Function at 0x453fd1
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xd8
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x58], ecx
call fcn.004378b6
mov al, byte [ebp + 0x7c]
cmp al, 1
pop ecx
mov byte [ebp + 0x57], al
jne 0x453ff7
mov byte [ebp + 0x57], 0
push ebx
cmp al, 1
sete bl
push esi
lea ecx, [ebp + 0x24]
mov byte [ebp + 0x7c], bl
call fcn.0043d3a5
lea ecx, [ebp + 0x28]
call fcn.0043d3a5
lea eax, [ebp + 0x74]
push eax
call fcn.004378b6
test bl, bl
pop ecx
je 0x454023
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043fd51
add esp, 0xc
test bl, bl
je 0x454041
mov eax, dword [ebp + 0x24]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x58]
push 0
lea eax, [ebp + 0x24]
push eax
call fcn.00402db0
mov eax, dword [ebp + 0x24]
movsx esi, bl
shl esi, 1
lea ebx, [esi + eax]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
mov dword [ebp + 0x30], ebx
je 0x454070
mov esi, 0x80070057
jmp 0x454e8a
add dword [ebp + 0x74], 2
push edi
push 0x3b
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043fda4
mov eax, dword [ebp + 0x74]
mov di, word [eax]
add esp, 0x10
cmp di, 0x2c
je 0x45409b
cmp di, 0x3b
jne 0x45409f
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x57], 0
mov byte [ebp + 0x67], 0
jne 0x454206
push dword [ebp + 0x28]
push str.WINVER
call fcn.00438ae0
test al, al
pop ecx
pop ecx
jne 0x4540db
push dword [ebp + 0x28]
push 0x4ac9c8
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454206
mov byte [ebp + 0x67], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.004378b6
mov eax, dword [ebp + 0x74]
xor edi, edi
xor ebx, ebx
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], edi
jne 0x4540fe
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x454123
lea ecx, [eax + 2]
cmp word [ecx], di
mov byte [ebp + 0x67], 1
jne 0x45411e
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x67], 0x2a
jmp 0x454123
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, di
mov dword [ebp + 0x34], ecx
jne 0x45413a
cmp byte [ebp + 0x67], 0
je 0x4541c1
mov dword [ebp + 0x7c], edi
cmp word [eax], 0x2a
je 0x454149
cmp byte [ebp + 0x67], 0x2a
jne 0x45419a
mov eax, dword [ebp + 0x58]
cmp byte [eax + 0x92], 0
push 0x11
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x454180
test byte [eax + 9], 0xf
jne 0x454180
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044bf54
jmp 0x454194
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044b25d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 0
push dword [ebp + 0x3c]
push eax
call fcn.004074a2
add esp, 0xc
lea ecx, [ebp + 0x7c]
mov ebx, eax
mov edi, edx
call fcn.00437884
cmp byte [ebp + 0x67], 0
jne 0x4541c1
cmp word [ebp + 0x34], 0
jne 0x4541ec
mov esi, ebx
mov dword [ebp + 0x3c], edi
call fcn.0043a367
cmp byte [ebp + 0x67], 0
mov ebx, eax
mov edi, edx
je 0x4541ec
shld edi, ebx, 0x10
shl ebx, 0x10
and esi, 0xffff
xor eax, eax
or esi, ebx
or eax, edi
mov ebx, esi
mov edi, eax
push str.0x_I64X
push dword [ebp + 0x30]
push edi
push ebx
push dword [ebp + 0x58]
call fcn.0043f697
add esp, 0x14
jmp 0x454e87
push dword [ebp + 0x28]
push str.ispe
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454230
push ebx
call fcn.00409341
push eax
push dword [ebp + 0x58]
call fcn.0043f71c
add esp, 0xc
jmp 0x454e87
test di, di
je 0x454245
cmp di, 0x2c
je 0x454245
mov esi, 0x80070057
jmp 0x454e89
cmp byte [ebp + 0x57], 0
je 0x454255
cmp byte [ebp + 0x57], 2
jne 0x45471f
push dword [ebp + 0x24]
lea ecx, [ebp + 0x50]
call fcn.00445746
cmp byte [ebp + 0x7c], 0
mov edi, dword [ebp + 0x50]
je 0x45426e
mov word [edi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.004378b6
mov ebx, dword [ebp + 0x28]
push ebx
push str.FVER
call fcn.00438ae0
add esp, 0xc
test al, al
je 0x454348
lea ecx, [ebp + 0x4c]
call fcn.0043d3a5
push dword [ebp + 0x74]
xor ebx, ebx
mov dword [ebp + 0x5c], ebx
call fcn.004110a0
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x7c], edi
xor esi, esi
call fcn.00437d61
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x4542ea
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fda4
mov eax, dword [ebp + 0x68]
mov si, word [eax]
add esp, 0x10
mov ax, si
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [edi]
neg ax
lea ecx, [ebp + 0x4c]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.004074a2
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push dword [ebp + 0x4c]
push edi
call fcn.0043cc80
cmp si, bx
je 0x454330
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x68]
call fcn.0043cc80
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x5c]
call fcn.00437884
lea ecx, [ebp + 0x4c]
jmp 0x4546a4
push ebx
push str.FTIME
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x4544e4
push dword [ebp + 0x74]
call fcn.004110a0
pop ecx
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.0043d3a5
lea ecx, [ebp + 0x4c]
call fcn.0043d3a5
lea ecx, [ebp + 0x44]
call fcn.0043d3a5
push 6
lea eax, [ebp + 0x60]
push eax
add esi, edi
push str._local
mov dword [ebp + 0x60], esi
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x4543b2
cmp byte [ebp + 0x7c], 0
je 0x4543ae
sub dword [ebp + 0x60], 2
mov eax, dword [ebp + 0x60]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
push 3
lea eax, [ebp + 0x60]
push eax
push 0x4ac958
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x4543cd
or byte [ebp + 0x7c], 4
push 4
lea eax, [ebp + 0x60]
push eax
push str._ws1
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x4543e8
or byte [ebp + 0x7c], 8
cmp byte [ebp + 0x7c], 0
je 0x4543f3
mov word [edi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], si
jne 0x454424
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fd51
add esp, 0xc
mov eax, dword [ebp + 0x60]
cmp word [eax], si
jne 0x454441
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fd51
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x4544b1
push dword [ebp + 0x7c]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.004407a4
push dword [ebp + 0x7c]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x58]
call fcn.004407a4
push dword [ebp + 0x7c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x58]
call fcn.004407a4
add esp, 0x30
lea ecx, [ebp + 0x44]
call fcn.00437884
lea ecx, [ebp + 0x4c]
call fcn.00437884
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x50]
call fcn.00437884
jmp 0x454e89
mov ecx, dword [ebp + 0x58]
mov esi, 0x4a39d4
push esi
push dword [ebp + 0x68]
call fcn.0043cc80
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x4c]
call fcn.0043cc80
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x44]
call fcn.0043cc80
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x45448c
push ebx
push str.FATTR
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454715
push dword [ebp + 0x74]
call fcn.004110a0
mov bl, byte [ebp + 0x7c]
test bl, bl
pop ecx
mov dword [ebp + 0x3c], eax
je 0x454511
mov word [edi], 0x26
lea ecx, [ebp + 0x60]
call fcn.0043d3a5
lea ecx, [ebp + 0x44]
call fcn.0043d3a5
lea ecx, [ebp + 0x4c]
call fcn.0043d3a5
lea ecx, [ebp + 0x68]
call fcn.0043d3a5
lea ecx, [ebp + 0x5c]
call fcn.0043d3a5
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], edi
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4545f8
test bl, bl
je 0x454567
mov word [eax], 0x26
jmp 0x45456c
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4545f8
test bl, bl
je 0x454590
mov word [eax], 0x26
jmp 0x454595
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4545f8
test bl, bl
je 0x4545b9
mov word [eax], 0x26
jmp 0x4545be
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4545f8
test bl, bl
je 0x4545e2
mov word [eax], 0x26
jmp 0x4545e7
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x4546b1
mov eax, dword [ebp - 8]
push dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.0043f71c
mov eax, dword [ebp - 8]
push dword [ebp + 0x44]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.0043f71c
mov eax, dword [ebp - 8]
push dword [ebp + 0x4c]
and eax, edi
push eax
push esi
call fcn.0043f71c
mov eax, dword [ebp - 8]
push dword [ebp + 0x68]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.0043f71c
push dword [ebp - 8]
and word [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push str.0x_lX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0043cc80
lea ecx, [ebp + 0x5c]
call fcn.00437884
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x4c]
call fcn.00437884
lea ecx, [ebp + 0x44]
call fcn.00437884
lea ecx, [ebp + 0x60]
call fcn.00437884
lea ecx, [ebp + 0x50]
jmp 0x454e82
mov edi, dword [ebp + 0x58]
mov esi, 0x4a39d4
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0043cc80
push esi
push dword [ebp + 0x44]
mov ecx, edi
call fcn.0043cc80
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.0043cc80
push esi
push dword [ebp + 0x68]
mov ecx, edi
call fcn.0043cc80
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437884
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x4c]
call fcn.00437884
lea ecx, [ebp + 0x44]
call fcn.00437884
lea ecx, [ebp + 0x60]
jmp 0x45449f
lea ecx, [ebp + 0x50]
call fcn.00437884
jmp 0x454722
mov ebx, dword [ebp + 0x28]
cmp byte [ebp + 0x57], 0
push 0x26
pop edi
jne 0x454e87
push dword [ebp + 0x24]
lea ecx, [ebp + 0x60]
call fcn.00445746
lea eax, [ebp + 0x74]
push eax
call fcn.004378b6
push ebx
push str.DROPFILE
call fcn.00438ae0
add esp, 0xc
test al, al
je 0x454831
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
xor ebx, ebx
push eax
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], ebx
call fcn.004486b7
pop ecx
pop ecx
lea ecx, [ebp + 0x50]
call fcn.0043d3a5
lea ecx, [ebp + 0x44]
call fcn.0043d3a5
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x4547c2
cmp byte [ebp + 0x7c], bl
je 0x4547ab
mov word [eax], di
jmp 0x4547b0
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0043fd51
add esp, 0xc
lea ecx, [ebp + 0x4c]
call fcn.0043d3a5
lea ecx, [ebp + 0x68]
call fcn.0043d3a5
mov esi, dword [ebp + 0x44]
xor eax, eax
cmp word [esi], bx
je 0x4547df
lea eax, [ebp + 0x68]
mov ecx, dword [ebp + 0x38]
or ecx, dword [ebp + 0x3c]
je 0x4547f7
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x38]
call fcn.0040457e
add esp, 0xc
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0043cc80
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x58]
push esi
call fcn.0043cc80
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x4c]
call fcn.00437884
lea ecx, [ebp + 0x44]
call fcn.00437884
lea ecx, [ebp + 0x50]
jmp 0x454e7a
push ebx
push str.FPOS
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454a40
push dword [ebp + 0x74]
call fcn.004110a0
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.004378b6
push dword [ebp + 0x68]
call fcn.0040f047
add esp, 0xc
lea ecx, [ebp + 0x3c]
call fcn.0043d3a5
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x68]
call fcn.0041143a
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x3c]
mov esi, dword [ebp + 0x60]
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
je 0x45488e
mov word [esi], di
lea ecx, [ebp + 0x34]
call fcn.0043d3a5
lea ecx, [ebp + 0x30]
call fcn.0043d3a5
lea ecx, [ebp + 0x20]
call fcn.0043d3a5
lea ecx, [ebp + 0x50]
call fcn.0043d3a5
lea ecx, [ebp + 0x44]
call fcn.0043d3a5
lea ecx, [ebp + 0x4c]
call fcn.0043d3a5
lea ecx, [ebp + 0x5c]
call fcn.0043d3a5
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x4548f2
mov word [eax], di
jmp 0x4548f7
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x45491d
mov word [eax], di
jmp 0x454922
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x454948
mov word [eax], di
jmp 0x45494d
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x45496f
mov word [eax], di
jmp 0x454974
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x454996
mov word [eax], di
jmp 0x45499b
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4549d3
test bl, bl
je 0x4549bd
mov word [eax], di
jmp 0x4549c2
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fd51
add esp, 0xc
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x44]
push dword [ebp + 0x50]
push dword [ebp + 0x20]
push dword [ebp + 0x30]
push dword [ebp + 0x34]
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.00436689
add esp, 0x24
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437884
lea ecx, [ebp + 0x4c]
call fcn.00437884
lea ecx, [ebp + 0x44]
call fcn.00437884
lea ecx, [ebp + 0x50]
call fcn.00437884
lea ecx, [ebp + 0x20]
call fcn.00437884
lea ecx, [ebp + 0x30]
call fcn.00437884
lea ecx, [ebp + 0x34]
call fcn.00437884
lea ecx, [ebp + 0x3c]
call fcn.00437884
lea ecx, [ebp + 0x60]
jmp 0x4544a7
push ebx
push str.PPID
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454a85
and dword [ebp + 0x38], 0
and dword [ebp + 0x3c], 0
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004486b7
pop ecx
pop ecx
push dword [ebp + 0x60]
push dword [ebp + 0x38]
call fcn.004049e9
pop ecx
push eax
push dword [ebp + 0x58]
call fcn.0043f71c
add esp, 0xc
jmp 0x454e7f
push ebx
push str.ISADMIN
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454aa0
push dword [ebp + 0x60]
call fcn.00484411
jmp 0x454a74
push ebx
push str.PWIN
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454c12
lea ecx, [ebp + 0x3c]
call fcn.0043d3a5
lea ecx, [ebp + 0x68]
call fcn.0043d3a5
mov eax, dword [ebp + 0x60]
xor esi, esi
push esi
mov dword [ebp + 0x34], eax
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0043311b
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0043fd51
add esp, 0x1c
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x30], esi
call fcn.004050a5
test eax, eax
pop ecx
pop ecx
je 0x454b18
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004050a5
test eax, eax
pop ecx
pop ecx
je 0x454b31
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x20], eax
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x20]
and dword [ebp + 0x30], 0
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], 3
call fcn.004050a5
pop ecx
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
test eax, eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x454be3
cmp dword [ebp + 0x2c], 3
jne 0x454b7c
cmp dword [ebp + 0x30], 0
jne 0x454b7c
mov eax, dword [ebp + 0x68]
cmp word [eax], 0
je 0x454be3
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x454b9c
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x454ba5
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x454b89
cmp dword [ebp + 0x2c], 3
jne 0x454bb1
cmp dword [ebp + 0x30], 0
je 0x454be3
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x48], 0
and dword [ebp + 0x4c], 0
lea eax, [ebp + 0x48]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x2c]
sub edi, dword [ebp + 0x4c]
sub esi, dword [ebp + 0x48]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x454be3
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x3c]
push dword [ebp + 0x7c]
push dword [ebp + 0x58]
call fcn.00445818
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.00445818
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x3c]
jmp 0x454e7a
push ebx
push str.PEBIT
call fcn.00438ae0
test al, al
pop ecx
pop ecx
je 0x454e7f
mov eax, dword [ebp + 0x60]
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x30], eax
call fcn.0043d3a5
lea ecx, [ebp + 0x68]
call fcn.0043d3a5
xor edi, edi
push edi
push 0x2c
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043311b
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043fd51
or dword [ebp + 0x40], 0xffffffff
or dword [ebp + 0x44], 0xffffffff
push 0xd
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4a39d4
push eax
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x4c], edi
call fcn.00418cf5
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], di
je 0x454e20
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x454cbc
cmp cx, 0x2f
je 0x454cbc
push edx
call fcn.0048eec0
test eax, eax
pop ecx
je 0x454cdf
jmp 0x454cbf
mov word [eax], di
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.0043d4c9
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.0043d411
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x3c], edi
call fcn.004050ca
mov ebx, dword [ebp + 0x3c]
cmp ebx, edi
mov dword [ebp + 0x50], esi
je 0x454e18
and dword [ebp + 0x7c], edi
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x20]
call fcn.0043d3c3
push esi
push edi
mov edi, dword [ebp + 0x20]
push edi
call fcn.0048f710
add esp, 0xc
push 0
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
push ebx
call esi
test eax, eax
je 0x454e10
cmp dword [ebp + 0x7c], 0x40
jb 0x454e10
cmp word [edi], 0x5a4d
jne 0x454e10
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x454d8a
xor ecx, ecx
push ecx
push ecx
push eax
push ebx
mov dword [edi], ecx
mov dword [edi + 4], ecx
call fcn.004389fe
and dword [ebp + 0x7c], 0
add esp, 0x10
push 0
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x454e10
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x40], ecx
mov dword [ebp + 0x44], edi
jne 0x454de0
cmp edi, 0x8664
jne 0x454dbf
mov dword [ebp + 0x50], 0x4ac8f0
jmp 0x454e10
cmp ecx, eax
jne 0x454de0
cmp edi, 0x14c
je 0x454e09
cmp ecx, eax
jne 0x454de0
cmp edi, 0x200
jne 0x454de0
mov dword [ebp + 0x50], str.ia64
jmp 0x454e10
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x454e10
cmp edi, 0x137
je 0x454e09
cmp ecx, eax
jne 0x454e10
cmp edi, 0x1b0
je 0x454e09
cmp ecx, eax
jne 0x454e10
cmp edi, 0xe7
jne 0x454e10
mov dword [ebp + 0x50], 0x4ac8dc
lea ecx, [ebp + 0x20]
call fcn.00437884
lea ecx, [ebp + 0x3c]
call fcn.00402b8a
push dword [ebp + 0x50]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x34]
call fcn.0043cc80
cmp dword [ebp + 0x44], 0
jg 0x454e4e
jl 0x454e3c
cmp dword [ebp + 0x40], 0
ja 0x454e4e
mov ecx, dword [ebp + 0x58]
push str._0x000000000001
push dword [ebp + 0x68]
call fcn.0043cc80
jmp 0x454e67
push str.0x_012I64X
push dword [ebp + 0x68]
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.0043f697
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.00437884
lea ecx, [ebp + 0x68]
call fcn.00437884
lea ecx, [ebp + 0x34]
call fcn.00437884
lea ecx, [ebp + 0x60]
call fcn.00437884
xor esi, esi
pop edi
lea ecx, [ebp + 0x28]
call fcn.00437884
lea ecx, [ebp + 0x24]
call fcn.00437884
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc