Function at 0x4ce260
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Encode data using base64
Encrypt data using dpapi
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Open clipboard
Parse pe header
Query or enumerate registry value
Read clipboard data
Read file on windows
Schedule task via at
Self delete
Set registry value
Write and execute a file
Write clipboard data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567fba
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0xfa00
call fcn.00535d00
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xf680], ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xf690], esi
mov dword [ebp - 0xf678], 0
mov dword [ebp - 4], 0
wait
lea ecx, [ebp - 0xc488]
call fcn.00403f80
mov byte [ebp - 4], 1
cmp dword [0x5c190c], 0
jbe 0x4ce2e2
push 0x5c18fc
lea ecx, [ebp - 0xc488]
call fcn.00411150
mov edx, str.chrome_extension:__hdokiejnpimakedhajhdlcegeplioahd_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
mov edx, str.chrome_extension:__debgaelkhoipmbjnhpoblmbacnmmgbeg_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
mov edx, str.chrome_extension:__hgnkdfamjgnljokmokheijphenjjhkjc_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
mov edx, str.chrome_extension:__hiadejpmkaejfnendkealdpgjgbmelem_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
mov edx, str.chrome_extension:__cdplaefimljmechgghpeadpphdmpjhld_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
mov edx, str.chrome_extension:__iebjpbkdemldgekhplhbagkofkemkkof_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
jne 0x4ce52e
push 0
push str.safari_extension:__com.lastpass.lpsafariextension_N24REP3BMN_
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
test eax, eax
jne 0x4ce3d7
mov esi, dword [ebp - 0xc478]
push eax
push str._background.html
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
lea ecx, [esi - 0x10]
cmp eax, ecx
je 0x4ce3c5
mov esi, dword [ebp - 0xc478]
push 0
push str._menu.html
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
lea ecx, [esi - 0xa]
cmp eax, ecx
jne 0x4ce3d7
mov byte [0x648251], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
push 0
push str.widget:__wuid_
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
test eax, eax
jne 0x4ce41d
mov esi, dword [ebp - 0xc478]
push eax
push str._index.html
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
lea ecx, [esi - 0xb]
cmp eax, ecx
jne 0x4ce41d
mov byte [0x64824f], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
mov edx, str.chrome_extension:__hnjalnkldgigidggphhmacmimbdlafdo_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
je 0x4ce443
mov byte [0x64824c], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
mov edx, str.mxaddon_pkg:__3c3b2f49_d929_4438_89e5_b8df89edc828_background.html
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
je 0x4ce469
mov byte [0x64824d], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
mov edx, str.safari_appext
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
je 0x4ce48f
mov byte [0x64824e], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
mov edx, str.lpmacapp
lea ecx, [ebp - 0xc488]
call fcn.00407490
test al, al
je 0x4ce4b5
mov byte [0x64815d], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
push 0
push str.data:application_vnd.mozilla.xulxml
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
test eax, eax
jne 0x4ce4da
mov byte [0x64815e], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
push 0
push str.ozilla
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
cmp eax, 0xffffffff
je 0x4ce517
push 0
push str.com.lastpass.nplastpass.
lea ecx, [ebp - 0xc488]
call fcn.00406ff0
cmp eax, 0xffffffff
je 0x4ce517
mov byte [0x64815f], 1
mov esi, dword [ebp - 0xf690]
jmp 0x4ce535
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
xor al, al
wait
jmp 0x4d64b4
mov byte [0x648250], 1
push str.trueapi_supported
lea ecx, [ebp - 0xcf20]
call fcn.004025d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0xcf20]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcf20]
call fcn.00402630
test bl, bl
je 0x4ce5ab
call fcn.0041cc90
test al, al
je 0x4ce582
call fcn.0041d100
mov cl, 1
jmp 0x4ce584
xor cl, cl
mov dword [esi], 2
xor eax, eax
test cl, cl
setne al
mov byte [esi + 8], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.trueapi_store_hash
lea ecx, [ebp - 0xdc70]
call fcn.004025d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0xdc70]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc70]
call fcn.00402630
test bl, bl
je 0x4ce700
xor bl, bl
mov byte [ebp - 0xf69e], bl
cmp dword [ebp + 0x10], 2
jb 0x4ce6d9
cmp dword [edi], 5
jne 0x4ce6d9
cmp dword [edi + 0x10], 5
jne 0x4ce6d9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdca8]
call fcn.00406f10
mov byte [ebp - 4], 4
mov edx, eax
lea ecx, [ebp - 0xcf50]
call fcn.00403da0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdca8]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xdcd8]
call fcn.00406f10
mov byte [ebp - 4], 7
mov edx, eax
lea ecx, [ebp - 0xcf68]
call fcn.00403da0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xdcd8]
call fcn.00402630
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xcf68]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0xa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf69c], esp
lea eax, [ebp - 0xcf50]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 9
call fcn.0041d1c0
add esp, 0x30
mov bl, al
mov byte [ebp - 0xf69e], bl
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcf68]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcf50]
call fcn.004040c0
xor eax, eax
test bl, bl
mov dword [esi], 2
setne al
mov byte [esi + 8], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.trueapi_get_hash
lea ecx, [ebp - 0xd5f8]
call fcn.004025d0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0xd5f8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd5f8]
call fcn.00402630
test bl, bl
je 0x4ce891
lea ecx, [ebp - 0xc7a0]
call fcn.00403f80
mov byte [ebp - 4], 0xd
cmp dword [ebp + 0x10], 1
jb 0x4ce80d
cmp dword [edi], 5
jne 0x4ce80d
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe6c8]
call fcn.00406f10
mov byte [ebp - 4], 0xe
mov edx, eax
lea ecx, [ebp - 0xcf98]
call fcn.00403da0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xe6c8]
call fcn.00402630
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xcf98]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xe398]
call fcn.0041d340
add esp, 0x18
mov byte [ebp - 4], 0x12
mov edx, eax
lea ecx, [ebp - 0xdd08]
call fcn.00403e90
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0xc7a0]
call fcn.00406f40
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xdd08]
call fcn.00402630
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xe398]
call fcn.004040c0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcf98]
call fcn.004040c0
mov ecx, dword [ebp - 0xc790]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4ce86b
lea ecx, [ebp - 0xc7a0]
cmp dword [ebp - 0xc78c], 0x10
cmovae ecx, dword [ebp - 0xc7a0]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4ce837
mov dword [esi], 5
mov dword [ebp - 0xf700], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ce856
sub ecx, edx
mov dword [ebp - 0xf6fc], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc7a0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.trueapi_store_default_login
lea ecx, [ebp - 0xdad8]
call fcn.004025d0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xdad8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdad8]
call fcn.00402630
test bl, bl
je 0x4cea24
xor bl, bl
mov byte [ebp - 0xf6a0], bl
cmp dword [ebp + 0x10], 3
jb 0x4ce6d9
cmp dword [edi], 5
jne 0x4ce6d9
cmp dword [edi + 0x10], 5
jne 0x4ce6d9
cmp dword [edi + 0x20], 5
jne 0x4ce6d9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdd38]
call fcn.00406f10
mov byte [ebp - 4], 0x15
mov edx, eax
lea ecx, [ebp - 0xcff8]
call fcn.00403da0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xdd38]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe878]
call fcn.00406f10
mov byte [ebp - 4], 0x18
mov edx, eax
lea ecx, [ebp - 0xd628]
call fcn.00403da0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe878]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xdd68]
call fcn.00406f10
mov byte [ebp - 4], 0x1b
mov edx, eax
lea ecx, [ebp - 0xcfc8]
call fcn.00403da0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xdd68]
call fcn.00402630
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xcfc8]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0x1e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf69c], esp
lea eax, [ebp - 0xd628]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0x1f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf6bc], esp
lea eax, [ebp - 0xcff8]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1d
call fcn.0041d5a0
add esp, 0x48
mov bl, al
mov byte [ebp - 0xf6a0], bl
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xcfc8]
call fcn.004040c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xd628]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcff8]
jmp 0x4ce6d4
push str.trueapi_get_default_login
lea ecx, [ebp - 0xd958]
call fcn.004025d0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0xd958]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd958]
call fcn.00402630
test bl, bl
je 0x4cefb5
lea ecx, [ebp - 0xc530]
call fcn.00403f80
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xc500]
call fcn.00403f80
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xc4b8]
call fcn.00403f80
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xcd40]
call fcn.00403fd0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xce00]
call fcn.00403fd0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xcce0]
call fcn.00403fd0
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0xcce0]
push eax
lea edx, [ebp - 0xce00]
lea ecx, [ebp - 0xcd40]
call fcn.0041d720
add esp, 4
mov bl, al
mov byte [ebp - 0xf679], bl
lea edx, [ebp - 0xcd40]
lea ecx, [ebp - 0xe3c8]
call fcn.00403e90
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0xc530]
call fcn.00406f40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xe3c8]
call fcn.00402630
lea edx, [ebp - 0xce00]
lea ecx, [ebp - 0xdd98]
call fcn.00403e90
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0xc500]
call fcn.00406f40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xdd98]
call fcn.00402630
lea edx, [ebp - 0xcce0]
lea ecx, [ebp - 0xe6f8]
call fcn.00403e90
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0xc4b8]
call fcn.00406f40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xe6f8]
call fcn.00402630
cmp dword [ebp + 0x10], 3
jb 0x4cedba
cmp dword [edi], 6
jne 0x4cedba
cmp dword [edi + 0x10], 6
jne 0x4cedba
cmp dword [edi + 0x20], 6
jne 0x4cedba
mov dword [ebp - 0xf740], 5
mov ecx, dword [ebp - 0xc520]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov ebx, eax
test ebx, ebx
je 0x4cec41
lea ecx, [ebp - 0xc530]
cmp dword [ebp - 0xc51c], 0x10
cmovae ecx, dword [ebp - 0xc530]
mov edx, ebx
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cebd0
mov dword [ebp - 0xf740], 5
mov dword [ebp - 0xf6f8], ebx
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cebf3
sub ecx, edx
mov dword [ebp - 0xf6f4], ecx
mov dword [ebp - 0xf738], ebx
mov dword [ebp - 0xf734], ecx
lea eax, [ebp - 0xf740]
push eax
mov ecx, str.value
call fcn.004ca100
push eax
mov edx, dword [edi + 8]
mov ecx, dword [ebp - 0xf680]
mov ecx, dword [ecx + 0xc]
call fcn.004ca120
lea eax, [ebp - 0xf740]
push eax
call dword [0x6481fc]
add esp, 0xc
mov dword [ebp - 0xf770], 5
mov ecx, dword [ebp - 0xc4f0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov ebx, eax
test ebx, ebx
je 0x4cecf1
lea ecx, [ebp - 0xc500]
cmp dword [ebp - 0xc4ec], 0x10
cmovae ecx, dword [ebp - 0xc500]
mov edx, ebx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cec80
mov dword [ebp - 0xf770], 5
mov dword [ebp - 0xf694], ebx
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ceca3
sub ecx, edx
mov dword [ebp - 0xf690], ecx
mov dword [ebp - 0xf768], ebx
mov dword [ebp - 0xf764], ecx
lea eax, [ebp - 0xf770]
push eax
mov ecx, str.value
call fcn.004ca100
push eax
mov edx, dword [edi + 0x18]
mov eax, dword [ebp - 0xf680]
mov ecx, dword [eax + 0xc]
call fcn.004ca120
lea eax, [ebp - 0xf770]
push eax
call dword [0x6481fc]
add esp, 0xc
mov dword [ebp - 0xf750], 5
mov ecx, dword [ebp - 0xc4a8]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov ebx, eax
test ebx, ebx
je 0x4ceda1
lea ecx, [ebp - 0xc4b8]
cmp dword [ebp - 0xc4a4], 0x10
cmovae ecx, dword [ebp - 0xc4b8]
mov edx, ebx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4ced30
mov dword [ebp - 0xf750], 5
mov dword [ebp - 0xf7e0], ebx
mov edx, ebx
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ced53
sub edx, ecx
mov dword [ebp - 0xf7dc], edx
mov dword [ebp - 0xf748], ebx
mov dword [ebp - 0xf744], edx
lea eax, [ebp - 0xf750]
push eax
mov ecx, str.value
call fcn.004ca100
push eax
mov edx, dword [edi + 0x28]
mov eax, dword [ebp - 0xf680]
mov ecx, dword [eax + 0xc]
call fcn.004ca120
lea eax, [ebp - 0xf750]
push eax
call dword [0x6481fc]
add esp, 0xc
mov dword [esi], 2
xor eax, eax
cmp byte [ebp - 0xf679], al
setne al
mov byte [esi + 8], al
jmp 0x4cef44
lea ecx, [ebp - 0xc518]
call fcn.00403f80
mov byte [ebp - 4], 0x2b
test bl, bl
je 0x4ceed2
lea edx, [ebp - 0xc530]
cmp dword [ebp - 0xc51c], 0x10
cmovae edx, dword [ebp - 0xc530]
push dword [ebp - 0xc520]
lea ecx, [ebp - 0xddc8]
call fcn.004320b0
add esp, 4
mov byte [ebp - 4], 0x2c
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc518]
call fcn.004070a0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xddc8]
call fcn.00402630
push 0x5846cc
lea ecx, [ebp - 0xc518]
call fcn.00424f70
lea edx, [ebp - 0xc500]
cmp dword [ebp - 0xc4ec], 0x10
cmovae edx, dword [ebp - 0xc500]
push dword [ebp - 0xc4f0]
lea ecx, [ebp - 0xe3f8]
call fcn.004320b0
add esp, 4
mov byte [ebp - 4], 0x2d
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc518]
call fcn.004070a0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xe3f8]
call fcn.00402630
push 0x5846cc
lea ecx, [ebp - 0xc518]
call fcn.00424f70
lea edx, [ebp - 0xc4b8]
cmp dword [ebp - 0xc4a4], 0x10
cmovae edx, dword [ebp - 0xc4b8]
push dword [ebp - 0xc4a8]
lea ecx, [ebp - 0xddf8]
call fcn.004320b0
add esp, 4
mov byte [ebp - 4], 0x2e
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc518]
call fcn.004070a0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xddf8]
call fcn.00402630
mov ecx, dword [ebp - 0xc508]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cef35
lea ecx, [ebp - 0xc518]
cmp dword [ebp - 0xc504], 0x10
cmovae ecx, dword [ebp - 0xc518]
mov edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cef00
mov dword [esi], 5
mov dword [ebp - 0xf81c], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cef20
sub ecx, edx
mov dword [ebp - 0xf818], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xc518]
call fcn.00402630
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xcce0]
call fcn.004040c0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xce00]
call fcn.004040c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xcd40]
call fcn.004040c0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xc4b8]
call fcn.00402630
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xc500]
call fcn.00402630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc530]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.trueapi_default_login_exists
lea ecx, [ebp - 0xd028]
call fcn.004025d0
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0xd028]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd028]
call fcn.00402630
test bl, bl
je 0x4cf03c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
push 0x58d0e4
call fcn.00403ff0
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 1
call fcn.0041d910
add esp, 0x18
mov dword [esi], 2
xor ecx, ecx
test al, al
setne cl
mov byte [esi + 8], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.trueapi_delete_default_login
lea ecx, [ebp - 0xd658]
call fcn.004025d0
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0xd658]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd658]
call fcn.00402630
test bl, bl
je 0x4cf07e
call fcn.0041dac0
jmp 0x4cf015
push str.omnikey_supported
lea ecx, [ebp - 0xd058]
call fcn.004025d0
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0xd058]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd058]
call fcn.00402630
test bl, bl
je 0x4cf0cc
call fcn.0041b8a0
test al, al
setne cl
xor eax, eax
test cl, cl
jmp 0x4ce6dd
push str.omnikey_get_public_key
lea ecx, [ebp - 0xdc58]
call fcn.004025d0
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0xdc58]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc58]
call fcn.00402630
test bl, bl
je 0x4cf21b
lea ecx, [ebp - 0xc680]
call fcn.00403f80
mov byte [ebp - 4], 0x34
cmp dword [ebp + 0x10], 1
jb 0x4cf195
cmp dword [edi], 5
jne 0x4cf195
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd088]
call fcn.00406f10
mov byte [ebp - 4], 0x35
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd088]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xe938]
call fcn.0041ba40
add esp, 0x18
mov byte [ebp - 4], 0x37
push eax
lea ecx, [ebp - 0xc680]
call fcn.00406f40
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xe938]
call fcn.00402630
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xd088]
call fcn.00402630
mov ecx, dword [ebp - 0xc670]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cf1f5
lea ecx, [ebp - 0xc680]
cmp dword [ebp - 0xc66c], 0x10
cmovae ecx, dword [ebp - 0xc680]
mov edx, edi
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cf1c0
mov dword [esi], 5
mov dword [ebp - 0xf87c], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf1e0
sub ecx, edx
mov dword [ebp - 0xf878], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc680]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.omnikey_encrypt
lea ecx, [ebp - 0xd688]
call fcn.004025d0
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0xd688]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd688]
call fcn.00402630
test bl, bl
je 0x4cf3bb
lea ecx, [ebp - 0xc698]
call fcn.00403f80
mov byte [ebp - 4], 0x39
cmp dword [ebp + 0x10], 2
jb 0x4cf335
cmp dword [edi], 5
jne 0x4cf335
cmp dword [edi + 0x10], 5
jne 0x4cf335
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd988]
call fcn.00406f10
mov byte [ebp - 4], 0x3a
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd0b8]
call fcn.00406f10
mov byte [ebp - 4], 0x3b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd0b8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x3c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf69c], esp
lea eax, [ebp - 0xd988]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xde28]
call fcn.0041beb0
add esp, 0x30
mov byte [ebp - 4], 0x3e
push eax
lea ecx, [ebp - 0xc698]
call fcn.00406f40
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xde28]
call fcn.00402630
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xd0b8]
call fcn.00402630
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xd988]
call fcn.00402630
mov ecx, dword [ebp - 0xc688]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cf395
lea ecx, [ebp - 0xc698]
cmp dword [ebp - 0xc684], 0x10
cmovae ecx, dword [ebp - 0xc698]
mov edx, edi
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cf360
mov dword [esi], 5
mov dword [ebp - 0xf82c], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf380
sub ecx, edx
mov dword [ebp - 0xf828], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc698]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.omnikey_decrypt
lea ecx, [ebp - 0xd0e8]
call fcn.004025d0
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0xd0e8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd0e8]
call fcn.00402630
test bl, bl
je 0x4cf55b
lea ecx, [ebp - 0xc6c8]
call fcn.00403f80
mov byte [ebp - 4], 0x40
cmp dword [ebp + 0x10], 2
jb 0x4cf4d5
cmp dword [edi], 5
jne 0x4cf4d5
cmp dword [edi + 0x10], 5
jne 0x4cf4d5
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd118]
call fcn.00406f10
mov byte [ebp - 4], 0x41
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd6b8]
call fcn.00406f10
mov byte [ebp - 4], 0x42
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd6b8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x43
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf69c], esp
lea eax, [ebp - 0xd118]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xe428]
call fcn.0041c260
add esp, 0x30
mov byte [ebp - 4], 0x45
push eax
lea ecx, [ebp - 0xc6c8]
call fcn.00406f40
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xe428]
call fcn.00402630
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xd6b8]
call fcn.00402630
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xd118]
call fcn.00402630
mov ecx, dword [ebp - 0xc6b8]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cf535
lea ecx, [ebp - 0xc6c8]
cmp dword [ebp - 0xc6b4], 0x10
cmovae ecx, dword [ebp - 0xc6c8]
mov edx, edi
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4cf500
mov dword [esi], 5
mov dword [ebp - 0xf83c], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf520
sub ecx, edx
mov dword [ebp - 0xf838], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc6c8]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.alert
lea ecx, [ebp - 0xdb08]
call fcn.004025d0
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0xdb08]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdb08]
call fcn.00402630
test bl, bl
je 0x4cf74f
sub esp, 8
lea ecx, [ebp - 0xfa10]
call fcn.004c7900
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0xc4e8]
call fcn.00403f80
mov byte [ebp - 4], 0x48
cmp dword [ebp + 0x10], 1
jb 0x4cf6c2
mov eax, dword [edi]
cmp eax, 6
ja case.default.0x4cf5d0
jmp dword [eax*4 + 0x4d64d8]
push str.void
jmp 0x4cf6c7
push str.null
jmp 0x4cf6c7
mov eax, str.true
mov ecx, str.false
cmp byte [edi + 8], 0
cmove eax, ecx
push eax
jmp 0x4cf6c7
push dword [edi + 8]
lea ecx, [ebp - 0xfa10]
call fcn.004117b0
lea eax, [ebp - 0xde58]
push eax
lea ecx, [ebp - 0xfa10]
call fcn.004c7ac0
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0xc4e8]
call fcn.00406f40
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xde58]
call fcn.00402630
jmp case.default.0x4cf5d0
movsd xmm1, qword [edi + 8]
lea ecx, [ebp - 0xfa10]
call fcn.004d6760
lea eax, [ebp - 0xe728]
push eax
lea ecx, [ebp - 0xfa10]
call fcn.004c7ac0
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0xc4e8]
call fcn.00406f40
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xe728]
call fcn.00402630
jmp case.default.0x4cf5d0
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xde88]
call fcn.00406f10
mov byte [ebp - 4], 0x4b
push eax
lea ecx, [ebp - 0xc4e8]
call fcn.00406f40
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xde88]
call fcn.00402630
jmp case.default.0x4cf5d0
push str._object_Object_
jmp 0x4cf6c7
push str.undefined
lea ecx, [ebp - 0xc4e8]
call fcn.00406f80
lea edx, [ebp - 0xc4e8]
lea ecx, [ebp - 0xcaa0]
call fcn.00403da0
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0xcaa0]
cmp dword [ebp - 0xca8c], 8
cmovae eax, dword [ebp - 0xcaa0]
push 0x1000
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xcaa0]
call fcn.004040c0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0xc4e8]
call fcn.00402630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xfa10]
call fcn.004c7390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.protect_data
lea ecx, [ebp - 0xd148]
call fcn.004025d0
mov byte [ebp - 4], 0x4d
lea eax, [ebp - 0xd148]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd148]
call fcn.00402630
test bl, bl
je 0x4cf8e4
lea ecx, [ebp - 0xc968]
call fcn.00403f80
mov byte [ebp - 4], 0x4e
xor ecx, ecx
mov dword [ebp - 0xf714], ecx
cmp dword [ebp + 0x10], 1
jb 0x4cf7fa
cmp dword [edi], 5
jne 0x4cf7fa
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe458]
call fcn.00406f10
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0xc968]
call fcn.00406f40
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xe458]
call fcn.00402630
lea ecx, [ebp - 0xc968]
cmp dword [ebp - 0xc954], 0x10
cmovae ecx, dword [ebp - 0xc968]
mov dword [ebp - 0xf714], ecx
mov dword [ebp - 0xf774], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf803
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xf778], eax
lea eax, [ebp - 0xf724]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xf778]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x4cf8be
mov edx, dword [ebp - 0xf724]
mov ecx, dword [ebp - 0xf720]
call fcn.00431b70
mov ebx, eax
push dword [ebp - 0xf720]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf860
sub ecx, edx
inc ecx
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cf8b5
mov ecx, ebx
mov edx, edi
sub edx, ebx
jmp 0x4cf880
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x4cf880
mov dword [esi], 5
mov dword [ebp - 0xf84c], edi
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf8a0
sub ecx, edx
mov dword [ebp - 0xf848], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
push ebx
call fcn.00443e80
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc968]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.unprotect_data
lea ecx, [ebp - 0xd6e8]
call fcn.004025d0
mov byte [ebp - 4], 0x50
lea eax, [ebp - 0xd6e8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd6e8]
call fcn.00402630
test bl, bl
je 0x4cfa95
lea ecx, [ebp - 0xc920]
call fcn.00403f80
mov byte [ebp - 4], 0x51
xor ecx, ecx
mov dword [ebp - 0xf70c], ecx
cmp dword [ebp + 0x10], 1
jb 0x4cf98f
cmp dword [edi], 5
jne 0x4cf98f
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdeb8]
call fcn.00406f10
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0xc920]
call fcn.00406f40
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xdeb8]
call fcn.00402630
lea ecx, [ebp - 0xc920]
cmp dword [ebp - 0xc90c], 0x10
cmovae ecx, dword [ebp - 0xc920]
mov dword [ebp - 0xf70c], ecx
mov dword [ebp - 0xf680], 0
mov edx, ecx
lea edi, [edx + 1]
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x4cf9a0
sub edx, edi
lea eax, [ebp - 0xf680]
push eax
call fcn.00432070
add esp, 4
mov dword [ebp - 0xf674], eax
mov dword [ebp - 0xf784], eax
mov ecx, dword [ebp - 0xf680]
mov dword [ebp - 0xf788], ecx
lea eax, [ebp - 0xf730]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xf788]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4cfa61
mov ecx, dword [ebp - 0xf72c]
lea edx, [ecx + 1]
jmp 0x4cfa00
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cfa00
sub ecx, edx
lea ebx, [ecx + 1]
mov ecx, ebx
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4cfa55
push dword [ebp - 0xf72c]
push ebx
push edi
call fcn.00522ba6
add esp, 0xc
mov dword [esi], 5
mov dword [ebp - 0xf8ac], edi
mov ecx, edi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cfa40
sub ecx, edx
mov dword [ebp - 0xf8a8], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
push dword [ebp - 0xf72c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xf674]
call fcn.00443e80
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc920]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.can_check_idle
lea ecx, [ebp - 0xd178]
call fcn.004025d0
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0xd178]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd178]
call fcn.00402630
test bl, bl
jne 0x4d2f44
push str.get_idle_ms
lea ecx, [ebp - 0xd9b8]
call fcn.004025d0
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0xd9b8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd9b8]
call fcn.00402630
test bl, bl
je 0x4cfb52
mov dword [ebp - 0xf780], 8
lea eax, [ebp - 0xf780]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xf77c]
mov dword [esi], 3
mov dword [esi + 8], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.StartNamedPipeServer
lea ecx, [ebp - 0xd1a8]
call fcn.004025d0
mov byte [ebp - 4], 0x55
lea eax, [ebp - 0xd1a8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd1a8]
call fcn.00402630
test bl, bl
je 0x4cfc62
mov eax, dword [ebp - 0xf680]
mov eax, dword [eax + 0xc]
mov dword [0x648cd8], eax
mov dword [esi], 2
mov byte [esi + 8], 1
call fcn.004024a0
cmp byte [0x648250], 0
je 0x4cfbbe
mov eax, str.lastpasscrplugin
jmp 0x4cfc21
cmp byte [0x648251], 0
je 0x4cfbce
mov eax, str.lastpasssfjsplugin
jmp 0x4cfc21
cmp byte [0x64824f], 0
je 0x4cfbde
mov eax, str.lastpassopplugin
jmp 0x4cfc21
cmp byte [0x64824c], 0
je 0x4cfbee
mov eax, str.lastpassopcrplugin
jmp 0x4cfc21
cmp byte [0x64824d], 0
je 0x4cfbfe
mov eax, str.lastpassmxplugin
jmp 0x4cfc21
cmp byte [0x64815e], 0
je 0x4cfc0e
mov eax, str.lastpassffplugin
jmp 0x4cfc21
mov eax, str.lastpassffweplugin
cmp byte [0x64815f], 0
cmove eax, dword [ebp - 0xf6c4]
push 0x4cadd0
push 0
push 0x4cac40
push eax
call sym.nplastpass.exe_ASOInitializeWithCallback
add esp, 0x10
test eax, eax
jne 0x4ce594
push 0x4cb0c0
call sym.nplastpass.exe_ASOLIBSetProcessMsgCallback
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.SendNamedPipeMessageToAll
lea ecx, [ebp - 0xd718]
call fcn.004025d0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0xd718]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd718]
call fcn.00402630
test bl, bl
je 0x4d052f
mov dword [esi], 2
mov byte [esi + 8], 1
lea ecx, [ebp - 0xc6f8]
call fcn.00403f80
mov byte [ebp - 4], 0x57
cmp dword [ebp + 0x10], 1
jb 0x4d0509
cmp dword [edi], 5
jne 0x4d0509
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe8a8]
call fcn.00406f10
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0xc6f8]
call fcn.00406f40
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xe8a8]
call fcn.00402630
lea eax, [ebp - 0xc6f8]
cmp dword [ebp - 0xc6e4], 0x10
cmovae eax, dword [ebp - 0xc6f8]
push eax
lea ecx, [ebp - 0xdee8]
call fcn.004025d0
mov byte [ebp - 4], 0x59
mov edx, eax
lea ecx, [ebp - 0xc4d0]
call fcn.00403da0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0xdee8]
call fcn.00402630
mov edx, 0x58d0e4
lea ecx, [ebp - 0xc4d0]
call fcn.0042bfa0
mov edi, dword [ebp - 0xc4c0]
test al, al
je 0x4cfd6c
lea esi, [edi - 1]
push esi
lea ecx, [ebp - 0xc4d0]
call fcn.00404240
cmp word [eax], 0x30
je 0x4cfd81
lea esi, [edi - 1]
push esi
lea ecx, [ebp - 0xc4d0]
call fcn.00404240
cmp word [eax], 0
jne 0x4cfdb5
push esi
push 0
lea eax, [ebp - 0xe488]
push eax
lea ecx, [ebp - 0xc4d0]
call fcn.004042c0
mov byte [ebp - 4], 0x5c
push eax
lea ecx, [ebp - 0xc4d0]
call fcn.00404080
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0xe488]
call fcn.004040c0
lea ecx, [ebp - 0xf688]
call fcn.004c0a80
mov byte [ebp - 4], 0x5d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xc4d0]
push eax
call fcn.0041dde0
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0xf688]
call fcn.00403230
add esp, 0x18
test al, al
je 0x4d04eb
push str.data9
lea ecx, [ebp - 0xd3b8]
call fcn.00403ff0
mov byte [ebp - 4], 0x5f
lea eax, [ebp - 0xd3b8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4cfe64
push str.data9
lea ecx, [ebp - 0xd808]
call fcn.00403ff0
mov byte [ebp - 4], 0x60
mov ebx, 1
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd808]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf680], eax
jmp 0x4cfe74
mov dword [ebp - 0xf680], 0
mov ebx, dword [ebp - 0xf678]
push str.data8
lea ecx, [ebp - 0xd388]
call fcn.00403ff0
mov dword [ebp - 4], 0x61
lea eax, [ebp - 0xd388]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4cfee0
push str.data8
lea ecx, [ebp - 0xdc28]
call fcn.00403ff0
mov byte [ebp - 4], 0x62
or ebx, 2
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf690], eax
jmp 0x4cfeea
mov dword [ebp - 0xf690], 0
push str.data7
lea ecx, [ebp - 0xd358]
call fcn.00403ff0
mov dword [ebp - 4], 0x63
lea eax, [ebp - 0xd358]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4cff56
push str.data7
lea ecx, [ebp - 0xd7d8]
call fcn.00403ff0
mov byte [ebp - 4], 0x64
or ebx, 4
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd7d8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf6f4], eax
jmp 0x4cff60
mov dword [ebp - 0xf6f4], 0
push str.data6
lea ecx, [ebp - 0xd328]
call fcn.00403ff0
mov dword [ebp - 4], 0x65
lea eax, [ebp - 0xd328]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4cffcc
push str.data6
lea ecx, [ebp - 0xda18]
call fcn.00403ff0
mov byte [ebp - 4], 0x66
or ebx, 8
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xda18]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf6fc], eax
jmp 0x4cffd6
mov dword [ebp - 0xf6fc], 0
push str.data5
lea ecx, [ebp - 0xd2f8]
call fcn.00403ff0
mov dword [ebp - 4], 0x67
lea eax, [ebp - 0xd2f8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d0042
push str.data5
lea ecx, [ebp - 0xd7a8]
call fcn.00403ff0
mov byte [ebp - 4], 0x68
or ebx, 0x10
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd7a8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf6c8], eax
jmp 0x4d004c
mov dword [ebp - 0xf6c8], 0
push str.data4
lea ecx, [ebp - 0xd2c8]
call fcn.00403ff0
mov dword [ebp - 4], 0x69
lea eax, [ebp - 0xd2c8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d00b8
push str.data4
lea ecx, [ebp - 0xdb38]
call fcn.00403ff0
mov byte [ebp - 4], 0x6a
or ebx, 0x20
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xdb38]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf6bc], eax
jmp 0x4d00c2
mov dword [ebp - 0xf6bc], 0
push str.data3
lea ecx, [ebp - 0xd298]
call fcn.00403ff0
mov dword [ebp - 4], 0x6b
lea eax, [ebp - 0xd298]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d012e
push str.data3
lea ecx, [ebp - 0xd778]
call fcn.00403ff0
mov byte [ebp - 4], 0x6c
or ebx, 0x40
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd778]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf69c], eax
jmp 0x4d0138
mov dword [ebp - 0xf69c], 0
push str.data2
lea ecx, [ebp - 0xd268]
call fcn.00403ff0
mov dword [ebp - 4], 0x6d
lea eax, [ebp - 0xd268]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d01a7
push str.data2
lea ecx, [ebp - 0xd9e8]
call fcn.00403ff0
mov byte [ebp - 4], 0x6e
or ebx, 0x80
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd9e8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov dword [ebp - 0xf674], eax
jmp 0x4d01b1
mov dword [ebp - 0xf674], 0
push str.data1
lea ecx, [ebp - 0xd238]
call fcn.00403ff0
mov dword [ebp - 4], 0x6f
lea eax, [ebp - 0xd238]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d021c
push str.data1
lea ecx, [ebp - 0xd748]
call fcn.00403ff0
mov byte [ebp - 4], 0x70
or ebx, 0x100
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xd748]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov edi, eax
jmp 0x4d021e
xor edi, edi
push str.data0
lea ecx, [ebp - 0xd208]
call fcn.00403ff0
mov dword [ebp - 4], 0x71
lea eax, [ebp - 0xd208]
push eax
lea ecx, [ebp - 0xf688]
call fcn.004d6c30
cmp eax, 1
jne 0x4d0289
push str.data0
lea ecx, [ebp - 0xdbc8]
call fcn.00403ff0
mov byte [ebp - 4], 0x72
or ebx, 0x200
mov dword [ebp - 0xf678], ebx
lea eax, [ebp - 0xdbc8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov esi, eax
jmp 0x4d028b
xor esi, esi
push 0x58461c
lea ecx, [ebp - 0xd1d8]
call fcn.00403ff0
mov dword [ebp - 4], 0x73
push dword [ebp - 0xf680]
push dword [ebp - 0xf690]
push dword [ebp - 0xf6f4]
push dword [ebp - 0xf6fc]
push dword [ebp - 0xf6c8]
push dword [ebp - 0xf6bc]
push dword [ebp - 0xf69c]
push dword [ebp - 0xf674]
push edi
lea eax, [ebp - 0xd1d8]
push eax
lea ecx, [ebp - 0xf688]
call fcn.00404340
mov ecx, eax
call fcn.00404260
mov edx, esi
mov ecx, eax
call fcn.004024d0
add esp, 0x24
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0xd1d8]
call fcn.004040c0
mov dword [ebp - 4], 0x71
test ebx, 0x200
je 0x4d032d
and ebx, 0xfffffdff
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xdbc8]
call fcn.004040c0
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0xd208]
call fcn.004040c0
mov dword [ebp - 4], 0x6f
test ebx, 0x100
je 0x4d0362
and ebx, 0xfffffeff
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd748]
call fcn.004040c0
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0xd238]
call fcn.004040c0
mov dword [ebp - 4], 0x6d
test bl, bl
jns 0x4d0393
and ebx, 0xffffff7f
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd9e8]
call fcn.004040c0
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0xd268]
call fcn.004040c0
mov dword [ebp - 4], 0x6b
test bl, 0x40
je 0x4d03c2
and ebx, 0xffffffbf
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd778]
call fcn.004040c0
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0xd298]
call fcn.004040c0
mov dword [ebp - 4], 0x69
test bl, 0x20
je 0x4d03f1
and ebx, 0xffffffdf
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xdb38]
call fcn.004040c0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0xd2c8]
call fcn.004040c0
mov dword [ebp - 4], 0x67
test bl, 0x10
je 0x4d0420
and ebx, 0xffffffef
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd7a8]
call fcn.004040c0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0xd2f8]
call fcn.004040c0
mov dword [ebp - 4], 0x65
test bl, 8
je 0x4d044f
and ebx, 0xfffffff7
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xda18]
call fcn.004040c0
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xd328]
call fcn.004040c0
mov dword [ebp - 4], 0x63
test bl, 4
je 0x4d047e
and ebx, 0xfffffffb
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd7d8]
call fcn.004040c0
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0xd358]
call fcn.004040c0
mov dword [ebp - 4], 0x61
test bl, 2
je 0x4d04ad
and ebx, 0xfffffffd
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xdc28]
call fcn.004040c0
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0xd388]
call fcn.004040c0
mov dword [ebp - 4], 0x5f
test bl, 1
je 0x4d04dc
and ebx, 0xfffffffe
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xd808]
call fcn.004040c0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0xd3b8]
call fcn.004040c0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0xf688]
call fcn.004bc540
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xc4d0]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc6f8]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.NamedPipeNumClients
lea ecx, [ebp - 0xda48]
call fcn.004025d0
mov byte [ebp - 4], 0x74
lea eax, [ebp - 0xda48]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xda48]
call fcn.00402630
test bl, bl
je 0x4d058f
call sym.nplastpass.exe_ASONumClients
mov dword [esi], 3
mov dword [esi + 8], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_javascript_message
lea ecx, [ebp - 0xd3e8]
call fcn.004025d0
mov byte [ebp - 4], 0x75
lea eax, [ebp - 0xd3e8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd3e8]
call fcn.00402630
test bl, bl
je 0x4d0680
lea ecx, [ebp - 0xc728]
call fcn.00403f80
mov byte [ebp - 4], 0x76
cmp dword [0x6489a0], 0
je 0x4d05fc
call fcn.004d6b30
push eax
lea ecx, [ebp - 0xc728]
call fcn.00411150
call fcn.004d6b70
mov ecx, dword [ebp - 0xc718]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d065a
lea ecx, [ebp - 0xc728]
cmp dword [ebp - 0xc714], 0x10
cmovae ecx, dword [ebp - 0xc728]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d0626
mov dword [esi], 5
mov dword [ebp - 0xf85c], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d0645
sub ecx, edx
mov dword [ebp - 0xf858], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc728]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.write_file
lea ecx, [ebp - 0xd418]
call fcn.004025d0
mov byte [ebp - 4], 0x77
mov eax, 0x400
mov dword [ebp - 0xf678], eax
lea eax, [ebp - 0xd418]
push eax
call fcn.004d6920
mov ebx, dword [ebp + 8]
cmp ebx, dword [eax]
je 0x4d06eb
push str.append_file
lea ecx, [ebp - 0xd838]
call fcn.004025d0
mov dword [ebp - 4], 0x78
mov eax, 0xc00
mov dword [ebp - 0xf678], eax
lea eax, [ebp - 0xd838]
push eax
call fcn.004d6920
cmp ebx, dword [eax]
mov byte [ebp - 0xf679], 0
jne 0x4d06f2
mov byte [ebp - 0xf679], 1
mov dword [ebp - 4], 0x77
mov eax, dword [ebp - 0xf678]
test eax, 0x800
je 0x4d0722
and eax, 0xfffff7ff
mov dword [ebp - 0xf678], eax
lea ecx, [ebp - 0xd838]
call fcn.00402630
mov eax, dword [ebp - 0xf678]
mov dword [ebp - 4], 1
test eax, 0x400
je 0x4d0746
and eax, 0xfffffbff
mov dword [ebp - 0xf678], eax
lea ecx, [ebp - 0xd418]
call fcn.00402630
cmp byte [ebp - 0xf679], 0
je 0x4d09af
mov byte [ebp - 0xf695], 0
mov byte [ebp - 0xf6cc], 0
mov esi, dword [ebp + 0x10]
cmp esi, 3
jb 0x4d0778
cmp dword [edi + 0x20], 2
jne 0x4d0778
mov al, byte [edi + 0x28]
mov byte [ebp - 0xf695], al
cmp esi, 4
jb 0x4d078c
cmp dword [edi + 0x30], 2
jne 0x4d078c
mov al, byte [edi + 0x38]
mov byte [ebp - 0xf6cc], al
call fcn.004ca2f0
test al, al
jne 0x4ce6e9
cmp esi, 2
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
cmp dword [edi + 0x10], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdf18]
call fcn.00406f10
mov byte [ebp - 4], 0x79
mov edx, eax
lea ecx, [ebp - 0xc950]
call fcn.00403da0
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xdf18]
call fcn.00402630
lea eax, [ebp - 0xc950]
push eax
lea ecx, [ebp - 0xc5d8]
call fcn.0041dde0
mov byte [ebp - 4], 0x7c
push dword [ebp - 0xf6cc]
push ecx
lea edx, [ebp - 0x33f8]
call fcn.004ca910
add esp, 8
test eax, eax
je 0x4d097a
lea eax, [ebp - 0xc950]
push eax
lea edx, [ebp - 0x33f8]
lea ecx, [ebp - 0xe758]
call fcn.0042c290
add esp, 4
mov byte [ebp - 4], 0x7d
push eax
lea ecx, [ebp - 0xc5d8]
call fcn.00404080
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0xe758]
call fcn.004040c0
mov esi, 0x40000000
mov dword [ebp - 0xf674], 2
push str.append_file
lea ecx, [ebp - 0xdb68]
call fcn.004025d0
mov byte [ebp - 4], 0x7e
lea eax, [ebp - 0xdb68]
push eax
call fcn.004d6920
cmp ebx, dword [eax]
sete bl
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0xdb68]
call fcn.00402630
test bl, bl
je 0x4d08a9
mov esi, 4
mov dword [ebp - 0xf674], 3
lea eax, [ebp - 0xc5d8]
cmp dword [ebp - 0xc5c4], 8
cmovae eax, dword [ebp - 0xc5d8]
push 0
push 0x80
push dword [ebp - 0xf674]
push 0
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d097a
mov dword [ebp - 0xf6c4], 0
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xc5c0]
call fcn.00406f10
mov byte [ebp - 4], 0x7f
cmp byte [ebp - 0xf695], 0
je 0x4d0939
lea edx, [ebp - 0xc5c0]
lea ecx, [ebp - 0xdf48]
call fcn.00432160
mov byte [ebp - 4], 0x80
push eax
lea ecx, [ebp - 0xc5c0]
call fcn.00406f40
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xdf48]
call fcn.00402630
lea eax, [ebp - 0xc5c0]
cmp dword [ebp - 0xc5ac], 0x10
cmovae eax, dword [ebp - 0xc5c0]
push 0
lea ecx, [ebp - 0xf6c4]
push ecx
push dword [ebp - 0xc5b0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0xc5c0]
call fcn.00402630
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xc5d8]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc950]
call fcn.004040c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_path
lea ecx, [ebp - 0xd448]
call fcn.004025d0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0xd448]
push eax
call fcn.004d6920
cmp ebx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd448]
call fcn.00402630
test bl, bl
je 0x4d0b0b
lea ecx, [ebp - 0xc638]
call fcn.00403f80
mov byte [ebp - 4], 0x82
mov byte [ebp - 0xf6d0], 0
cmp dword [ebp + 0x10], 1
jb 0x4d0a15
cmp dword [edi], 2
jne 0x4d0a15
mov al, byte [edi + 8]
mov byte [ebp - 0xf6d0], al
push dword [ebp - 0xf6d0]
push ecx
lea edx, [ebp - 0xbbf8]
call fcn.004ca910
add esp, 8
test eax, eax
je 0x4d0ae5
lea eax, [ebp - 0xbbf8]
push eax
lea ecx, [ebp - 0xdf78]
call fcn.00403ff0
mov byte [ebp - 4], 0x83
mov edx, eax
lea ecx, [ebp - 0xe4b8]
call fcn.00403e90
mov byte [ebp - 4], 0x84
push eax
lea ecx, [ebp - 0xc638]
call fcn.00406f40
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0xe4b8]
call fcn.00402630
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0xdf78]
call fcn.004040c0
mov ecx, dword [ebp - 0xc628]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d0ae5
lea ecx, [ebp - 0xc638]
cmp dword [ebp - 0xc624], 0x10
cmovae ecx, dword [ebp - 0xc638]
mov edx, edi
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d0ab0
mov dword [esi], 5
mov dword [ebp - 0xf7e8], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d0ad0
sub ecx, edx
mov dword [ebp - 0xf7e4], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc638]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.read_file
lea ecx, [ebp - 0xd868]
call fcn.004025d0
mov byte [ebp - 4], 0x85
lea eax, [ebp - 0xd868]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd868]
call fcn.00402630
test bl, bl
je 0x4d0deb
lea ecx, [ebp - 0xc758]
call fcn.00403f80
mov byte [ebp - 4], 0x86
xor bl, bl
mov byte [ebp - 0xf69f], bl
cmp dword [ebp + 0x10], 2
jb 0x4d0b76
cmp dword [edi + 0x10], 2
jne 0x4d0b76
mov bl, byte [edi + 0x18]
mov byte [ebp - 0xf69f], bl
call fcn.004ca2f0
test al, al
je 0x4d0b87
test bl, bl
jne 0x4d0d63
cmp dword [ebp + 0x10], 1
jb 0x4d0d63
cmp dword [edi], 5
jne 0x4d0d63
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe980]
call fcn.00406f10
mov byte [ebp - 4], 0x87
mov edx, eax
lea ecx, [ebp - 0xcdd0]
call fcn.00403da0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0xe980]
call fcn.00402630
test bl, bl
jne 0x4d0c18
push 0
push ecx
lea edx, [ebp - 0x5bf8]
call fcn.004ca910
add esp, 8
test eax, eax
jle 0x4d0d54
lea eax, [ebp - 0xcdd0]
push eax
lea edx, [ebp - 0x5bf8]
lea ecx, [ebp - 0xdfa8]
call fcn.0042c290
add esp, 4
mov dword [ebp - 4], 0x8b
mov ebx, dword [ebp - 0xf678]
or ebx, 0x2000
jmp 0x4d0c3a
lea eax, [ebp - 0xcdd0]
push eax
lea ecx, [ebp - 0xe4e8]
call fcn.0041dde0
mov byte [ebp - 4], 0x8a
mov ebx, dword [ebp - 0xf678]
or ebx, 0x1000
mov dword [ebp - 0xf678], ebx
push eax
lea ecx, [ebp - 0xca70]
call fcn.00404050
mov dword [ebp - 4], 0x8d
test ebx, 0x2000
je 0x4d0c72
and ebx, 0xffffdfff
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xdfa8]
call fcn.004040c0
mov byte [ebp - 4], 0x8e
test ebx, 0x1000
je 0x4d0c95
and ebx, 0xffffefff
mov dword [ebp - 0xf678], ebx
lea ecx, [ebp - 0xe4e8]
call fcn.004040c0
lea eax, [ebp - 0xca70]
cmp dword [ebp - 0xca5c], 8
cmovae eax, dword [ebp - 0xca70]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4d0d45
mov dword [ebp - 0xf6d4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ecx]
push 0
lea eax, [ebp - 0xf6d4]
push eax
push 0x400
lea eax, [ebp - 0xff8]
push eax
push edi
call ebx
test eax, eax
je 0x4d0d3e
mov eax, dword [ebp - 0xf6d4]
test eax, eax
je 0x4d0d3e
push eax
lea eax, [ebp - 0xff8]
push eax
lea ecx, [ebp - 0xdfd8]
call fcn.00406f10
mov byte [ebp - 4], 0x8f
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc758]
call fcn.004070a0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0xdfd8]
call fcn.00402630
jmp 0x4d0ce0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0xca70]
call fcn.004040c0
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0xcdd0]
call fcn.004040c0
mov ecx, dword [ebp - 0xc748]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d0dc5
lea ecx, [ebp - 0xc758]
cmp dword [ebp - 0xc744], 0x10
cmovae ecx, dword [ebp - 0xc758]
mov edx, edi
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d0d90
mov dword [esi], 5
mov dword [ebp - 0xf7f8], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d0db0
sub ecx, edx
mov dword [ebp - 0xf7f4], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc758]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.delete_file
lea ecx, [ebp - 0xd478]
call fcn.004025d0
mov byte [ebp - 4], 0x90
lea eax, [ebp - 0xd478]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd478]
call fcn.00402630
test bl, bl
je 0x4d0f30
call fcn.004ca2f0
test al, al
jne 0x4ce6e9
cmp dword [ebp + 0x10], 1
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe788]
call fcn.00406f10
mov byte [ebp - 4], 0x91
mov edx, eax
lea ecx, [ebp - 0xc9c8]
call fcn.00403da0
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0xe788]
call fcn.00402630
lea eax, [ebp - 0xc9c8]
push eax
lea ecx, [ebp - 0xc788]
call fcn.0041dde0
mov byte [ebp - 4], 0x94
push 0
push ecx
lea edx, [ebp - 0x53f8]
call fcn.004ca910
add esp, 8
test eax, eax
je 0x4d0efb
lea eax, [ebp - 0xc9c8]
push eax
lea edx, [ebp - 0x53f8]
lea ecx, [ebp - 0xe008]
call fcn.0042c290
add esp, 4
mov byte [ebp - 4], 0x95
push eax
lea ecx, [ebp - 0xc788]
call fcn.00404080
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0xe008]
call fcn.004040c0
lea eax, [ebp - 0xc788]
cmp dword [ebp - 0xc774], 8
cmovae eax, dword [ebp - 0xc788]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0xc788]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc9c8]
call fcn.004040c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.delete_files_by_extension
lea ecx, [ebp - 0xda78]
call fcn.004025d0
mov byte [ebp - 4], 0x96
lea eax, [ebp - 0xda78]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xda78]
call fcn.00402630
test bl, bl
je 0x4d11bc
mov byte [ebp - 0xf6d8], 0
mov esi, dword [ebp + 0x10]
cmp esi, 3
jb 0x4d0f8d
cmp dword [edi + 0x20], 2
jne 0x4d0f8d
mov al, byte [edi + 0x28]
mov byte [ebp - 0xf6d8], al
call fcn.004ca2f0
test al, al
jne 0x4ce6e9
cmp esi, 2
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
cmp dword [edi + 0x10], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe518]
call fcn.00406f10
mov byte [ebp - 4], 0x97
mov edx, eax
lea ecx, [ebp - 0xce30]
call fcn.00403da0
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0xe518]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe038]
call fcn.00406f10
mov byte [ebp - 4], 0x9a
mov edx, eax
lea ecx, [ebp - 0xcd70]
call fcn.00403da0
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0xe038]
call fcn.00402630
push dword [ebp - 0xf6d8]
push ecx
lea edx, [ebp - 0x7bf8]
call fcn.004ca910
add esp, 8
test eax, eax
jle 0x4d1187
lea eax, [ebp - 0x7bf8]
push eax
lea ecx, [ebp - 0xe548]
call fcn.00403ff0
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0xce30]
push ecx
mov edx, eax
lea ecx, [ebp - 0xe068]
call fcn.004c11e0
add esp, 4
mov byte [ebp - 4], 0x9e
push 0x59a900
mov edx, eax
lea ecx, [ebp - 0xe8d8]
call fcn.00419d80
add esp, 4
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0xcd70]
push ecx
mov edx, eax
lea ecx, [ebp - 0xc980]
call fcn.004c11e0
add esp, 4
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0xe8d8]
call fcn.004040c0
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0xe068]
call fcn.004040c0
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0xe548]
call fcn.004040c0
lea eax, [ebp - 0xc980]
cmp dword [ebp - 0xc96c], 8
cmovae eax, dword [ebp - 0xc980]
lea ecx, [ebp - 0xed80]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d1178
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
lea eax, [ebp - 0xed54]
push eax
lea ecx, [ebp - 0xd4a8]
call fcn.00403ff0
mov byte [ebp - 4], 0xa4
lea eax, [ebp - 0xd4a8]
push eax
lea edx, [ebp - 0x7bf8]
lea ecx, [ebp - 0xcad0]
call fcn.0042c290
add esp, 4
mov byte [ebp - 4], 0xa5
lea eax, [ebp - 0xcad0]
cmp dword [ebp - 0xcabc], 8
cmovae eax, dword [ebp - 0xcad0]
push eax
call edi
mov byte [ebp - 4], 0xa4
lea ecx, [ebp - 0xcad0]
call fcn.004040c0
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0xd4a8]
call fcn.004040c0
lea eax, [ebp - 0xed80]
push eax
push esi
call ebx
test eax, eax
jne 0x4d1100
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0xc980]
call fcn.004040c0
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0xcd70]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xce30]
call fcn.004040c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.file_exists
lea ecx, [ebp - 0xce60]
call fcn.004025d0
mov byte [ebp - 4], 0xa6
lea eax, [ebp - 0xce60]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xce60]
call fcn.00402630
test bl, bl
je 0x4d12e4
xor bl, bl
mov byte [ebp - 0xf69d], bl
call fcn.004ca2f0
test al, al
jne 0x4ce6d9
cmp dword [ebp + 0x10], 1
jb 0x4ce6d9
cmp dword [edi], 5
jne 0x4ce6d9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe098]
call fcn.00406f10
mov byte [ebp - 4], 0xa7
mov edx, eax
lea ecx, [ebp - 0xc7b8]
call fcn.00403da0
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0xe098]
call fcn.00402630
push 0
push ecx
lea edx, [ebp - 0x83f8]
call fcn.004ca910
add esp, 8
test eax, eax
jle 0x4d12d5
lea eax, [ebp - 0xc7b8]
push eax
lea edx, [ebp - 0x83f8]
lea ecx, [ebp - 0xe7b8]
call fcn.0042c290
add esp, 4
mov byte [ebp - 4], 0xaa
push eax
lea ecx, [ebp - 0xc7b8]
call fcn.00404080
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0xe7b8]
call fcn.004040c0
lea eax, [ebp - 0xc7b8]
cmp dword [ebp - 0xc7a4], 8
cmovae eax, dword [ebp - 0xc7b8]
push 0
push eax
call fcn.00524b50
add esp, 8
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov byte [ebp - 0xf69d], bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc7b8]
jmp 0x4ce6d4
push str.get_chrome_passwords
lea ecx, [ebp - 0xd898]
call fcn.004025d0
mov byte [ebp - 4], 0xab
lea eax, [ebp - 0xd898]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd898]
call fcn.00402630
test bl, bl
je 0x4d1628
lea ecx, [ebp - 0xf6b4]
call fcn.00438940
mov byte [ebp - 4], 0xac
mov dword [0x647f10], 0
xor cl, cl
call fcn.00434010
push 0x64892c
lea ecx, [ebp - 0xf6b4]
call fcn.004d6c70
push 0
lea ecx, [ebp - 0xf760]
call fcn.004c4440
mov byte [ebp - 4], 0xad
xor edi, edi
mov dword [ebp - 0xf728], edi
mov ebx, dword [ebp - 0xf6b4]
lea ecx, [ebp - 0xf6b4]
call fcn.004389b0
cmp edi, eax
jae 0x4d1546
lea eax, [edi + edi*8]
shl eax, 4
add eax, ebx
push eax
lea ecx, [ebp - 0xeaa0]
call fcn.00434550
mov byte [ebp - 4], 0xae
push 0
lea ecx, [ebp - 0xf6f0]
call fcn.004c4440
mov byte [ebp - 4], 0xaf
lea eax, [ebp - 0xeaa0]
push eax
lea ecx, [ebp - 0xf7d8]
call fcn.004c45d0
mov byte [ebp - 4], 0xb0
lea eax, [ebp - 0xf7d8]
push eax
push ecx
push 0x59a904
lea ecx, [ebp - 0xf6f0]
call fcn.004c5360
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0xf7d8]
call fcn.004c47f0
lea eax, [ebp - 0xea70]
push eax
lea ecx, [ebp - 0xf798]
call fcn.004c45d0
mov byte [ebp - 4], 0xb1
lea eax, [ebp - 0xf798]
push eax
push ecx
push str.username_field
lea ecx, [ebp - 0xf6f0]
call fcn.004c5360
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0xf798]
call fcn.004c47f0
lea eax, [ebp - 0xea88]
push eax
lea ecx, [ebp - 0xf7c8]
call fcn.004c45d0
mov byte [ebp - 4], 0xb2
lea eax, [ebp - 0xf7c8]
push eax
push ecx
push str.username
lea ecx, [ebp - 0xf6f0]
call fcn.004c5360
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0xf7c8]
call fcn.004c47f0
lea eax, [ebp - 0xea40]
push eax
lea ecx, [ebp - 0xf7b8]
call fcn.004c45d0
mov byte [ebp - 4], 0xb3
lea eax, [ebp - 0xf7b8]
push eax
push ecx
push str.password_field
lea ecx, [ebp - 0xf6f0]
call fcn.004c5360
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0xf7b8]
call fcn.004c47f0
lea eax, [ebp - 0xea58]
push eax
lea ecx, [ebp - 0xf7a8]
call fcn.004c45d0
mov byte [ebp - 4], 0xb4
lea eax, [ebp - 0xf7a8]
push eax
push ecx
push str.password
lea ecx, [ebp - 0xf6f0]
call fcn.004c5360
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0xf7a8]
call fcn.004c47f0
lea eax, [ebp - 0xf6f0]
push eax
push edi
lea ecx, [ebp - 0xf760]
call fcn.004c5080
mov ecx, eax
call fcn.004c48c0
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xf6f0]
call fcn.004c47f0
mov byte [ebp - 4], 0xad
lea ecx, [ebp - 0xeaa0]
call fcn.00434670
inc edi
mov dword [ebp - 0xf728], edi
jmp 0x4d1372
lea ecx, [ebp - 0xdc90]
call fcn.004c7430
mov byte [ebp - 4], 0xb5
lea eax, [ebp - 0xf760]
push eax
lea eax, [ebp - 0xc9b0]
push eax
lea ecx, [ebp - 0xdc90]
call fcn.004c74a0
mov byte [ebp - 4], 0xb6
mov ecx, dword [ebp - 0xc9a0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d15d5
lea ecx, [ebp - 0xc9b0]
cmp dword [ebp - 0xc99c], 0x10
cmovae ecx, dword [ebp - 0xc9b0]
mov edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d15a0
mov dword [esi], 5
mov dword [ebp - 0xf808], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d15c0
sub ecx, edx
mov dword [ebp - 0xf804], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0xb5
lea ecx, [ebp - 0xc9b0]
call fcn.00402630
mov byte [ebp - 4], 0xad
lea ecx, [ebp - 0xdc90]
call fcn.004c69e0
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0xf760]
call fcn.004c47f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf6b4]
call fcn.00438960
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_safari_passwords
lea ecx, [ebp - 0xd4d8]
call fcn.004025d0
mov byte [ebp - 4], 0xb7
lea eax, [ebp - 0xd4d8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd4d8]
call fcn.00402630
test bl, bl
je 0x4d1a31
lea ecx, [ebp - 0xf6b4]
call fcn.00438940
mov byte [ebp - 4], 0xb8
call fcn.004357d0
push eax
lea ecx, [ebp - 0xf6b4]
call fcn.004d6c70
push str.url_username_field_username_password_field_password_n
lea ecx, [ebp - 0xc7e8]
call fcn.004025d0
mov byte [ebp - 4], 0xb9
xor edi, edi
mov dword [ebp - 0xf704], edi
mov ebx, dword [ebp - 0xf6b4]
lea esp, [esp]
lea ecx, [ebp - 0xf6b4]
call fcn.004389b0
cmp edi, eax
jae 0x4d199e
lea eax, [edi + edi*8]
shl eax, 4
add eax, ebx
push eax
lea ecx, [ebp - 0xeb30]
call fcn.00434550
mov byte [ebp - 4], 0xba
push 0x58d1d8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xeae8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xbb
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0xe608]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xbc
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xead0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xbd
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0xe1e8]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xbe
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xeb18]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xbf
mov byte [ebp - 4], 0xbe
lea ecx, [ebp - 0xe908]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xc0
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xeb00]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xc1
mov byte [ebp - 4], 0xc0
lea ecx, [ebp - 0xe1b8]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xc2
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xeb30]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xc3
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0xe5d8]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xc4
push eax
lea eax, [ebp - 0xe188]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xc5
push eax
lea eax, [ebp - 0xe7e8]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xc6
push eax
lea eax, [ebp - 0xe158]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xc7
push eax
lea eax, [ebp - 0xe5a8]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xc8
push eax
lea eax, [ebp - 0xe128]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xc9
push eax
lea eax, [ebp - 0xe950]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xca
push eax
lea eax, [ebp - 0xe0f8]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xcb
push eax
lea eax, [ebp - 0xe578]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xcc
push eax
lea eax, [ebp - 0xe0c8]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xcd
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc7e8]
call fcn.004070a0
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0xe0c8]
call fcn.00402630
mov byte [ebp - 4], 0xcb
lea ecx, [ebp - 0xe578]
call fcn.00402630
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0xe0f8]
call fcn.00402630
mov byte [ebp - 4], 0xc9
lea ecx, [ebp - 0xe950]
call fcn.00402630
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0xe128]
call fcn.00402630
mov byte [ebp - 4], 0xc7
lea ecx, [ebp - 0xe5a8]
call fcn.00402630
mov byte [ebp - 4], 0xc6
lea ecx, [ebp - 0xe158]
call fcn.00402630
mov byte [ebp - 4], 0xc5
lea ecx, [ebp - 0xe7e8]
call fcn.00402630
mov byte [ebp - 4], 0xc4
lea ecx, [ebp - 0xe188]
call fcn.00402630
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0xe5d8]
call fcn.00402630
mov byte [ebp - 4], 0xc0
lea ecx, [ebp - 0xe1b8]
call fcn.00402630
mov byte [ebp - 4], 0xbe
lea ecx, [ebp - 0xe908]
call fcn.00402630
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0xe1e8]
call fcn.00402630
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0xe608]
call fcn.00402630
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0xeb30]
call fcn.00434670
inc edi
mov dword [ebp - 0xf704], edi
jmp 0x4d16b0
mov ecx, dword [ebp - 0xc7d8]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d19fc
lea ecx, [ebp - 0xc7e8]
cmp dword [ebp - 0xc7d4], 0x10
cmovae ecx, dword [ebp - 0xc7e8]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d19c8
mov dword [esi], 5
mov dword [ebp - 0xf814], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d19e7
sub ecx, edx
mov dword [ebp - 0xf810], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0xb8
lea ecx, [ebp - 0xc7e8]
call fcn.00402630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf6b4]
call fcn.00438960
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_opera_passwords
lea ecx, [ebp - 0xdbf8]
call fcn.004025d0
mov byte [ebp - 4], 0xce
lea eax, [ebp - 0xdbf8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdbf8]
call fcn.00402630
test bl, bl
je 0x4d1e14
lea ecx, [ebp - 0xf6b4]
call fcn.00438940
mov byte [ebp - 4], 0xcf
call fcn.004368d0
push eax
lea ecx, [ebp - 0xf6b4]
call fcn.004d6c70
push str.url_username_field_username_password_field_password_n
lea ecx, [ebp - 0xc818]
call fcn.004025d0
mov byte [ebp - 4], 0xd0
xor edi, edi
mov dword [ebp - 0xf71c], edi
mov ebx, dword [ebp - 0xf6b4]
lea ecx, [ebp - 0xf6b4]
call fcn.004389b0
cmp edi, eax
jae 0x4d1da0
lea eax, [edi + edi*8]
shl eax, 4
add eax, ebx
push eax
lea ecx, [ebp - 0xea10]
call fcn.00434550
mov byte [ebp - 4], 0xd1
push 0x58d1d8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xe9c8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xd2
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0xe968]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xd3
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xe9b0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xd4
mov byte [ebp - 4], 0xd3
lea ecx, [ebp - 0xe338]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xd5
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xe9f8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xd6
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0xe698]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xd7
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xe9e0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xd8
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0xe308]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xd9
push eax
push 0x596748
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xea10]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xda
mov byte [ebp - 4], 0xd9
lea ecx, [ebp - 0xe848]
call fcn.004c07b0
add esp, 0x18
mov byte [ebp - 4], 0xdb
push eax
lea eax, [ebp - 0xe2d8]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xdc
push eax
lea eax, [ebp - 0xe668]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xdd
push eax
lea eax, [ebp - 0xe2a8]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xde
push eax
lea eax, [ebp - 0xe920]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xdf
push eax
lea eax, [ebp - 0xe278]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xe0
push eax
lea eax, [ebp - 0xe638]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xe1
push eax
lea eax, [ebp - 0xe248]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xe2
push eax
lea eax, [ebp - 0xe818]
push eax
call fcn.00407600
add esp, 0xc
mov byte [ebp - 4], 0xe3
push eax
lea eax, [ebp - 0xe218]
push eax
call fcn.00407570
add esp, 0xc
mov byte [ebp - 4], 0xe4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xc818]
call fcn.004070a0
mov byte [ebp - 4], 0xe3
lea ecx, [ebp - 0xe218]
call fcn.00402630
mov byte [ebp - 4], 0xe2
lea ecx, [ebp - 0xe818]
call fcn.00402630
mov byte [ebp - 4], 0xe1
lea ecx, [ebp - 0xe248]
call fcn.00402630
mov byte [ebp - 4], 0xe0
lea ecx, [ebp - 0xe638]
call fcn.00402630
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0xe278]
call fcn.00402630
mov byte [ebp - 4], 0xde
lea ecx, [ebp - 0xe920]
call fcn.00402630
mov byte [ebp - 4], 0xdd
lea ecx, [ebp - 0xe2a8]
call fcn.00402630
mov byte [ebp - 4], 0xdc
lea ecx, [ebp - 0xe668]
call fcn.00402630
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0xe2d8]
call fcn.00402630
mov byte [ebp - 4], 0xd9
lea ecx, [ebp - 0xe848]
call fcn.00402630
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0xe308]
call fcn.00402630
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0xe698]
call fcn.00402630
mov byte [ebp - 4], 0xd3
lea ecx, [ebp - 0xe338]
call fcn.00402630
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0xe968]
call fcn.00402630
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xea10]
call fcn.00434670
inc edi
mov dword [ebp - 0xf71c], edi
jmp 0x4d1ab2
mov ecx, dword [ebp - 0xc808]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d1e05
lea ecx, [ebp - 0xc818]
cmp dword [ebp - 0xc804], 0x10
cmovae ecx, dword [ebp - 0xc818]
mov edx, edi
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d1dd0
mov dword [esi], 5
mov dword [ebp - 0xf824], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1df0
sub ecx, edx
mov dword [ebp - 0xf820], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0xc818]
jmp 0x4d1a06
push str.get_registry_value
lea ecx, [ebp - 0xd508]
call fcn.004025d0
mov byte [ebp - 4], 0xe5
lea eax, [ebp - 0xd508]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd508]
call fcn.00402630
test bl, bl
je 0x4d2192
lea ecx, [ebp - 0xc560]
call fcn.00403f80
mov byte [ebp - 4], 0xe6
mov ebx, dword [ebp + 0x10]
cmp ebx, 3
jb 0x4d1ea0
cmp dword [edi + 0x20], 5
jne 0x4d1ea0
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xe368]
call fcn.00406f10
mov byte [ebp - 4], 0xe7
push eax
lea ecx, [ebp - 0xc560]
call fcn.00406f40
mov byte [ebp - 4], 0xe6
lea ecx, [ebp - 0xe368]
call fcn.00402630
mov byte [ebp - 0xf696], 1
cmp ebx, 4
jb 0x4d1ebb
cmp dword [edi + 0x30], 2
jne 0x4d1ebb
mov al, byte [edi + 0x38]
mov byte [ebp - 0xf696], al
cmp ebx, 2
jb 0x4d210e
cmp dword [edi], 5
jne 0x4d210e
cmp dword [edi + 0x10], 5
jne 0x4d210e
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdcc0]
call fcn.00406f10
mov byte [ebp - 4], 0xe8
mov edx, eax
lea ecx, [ebp - 0xc5a8]
call fcn.00403da0
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0xdcc0]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xdcf0]
call fcn.00406f10
mov byte [ebp - 4], 0xeb
mov edx, eax
lea ecx, [ebp - 0xc608]
call fcn.00403da0
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0xdcf0]
call fcn.00402630
mov dword [ebp - 0xf6b8], 0
mov dword [ebp - 0xf6c0], 0x800
xor ebx, ebx
cmp byte [ebp - 0xf696], bl
sete bl
add ebx, 0x80000001
lea eax, [ebp - 0xc5a8]
cmp dword [ebp - 0xc594], 8
cmovae eax, dword [ebp - 0xc5a8]
lea ecx, [ebp - 0xf6b8]
push ecx
push 0x20219
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d2024
lea eax, [ebp - 0xc608]
cmp dword [ebp - 0xc5f4], 8
cmovae eax, dword [ebp - 0xc608]
lea ecx, [ebp - 0xf6c0]
push ecx
lea ecx, [ebp - 0x93f8]
push ecx
push 0
push 0
push eax
push dword [ebp - 0xf6b8]
call edi
test eax, eax
jne 0x4d2024
mov eax, dword [ebp - 0xf6c0]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x93f8]
push eax
lea ecx, [ebp - 0xdd50]
call fcn.00428e40
mov byte [ebp - 4], 0xee
mov edx, eax
lea ecx, [ebp - 0xdd20]
call fcn.00403e90
mov byte [ebp - 4], 0xef
push eax
lea ecx, [ebp - 0xc560]
call fcn.00406f40
mov byte [ebp - 4], 0xee
lea ecx, [ebp - 0xdd20]
call fcn.00402630
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0xdd50]
jmp 0x4d20df
lea eax, [ebp - 0xc5a8]
cmp dword [ebp - 0xc594], 8
cmovae eax, dword [ebp - 0xc5a8]
lea ecx, [ebp - 0xf6b8]
push ecx
push 0x20119
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d20f0
lea eax, [ebp - 0xc608]
cmp dword [ebp - 0xc5f4], 8
cmovae eax, dword [ebp - 0xc608]
lea ecx, [ebp - 0xf6c0]
push ecx
lea ecx, [ebp - 0x93f8]
push ecx
push 0
push 0
push eax
push dword [ebp - 0xf6b8]
call edi
test eax, eax
jne 0x4d20f0
mov eax, dword [ebp - 0xf6c0]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x93f8]
push eax
lea ecx, [ebp - 0xddb0]
call fcn.00428e40
mov byte [ebp - 4], 0xf0
mov edx, eax
lea ecx, [ebp - 0xdd80]
call fcn.00403e90
mov byte [ebp - 4], 0xf1
push eax
lea ecx, [ebp - 0xc560]
call fcn.00406f40
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0xdd80]
call fcn.00402630
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0xddb0]
call fcn.004040c0
push dword [ebp - 0xf6b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0xc608]
call fcn.004040c0
mov byte [ebp - 4], 0xe6
lea ecx, [ebp - 0xc5a8]
call fcn.004040c0
mov ecx, dword [ebp - 0xc550]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d216c
lea ecx, [ebp - 0xc560]
cmp dword [ebp - 0xc54c], 0x10
cmovae ecx, dword [ebp - 0xc560]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d2138
mov dword [esi], 5
mov dword [ebp - 0xf834], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d2157
sub ecx, edx
mov dword [ebp - 0xf830], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc560]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.lpvt_supported
lea ecx, [ebp - 0xd8c8]
call fcn.004025d0
mov byte [ebp - 4], 0xf2
lea eax, [ebp - 0xd8c8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd8c8]
call fcn.00402630
test bl, bl
jne 0x4d2383
push str.lpvt_store_data
lea ecx, [ebp - 0xd538]
call fcn.004025d0
mov byte [ebp - 4], 0xf3
lea eax, [ebp - 0xd538]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd538]
call fcn.00402630
test bl, bl
jne 0x4d2383
push str.lpvt_has_data
lea ecx, [ebp - 0xdaa8]
call fcn.004025d0
mov byte [ebp - 4], 0xf4
lea eax, [ebp - 0xdaa8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdaa8]
call fcn.00402630
test bl, bl
jne 0x4d2383
push str.lpvt_verify_user
lea ecx, [ebp - 0xd568]
call fcn.004025d0
mov byte [ebp - 4], 0xf5
lea eax, [ebp - 0xd568]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd568]
call fcn.00402630
test bl, bl
je 0x4d2321
lea ecx, [ebp - 0xc998]
call fcn.00403f80
mov byte [ebp - 4], 0xf6
mov ecx, dword [ebp - 0xc988]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d22fb
lea ecx, [ebp - 0xc998]
cmp dword [ebp - 0xc984], 0x10
cmovae ecx, dword [ebp - 0xc998]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d22c7
mov dword [esi], 5
mov dword [ebp - 0xf844], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d22e6
sub ecx, edx
mov dword [ebp - 0xf840], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc998]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.lpvt_verify_file_contents
lea ecx, [ebp - 0xd8f8]
call fcn.004025d0
mov byte [ebp - 4], 0xf7
lea eax, [ebp - 0xd8f8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd8f8]
call fcn.00402630
test bl, bl
je 0x4d23a4
cmp dword [ebp + 0x10], 1
jb 0x4d2383
cmp dword [edi], 5
jne 0x4d2383
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdde0]
call fcn.00406f10
lea ecx, [ebp - 0xdde0]
call fcn.00402630
mov dword [esi], 2
mov byte [esi + 8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.lpvt_setup_if
lea ecx, [ebp - 0xd598]
call fcn.004025d0
mov byte [ebp - 4], 0xf8
lea eax, [ebp - 0xd598]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd598]
call fcn.00402630
test bl, bl
jne 0x4ce594
push str.is_chrome_portable
lea ecx, [ebp - 0xdb98]
call fcn.004025d0
mov byte [ebp - 4], 0xf9
lea eax, [ebp - 0xdb98]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdb98]
call fcn.00402630
test bl, bl
je 0x4d242e
mov dword [esi], 2
call fcn.004ca2f0
jmp 0x4cf01b
push str.validity_supported
lea ecx, [ebp - 0xd5c8]
call fcn.004025d0
mov byte [ebp - 4], 0xfa
lea eax, [ebp - 0xd5c8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd5c8]
call fcn.00402630
test bl, bl
je 0x4d2473
call fcn.00420a40
jmp 0x4cf015
push str.validity_store_data
lea ecx, [ebp - 0xd928]
call fcn.004025d0
mov byte [ebp - 4], 0xfb
lea eax, [ebp - 0xd928]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd928]
call fcn.00402630
test bl, bl
je 0x4d268d
xor bl, bl
mov byte [ebp - 0xf6a1], bl
cmp dword [ebp + 0x10], 4
jb 0x4d2660
cmp dword [edi], 5
jne 0x4d2660
cmp dword [edi + 0x10], 5
jne 0x4d2660
cmp dword [edi + 0x20], 5
jne 0x4d2660
cmp dword [edi + 0x30], 5
jne 0x4d2660
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xde10]
call fcn.00406f10
mov byte [ebp - 4], 0xfc
mov edx, eax
lea ecx, [ebp - 0xcb90]
call fcn.00403da0
mov byte [ebp - 4], 0xfe
lea ecx, [ebp - 0xde10]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xde40]
call fcn.00406f10
mov byte [ebp - 4], 0xff
mov edx, eax
lea ecx, [ebp - 0xcb60]
call fcn.00403da0
mov dword [ebp - 4], 0x101
lea ecx, [ebp - 0xde40]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xde70]
call fcn.00406f10
mov byte [ebp - 4], 2
mov edx, eax
lea ecx, [ebp - 0xcb30]
call fcn.00403da0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xde70]
call fcn.00402630
push dword [edi + 0x3c]
push dword [edi + 0x38]
lea ecx, [ebp - 0xdea0]
call fcn.00406f10
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0xcb00]
call fcn.00403da0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xdea0]
call fcn.00402630
lea esi, [ebp - 0xcb00]
cmp dword [ebp - 0xcaec], 8
cmovae esi, dword [ebp - 0xcb00]
lea eax, [ebp - 0xcb30]
cmp dword [ebp - 0xcb1c], 8
cmovae eax, dword [ebp - 0xcb30]
lea edx, [ebp - 0xcb60]
cmp dword [ebp - 0xcb4c], 8
cmovae edx, dword [ebp - 0xcb60]
lea ecx, [ebp - 0xcb90]
cmp dword [ebp - 0xcb7c], 8
cmovae ecx, dword [ebp - 0xcb90]
push esi
push eax
call fcn.00420d50
add esp, 8
mov bl, al
mov byte [ebp - 0xf6a1], bl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xcb00]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcb30]
call fcn.004040c0
mov dword [ebp - 4], 0xfe
lea ecx, [ebp - 0xcb60]
call fcn.004040c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcb90]
call fcn.004040c0
jmp 0x4d2660
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 2
xor eax, eax
test bl, bl
setne al
mov byte [ecx + 8], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.validity_has_data
lea ecx, [ebp - 0xcf38]
call fcn.004025d0
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xcf38]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcf38]
call fcn.00402630
test bl, bl
je 0x4d26d8
call fcn.00420e30
jmp 0x4cf015
push str.validity_verify_user
lea ecx, [ebp - 0xcf80]
call fcn.004025d0
mov dword [ebp - 4], 0x109
lea eax, [ebp - 0xcf80]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcf80]
call fcn.00402630
test bl, bl
je 0x4d29ae
lea ecx, [ebp - 0xc848]
call fcn.00403f80
mov dword [ebp - 4], 0x10a
cmp dword [ebp + 0x10], 4
jb 0x4d291c
cmp dword [edi], 5
jne 0x4d291c
cmp dword [edi + 0x10], 5
jne 0x4d291c
cmp dword [edi + 0x20], 5
jne 0x4d291c
cmp dword [edi + 0x30], 5
jne 0x4d291c
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdf90]
call fcn.00406f10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xcc50]
call fcn.00403fd0
mov byte [ebp - 4], 0xc
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xded0]
call fcn.00406f10
mov byte [ebp - 4], 0xd
mov edx, eax
lea ecx, [ebp - 0xcc20]
call fcn.00403da0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xded0]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xdf00]
call fcn.00406f10
mov byte [ebp - 4], 0x10
mov edx, eax
lea ecx, [ebp - 0xcbf0]
call fcn.00403da0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xdf00]
call fcn.00402630
push dword [edi + 0x3c]
push dword [edi + 0x38]
lea ecx, [ebp - 0xdf30]
call fcn.00406f10
mov byte [ebp - 4], 0x13
mov edx, eax
lea ecx, [ebp - 0xcbc0]
call fcn.00403da0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xdf30]
call fcn.00402630
lea esi, [ebp - 0xcbc0]
cmp dword [ebp - 0xcbac], 8
cmovae esi, dword [ebp - 0xcbc0]
lea eax, [ebp - 0xcbf0]
cmp dword [ebp - 0xcbdc], 8
cmovae eax, dword [ebp - 0xcbf0]
lea edx, [ebp - 0xcc20]
cmp dword [ebp - 0xcc0c], 8
cmovae edx, dword [ebp - 0xcc20]
lea ecx, [ebp - 0xcc50]
cmp dword [ebp - 0xcc3c], 8
cmovae ecx, dword [ebp - 0xcc50]
push 0
push esi
push eax
call fcn.00420ab0
add esp, 0xc
mov esi, eax
test esi, esi
je 0x4d28d1
push esi
lea ecx, [ebp - 0xcfb0]
call fcn.00403ff0
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0xcfb0]
lea ecx, [ebp - 0xdf60]
call fcn.00403e90
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0xc848]
call fcn.00406f40
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xdf60]
call fcn.00402630
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xcfb0]
call fcn.004040c0
push esi
call fcn.0051f344
add esp, 4
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xcbc0]
call fcn.004040c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xcbf0]
call fcn.004040c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xcc20]
call fcn.004040c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xcc50]
call fcn.004040c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xdf90]
call fcn.00402630
mov ecx, dword [ebp - 0xc838]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d2985
lea ecx, [ebp - 0xc848]
cmp dword [ebp - 0xc834], 0x10
cmovae ecx, dword [ebp - 0xc848]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d2946
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf854], esi
mov edx, esi
lea edi, [edx + 1]
jmp 0x4d2970
mov al, byte [edx]
inc edx
test al, al
jne 0x4d2970
sub edx, edi
mov dword [ebp - 0xf850], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc848]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.winbio_supported
lea ecx, [ebp - 0xcfe0]
call fcn.004025d0
mov dword [ebp - 4], 0x118
lea eax, [ebp - 0xcfe0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcfe0]
call fcn.00402630
test bl, bl
je 0x4d29f9
call fcn.00426ac0
jmp 0x4cf015
push str.winbio_store_data
lea ecx, [ebp - 0xd010]
call fcn.004025d0
mov dword [ebp - 4], 0x119
lea eax, [ebp - 0xd010]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd010]
call fcn.00402630
test bl, bl
je 0x4d2bdf
xor bl, bl
mov byte [ebp - 0xf6a3], bl
cmp dword [ebp + 0x10], 4
jb 0x4d2660
cmp dword [edi], 5
jne 0x4d2660
cmp dword [edi + 0x10], 5
jne 0x4d2660
cmp dword [edi + 0x20], 5
jne 0x4d2660
cmp dword [edi + 0x30], 5
jne 0x4d2660
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xdfc0]
call fcn.00406f10
mov dword [ebp - 4], 0x11a
mov edx, eax
lea ecx, [ebp - 0xca40]
call fcn.00403da0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xdfc0]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xdff0]
call fcn.00406f10
mov byte [ebp - 4], 0x1d
mov edx, eax
lea ecx, [ebp - 0xc9f8]
call fcn.00403da0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xdff0]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xe020]
call fcn.00406f10
mov byte [ebp - 4], 0x20
mov edx, eax
lea ecx, [ebp - 0xccb0]
call fcn.00403da0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xe020]
call fcn.00402630
push dword [edi + 0x3c]
push dword [edi + 0x38]
lea ecx, [ebp - 0xe050]
call fcn.00406f10
mov byte [ebp - 4], 0x23
mov edx, eax
lea ecx, [ebp - 0xcc80]
call fcn.00403da0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xe050]
call fcn.00402630
lea esi, [ebp - 0xcc80]
cmp dword [ebp - 0xcc6c], 8
cmovae esi, dword [ebp - 0xcc80]
lea eax, [ebp - 0xccb0]
cmp dword [ebp - 0xcc9c], 8
cmovae eax, dword [ebp - 0xccb0]
lea edx, [ebp - 0xc9f8]
cmp dword [ebp - 0xc9e4], 8
cmovae edx, dword [ebp - 0xc9f8]
lea ecx, [ebp - 0xca40]
cmp dword [ebp - 0xca2c], 8
cmovae ecx, dword [ebp - 0xca40]
push esi
push eax
call fcn.00428890
add esp, 8
mov bl, al
mov byte [ebp - 0xf6a3], bl
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xcc80]
call fcn.004040c0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xccb0]
call fcn.004040c0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xc9f8]
call fcn.004040c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xca40]
jmp 0x4d264e
push str.winbio_has_data
lea ecx, [ebp - 0xd040]
call fcn.004025d0
mov dword [ebp - 4], 0x126
lea eax, [ebp - 0xd040]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd040]
call fcn.00402630
test bl, bl
je 0x4d2c2a
call fcn.00428a40
jmp 0x4cf015
push str.winbio_verify_user
lea ecx, [ebp - 0xd070]
call fcn.004025d0
mov dword [ebp - 4], 0x127
lea eax, [ebp - 0xd070]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd070]
call fcn.00402630
test bl, bl
je 0x4d2efe
lea ecx, [ebp - 0xc878]
call fcn.00403f80
mov dword [ebp - 4], 0x128
cmp dword [ebp + 0x10], 4
jb 0x4d2e6e
cmp dword [edi], 5
jne 0x4d2e6e
cmp dword [edi + 0x10], 5
jne 0x4d2e6e
cmp dword [edi + 0x20], 5
jne 0x4d2e6e
cmp dword [edi + 0x30], 5
jne 0x4d2e6e
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe140]
call fcn.00406f10
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xca58]
call fcn.00403fd0
mov byte [ebp - 4], 0x2a
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe080]
call fcn.00406f10
mov byte [ebp - 4], 0x2b
mov edx, eax
lea ecx, [ebp - 0xcb78]
call fcn.00403da0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xe080]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xe0b0]
call fcn.00406f10
mov byte [ebp - 4], 0x2e
mov edx, eax
lea ecx, [ebp - 0xca28]
call fcn.00403da0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xe0b0]
call fcn.00402630
push dword [edi + 0x3c]
push dword [edi + 0x38]
lea ecx, [ebp - 0xe0e0]
call fcn.00406f10
mov byte [ebp - 4], 0x31
mov edx, eax
lea ecx, [ebp - 0xcc08]
call fcn.00403da0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xe0e0]
call fcn.00402630
lea esi, [ebp - 0xcc08]
cmp dword [ebp - 0xcbf4], 8
cmovae esi, dword [ebp - 0xcc08]
lea eax, [ebp - 0xca28]
cmp dword [ebp - 0xca14], 8
cmovae eax, dword [ebp - 0xca28]
lea edx, [ebp - 0xcb78]
cmp dword [ebp - 0xcb64], 8
cmovae edx, dword [ebp - 0xcb78]
lea ecx, [ebp - 0xca58]
cmp dword [ebp - 0xca44], 8
cmovae ecx, dword [ebp - 0xca58]
push 0
push esi
push eax
call fcn.00428140
add esp, 0xc
mov esi, eax
test esi, esi
je 0x4d2e23
push esi
lea ecx, [ebp - 0xd0a0]
call fcn.00403ff0
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0xd0a0]
lea ecx, [ebp - 0xe110]
call fcn.00403e90
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0xc878]
call fcn.00406f40
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xe110]
call fcn.00402630
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xd0a0]
call fcn.004040c0
push esi
call fcn.0051f344
add esp, 4
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xcc08]
call fcn.004040c0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xca28]
call fcn.004040c0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xcb78]
call fcn.004040c0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xca58]
call fcn.004040c0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xe140]
call fcn.00402630
mov ecx, dword [ebp - 0xc868]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d2ed5
lea ecx, [ebp - 0xc878]
cmp dword [ebp - 0xc864], 0x10
cmovae ecx, dword [ebp - 0xc878]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d2e98
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf864], esi
mov edx, esi
lea edi, [edx + 1]
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d2ec0
sub edx, edi
mov dword [ebp - 0xf860], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc878]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.winbio_delete_default_login
lea ecx, [ebp - 0xd0d0]
call fcn.004025d0
mov dword [ebp - 4], 0x136
lea eax, [ebp - 0xd0d0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd0d0]
call fcn.00402630
test bl, bl
je 0x4d2f65
call fcn.00426850
mov dword [esi], 2
mov byte [esi + 8], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.winbio_has_fingerprints
lea ecx, [ebp - 0xd100]
call fcn.004025d0
mov dword [ebp - 4], 0x137
lea eax, [ebp - 0xd100]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd100]
call fcn.00402630
test bl, bl
je 0x4d2fb0
call fcn.00427120
jmp 0x4cf015
push str.winbio_launch_enrollment
lea ecx, [ebp - 0xd130]
call fcn.004025d0
mov dword [ebp - 4], 0x138
lea eax, [ebp - 0xd130]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd130]
call fcn.00402630
test bl, bl
je 0x4d300d
call fcn.004272a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.GetStringResource
lea ecx, [ebp - 0xd160]
call fcn.004025d0
mov dword [ebp - 4], 0x139
lea eax, [ebp - 0xd160]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd160]
call fcn.00402630
test bl, bl
je 0x4d3204
lea ecx, [ebp - 0xc5f0]
call fcn.00403f80
mov dword [ebp - 4], 0x13a
cmp dword [ebp + 0x10], 2
jb 0x4d317d
cmp dword [edi], 5
jne 0x4d317d
cmp dword [edi + 0x10], 3
jne 0x4d317d
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd1c0]
call fcn.00406f10
mov byte [ebp - 4], 0x3b
mov edi, dword [edi + 0x18]
push str.muitest.exe.mui
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x4d3105
lea eax, [ebp - 0x9bf8]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
lea eax, [ebp - 0x9bf8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xd1c0]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc5f0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push 0x3e8
lea ecx, [ebp - 0xbf8]
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0xbf8]
push eax
lea ecx, [ebp - 0xd190]
call fcn.00403ff0
mov byte [ebp - 4], 0x3c
lea edx, [ebp - 0xd190]
lea ecx, [ebp - 0xe170]
call fcn.00403e90
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0xc5f0]
call fcn.00406f40
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xe170]
call fcn.00402630
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xd190]
call fcn.004040c0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xd1c0]
call fcn.00402630
mov ecx, dword [ebp - 0xc5e0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d31db
lea ecx, [ebp - 0xc5f0]
cmp dword [ebp - 0xc5dc], 0x10
cmovae ecx, dword [ebp - 0xc5f0]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d31a7
mov dword [esi], 5
mov dword [ebp - 0xf874], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d31c6
sub ecx, edx
mov dword [ebp - 0xf870], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc5f0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.GetImageResource
lea ecx, [ebp - 0xd1f0]
call fcn.004025d0
mov dword [ebp - 4], 0x13e
lea eax, [ebp - 0xd1f0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd1f0]
call fcn.00402630
test bl, bl
je 0x4d33fe
lea ecx, [ebp - 0xc620]
call fcn.00403f80
mov dword [ebp - 4], 0x13f
cmp dword [ebp + 0x10], 2
jb 0x4d336e
cmp dword [edi], 5
jne 0x4d336e
cmp dword [edi + 0x10], 3
jne 0x4d336e
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd220]
call fcn.00406f10
mov byte [ebp - 4], 0x40
mov esi, dword [edi + 0x18]
mov dword [ebp - 0xf6c8], esi
push str.muitest.exe.mui
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x4d3300
lea eax, [ebp - 0xc3f8]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
lea eax, [ebp - 0xc3f8]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xd220]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc620]
call fcn.00402630
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push 0x59a998
movzx eax, si
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, esi
call fcn.00431b70
push eax
lea ecx, [ebp - 0xe1a0]
call fcn.004025d0
mov byte [ebp - 4], 0x41
push eax
lea ecx, [ebp - 0xc620]
call fcn.00406f40
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xe1a0]
call fcn.00402630
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xd220]
call fcn.00402630
mov ecx, dword [ebp - 0xc610]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d33d5
lea ecx, [ebp - 0xc620]
cmp dword [ebp - 0xc60c], 0x10
cmovae ecx, dword [ebp - 0xc620]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d3398
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf884], esi
mov edx, esi
lea edi, [edx + 1]
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d33c0
sub edx, edi
mov dword [ebp - 0xf880], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc620]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.setup_basicauth_timer
lea ecx, [ebp - 0xd250]
call fcn.004025d0
mov dword [ebp - 4], 0x142
lea eax, [ebp - 0xd250]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd250]
call fcn.00402630
test bl, bl
je 0x4d3479
mov eax, dword [ebp - 0xf680]
mov eax, dword [eax + 0xc]
mov dword [0x648cd8], eax
push 0
push 0
push 0
push 0x4cd970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.fill_basicauth
lea ecx, [ebp - 0xd280]
call fcn.004025d0
mov dword [ebp - 4], 0x143
lea eax, [ebp - 0xd280]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd280]
call fcn.00402630
test bl, bl
je 0x4d35e7
xor bl, bl
mov byte [ebp - 0xf6a4], bl
cmp dword [ebp + 0x10], 5
jb 0x4ce6d9
cmp dword [edi], 5
jne 0x4ce6d9
cmp dword [edi + 0x10], 5
jne 0x4ce6d9
cmp dword [edi + 0x20], 2
jne 0x4ce6d9
cmp dword [edi + 0x30], 5
jne 0x4ce6d9
cmp dword [edi + 0x40], 2
jne 0x4ce6d9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd310]
call fcn.00406f10
mov dword [ebp - 4], 0x144
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd2e0]
call fcn.00406f10
mov byte [ebp - 4], 0x45
mov bh, byte [edi + 0x28]
push dword [edi + 0x3c]
push dword [edi + 0x38]
lea ecx, [ebp - 0xd2b0]
call fcn.00406f10
mov byte [ebp - 4], 0x46
mov bl, byte [edi + 0x48]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd2b0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x47
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf69c], esp
lea eax, [ebp - 0xd2e0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x48
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf6bc], esp
lea eax, [ebp - 0xd310]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x46
mov dl, bl
mov cl, bh
call fcn.004cdb10
add esp, 0x48
mov bl, al
mov byte [ebp - 0xf6a4], bl
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xd2b0]
call fcn.00402630
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0xd2e0]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd310]
call fcn.00402630
jmp 0x4ce6d9
push str.accessibility_enabled
lea ecx, [ebp - 0xd340]
call fcn.004025d0
mov dword [ebp - 4], 0x14a
lea eax, [ebp - 0xd340]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd340]
call fcn.00402630
test bl, bl
jne 0x4d2f44
push str.xCryptoRSAEncrypt
lea ecx, [ebp - 0xd370]
call fcn.004025d0
mov dword [ebp - 4], 0x14b
lea eax, [ebp - 0xd370]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd370]
call fcn.00402630
test bl, bl
je 0x4d3841
lea ecx, [ebp - 0xc8a8]
call fcn.00403f80
mov dword [ebp - 4], 0x14c
cmp dword [ebp + 0x10], 2
jb 0x4d37ba
cmp dword [edi], 5
jne 0x4d37ba
cmp dword [edi + 0x10], 5
jne 0x4d37ba
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd3d0]
call fcn.00406f10
mov byte [ebp - 4], 0x4d
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd3a0]
call fcn.00406f10
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0xd3a0]
push eax
lea ecx, [ebp - 0xe1d0]
call fcn.00406ee0
mov byte [ebp - 4], 0x4f
mov edx, eax
lea ecx, [ebp - 0xccf8]
call fcn.0043dde0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xe1d0]
call fcn.00402630
cmp dword [ebp - 0xcce8], 0
jbe 0x4d378d
lea eax, [ebp - 0xd3d0]
push eax
lea ecx, [ebp - 0xe200]
call fcn.00406ee0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xccf8]
push ecx
mov edx, eax
lea ecx, [ebp - 0xccc8]
call fcn.0043e670
add esp, 4
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0xe200]
call fcn.00402630
cmp dword [ebp - 0xccb8], 0
jbe 0x4d377e
lea edx, [ebp - 0xccc8]
lea ecx, [ebp - 0xe230]
call fcn.0043dc50
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0xc8a8]
call fcn.00406f40
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0xe230]
call fcn.00402630
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xccc8]
call fcn.00402630
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xccf8]
call fcn.00402630
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xd3a0]
call fcn.00402630
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xd3d0]
call fcn.00402630
mov ecx, dword [ebp - 0xc898]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d3818
lea ecx, [ebp - 0xc8a8]
cmp dword [ebp - 0xc894], 0x10
cmovae ecx, dword [ebp - 0xc8a8]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d37e4
mov dword [esi], 5
mov dword [ebp - 0xf894], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3803
sub ecx, edx
mov dword [ebp - 0xf890], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8a8]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.xCryptoRSADecrypt
lea ecx, [ebp - 0xd400]
call fcn.004025d0
mov dword [ebp - 4], 0x156
lea eax, [ebp - 0xd400]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd400]
call fcn.00402630
test bl, bl
je 0x4d3a5e
lea ecx, [ebp - 0xc668]
call fcn.00403f80
mov dword [ebp - 4], 0x157
cmp dword [ebp + 0x10], 2
jb 0x4d39cf
cmp dword [edi], 5
jne 0x4d39cf
cmp dword [edi + 0x10], 5
jne 0x4d39cf
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd460]
call fcn.00406f10
mov byte [ebp - 4], 0x58
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd430]
call fcn.00406f10
mov byte [ebp - 4], 0x59
lea eax, [ebp - 0xd430]
push eax
lea ecx, [ebp - 0xe260]
call fcn.00406ee0
mov byte [ebp - 4], 0x5a
mov edx, eax
lea ecx, [ebp - 0xcd58]
call fcn.0043dde0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xe260]
call fcn.00402630
cmp dword [ebp - 0xcd48], 0
jbe 0x4d39a2
lea eax, [ebp - 0xd460]
push eax
lea ecx, [ebp - 0xe290]
call fcn.00406ee0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0xcd58]
push ecx
mov edx, eax
lea ecx, [ebp - 0xcd28]
call fcn.0043e8a0
add esp, 4
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0xe290]
call fcn.00402630
cmp dword [ebp - 0xcd18], 0
jbe 0x4d3993
lea edx, [ebp - 0xcd28]
lea ecx, [ebp - 0xe2c0]
call fcn.0043dc50
mov byte [ebp - 4], 0x60
push eax
lea ecx, [ebp - 0xc668]
call fcn.00406f40
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0xe2c0]
call fcn.00402630
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xcd28]
call fcn.00402630
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0xcd58]
call fcn.00402630
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0xd430]
call fcn.00402630
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xd460]
call fcn.00402630
mov ecx, dword [ebp - 0xc658]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d3a35
lea ecx, [ebp - 0xc668]
cmp dword [ebp - 0xc654], 0x10
cmovae ecx, dword [ebp - 0xc668]
mov edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d3a00
mov dword [esi], 5
mov dword [ebp - 0xf8a4], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3a20
sub ecx, edx
mov dword [ebp - 0xf8a0], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc668]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.xGenerateKeys
lea ecx, [ebp - 0xd490]
call fcn.004025d0
mov dword [ebp - 4], 0x161
lea eax, [ebp - 0xd490]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd490]
call fcn.00402630
test bl, bl
je 0x4d3c4e
lea ecx, [ebp - 0xc578]
call fcn.00403f80
mov dword [ebp - 4], 0x162
cmp dword [ebp + 0x10], 1
jb 0x4d3bc5
cmp dword [edi], 5
jne 0x4d3bc5
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe2f0]
call fcn.00406f10
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0xc6b0]
call fcn.00403f80
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xc860]
call fcn.00403f80
mov byte [ebp - 4], 0x65
lea edx, [ebp - 0xc860]
lea ecx, [ebp - 0xc6b0]
call fcn.0043df00
test al, al
je 0x4d3b98
lea ecx, [ebp - 0xc6b0]
cmp dword [ebp - 0xc69c], 0x10
cmovae ecx, dword [ebp - 0xc6b0]
mov edx, dword [ebp - 0xc6a0]
call fcn.00431b70
mov edi, eax
test edi, edi
je 0x4d3b98
lea ecx, [ebp - 0xc860]
cmp dword [ebp - 0xc84c], 0x10
cmovae ecx, dword [ebp - 0xc860]
mov edx, dword [ebp - 0xc850]
call fcn.00431b70
mov ebx, eax
test ebx, ebx
je 0x4d3b8f
push edi
lea ecx, [ebp - 0xc578]
call fcn.00406f80
push 0x5846cc
lea ecx, [ebp - 0xc578]
call fcn.00424f70
push ebx
lea ecx, [ebp - 0xc578]
call fcn.00424f70
push ebx
call fcn.0051f88d
add esp, 4
push edi
call fcn.0051f88d
add esp, 4
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xc860]
call fcn.00402630
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0xc6b0]
call fcn.00402630
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0xe2f0]
call fcn.00402630
mov ecx, dword [ebp - 0xc568]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d3c25
lea ecx, [ebp - 0xc578]
cmp dword [ebp - 0xc564], 0x10
cmovae ecx, dword [ebp - 0xc578]
mov edx, edi
nop
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d3bf0
mov dword [esi], 5
mov dword [ebp - 0xf8bc], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3c10
sub ecx, edx
mov dword [ebp - 0xf8b8], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc578]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.encrypt
lea ecx, [ebp - 0xd4c0]
call fcn.004025d0
mov dword [ebp - 4], 0x166
lea eax, [ebp - 0xd4c0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd4c0]
call fcn.00402630
test bl, bl
je 0x4d3e45
lea ecx, [ebp - 0xc830]
call fcn.00403f80
mov dword [ebp - 4], 0x167
cmp dword [ebp + 0x10], 2
jb 0x4d3db8
cmp dword [edi], 5
jne 0x4d3db8
cmp dword [edi + 0x10], 5
jne 0x4d3db8
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xcc68]
call fcn.00406f10
mov byte [ebp - 4], 0x68
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xc908]
call fcn.00406f10
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0xf670]
call fcn.004e3ac0
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0xcc68]
cmp dword [ebp - 0xcc54], 0x10
cmovae ecx, dword [ebp - 0xcc68]
lea edx, [ebp - 0xf670]
call fcn.00406080
test al, al
je 0x4d3d8c
mov dword [ebp - 0xf674], 0
lea ecx, [ebp - 0xc908]
cmp dword [ebp - 0xc8f4], 0x10
cmovae ecx, dword [ebp - 0xc908]
push ecx
lea eax, [ebp - 0xf674]
push eax
lea eax, [ebp - 0xf670]
push eax
mov edx, dword [ebp - 0xc8f8]
call fcn.004060f0
add esp, 0xc
mov edi, eax
test edi, edi
je 0x4d3d8c
mov edx, dword [ebp - 0xf674]
mov ecx, edi
call fcn.00431b70
mov esi, eax
push edi
call fcn.0051f344
add esp, 4
push esi
lea ecx, [ebp - 0xc830]
call fcn.00406f80
push esi
call fcn.00443e80
add esp, 4
mov byte [ebp - 4], 0x69
mov dword [ebp - method.CRijndael.virtual_0], vtable.CRijndael.0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0xc908]
call fcn.00402630
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0xcc68]
call fcn.00402630
mov ecx, dword [ebp - 0xc820]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d3e1c
lea ecx, [ebp - 0xc830]
cmp dword [ebp - 0xc81c], 0x10
cmovae ecx, dword [ebp - 0xc830]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d3de2
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf88c], esi
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d3e07
sub edx, edi
mov dword [ebp - 0xf888], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc830]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.decrypt
lea ecx, [ebp - 0xd4f0]
call fcn.004025d0
mov dword [ebp - 4], 0x16b
lea eax, [ebp - 0xd4f0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd4f0]
call fcn.00402630
test bl, bl
je 0x4d4053
lea ecx, [ebp - 0xc6e0]
call fcn.00403f80
mov dword [ebp - 4], 0x16c
cmp dword [ebp + 0x10], 2
jb 0x4d3fc3
cmp dword [edi], 5
jne 0x4d3fc3
cmp dword [edi + 0x10], 5
jne 0x4d3fc3
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xca88]
call fcn.00406f10
mov byte [ebp - 4], 0x6d
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xc8c0]
call fcn.00406f10
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0xf1f8]
call fcn.004e3ac0
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0xca88]
cmp dword [ebp - 0xca74], 0x10
cmovae ecx, dword [ebp - 0xca88]
lea edx, [ebp - 0xf1f8]
call fcn.00406080
test al, al
je 0x4d3f97
mov dword [ebp - 0xf69c], 0
lea ecx, [ebp - 0xc8c0]
cmp dword [ebp - 0xc8ac], 0x10
cmovae ecx, dword [ebp - 0xc8c0]
lea eax, [ebp - 0xf69c]
push eax
mov edx, dword [ebp - 0xc8b0]
call fcn.00432070
add esp, 4
mov esi, eax
mov dword [ebp - 0xf6bc], 0
lea eax, [ebp - 0xf6bc]
push eax
lea eax, [ebp - 0xf1f8]
push eax
mov edx, dword [ebp - 0xf69c]
mov ecx, esi
call fcn.00406210
mov edi, eax
push esi
call fcn.0051f344
add esp, 0xc
test edi, edi
je 0x4d3f97
push edi
lea ecx, [ebp - 0xc6e0]
call fcn.00406f80
push edi
call fcn.0051f344
add esp, 4
mov byte [ebp - 4], 0x6e
mov dword [ebp - method.CRijndael.virtual_0], vtable.CRijndael.0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0xc8c0]
call fcn.00402630
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0xca88]
call fcn.00402630
mov ecx, dword [ebp - 0xc6d0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d402a
lea ecx, [ebp - 0xc6e0]
cmp dword [ebp - 0xc6cc], 0x10
cmovae ecx, dword [ebp - 0xc6e0]
mov edx, esi
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d3ff0
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf8c4], esi
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d4015
sub edx, edi
mov dword [ebp - 0xf8c0], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc6e0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.encryptcbc
lea ecx, [ebp - 0xd520]
call fcn.004025d0
mov dword [ebp - 4], 0x170
lea eax, [ebp - 0xd520]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd520]
call fcn.00402630
test bl, bl
je 0x4d421e
lea ecx, [ebp - 0xc7d0]
call fcn.00403f80
mov dword [ebp - 4], 0x171
cmp dword [ebp + 0x10], 2
jb 0x4d4194
cmp dword [edi], 5
jne 0x4d4194
cmp dword [edi + 0x10], 5
jne 0x4d4194
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd580]
call fcn.00406f10
mov byte [ebp - 4], 0x72
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd550]
call fcn.00406f10
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0xcd88]
call fcn.00403f80
mov byte [ebp - 4], 0x74
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd580]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x75
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0xcd88]
call fcn.00432220
add esp, 0x10
lea eax, [ebp - 0xd550]
push eax
lea edx, [ebp - 0xcd88]
lea ecx, [ebp - 0xe320]
call fcn.004063b0
add esp, 0xc
mov byte [ebp - 4], 0x76
push eax
lea ecx, [ebp - 0xc7d0]
call fcn.00406f40
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0xe320]
call fcn.00402630
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0xcd88]
call fcn.00402630
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0xd550]
call fcn.00402630
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0xd580]
call fcn.00402630
mov ecx, dword [ebp - 0xc7c0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d41f5
lea ecx, [ebp - 0xc7d0]
cmp dword [ebp - 0xc7bc], 0x10
cmovae ecx, dword [ebp - 0xc7d0]
mov edx, edi
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d41c0
mov dword [esi], 5
mov dword [ebp - 0xf89c], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d41e0
sub ecx, edx
mov dword [ebp - 0xf898], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc7d0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.decryptcbc
lea ecx, [ebp - 0xd5b0]
call fcn.004025d0
mov dword [ebp - 4], 0x177
lea eax, [ebp - 0xd5b0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd5b0]
call fcn.00402630
test bl, bl
je 0x4d43ee
lea ecx, [ebp - 0xc710]
call fcn.00403f80
mov dword [ebp - 4], 0x178
cmp dword [ebp + 0x10], 2
jb 0x4d435f
cmp dword [edi], 5
jne 0x4d435f
cmp dword [edi + 0x10], 5
jne 0x4d435f
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd610]
call fcn.00406f10
mov byte [ebp - 4], 0x79
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xd5e0]
call fcn.00406f10
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0xcdb8]
call fcn.00403f80
mov byte [ebp - 4], 0x7b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xd610]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x7c
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xcdb8]
call fcn.00432220
add esp, 0x10
lea eax, [ebp - 0xd5e0]
push eax
lea edx, [ebp - 0xcdb8]
lea ecx, [ebp - 0xe350]
call fcn.004069d0
add esp, 0xc
mov byte [ebp - 4], 0x7d
push eax
lea ecx, [ebp - 0xc710]
call fcn.00406f40
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xe350]
call fcn.00402630
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0xcdb8]
call fcn.00402630
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0xd5e0]
call fcn.00402630
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0xd610]
call fcn.00402630
mov ecx, dword [ebp - 0xc700]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d43c5
lea ecx, [ebp - 0xc710]
cmp dword [ebp - 0xc6fc], 0x10
cmovae ecx, dword [ebp - 0xc710]
mov edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d4390
mov dword [esi], 5
mov dword [ebp - 0xf800], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d43b0
sub ecx, edx
mov dword [ebp - 0xf7fc], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc710]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.copy_to_clipboard
lea ecx, [ebp - 0xd640]
call fcn.004025d0
mov dword [ebp - 4], 0x17e
lea eax, [ebp - 0xd640]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd640]
call fcn.00402630
test bl, bl
je 0x4d4652
cmp dword [ebp + 0x10], 1
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xc740]
call fcn.00406f10
mov dword [ebp - 4], 0x17f
push 0x58d1d8
lea ecx, [ebp - 0xd6a0]
call fcn.004025d0
mov byte [ebp - 4], 0x80
push 0x59a2e0
lea ecx, [ebp - 0xd670]
call fcn.004025d0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0xd6a0]
push eax
lea esi, [ebp - 0xd670]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xc740]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x82
mov byte [ebp - 4], 0x81
mov edx, esi
lea ecx, [ebp - 0xe380]
call fcn.004ce170
add esp, 0x1c
mov byte [ebp - 4], 0x83
push eax
lea ecx, [ebp - 0xc740]
call fcn.00406f40
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0xe380]
call fcn.00402630
mov byte [ebp - 4], 0x80
mov ecx, esi
call fcn.00402630
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xd6a0]
call fcn.00402630
push 0x59a2e0
lea ecx, [ebp - 0xd700]
call fcn.004025d0
mov byte [ebp - 4], 0x84
push 0x58d1d8
lea ecx, [ebp - 0xd6d0]
call fcn.004025d0
mov byte [ebp - 4], 0x85
lea eax, [ebp - 0xd700]
push eax
lea esi, [ebp - 0xd6d0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xc740]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x86
mov byte [ebp - 4], 0x85
mov edx, esi
lea ecx, [ebp - 0xe3b0]
call fcn.004ce170
add esp, 0x1c
mov byte [ebp - 4], 0x87
push eax
lea ecx, [ebp - 0xc740]
call fcn.00406f40
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xe3b0]
call fcn.00402630
mov byte [ebp - 4], 0x84
mov ecx, esi
call fcn.00402630
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xd700]
call fcn.00402630
lea edx, [ebp - 0xc740]
lea ecx, [ebp - 0xc890]
call fcn.00403da0
mov byte [ebp - 4], 0x88
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d461a
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp - 0xc880]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0xc890]
cmp dword [ebp - 0xc87c], 8
cmovae ecx, dword [ebp - 0xc890]
push ecx
mov ecx, dword [ebp - 0xc880]
inc ecx
push ecx
push eax
call fcn.00523667
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xc890]
call fcn.004040c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc740]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.clear_clipboard_if
lea ecx, [ebp - 0xd730]
call fcn.004025d0
mov dword [ebp - 4], 0x189
lea eax, [ebp - 0xd730]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd730]
call fcn.00402630
test bl, bl
je 0x4d4892
cmp dword [ebp + 0x10], 1
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xc800]
call fcn.00406f10
mov dword [ebp - 4], 0x18a
push 0x58d1d8
lea ecx, [ebp - 0xd790]
call fcn.004025d0
mov byte [ebp - 4], 0x8b
push 0x59a2e0
lea ecx, [ebp - 0xd760]
call fcn.004025d0
mov byte [ebp - 4], 0x8c
lea eax, [ebp - 0xd790]
push eax
lea esi, [ebp - 0xd760]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xc800]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x8d
mov byte [ebp - 4], 0x8c
mov edx, esi
lea ecx, [ebp - 0xe3e0]
call fcn.004ce170
add esp, 0x1c
mov byte [ebp - 4], 0x8e
push eax
lea ecx, [ebp - 0xc800]
call fcn.00406f40
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0xe3e0]
call fcn.00402630
mov byte [ebp - 4], 0x8b
mov ecx, esi
call fcn.00402630
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0xd790]
call fcn.00402630
push 0x59a2e0
lea ecx, [ebp - 0xce78]
call fcn.004025d0
mov byte [ebp - 4], 0x8f
push 0x58d1d8
lea ecx, [ebp - 0xd7c0]
call fcn.004025d0
mov byte [ebp - 4], 0x90
lea eax, [ebp - 0xce78]
push eax
lea esi, [ebp - 0xd7c0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xc800]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0x91
mov byte [ebp - 4], 0x90
mov edx, esi
lea ecx, [ebp - 0xe410]
call fcn.004ce170
add esp, 0x1c
mov byte [ebp - 4], 0x92
push eax
lea ecx, [ebp - 0xc800]
call fcn.00406f40
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0xe410]
call fcn.00402630
mov byte [ebp - 4], 0x8f
mov ecx, esi
call fcn.00402630
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0xce78]
call fcn.00402630
lea edx, [ebp - 0xc800]
lea ecx, [ebp - 0xce90]
call fcn.00403da0
mov byte [ebp - 4], 0x93
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d485a
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4d4854
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4d4854
mov edx, eax
lea ecx, [ebp - 0xce90]
call fcn.0041dd90
test al, al
je 0x4d484d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0xce90]
call fcn.004040c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc800]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.choose_file
lea ecx, [ebp - 0xd7f0]
call fcn.004025d0
mov dword [ebp - 4], 0x194
lea eax, [ebp - 0xd7f0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd7f0]
call fcn.00402630
test bl, bl
je 0x4d4dc2
lea ecx, [ebp - 0xc4a0]
call fcn.00403f80
mov dword [ebp - 4], 0x195
lea ecx, [ebp - 0xcde8]
call fcn.00403f80
mov byte [ebp - 4], 0x96
mov byte [ebp - 0xf68a], 0
mov byte [ebp - 0xf689], 0
lea ecx, [ebp - 0xc8f0]
call fcn.00403f80
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0xc8d8]
call fcn.00403f80
mov byte [ebp - 4], 0x98
mov esi, dword [ebp + 0x10]
cmp esi, 1
jb 0x4d493a
cmp dword [edi], 2
jne 0x4d493a
mov al, byte [edi + 8]
mov byte [ebp - 0xf68a], al
cmp esi, 3
jb 0x4d49ab
cmp dword [edi + 0x10], 5
jne 0x4d49ab
cmp dword [edi + 0x20], 5
jne 0x4d49ab
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe440]
call fcn.00406f10
mov byte [ebp - 4], 0x99
push eax
lea ecx, [ebp - 0xc8d8]
call fcn.00406f40
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xe440]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xe470]
call fcn.00406f10
mov byte [ebp - 4], 0x9a
push eax
lea ecx, [ebp - 0xc8f0]
call fcn.00406f40
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xe470]
call fcn.00402630
cmp esi, 4
jb 0x4d49bf
cmp dword [edi + 0x30], 2
jne 0x4d49bf
mov al, byte [edi + 0x38]
mov byte [ebp - 0xf689], al
xor ebx, ebx
mov dword [ebp - 0xf718], ebx
cmp dword [ebp - 0xc8e0], ebx
je 0x4d4abc
cmp dword [ebp - 0xc8c8], ebx
je 0x4d4abc
lea edx, [ebp - 0xc8f0]
lea ecx, [ebp - 0xcba8]
call fcn.00403da0
mov byte [ebp - 4], 0x9b
lea edx, [ebp - 0xc8d8]
lea ecx, [ebp - 0xc938]
call fcn.00403da0
mov byte [ebp - 4], 0x9c
mov edi, dword [ebp - 0xc8e0]
mov eax, dword [ebp - 0xc8c8]
add eax, 3
add edi, eax
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051a596
add esp, 4
mov ebx, eax
mov dword [ebp - 0xf718], ebx
lea esi, [edi + edi]
push esi
push 0
push ebx
call fcn.00525d00
add esp, 0xc
lea eax, [ebp - 0xc938]
cmp dword [ebp - 0xc924], 8
cmovae eax, dword [ebp - 0xc938]
push eax
push edi
push ebx
call fcn.00523667
add esp, 0xc
lea eax, [ebp - 0xcba8]
cmp dword [ebp - 0xcb94], 8
cmovae eax, dword [ebp - 0xcba8]
push eax
mov eax, dword [ebp - 0xc928]
sub edi, eax
dec edi
push edi
inc eax
lea eax, [ebx + eax*2]
push eax
call fcn.00523667
add esp, 0xc
xor eax, eax
mov word [esi + ebx - 2], ax
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0xc938]
call fcn.004040c0
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xcba8]
call fcn.004040c0
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push eax
lea eax, [ebp - 0x426]
push eax
call fcn.00525d00
add esp, 0xc
push 0x58
push 0
lea eax, [ebp - 0xf978]
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0xf978], 0x58
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xf974], eax
test ebx, ebx
je 0x4d4b19
mov dword [ebp - 0xf96c], ebx
mov dword [ebp - 0xf960], 1
jmp 0x4d4b23
mov dword [ebp - 0xf96c], 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0xf95c], eax
mov dword [ebp - 0xf958], 0x104
mov dword [ebp - 0xf944], 0x81000
mov dword [ebp - 0xf948], 0
lea eax, [ebp - 0xf978]
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x4d4c51
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0xe4d0]
call fcn.00403ff0
mov byte [ebp - 4], 0x9d
mov edx, eax
lea ecx, [ebp - 0xe4a0]
call fcn.00403e90
mov byte [ebp - 4], 0x9e
push eax
lea ecx, [ebp - 0xcde8]
call fcn.00406f40
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0xe4a0]
call fcn.00402630
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xe4d0]
call fcn.004040c0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4c51
mov dword [ebp - 0xf6e0], 0
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ecx]
push 0
lea eax, [ebp - 0xf6e0]
push eax
push 0x400
lea eax, [ebp - 0x13f8]
push eax
push esi
call edi
test eax, eax
je 0x4d4c4a
mov eax, dword [ebp - 0xf6e0]
test eax, eax
je 0x4d4c4a
push eax
lea eax, [ebp - 0x13f8]
push eax
lea ecx, [ebp - 0xe500]
call fcn.00406f10
mov byte [ebp - 4], 0x9f
push eax
lea ecx, [ebp - 0xc4a0]
call fcn.00415d60
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xe500]
call fcn.00402630
jmp 0x4d4bf0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4d4c5e
push ebx
call fcn.0051f88d
add esp, 4
cmp byte [ebp - 0xf689], 0
je 0x4d4c92
lea ecx, [ebp - 0xc4a0]
cmp dword [ebp - 0xc48c], 0x10
cmovae ecx, dword [ebp - 0xc4a0]
mov edx, dword [ebp - 0xc490]
call fcn.00431b70
push eax
lea ecx, [ebp - 0xc4a0]
call fcn.00406f80
cmp byte [ebp - 0xf68a], 0
je 0x4d4d08
cmp dword [ebp - 0xc490], 0
je 0x4d4d08
push 0x58d1d8
lea eax, [ebp - 0xcde8]
push eax
lea eax, [ebp - 0xe560]
push eax
call fcn.004c1260
add esp, 0xc
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0xc4a0]
push ecx
push eax
lea eax, [ebp - 0xe530]
push eax
call fcn.004d8100
add esp, 0xc
mov byte [ebp - 4], 0xa1
push eax
lea ecx, [ebp - 0xc4a0]
call fcn.00406f40
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0xe530]
call fcn.00402630
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0xe560]
call fcn.00402630
mov ecx, dword [ebp - 0xc490]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d4d6c
lea ecx, [ebp - 0xc4a0]
cmp dword [ebp - 0xc48c], 0x10
cmovae ecx, dword [ebp - 0xc4a0]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4d4d32
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf86c], esi
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d4d57
sub edx, edi
mov dword [ebp - 0xf868], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0xc8d8]
call fcn.00402630
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0xc8f0]
call fcn.00402630
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0xcde8]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc4a0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.run_file
lea ecx, [ebp - 0xd820]
call fcn.004025d0
mov dword [ebp - 4], 0x1a2
lea eax, [ebp - 0xd820]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd820]
call fcn.00402630
test bl, bl
je 0x4d50f0
lea ecx, [ebp - 0xc770]
call fcn.00403f80
mov dword [ebp - 4], 0x1a3
cmp dword [ebp + 0x10], 1
jb 0x4d4e54
cmp dword [edi], 5
jne 0x4d4e54
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe590]
call fcn.00406f10
mov byte [ebp - 4], 0xa4
push eax
lea ecx, [ebp - 0xc770]
call fcn.00406f40
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0xe590]
call fcn.00402630
mov dword [ebp - 0xc470], 0x59a9a0
mov dword [ebp - 0xc46c], 0x59a9a4
mov dword [ebp - 0xc468], str.docx
mov dword [ebp - 0xc464], 0x59a9b0
mov dword [ebp - 0xc460], 0x59a9b4
mov dword [ebp - 0xc45c], str.pptx
mov dword [ebp - 0xc458], 0x59a9c0
mov dword [ebp - 0xc454], 0x59a9c4
mov dword [ebp - 0xc450], str.xlsx
mov dword [ebp - 0xc44c], 0x59a9d0
mov dword [ebp - 0xc448], 0x59a9d4
mov dword [ebp - 0xc444], 0x59a9d8
mov dword [ebp - 0xc440], 0x59a9dc
mov dword [ebp - 0xc43c], 0x59a9e0
mov dword [ebp - 0xc438], 0x59a9e4
mov dword [ebp - 0xc434], 0x59a9e8
mov dword [ebp - 0xc430], 0x59a9ec
mov dword [ebp - 0xc42c], 0x59a9f0
mov dword [ebp - 0xc428], str.html
mov dword [ebp - 0xc424], 0x59a9fc
mov dword [ebp - 0xc420], 0x59aa00
mov dword [ebp - 0xc41c], str.tiff
mov dword [ebp - 0xc418], 0x59aa0c
mov dword [ebp - 0xc414], str.jpeg
mov dword [ebp - 0xc410], 0x59aa18
mov dword [ebp - 0xc40c], 0x59aa1c
mov dword [ebp - 0xc408], 0x59aa20
mov dword [ebp - 0xc404], 0x59aa24
mov dword [ebp - 0xc400], 0x597938
mov dword [ebp - 0xc3fc], 0x5933f4
mov dword [ebp - 0xf6b4], 0
mov dword [ebp - 0xf6b0], 0
mov dword [ebp - 0xf6ac], 0
push dword [ebp - 0xf6c4]
lea eax, [ebp - 0xc3f8]
push eax
lea eax, [ebp - 0xc470]
push eax
lea ecx, [ebp - 0xf6b4]
call fcn.004d8800
mov byte [ebp - 4], 0xa5
push 1
sub esp, 8
lea ecx, [ebp - 0xc770]
call fcn.004d6f70
mov ebx, eax
push 0xffffffffffffffff
lea ecx, [ebx + 1]
push ecx
lea eax, [ebp - 0xc590]
push eax
lea ecx, [ebp - 0xc770]
call fcn.00407030
mov byte [ebp - 4], 0xa6
lea edi, [ebp - 0xc590]
cmp dword [ebp - 0xc57c], 0x10
cmovae edi, dword [ebp - 0xc590]
lea esi, [ebp - 0xc590]
cmovae esi, dword [ebp - 0xc590]
lea eax, [ebp - 0xf80c]
push eax
lea ecx, [ebp - 0xc590]
call fcn.00407300
push edi
push dword [eax]
push esi
lea ecx, [ebp - 0xf674]
call fcn.004d8180
add esp, 0xc
cmp ebx, 0xffffffff
je 0x4d50a9
mov byte [ebp - 0xf674], 0
push dword [ebp - 0xf674]
lea eax, [ebp - 0xc590]
push eax
mov edx, dword [ebp - 0xf6b0]
mov ecx, dword [ebp - 0xf6b4]
call fcn.004d8890
add esp, 8
cmp eax, dword [ebp - 0xf6b0]
je 0x4d50a9
lea edx, [ebp - 0xc770]
lea ecx, [ebp - 0xd850]
call fcn.00403da0
mov byte [ebp - 4], 0xa7
push 1
push 0
push 0
lea ecx, [ebp - 0xd850]
call fcn.00404260
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0xd850]
call fcn.004040c0
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0xc590]
call fcn.00402630
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0xf6b4]
call fcn.00439600
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc770]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.save_file
lea ecx, [ebp - 0xd880]
call fcn.004025d0
mov dword [ebp - 4], 0x1a8
lea eax, [ebp - 0xd880]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd880]
call fcn.00402630
test bl, bl
je 0x4d56ad
lea ecx, [ebp - 0xc650]
call fcn.00403f80
mov dword [ebp - 4], 0x1a9
lea ecx, [ebp - 0xd8b0]
call fcn.00403f80
mov byte [ebp - 4], 0xaa
xor al, al
mov dword [ebp - 0xf680], eax
mov byte [ebp - 0xf6a2], al
lea ecx, [ebp - 0xcb18]
call fcn.00403f80
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0xcbd8]
call fcn.00403f80
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0xcae8]
call fcn.00403f80
mov byte [ebp - 4], 0xad
lea ecx, [ebp - 0xcc38]
call fcn.00403f80
mov byte [ebp - 4], 0xae
mov esi, dword [ebp + 0x10]
cmp esi, 1
jb 0x4d51dd
cmp dword [edi], 5
jne 0x4d51dd
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe5c0]
call fcn.00406f10
mov byte [ebp - 4], 0xaf
push eax
lea ecx, [ebp - 0xc650]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe5c0]
call fcn.00402630
cmp esi, 3
jb 0x4d524e
cmp dword [edi + 0x10], 5
jne 0x4d524e
cmp dword [edi + 0x20], 5
jne 0x4d524e
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe5f0]
call fcn.00406f10
mov byte [ebp - 4], 0xb0
push eax
lea ecx, [ebp - 0xcbd8]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe5f0]
call fcn.00402630
push dword [edi + 0x2c]
push dword [edi + 0x28]
lea ecx, [ebp - 0xe620]
call fcn.00406f10
mov byte [ebp - 4], 0xb1
push eax
lea ecx, [ebp - 0xcb18]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe620]
call fcn.00402630
cmp esi, 4
jb 0x4d5290
cmp dword [edi + 0x30], 2
jne 0x4d5290
mov al, byte [edi + 0x38]
test al, al
je 0x4d5290
lea edx, [ebp - 0xc650]
lea ecx, [ebp - 0xe650]
call fcn.00432160
mov byte [ebp - 4], 0xb2
push eax
lea ecx, [ebp - 0xc650]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe650]
call fcn.00402630
cmp esi, 5
jb 0x4d52cb
cmp dword [edi + 0x40], 5
jne 0x4d52cb
push dword [edi + 0x4c]
push dword [edi + 0x48]
lea ecx, [ebp - 0xe680]
call fcn.00406f10
mov byte [ebp - 4], 0xb3
push eax
lea ecx, [ebp - 0xcae8]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe680]
call fcn.00402630
cmp esi, 6
jb 0x4d5303
cmp dword [edi + 0x50], 5
jne 0x4d5303
push dword [edi + 0x5c]
push dword [edi + 0x58]
lea ecx, [ebp - 0xe6b0]
call fcn.00406f10
mov byte [ebp - 4], 0xb4
push eax
lea ecx, [ebp - 0xcc38]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe6b0]
jmp 0x4d5362
cmp dword [ebp - 0xcad8], 0
jbe 0x4d5338
push str.If_not_specified__will_use_a_file_extension_of:
lea ecx, [ebp - 0xe6e0]
call fcn.004025d0
mov byte [ebp - 4], 0xb5
push eax
lea ecx, [ebp - 0xcc38]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe6e0]
jmp 0x4d5362
push str.No_default_file_extension
lea ecx, [ebp - 0xe710]
call fcn.004025d0
mov byte [ebp - 4], 0xb6
push eax
lea ecx, [ebp - 0xcc38]
call fcn.00406f40
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xe710]
call fcn.00402630
xor ebx, ebx
mov dword [ebp - 0xf710], ebx
cmp dword [ebp - 0xcb08], ebx
je 0x4d5452
cmp dword [ebp - 0xcbc8], ebx
je 0x4d5452
lea edx, [ebp - 0xcb18]
lea ecx, [ebp - 0xce18]
call fcn.00403da0
mov byte [ebp - 4], 0xb7
lea edx, [ebp - 0xcbd8]
lea ecx, [ebp - 0xcab8]
call fcn.00403da0
mov byte [ebp - 4], 0xb8
mov edi, dword [ebp - 0xce08]
mov eax, dword [ebp - 0xcaa8]
add eax, 3
add edi, eax
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051a596
add esp, 4
mov ebx, eax
mov dword [ebp - 0xf710], ebx
lea esi, [edi + edi]
push esi
push 0
push ebx
call fcn.00525d00
add esp, 0xc
lea ecx, [ebp - 0xcab8]
call fcn.00404260
push eax
push edi
push ebx
call fcn.00523667
add esp, 0xc
lea ecx, [ebp - 0xce18]
call fcn.00404260
push eax
mov eax, dword [ebp - 0xcaa8]
sub edi, eax
dec edi
push edi
inc eax
lea eax, [ebx + eax*2]
push eax
call fcn.00523667
add esp, 0xc
xor eax, eax
mov word [esi + ebx - 2], ax
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0xcab8]
call fcn.004040c0
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xce18]
call fcn.004040c0
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push eax
lea eax, [ebp - 0x21e]
push eax
call fcn.00525d00
add esp, 0xc
push 0x58
push 0
lea eax, [ebp - 0xf920]
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0xf920], 0x58
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xf91c], eax
test ebx, ebx
je 0x4d54af
mov dword [ebp - 0xf914], ebx
mov dword [ebp - 0xf908], 1
jmp 0x4d54b9
mov dword [ebp - 0xf914], 0
lea eax, [ebp - 0x220]
mov dword [ebp - 0xf904], eax
mov dword [ebp - 0xf900], 0x104
mov dword [ebp - 0xf8ec], 0x80802
lea edx, [ebp - 0xcae8]
lea ecx, [ebp - 0xce48]
call fcn.00403da0
mov byte [ebp - 4], 0xb9
cmp dword [ebp - 0xce38], 0
jbe 0x4d5508
lea ecx, [ebp - 0xce48]
call fcn.00404260
mov dword [ebp - 0xf8e4], eax
mov dword [ebp - 0xf8f0], 0
lea eax, [ebp - 0xf920]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x4d55fe
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xe770]
call fcn.00403ff0
mov byte [ebp - 4], 0xba
mov edx, eax
lea ecx, [ebp - 0xe740]
call fcn.00403e90
mov byte [ebp - 4], 0xbb
push eax
lea ecx, [ebp - 0xd8b0]
call fcn.00406f40
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0xe740]
call fcn.00402630
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0xe770]
call fcn.004040c0
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d55fe
mov dword [ebp - 0xf6dc], 0
push 0
lea eax, [ebp - 0xf6dc]
push eax
push dword [ebp - 0xc640]
lea ecx, [ebp - 0xc650]
call fcn.004027e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4d55f7
mov ecx, dword [ebp - 0xf680]
movzx ecx, cl
mov edx, 1
mov eax, dword [ebp - 0xf6dc]
cmp eax, dword [ebp - 0xc640]
cmove ecx, edx
mov dword [ebp - 0xf680], ecx
mov byte [ebp - 0xf6a2], cl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4d5610
push ebx
call fcn.0051f88d
add esp, 4
jmp 0x4d5610
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 2
xor eax, eax
cmp byte [ebp - 0xf680], al
setne al
mov byte [ecx + 8], al
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0xce48]
call fcn.004040c0
mov byte [ebp - 4], 0xad
lea ecx, [ebp - 0xcc38]
call fcn.00402630
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0xcae8]
call fcn.00402630
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0xcbd8]
call fcn.00402630
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0xcb18]
call fcn.00402630
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0xd8b0]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc650]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.wlan_works
lea ecx, [ebp - 0xd8e0]
call fcn.004025d0
mov dword [ebp - 4], 0x1bc
lea eax, [ebp - 0xd8e0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd8e0]
call fcn.00402630
test bl, bl
je 0x4d5714
xor bl, bl
call fcn.004bbed0
test al, al
je 0x4d5700
call fcn.004bc5b0
mov bl, al
call fcn.004bbd90
mov dword [esi], 2
xor ecx, ecx
test bl, bl
jmp 0x4cf01f
push str.wlan_pull_csv
lea ecx, [ebp - 0xd910]
call fcn.004025d0
mov dword [ebp - 4], 0x1bd
lea eax, [ebp - 0xd910]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd910]
call fcn.00402630
test bl, bl
je 0x4d583d
lea ecx, [ebp - 0xcc98]
call fcn.00403f80
mov dword [ebp - 4], 0x1be
lea ecx, [ebp - 0xd940]
call fcn.004bda00
mov byte [ebp - 4], 0xbf
lea edx, [ebp - 0xd940]
lea ecx, [ebp - 0xe7a0]
call fcn.00403e90
mov byte [ebp - 4], 0xc0
push eax
lea ecx, [ebp - 0xcc98]
call fcn.00406f40
mov byte [ebp - 4], 0xbf
lea ecx, [ebp - 0xe7a0]
call fcn.00402630
mov ecx, dword [ebp - 0xcc88]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d5805
lea ecx, [ebp - 0xcc98]
call fcn.004027e0
mov edx, edi
jmp 0x4d57d0
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d57d0
mov dword [esi], 5
mov dword [ebp - 0xf8b4], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d57f0
sub ecx, edx
mov dword [ebp - 0xf8b0], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0xbe
lea ecx, [ebp - 0xd940]
call fcn.004040c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcc98]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.wlan_push
lea ecx, [ebp - 0xd970]
call fcn.004025d0
mov dword [ebp - 4], 0x1c1
lea eax, [ebp - 0xd970]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd970]
call fcn.00402630
test bl, bl
je 0x4d58fc
cmp dword [ebp + 0x10], 1
jb 0x4ce6e9
cmp dword [edi], 5
jne 0x4ce6e9
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xd9a0]
call fcn.00406f10
mov dword [ebp - 4], 0x1c2
sub esp, 0x18
mov dword [ebp - 0xf674], esp
lea edx, [ebp - 0xd9a0]
mov ecx, esp
call fcn.00403da0
mov byte [ebp - 4], 0xc3
mov byte [ebp - 4], 0xc2
call fcn.004be7c0
add esp, 0x18
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd9a0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.wlan_has_exe
lea ecx, [ebp - 0xd9d0]
call fcn.004025d0
mov dword [ebp - 4], 0x1c4
lea eax, [ebp - 0xd9d0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd9d0]
call fcn.00402630
test bl, bl
je 0x4d5947
call fcn.004bc5b0
jmp 0x4cf015
push str.get_version
lea ecx, [ebp - 0xda00]
call fcn.004025d0
mov dword [ebp - 4], 0x1c5
lea eax, [ebp - 0xda00]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xda00]
call fcn.00402630
test bl, bl
je 0x4d59ed
mov ecx, 7
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4ce6e9
mov ecx, 0x599b6c
mov edx, edi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x4d59a5
mov dword [esi], 5
mov dword [ebp - 0xf7f0], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d59c2
sub ecx, edx
mov dword [ebp - 0xf7ec], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_build_date
lea ecx, [ebp - 0xda30]
call fcn.004025d0
mov dword [ebp - 4], 0x1c6
lea eax, [ebp - 0xda30]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xda30]
call fcn.00402630
test bl, bl
je 0x4d5a9b
mov ecx, 0xc
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4ce6e9
mov ecx, str.Jun__7_2022
mov edx, edi
sub edx, ecx
jmp 0x4d5a50
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x4d5a50
mov dword [esi], 5
mov dword [ebp - 0xf7a0], edi
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d5a70
sub ecx, edx
mov dword [ebp - 0xf79c], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_build_time
lea ecx, [ebp - 0xda60]
call fcn.004025d0
mov dword [ebp - 4], 0x1c7
lea eax, [ebp - 0xda60]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xda60]
call fcn.00402630
test bl, bl
je 0x4d5b4b
mov ecx, 9
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4ce6e9
mov ecx, str.15:26:07
mov edx, edi
sub edx, ecx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x4d5b00
mov dword [esi], 5
mov dword [ebp - 0xf7b0], edi
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d5b20
sub ecx, edx
mov dword [ebp - 0xf7ac], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.debug_windows
lea ecx, [ebp - 0xda90]
call fcn.004025d0
mov dword [ebp - 4], 0x1c8
lea eax, [ebp - 0xda90]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xda90]
call fcn.00402630
test bl, bl
jne 0x4ce594
push str.pbkdf2
lea ecx, [ebp - 0xdac0]
call fcn.004025d0
mov dword [ebp - 4], 0x1c9
lea eax, [ebp - 0xdac0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdac0]
call fcn.00402630
test bl, bl
je 0x4d5dd3
lea ecx, [ebp - 0xc548]
call fcn.00403f80
mov dword [ebp - 4], 0x1ca
cmp dword [ebp + 0x10], 4
jb 0x4d5d4c
cmp dword [edi], 5
jne 0x4d5d4c
cmp dword [edi + 0x10], 5
jne 0x4d5d4c
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xe7d0]
call fcn.00406f10
mov byte [ebp - 4], 0xcb
mov edx, eax
lea ecx, [ebp - 0xdb20]
call fcn.00432160
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0xe7d0]
call fcn.00402630
push dword [edi + 0x1c]
push dword [edi + 0x18]
lea ecx, [ebp - 0xe800]
call fcn.00406f10
mov byte [ebp - 4], 0xce
mov edx, eax
lea ecx, [ebp - 0xdaf0]
call fcn.00432160
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xe800]
call fcn.00402630
sub esp, 0x10
mov eax, esp
movdqu xmm0, xmmword [edi + 0x20]
movdqu xmmword [eax], xmm0
call fcn.004ca140
mov esi, eax
mov ecx, esp
movdqu xmm0, xmmword [edi + 0x30]
movdqu xmmword [ecx], xmm0
call fcn.004ca140
add esp, 0xc
push esi
lea eax, [ebp - 0xdaf0]
push eax
lea edx, [ebp - 0xdb20]
lea ecx, [ebp - 0xe860]
call fcn.0043eaa0
add esp, 0xc
mov byte [ebp - 4], 0xd1
mov edx, eax
lea ecx, [ebp - 0xe830]
call fcn.0043dc50
mov byte [ebp - 4], 0xd2
push eax
lea ecx, [ebp - 0xc548]
call fcn.00406f40
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0xe830]
call fcn.00402630
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xe860]
call fcn.00402630
lea edi, [ebp - 0xc548]
cmp dword [ebp - 0xc534], 0x10
cmovae edi, dword [ebp - 0xc548]
lea esi, [ebp - 0xc548]
cmovae esi, dword [ebp - 0xc548]
lea eax, [ebp - 0xf8c8]
push eax
lea ecx, [ebp - 0xc548]
call fcn.00407300
push edi
push dword [eax]
push esi
lea ecx, [ebp - 0xf674]
call fcn.004d8180
add esp, 0xc
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0xdaf0]
call fcn.00402630
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0xdb20]
call fcn.00402630
mov ecx, dword [ebp - 0xc538]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov esi, eax
test esi, esi
je 0x4d5daa
lea ecx, [ebp - 0xc548]
call fcn.004027e0
mov edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d5d70
mov ecx, dword [ebp - 0xf690]
mov dword [ecx], 5
mov dword [ebp - 0xf7c0], esi
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d5d95
sub edx, edi
mov dword [ebp - 0xf7bc], edx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc548]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_function_names
lea ecx, [ebp - 0xdb50]
call fcn.004025d0
mov dword [ebp - 4], 0x1d3
lea eax, [ebp - 0xdb50]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdb50]
call fcn.00402630
test bl, bl
je 0x4d5f22
lea ecx, [ebp - 0xcb48]
call fcn.00403f80
mov dword [ebp - 4], 0x1d4
lea ecx, [ebp - 0xcda0]
call fcn.00403f80
mov byte [ebp - 4], 0xd5
xor edi, edi
mov dword [ebp - 0xf708], edi
mov eax, dword [edi*4 + 0x589030]
test eax, eax
je 0x4d5e95
push eax
lea eax, [ebp - 0xcda0]
push eax
lea eax, [ebp - 0xe890]
push eax
call fcn.004c1260
add esp, 0xc
mov byte [ebp - 4], 0xd6
push eax
lea ecx, [ebp - 0xcb48]
call fcn.00415d60
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0xe890]
call fcn.00402630
push 0x596748
lea ecx, [ebp - 0xcda0]
call fcn.00406f80
inc edi
jmp 0x4d5e3b
mov ecx, dword [ebp - 0xcb38]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d5eea
lea ecx, [ebp - 0xcb48]
call fcn.004027e0
mov edx, edi
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d5eb6
mov dword [esi], 5
mov dword [ebp - 0xf790], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d5ed5
sub ecx, edx
mov dword [ebp - 0xf78c], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov byte [ebp - 4], 0xd4
lea ecx, [ebp - 0xcda0]
call fcn.00402630
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcb48]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.nymi_supported
lea ecx, [ebp - 0xdb80]
call fcn.004025d0
mov dword [ebp - 4], 0x1d7
lea eax, [ebp - 0xdb80]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdb80]
call fcn.00402630
test bl, bl
je 0x4d5f76
call fcn.0040ff70
test al, al
setne cl
xor eax, eax
test cl, cl
jmp 0x4ce6dd
push str.nymi_provision
lea ecx, [ebp - 0xdbb0]
call fcn.004025d0
mov dword [ebp - 4], 0x1d8
lea eax, [ebp - 0xdbb0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdbb0]
call fcn.00402630
test bl, bl
je 0x4d603f
xor bl, bl
mov byte [ebp - 0xf6a5], bl
cmp dword [ebp + 0x10], 1
jb 0x4d6030
cmp dword [edi], 5
jne 0x4d6030
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xcea8]
call fcn.00406f10
mov dword [ebp - 4], 0x1d9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xcea8]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xda
mov byte [ebp - 4], 0xd9
call fcn.0040fff0
add esp, 0x18
mov bl, al
mov byte [ebp - 0xf6a5], bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcea8]
call fcn.00402630
jmp 0x4d6030
mov dword [esi], 2
xor ecx, ecx
test bl, bl
jmp 0x4cf01f
push str.nymi_has_data
lea ecx, [ebp - 0xcec0]
call fcn.004025d0
mov dword [ebp - 4], 0x1db
lea eax, [ebp - 0xcec0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcec0]
call fcn.00402630
test bl, bl
je 0x4d608a
call fcn.004106b0
jmp 0x4cf015
push str.nymi_validate
lea ecx, [ebp - 0xdbe0]
call fcn.004025d0
mov dword [ebp - 4], 0x1dc
lea eax, [ebp - 0xdbe0]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdbe0]
call fcn.00402630
test bl, bl
je 0x4d618e
lea ecx, [ebp - 0xc9e0]
call fcn.00403f80
mov dword [ebp - 4], 0x1dd
lea ecx, [ebp - 0xe8c0]
call fcn.00410350
mov byte [ebp - 4], 0xde
push eax
lea ecx, [ebp - 0xc9e0]
call fcn.00406f40
mov byte [ebp - 4], 0xdd
lea ecx, [ebp - 0xe8c0]
call fcn.00402630
mov ecx, dword [ebp - 0xc9d0]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d6165
lea ecx, [ebp - 0xc9e0]
call fcn.004027e0
mov edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d6130
mov dword [esi], 5
mov dword [ebp - 0xf7d0], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d6150
sub ecx, edx
mov dword [ebp - 0xf7cc], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc9e0]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.nymi_get_version
lea ecx, [ebp - 0xdc10]
call fcn.004025d0
mov dword [ebp - 4], 0x1df
lea eax, [ebp - 0xdc10]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdc10]
call fcn.00402630
test bl, bl
je 0x4d61f4
call fcn.00410800
mov dword [esi], 3
mov dword [esi + 8], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.nymi_read_data
lea ecx, [ebp - 0xdc40]
call fcn.004025d0
mov dword [ebp - 4], 0x1e0
lea eax, [ebp - 0xdc40]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xdc40]
call fcn.00402630
test bl, bl
je 0x4d62f3
lea ecx, [ebp - 0xca10]
call fcn.00403f80
mov dword [ebp - 4], 0x1e1
lea ecx, [ebp - 0xe8f0]
call fcn.004109f0
mov byte [ebp - 4], 0xe2
push eax
lea ecx, [ebp - 0xca10]
call fcn.00406f40
mov byte [ebp - 4], 0xe1
lea ecx, [ebp - 0xe8f0]
call fcn.00402630
mov ecx, dword [ebp - 0xca00]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d62ca
lea ecx, [ebp - 0xca10]
call fcn.004027e0
mov edx, edi
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d6296
mov dword [esi], 5
mov dword [ebp - 0xf758], edi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d62b5
sub ecx, edx
mov dword [ebp - 0xf754], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xca10]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.nymi_write_data
lea ecx, [ebp - 0xced8]
call fcn.004025d0
mov dword [ebp - 4], 0x1e3
lea eax, [ebp - 0xced8]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xced8]
call fcn.00402630
test bl, bl
je 0x4d63c4
cmp dword [ebp + 0x10], 1
jb 0x4d63a0
cmp dword [edi], 5
jne 0x4d63a0
push dword [edi + 0xc]
push dword [edi + 8]
lea ecx, [ebp - 0xcef0]
call fcn.00406f10
mov dword [ebp - 4], 0x1e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf674], esp
lea eax, [ebp - 0xcef0]
push eax
call fcn.00406ee0
mov byte [ebp - 4], 0xe5
mov byte [ebp - 4], 0xe4
call fcn.00410e90
add esp, 0x18
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcef0]
call fcn.00402630
jmp 0x4d63a0
mov dword [esi], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
push str.get_safari_history
lea ecx, [ebp - 0xcf08]
call fcn.004025d0
mov dword [ebp - 4], 0x1e6
lea eax, [ebp - 0xcf08]
push eax
call fcn.004d6920
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
sete bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcf08]
call fcn.00402630
test bl, bl
je 0x4d649b
lea ecx, [ebp - 0xcd10]
call fcn.00403f80
mov dword [ebp - 4], 0x1e7
mov ecx, dword [ebp - 0xcd00]
lea ecx, [ecx + 1]
call fcn.004ca0e0
mov edi, eax
test edi, edi
je 0x4d6475
lea ecx, [ebp - 0xcd10]
call fcn.004027e0
mov edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4d6440
mov dword [esi], 5
mov dword [ebp - 0xf6e8], edi
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d6460
sub ecx, edx
mov dword [ebp - 0xf6e4], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xcd10]
call fcn.00402630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
mov al, 1
wait
jmp 0x4d64b4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc488]
call fcn.00402630
wait
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret 0x10