Function at 0x4149a0
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421046
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x42e024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_enter_
push str.stealth_manager
mov dword [ebp - 0xb4], edi
call fcn.00402620
push 0x423638
lea edx, [edi + 0x58]
lea ecx, [ebp - 0x2c]
call fcn.00404f90
push 0x42ea70
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00406350
push 0x423638
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00404f40
add esp, 0x18
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x414a3b
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x414a63
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
push str.libs_
lea edx, [ebp - 0x74]
mov dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 0x10
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x415b64
test al, 0x10
je 0x415b64
push 0x4282ec
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xad], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00404f90
add esp, 4
push str.PocoCrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x414ba8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb8], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x414b33
mov eax, dword [ecx]
jmp 0x414b35
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x414b74
mov eax, dword [ecx]
jmp 0x414b76
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 8
call fcn.00414010
add esp, 0x30
test al, al
jne 0x414bd6
push str.Update_poco_crypto_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x10
push 0
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xad]
jmp 0x414be3
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0xad], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x414bf5
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x414c19
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x414c7f
push 0x428340
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa6], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.00404f90
add esp, 4
push str.PocoFoundation.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x414d72
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x414cfd
mov eax, dword [ecx]
jmp 0x414cff
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x414d3e
mov eax, dword [ecx]
jmp 0x414d40
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0xe
call fcn.00414010
add esp, 0x30
test al, al
jne 0x414d9a
push str.Update_poco_foundation_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa6]
jmp 0x414da1
mov byte [ebp - 0xa6], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x414db3
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x414dd7
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x414e3d
push 0x4283a4
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa7], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x12
call fcn.00404f90
add esp, 4
push str.PocoJSON.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x414f30
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x414ebb
mov eax, dword [ecx]
jmp 0x414ebd
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x414efc
mov eax, dword [ecx]
jmp 0x414efe
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x14
call fcn.00414010
add esp, 0x30
test al, al
jne 0x414f58
push str.Update_poco_json_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa7]
jmp 0x414f5f
mov byte [ebp - 0xa7], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x414f71
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x414f95
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x414ffb
push 0x4283f8
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa8], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
call fcn.00404f90
add esp, 4
push str.PocoNet.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4150ee
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x415079
mov eax, dword [ecx]
jmp 0x41507b
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4150ba
mov eax, dword [ecx]
jmp 0x4150bc
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x1a
call fcn.00414010
add esp, 0x30
test al, al
jne 0x415116
push str.Update_poco_net_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa8]
jmp 0x41511d
mov byte [ebp - 0xa8], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x41512f
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x415153
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x4151b9
push 0x428444
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa9], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.00404f90
add esp, 4
push str.PocoNetSSL.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4152ac
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x415237
mov eax, dword [ecx]
jmp 0x415239
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x415278
mov eax, dword [ecx]
jmp 0x41527a
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x20
call fcn.00414010
add esp, 0x30
test al, al
jne 0x4152d4
push str.Update_poco_netssl_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa9]
jmp 0x4152db
mov byte [ebp - 0xa9], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x4152ed
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x415311
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x415377
push 0x428498
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xaa], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x24
call fcn.00404f90
add esp, 4
push str.PocoUtil.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x41546a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4153f5
mov eax, dword [ecx]
jmp 0x4153f7
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x415436
mov eax, dword [ecx]
jmp 0x415438
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x26
call fcn.00414010
add esp, 0x30
test al, al
jne 0x415492
push str.Update_poco_util_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xaa]
jmp 0x415499
mov byte [ebp - 0xaa], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x4154ab
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x4154cf
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x415535
push 0x4284ec
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xab], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x2a
call fcn.00404f90
add esp, 4
push str.PocoXML.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x415628
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x4155b3
mov eax, dword [ecx]
jmp 0x4155b5
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4155f4
mov eax, dword [ecx]
jmp 0x4155f6
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x2c
call fcn.00414010
add esp, 0x30
test al, al
jne 0x415650
push str.Update_poco_xml_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xab]
jmp 0x415657
mov byte [ebp - 0xab], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x415669
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x41568d
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x4156f3
push 0x428538
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xac], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x30
call fcn.00404f90
add esp, 4
push str.libcrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4157e6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x415771
mov eax, dword [ecx]
jmp 0x415773
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x33
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4157b2
mov eax, dword [ecx]
jmp 0x4157b4
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x32
call fcn.00414010
add esp, 0x30
test al, al
jne 0x41580e
push str.Update_libcrypto_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xac]
jmp 0x415815
mov byte [ebp - 0xac], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x415827
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x41584b
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
mov dword [ebp - 4], 5
jmp 0x4158b1
push 0x42858c
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa5], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x36
call fcn.00404f90
add esp, 4
push str.libssl.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2c]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
je 0x41592d
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete bl
jmp 0x4159da
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x41595e
mov eax, dword [ecx]
jmp 0x415960
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x41599f
mov eax, dword [ecx]
jmp 0x4159a1
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00404370
mov byte [ebp - 4], 0x38
call fcn.00414010
add esp, 0x30
test al, al
jne 0x4159d8
push str.Update_libssl_dll
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x415906
mov bl, 1
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0xa5], bl
cmp eax, 0x10
jb 0x4159f2
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x415a68
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00404770
jmp 0x415a68
mov bh, byte [ebp - 0xac]
movzx eax, bl
push eax
mov bl, byte [ebp - 0xad]
movzx eax, bh
push eax
movzx eax, byte [ebp - 0xab]
push eax
movzx eax, byte [ebp - 0xaa]
push eax
movzx eax, byte [ebp - 0xa9]
push eax
movzx eax, byte [ebp - 0xa8]
push eax
movzx eax, byte [ebp - 0xa7]
push eax
movzx eax, byte [ebp - 0xa6]
push eax
movzx eax, bl
push eax
push str.__d___d___d___d___d___d___d___d___d_
push str.stealth_manager
mov dword [ebp - 4], 5
call fcn.00402620
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_exit_
push str.stealth_manager
call fcn.00402620
add esp, 0x38
test bl, bl
je 0x415b28
cmp byte [ebp - 0xa6], 0
je 0x415b28
cmp byte [ebp - 0xa7], 0
je 0x415b28
cmp byte [ebp - 0xa8], 0
je 0x415b28
cmp byte [ebp - 0xa9], 0
je 0x415b28
cmp byte [ebp - 0xaa], 0
je 0x415b28
cmp byte [ebp - 0xab], 0
je 0x415b28
test bh, bh
je 0x415b28
cmp byte [ebp - 0xa5], 0
je 0x415b28
mov bl, 1
jmp 0x415b2a
xor bl, bl
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x415b3c
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.00404770
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp ecx, 0x10
jb 0x415b60
inc ecx
push ecx
push dword [ebp - 0x74]
call fcn.00404770
mov al, bl
jmp 0x415b9c
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x415b76
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.00404770
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp eax, 0x10
jb 0x415b9a
inc eax
push eax
push dword [ebp - 0x74]
call fcn.00404770
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e02b
mov esp, ebp
pop ebp
ret