0x10
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp edi, 0x45
jbe 0x908c93
test cl, cl
jne 0x908c93
cmp byte [esi + 1], cl
jne 0x908c93
cmp dl, 2
jne 0x908c93
cmp byte [esi + 3], cl
jne 0x908c93
test bl, bl
jne 0x908c93
mov al, 0x20
cmp byte [esi + 6], al
jne 0x908c93
cmp byte [esi + 7], al
jne 0x908c93
cmp byte [esi + 9], bl
jne 0x908c93
cmp byte [esi + 0xb], bl
jne 0x908c93
cmp byte [esi + 0xd], bl
jne 0x908c93
cmp byte [esi + 0x10], bl
jne 0x908c93
cmp byte [esi + 0x11], bl
jne 0x908c93
cmp byte [esi + 0x13], bl
jne 0x908c93
cmp byte [esi + 0x14], bl
jne 0x908c93
cmp byte [esi + 0x15], bl
jne 0x908c93
cmp byte [esi + 0x18], bl
jne 0x908c93
cmp byte [esi + 0x19], bl
jne 0x908c93
cmp byte [esi + 0x1b], bl
jne 0x908c93
cmp byte [esi + 0x1d], bl
jne 0x908c93
cmp byte [esi + 0x1f], bl
jne 0x908c93
cmp byte [esi + 0x20], bl
jne 0x908c93
cmp byte [esi + 0x21], bl
jne 0x908c93
cmp byte [esi + 0x25], bl
jne 0x908c93
cmp byte [esi + 0x27], bl
jne 0x908c93
cmp byte [esi + 0x28], bl
jne 0x908c93
cmp byte [esi + 0x29], bl
jne 0x908c93
cmp byte [esi + 0x2c], bl
jne 0x908c93
cmp byte [esi + 0x2d], bl
jne 0x908c93
cmp byte [esi + 0x2f], bl
jne 0x908c93
cmp byte [esi + 0x30], bl
jne 0x908c93
cmp byte [esi + 0x31], bl
jne 0x908c93
cmp byte [esi + 0x33], bl
jne 0x908c93
cmp byte [esi + 0x35], bl
jne 0x908c93
cmp byte [esi + 0x37], bl
jne 0x908c93
cmp byte [esi + 0x38], bl
jne 0x908c93
cmp byte [esi + 0x39], bl
jne 0x908c93
cmp byte [esi + 0x3c], bl
jne 0x908c93
cmp byte [esi + 0x3d], bl
jne 0x908c93
cmp byte [esi + 0x3e], bl
jne 0x908c93
cmp byte [esi + 0x3f], bl
jne 0x908c93
cmp byte [esi + 0x40], bl
jne 0x908c93
cmp byte [esi + 0x41], bl
jne 0x908c93
cmp byte [esi + 0x45], bl
jne 0x908c93
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf3c4
push eax
mov dword [edx], 0x11
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp cl, 0x49
jne 0x908cc9
cmp byte [esi + 1], 0x44
jne 0x908cc9
cmp dl, 0x33
jne 0x908cc9
cmp byte [esi + 4], 0
jne 0x908cc9
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf3c8
push edx
mov dword [ecx], 0x17
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp cl, 0x4c
jne 0x908cd4
cmp byte [esi + 1], 1
je 0x908cdf
cmp cl, 0xc0
jne 0x908d2a
cmp byte [esi + 1], 1
jne 0x908d2a
cmp byte [esi + 0xe], 0
jne 0x908d2a
cmp byte [esi + 0xf], 0
jne 0x908d2a
push 0
push 0
push edi
push str.NETMANIAC
push esi
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
jne 0x9097e6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf3d8
push ecx
mov dword [eax], 0x1b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x38]
jmp 0x909807
test dl, dl
jne 0x908d5e
cmp byte [esi + 3], dl
jne 0x908d5e
cmp byte [esi + 4], 2
jne 0x908d5e
cmp bl, 0x5a
jne 0x908d5e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf3dc
push eax
mov dword [edx], 0x2c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, str.__PS_Adobe
inc edi
cmp byte [edi], 0
jne 0x908d63
lea ebx, [esi + 6]
sub edi, str.__PS_Adobe
mov eax, str.__PS_Adobe
mov ecx, ebx
call fcn.00904d50
test eax, eax
jne 0x908da2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf3ec
push edx
mov dword [ecx], 0x30
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [ebx], 0xca
jne 0x908dd9
cmp byte [esi + 7], 0xc0
jne 0x908dd9
cmp byte [esi + 8], 0xa6
jne 0x908dd9
cmp byte [esi + 9], 0x60
jne 0x908dd9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push str.Virus_Signature
push ecx
mov dword [eax], 0x5b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, str._____BEGIN_CERTIFICATE_
mov edi, edi
inc edi
cmp byte [edi], 0
jne 0x908de0
mov ecx, dword [esp + 0x2c]
sub edi, str._____BEGIN_CERTIFICATE_
mov eax, str._____BEGIN_CERTIFICATE_
call fcn.00904d50
test eax, eax
jne 0x908e2c
cmp dword [esp + 0x3c], 0x1000
ja 0x9097e6
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf418
push eax
mov dword [edx], 0x60
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi], 0
jne 0x908e6f
cmp byte [esi + 1], 4
jne 0x908e6f
cmp byte [esi + 2], 0
jne 0x908e6f
cmp byte [esi + 3], 0
jne 0x908e6f
cmp byte [esi + 0xc], 0xa
jne 0x908e6f
cmp byte [esi + 0xd], 0
jne 0x908e6f
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf41c
push edx
mov dword [ecx], 0x65
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x908eb2
mov eax, 0xace5d4
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x908eb2
cmp byte [esi], al
jne 0x908eb2
cmp byte [esi + 1], al
jne 0x908eb2
cmp byte [esi + 2], 1
jne 0x908eb2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push str.EXE_ICON_File
push ecx
mov dword [eax], 0x6a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi], 0xd
jne 0x908f0b
cmp byte [esi + 1], 0
jne 0x908f0b
mov al, 0x3f
cmp byte [esi + 6], al
jne 0x908eca
cmp byte [esi + 7], 0
je 0x908ed5
cmp byte [esi + 8], al
jne 0x908f0b
cmp byte [esi + 9], 0
jne 0x908f0b
cmp byte [esi + 0xa], al
jne 0x908ee0
cmp byte [esi + 0xb], 0
je 0x908eeb
cmp byte [esi + 0xc], al
jne 0x908f0b
cmp byte [esi + 0xd], 0
jne 0x908f0b
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf430
push eax
mov dword [edx], 0x72
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi + 4], 0x53
jne 0x908f43
cmp byte [esi + 5], 0x43
jne 0x908f43
cmp byte [esi + 6], 0x43
jne 0x908f43
cmp byte [esi + 7], 0x41
jne 0x908f43
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf434
push edx
mov dword [ecx], 0x73
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea ebx, [esi + 8]
mov edi, 4
mov eax, str.sdbf
mov ecx, ebx
call fcn.00904d50
test eax, eax
jne 0x908f7b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf440
push ecx
mov dword [eax], 0x76
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov cl, byte [esi + 4]
cmp cl, 0xef
jne 0x908fb5
cmp byte [esi + 5], 0xcd
jne 0x908fb5
cmp byte [esi + 6], 0xab
jne 0x908fb5
cmp byte [esi + 7], 0x89
jne 0x908fb5
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf444
push eax
mov dword [edx], 0x7b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
cmp al, 3
jne 0x908fe7
cmp byte [esi + 2], 2
jne 0x908fe7
cmp byte [esi + 3], 9
jne 0x908fe7
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push str.SBSI_DAT
push edx
mov dword [ecx], 0x81
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp al, 0x30
jne 0x90901c
mov al, 0x82
cmp byte [esi + 1], al
jne 0x90901c
cmp cl, 0x30
jne 0x90901c
cmp byte [esi + 5], al
jne 0x90901c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf454
push ecx
mov dword [eax], 0x83
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi + 1], 0xf3
jne 0x90904e
cmp byte [esi + 2], 0x9f
jne 0x90904e
cmp byte [esi + 3], 0x77
jne 0x90904e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf458
push eax
mov dword [edx], 0x84
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi + 6], 0xd3
jne 0x909085
cmp byte [esi + 7], 0x11
jne 0x909085
cmp byte [ebx], 0x9c
jne 0x909085
cmp byte [esi + 9], 0x26
jne 0x909085
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf45c
push edx
mov dword [ecx], 0x86
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, str.Pqtch
lea ebx, [ebx]
inc edi
cmp byte [edi], 0
jne 0x909090
mov ebx, dword [esp + 0x2c]
sub edi, str.Pqtch
lea ecx, [ebx + 3]
mov eax, str.Pqtch
call fcn.00904d50
test eax, eax
jne 0x9090d1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push str.QTCH
push ecx
mov dword [eax], 0x8e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x2a
push ebx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x90912d
lea edi, [eax + 1]
push 6
mov eax, 0xadf470
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x90910d
push 7
mov eax, str.Feature
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x90912d
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf480
push eax
mov dword [edx], 0x99
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esp + 0x34], 0xffffffff
mov bl, 0xff
jne 0x90927d
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 0x100
jbe 0x90927d
cmp byte [esi], 0x4d
jne 0x90927d
cmp byte [esi + 1], 0x5a
jne 0x90927d
cmp byte [esi + 5], 0
jne 0x90927d
cmp byte [esi + 6], 0
jne 0x90927d
cmp byte [esi + 7], 0
jne 0x90927d
cmp byte [esi + 9], 0
jne 0x90927d
cmp byte [esi + 0xa], 0
jne 0x90927d
cmp byte [esi + 0xb], 0
jne 0x90927d
cmp byte [esi + 0xc], bl
jne 0x90927d
cmp byte [esi + 0xd], bl
jne 0x90927d
cmp byte [esi + 0xf], 0
jne 0x90927d
cmp byte [esi + 0x14], 0
jne 0x90927d
cmp byte [esi + 0x15], 0
jne 0x90927d
cmp byte [esi + 0x16], 0
jne 0x90927d
cmp byte [esi + 0x17], 0
jne 0x90927d
cmp byte [esi + 0x18], 0x40
jne 0x90927d
cmp byte [esi + 0x19], 0
jne 0x90927d
cmp byte [esi + 0x1a], 0
jne 0x90927d
cmp byte [esi + 0x1b], 0
jne 0x90927d
add esi, 0x100
xor ebp, ebp
xor ebx, ebx
mov edi, 0x100
cmp byte [esi], 0x46
jne 0x909247
push 7
mov eax, str.FONTDIR
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x90922f
lea ebp, [eax + 1]
jmp 0x909247
push 7
mov eax, str.FONTRES
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x909247
lea ebx, [eax + 1]
inc esi
sub edi, 1
jne 0x909210
test ebp, ebp
je 0x909811
test ebx, ebx
je 0x909811
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf204
push eax
mov dword [edx], 0x9a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea edi, [esi + 4]
mov eax, str.Standard
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x9092b6
cmp byte [esi + 0xd], 0x4a
je 0x9092b6
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push str.ACCD
push edx
mov dword [ecx], 0x9c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
cmp al, 2
jne 0x9092ed
cmp byte [edi], 0x53
jne 0x9092ed
cmp byte [esi + 5], 0x44
jne 0x9092ed
cmp byte [esi + 6], 0x4d
jne 0x9092ed
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf4a8
push ecx
mov dword [eax], 0x9f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test al, al
jne 0x909322
cmp byte [edi], 0x4b
jne 0x909322
cmp byte [esi + 5], 0x43
jne 0x909322
cmp byte [esi + 6], 0x4d
jne 0x909322
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf4ac
push eax
mov dword [edx], 0xa1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, str.NSB1
inc edi
cmp byte [edi], 0
jne 0x909327
lea ebp, [esi + 4]
sub edi, str.NSB1
mov eax, str.NSB1
mov ecx, ebp
call fcn.00904d50
test eax, eax
jne 0x909366
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf4b8
push edx
mov dword [ecx], 0xa8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.Bud1
mov ecx, ebp
call fcn.00904d50
test eax, eax
jne 0x909398
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push str.DS_Store
push ecx
mov dword [eax], 0xc8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi + 8], bl
jne 0x9093e4
cmp byte [esi + 9], bl
jne 0x9093e4
cmp byte [esi + 0xa], bl
jne 0x9093e4
cmp byte [esi + 0xb], bl
jne 0x9093e4
cmp byte [esi + 0xc], 0
jne 0x9093e4
cmp byte [esi + 0xd], 0
jne 0x9093e4
cmp byte [esi + 0xe], 0
jne 0x9093e4
cmp byte [esi + 0xf], 0
jne 0x9093e4
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf4d0
push eax
mov dword [edx], 0xd8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.RECR
lea ecx, [esi + 1]
call fcn.00904d50
test eax, eax
jne 0x909417
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push str.META
push edx
mov dword [ecx], 0xde
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.WBRK
lea ecx, [esi + 2]
call fcn.00904d50
test eax, eax
jne 0x90944a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf458
push ecx
mov dword [eax], 0x108
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea ebp, [esi + 3]
xor edi, edi
mov eax, str._Work
mov ecx, ebp
call fcn.00904d50
test eax, eax
je 0x9097c6
lea ebx, [esi + 2]
mov eax, str._Work
mov ecx, ebx
call fcn.00904d50
test eax, eax
je 0x9097c6
mov eax, str.GPDS
lea ecx, [esi + 1]
call fcn.00904d50
test eax, eax
jne 0x9094ab
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf500
push eax
mov dword [edx], 0x10a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.MySQL
mov ecx, ebp
call fcn.00904d50
test eax, eax
jne 0x9094dd
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push str.MySQL_Dump
push edx
mov dword [ecx], 0x10e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.Win4
lea ecx, [esi + 4]
call fcn.00904d50
test eax, eax
jne 0x909510
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf520
push ecx
mov dword [eax], 0x10f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x909561
push 4
mov eax, str..MUI
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x909561
lea ecx, [esi + 0xa0]
xor edi, edi
mov eax, str.Rich
call fcn.00904d50
test eax, eax
jne 0x909561
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf534
push eax
mov dword [edx], 0x11e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
cmp al, 1
je 0x90956b
cmp al, 2
jne 0x909596
cmp byte [ebx], 0x50
jne 0x909596
cmp byte [ebp], 0x48
jne 0x909596
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf538
push edx
mov dword [ecx], 0x12c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp al, 6
je 0x90959e
cmp al, 7
jne 0x9095c9
cmp byte [ebx], 0x48
jne 0x9095c9
cmp byte [ebp], 0x59
jne 0x9095c9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf53c
push ecx
mov dword [eax], 0x12e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, edi
mov eax, str.COREL
lea ecx, [esi + 1]
call fcn.00904d50
test eax, eax
jne 0x9095fc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf548
push eax
mov dword [edx], 0x138
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
cmp al, 0xfe
jne 0x909634
cmp byte [esi + 1], 1
jne 0x909634
cmp byte [esi + 5], 0
jne 0x909634
cmp byte [esi + 6], 0
jne 0x909634
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf54c
push edx
mov dword [ecx], 0x141
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp al, 1
jne 0x90966a
cmp byte [esi + 0xc], 0x33
jne 0x90966a
cmp byte [esi + 0xd], 0x7f
jne 0x90966a
cmp byte [esi + 0xe], 0x7c
jne 0x90966a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf550
push ecx
mov dword [eax], 0x14a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi + 1], 0
jne 0x9096a3
lea ecx, [esi + 0xc]
xor edi, edi
mov eax, str.BEAC
call fcn.00904d50
test eax, eax
jne 0x9096a3
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf55c
push eax
mov dword [edx], 0x14c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 8
jbe 0x909732
cmp byte [esi], 5
jne 0x909732
cmp byte [esi + 1], 0
jne 0x909732
cmp byte [ebx], 0
jne 0x909732
cmp byte [ebp], 0
jne 0x909732
cmp byte [esi + 4], 1
jne 0x909732
cmp byte [esi + 5], 0
jne 0x909732
cmp byte [esi + 6], 1
jne 0x909732
cmp byte [esi + 7], 0
jne 0x909732
cmp byte [esi + 8], 0
jne 0x909732
mov edi, str.pictures
lea esp, [esp]
inc edi
cmp byte [edi], 0
jne 0x9096f0
sub edi, str.pictures
neg edi
sbb edi, edi
inc edi
lea ecx, [esi + 0xe]
mov eax, str.pictures
call fcn.00904d50
test eax, eax
je 0x909732
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0xadf56c
push eax
mov dword [edx], 0x34
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esi], 0
jne 0x909761
cmp byte [esi + 1], 1
jne 0x909761
cmp byte [esi + 2], 0
jne 0x909761
cmp byte [ebp], 0
jne 0x909761
cmp byte [esi + 0xc], 0x44
jne 0x909761
cmp byte [esi + 0xd], 0x53
jne 0x909761
cmp byte [esi + 0xe], 0x49
jne 0x909761
cmp byte [esi + 0xf], 0x47
je 0x9097a6
mov al, byte [esi + 0xc]
cmp al, 0x4f
jne 0x90977a
cmp byte [esi + 0xd], 0x53
jne 0x90977a
cmp byte [esi + 0xe], 0x2f
jne 0x90977a
cmp byte [esi + 0xf], 0x32
je 0x9097a6
cmp al, 0x4c
jne 0x909790
cmp byte [esi + 0xd], 0x54
jne 0x909790
cmp byte [esi + 0xe], 0x53
jne 0x909790
cmp byte [esi + 0xf], 0x48
je 0x9097a6
cmp al, 0x42
jne 0x909811
cmp byte [esi + 0xd], 0x41
jne 0x909811
cmp byte [esi + 0xe], 0x53
jne 0x909811
cmp byte [esi + 0xf], 0x45
jne 0x909811
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0xadf570
push edx
mov dword [ecx], 0x57
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push 0xadf4f4
push ecx
mov dword [eax], 0x109
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [edx], 0
test eax, eax
je 0x909803
cmp dword [eax], 0
jne 0x909803
mov dword [eax], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x909811
mov dword [eax], 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret