Function at 0x4c6c60
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x30]
push ebx
mov ebx, dword [ebp + 0x28]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp + 0x34]
push esi
mov esi, dword [ebp + 0x3c]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp + 0x38]
push edi
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1d4], 0
call fcn.00493410
mov edi, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x204], 0
cmp edi, 0xffffffff
jne 0x4c6d2a
push dword [0x58fe8c]
call fcn.0047e990
add esp, 4
mov dword [0x58fe8c], 0
mov eax, dword [0x58fd5c]
test eax, eax
je 0x4c6d17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x58fd5c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
test edi, edi
jns 0x4c6d77
mov eax, edi
and eax, 7
cmp al, 3
jne 0x4c6d17
test byte [edx + 0xc], 4
jne 0x4c6d17
mov eax, edi
mov ecx, edi
or ecx, 1
and al, 3
mov eax, 0x10000
cmovne ecx, edi
mov edi, ecx
mov dword [ebp - 0x1e0], ecx
and edi, 0xf0000
cmove edi, eax
mov dword [ebp - 0x1e4], edi
test esi, esi
jne 0x4c6e4e
cmp edi, 0xf0000
jne 0x4c6d17
jmp 0x4c6cfd
cmp edi, 0x1000000
jne 0x4c6d37
cmp dword [edx + 0x4c8], 0
je 0x4c6d17
cmp dword [0x58fd5c], 0
je 0x4c6d17
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
sub eax, dword [0x5900f8]
sbb edx, dword [0x5900fc]
mov dword [ebp - 0x208], edx
js 0x4c6d17
jg 0x4c6dbe
cmp eax, 0x3c
jb 0x4c6d17
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x1b0]
push eax
push eax
push 0
push dword [0x58fd5c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x58fd5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 4
push 0
push 3
push 0x40000000
push 0x58fe90
call fcn.0047da90
xor ecx, ecx
cmp eax, 0xffffffff
push ecx
cmove eax, ecx
mov dword [0x58fd5c], eax
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 0x20
mov dword [0x5900f8], eax
mov dword [0x5900fc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
jne 0x4c6e60
mov al, cl
and al, 0xf
cmp al, 3
jne 0x4c6d17
push 0x501
push str.Message.c
lea eax, [edx + 0xd9c]
push 0
push eax
call fcn.0047efe0
mov eax, dword [ebp - 0x1fc]
add esp, 0x10
test eax, eax
je 0x4c701b
mov ebx, dword [eax + 0x50]
xor ecx, ecx
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], ecx
test ebx, ebx
je 0x4c6fc2
nop word [eax + eax]
push dword [ebx]
lea eax, [ebp - 0x130]
push 0x4ea7fc
push eax
call fcn.004010a0
mov ecx, dword [ebp - 0x1c8]
mov edi, eax
xor edx, edx
add ecx, edi
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
push dword [ebp - 0x1c4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov ecx, dword [ebp - 0x1c8]
add esp, 0x14
mov dword [ebp - 0x1c4], eax
test ecx, ecx
je 0x4c6f0b
push ecx
push eax
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x1c4]
add esp, 0xc
push edi
lea ecx, [ebp - 0x130]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x1c8]
add esp, 0xc
add ecx, edi
mov dword [ebp - 0x1c8], ecx
mov ebx, dword [ebx + 0x5c]
test ebx, ebx
jne 0x4c6eb0
mov eax, dword [ebp - 0x1c4]
mov edi, dword [ebp - 0x1e4]
mov byte [eax + ecx], bl
mov ecx, dword [ebp - 0x1c4]
mov ebx, dword [ebp + 8]
push str._d_s
push str._d_s
push str._d_s
test ecx, ecx
mov dword [ebp - 0x1c8], 0
mov eax, 0x4eb673
cmovne eax, ecx
push eax
mov eax, dword [0x52e824]
mov eax, dword [eax + 0x10]
push dword [eax]
lea eax, [ebp - 0x1c8]
push str._d_s
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.0047bfe0
add esp, 0x20
cmp dword [ebp - 0x1c4], 0
je 0x4c704e
lea eax, [ebp - 0x1c4]
push eax
call fcn.0047e900
push dword [ebp - 0x1c4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
jmp 0x4c704e
mov eax, dword [0x52e824]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x4c6f4a
mov ebx, dword [ebp + 8]
test ebx, 0x1000
je 0x4c6f4d
push 0x4ea7fc
push 0x4ea7fc
push 0x4ea7fc
push dword [eax]
lea eax, [ebp - 0x1c8]
push 0x4ea7fc
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.0047bfe0
mov ecx, dword [ebp - 0x1c4]
add esp, 0x1c
jmp 0x4c6f4d
test ebx, ebx
mov eax, 0x4eb673
cmovne eax, ebx
cmp byte [eax], 0
je 0x4c704b
push 0x51a
push str.Message.c
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push 0
lea eax, [ebp - 0x1d4]
push ebx
push eax
call fcn.0047ce40
add esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x1dc]
add eax, 0xd9c
push eax
call fcn.00480f30
add esp, 4
mov dword [ebp - 0x1d0], 0
cmp edi, 0x10000
je 0x4c7080
cmp edi, 0x20000
jne 0x4c7d70
mov eax, dword [0x58fc50]
inc eax
mov dword [0x58fc50], eax
cmp al, 1
je 0x4c70a8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 5
call edi
mov eax, dword [0x58fc50]
inc eax
mov dword [0x58fc50], eax
cmp al, 1
jne 0x4c7095
mov ecx, dword [ebp - 0x1e0]
mov edx, 0x4eb673
mov eax, ecx
and eax, 0x20
mov dword [ebp - 0x210], eax
mov eax, ebx
and eax, 0x300
mov dword [ebp - 0x214], eax
mov eax, ecx
and eax, 0x4000000
mov dword [ebp - 0x218], eax
mov eax, ecx
and eax, 0x1000
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x1f8]
test eax, eax
cmovne edx, eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f8], edx
test eax, eax
mov edx, 0x4eb673
cmovne edx, eax
and ecx, 0x80
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1fc], ecx
test ecx, ecx
jne 0x4c716f
push 0xd
push esi
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
push 0xa
push esi
mov edi, eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x1c4], ebx
test edi, edi
je 0x4c7141
cmp edi, ebx
jb 0x4c7145
test ebx, ebx
jne 0x4c7151
mov ebx, edi
mov dword [ebp - 0x1c4], ebx
test edi, edi
je 0x4c716f
mov al, byte [ebx]
cmp al, 0xd
je 0x4c715b
cmp al, 0xa
jne 0x4c716b
mov byte [ebx], 0
add ebx, 1
mov dword [ebp - 0x1c4], ebx
jne 0x4c7151
jmp 0x4c716f
test al, al
jne 0x4c7177
xor eax, eax
mov dword [ebp - 0x1c4], eax
push 0x27
push esi
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 8
test eax, eax
jne 0x4c7191
push 0x5c
push esi
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 8
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7196
sub ecx, edx
lea eax, [esi - 1]
add eax, ecx
cmp eax, esi
jb 0x4c71b5
cmp byte [eax], 0x20
jne 0x4c71b5
mov byte [eax], 0
dec eax
cmp eax, esi
jae 0x4c71a8
push 0x44
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1e4], ebx
test ebx, ebx
je 0x4c71d8
push 0x44
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edi, dword [ebp - 0x204]
test edi, edi
jne 0x4c71ff
push 8
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edi, eax
add esp, 4
mov dword [ebp - 0x204], edi
test edi, edi
je 0x4c71ff
xorps xmm0, xmm0
movq qword [edi], xmm0
inc dword [edi]
xor ecx, ecx
mov eax, dword [edi]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [edi + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov ecx, dword [edi]
mov dword [edi + 4], eax
push 0x543
push str.Message.c
mov dword [eax + ecx*4 - 4], ebx
mov ecx, 0x4eb673
mov eax, dword [ebp - 0x1f0]
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push 0
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 8]
mov dword [ebx + 0x28], eax
movups xmmword [ebx], xmm0
mov eax, dword [ebp - 0x1d4]
test eax, eax
cmovne ecx, eax
lea eax, [ebx + 0x34]
push ecx
push eax
call fcn.0047ce40
push 0x544
push str.Message.c
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push 0
push dword [ebp - 0x1ec]
lea eax, [ebx + 0x1c]
push eax
call fcn.0047ce40
push 0x545
push str.Message.c
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push 0
push dword [ebp - 0x1f8]
lea eax, [ebx + 0x20]
push eax
call fcn.0047ce40
mov eax, dword [ebp - 0x1e0]
add esp, 0x50
and eax, 0xef
mov ecx, 0xc01
cmp dword [ebp - 0x210], 0
push 0x54d
cmovne eax, ecx
or eax, dword [ebp - 0x214]
push str.Message.c
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
or eax, 0x20002000
push 0
push dword [ebp - 0x200]
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x18]
push eax
call fcn.0047ce40
mov eax, dword [ebp + 0x14]
add esp, 0x18
cmp dword [ebp + 0x18], 3
mov edx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x2c], edi
je 0x4c7319
mov ecx, dword [ebp - 0x1dc]
mov eax, edi
test dword [ecx + 4], 0x1000000
je 0x4c7335
mov ecx, dword [ebp - 0x1e0]
mov eax, edi
test edx, edx
je 0x4c733b
test ecx, 0x8000
jne 0x4c733b
lea eax, [edi + 3]
mov dword [ebx + 0x2c], eax
jmp 0x4c733b
mov ecx, dword [ebp - 0x1e0]
cmp dword [ebp - 0x218], 0
jne 0x4c7396
test eax, eax
jle 0x4c7396
test edx, edx
je 0x4c737e
test ecx, 0x8000
je 0x4c737e
push str._v_d__d:__s
push str._v_d__d:__s
push str._v_d__d:__s
push esi
push edx
push eax
push str._v_d__d:__s
lea edi, [ebx + 0x14]
push 0
push edi
call fcn.00482920
add esp, 0x24
jmp 0x4c740d
push str._v_d__s
push str._v_d__s
push str._v_d__s
push esi
push eax
push str._v_d__s
jmp 0x4c73ff
test edx, edx
je 0x4c73d9
test ecx, 0x8000
je 0x4c73d9
mov eax, dword [ebp - 0x1d0]
lea edi, [ebx + 0x14]
push str._s_d:__s
push str._s_d:__s
push str._s_d:__s
push esi
push edx
test eax, eax
mov ecx, 0x4eb673
cmovne ecx, eax
push ecx
push str._s_d:__s
push 0
push edi
call fcn.00482920
add esp, 0x24
jmp 0x4c740d
mov eax, dword [ebp - 0x1d0]
mov ecx, 0x4eb673
push 0x4f20b8
push 0x4f20b8
push 0x4f20b8
test eax, eax
push esi
cmovne ecx, eax
push ecx
push 0x4f20b8
push 0
lea edi, [ebx + 0x14]
push edi
call fcn.00482920
add esp, 0x20
cmp dword [ebp - 0x21c], 0
mov edi, dword [edi]
mov eax, dword [ebp - 0x1e8]
mov esi, dword [ebp - 0x1dc]
mov dword [ebp - 0x1f4], edi
jne 0x4c744f
cmp eax, 0x58fc60
jne 0x4c744f
test dword [esi + 8], 0x10000
jne 0x4c744f
cmp dword [esi + 0x4c8], 0
je 0x4c744f
test dword [ebp - 0x1e0], 0x2000000
je 0x4c7459
test byte [eax + 0xc], 1
je 0x4c7c26
lea edi, [esi + 0x270]
mov edx, 0x58ffc0
mov ecx, edi
sub edx, edi
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4c7470
mov ecx, dword [ebp - 0x1e8]
mov eax, 0x4eb673
push str._s_04d_02d_02d._slog
cmp dword [ecx + 0x44], 1
mov ecx, str.client.
cmove eax, ecx
mov ecx, dword [ebp - 0x1f0]
push eax
movzx eax, word [ecx + 6]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x58ffc0
push 0x56a
push str.Message.c
push str._s_04d_02d_02d._slog
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.00482bc0
add esp, 0x2c
cmp dword [esi + 0x4c8], 0
je 0x4c7748
lea eax, [ebp - 0x130]
push 0x58fe90
push eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp
add esp, 8
test eax, eax
je 0x4c75de
mov esi, dword [0x58fd5c]
test esi, esi
je 0x4c7518
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [0x58fd5c], esi
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x130]
lea ecx, [ecx + 1]
mov byte [ecx + 0x58fe8f], al
test al, al
jne 0x4c7520
mov eax, dword [ebp - 0x1dc]
cmp dword [eax + 0x4c8], 0
jle 0x4c7638
mov ecx, dword [ebp - 0x1f0]
movzx eax, word [ecx + 6]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
call fcn.0047a5d0
mov ecx, dword [ebp - 0x1dc]
add esp, 0xc
fstp qword [ebp - 0x20c]
cvttsd2si eax, qword [ebp - 0x20c]
sub eax, dword [ecx + 0x4c8]
lea ecx, [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x19c]
movd xmm0, eax
push ecx
lea ecx, [ebp - 0x198]
cvtdq2pd xmm0, xmm0
push ecx
sub esp, 8
movsd qword [esp], xmm0
call fcn.0047a2d0
movzx eax, word [ebp - 0x198]
imul ecx, eax, 0x64
movzx eax, word [ebp - 0x19c]
add ecx, eax
movzx eax, word [ebp - 0x1a0]
imul ecx, ecx, 0x64
add ecx, eax
push ecx
push str.log
push edi
call fcn.0047e620
add esp, 0x24
jmp 0x4c7632
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
sub eax, dword [0x5900f0]
sbb edx, dword [0x5900f4]
mov dword [ebp - 0x208], edx
js 0x4c7632
jg 0x4c7603
cmp eax, 0xa
jb 0x4c7632
mov eax, dword [0x58fd5c]
test eax, eax
je 0x4c761d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x58fd5c], 0
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov dword [0x5900f0], eax
mov dword [0x5900f4], edx
mov esi, dword [0x58fd5c]
test esi, esi
jne 0x4c7762
mov eax, dword [0x58fe8c]
test eax, eax
jne 0x4c765c
push eax
push 0x58ffc0
call fcn.004800b0
add esp, 8
mov dword [0x58fe8c], eax
push 0
push 0
push 4
push eax
push 3
push 0x40000000
push 0x58fe90
call fcn.0047da90
add esp, 0x1c
mov dword [0x58fd5c], eax
cmp eax, 0xffffffff
jne 0x4c771f
push 0x58ffc0
push 0
call fcn.0047d810
push 0
push 0
push 4
push dword [0x58fe8c]
push 3
push 0x40000000
push 0x58fe90
call fcn.0047da90
add esp, 0x24
mov dword [0x58fd5c], eax
cmp eax, 0xffffffff
jne 0x4c772c
mov eax, dword [0x52e820]
test eax, eax
je 0x4c76cc
mov esi, dword [eax + 0x190]
jmp 0x4c76d2
mov esi, dword [0x52e824]
push str.Unable_to_create_logfile__s:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047f8c0
add esp, 8
push eax
push 0x58fe90
push str.Unable_to_create_logfile__s:__s
push dword [0x52e820]
push esi
push 0
push 0x58b
push str.Message.c
push 0x2000003
call fcn.004c66b0
add esp, 0x28
mov dword [0x58fd5c], 0
jmp 0x4c772c
push 2
push 0
push 0
push eax
call dword [0x595dd8]
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov dword [0x5900f8], eax
mov dword [0x5900fc], edx
mov byte [0x590100], 0
mov esi, dword [0x58fd5c]
test esi, esi
jne 0x4c7762
mov eax, dword [ebp - 0x1e8]
test byte [eax + 0xc], 1
je 0x4c7c20
mov edi, dword [ebp - 0x1f4]
cmp byte [edi], 0x5f
je 0x4c7b7b
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4c7776
sub esi, ecx
lea eax, [esi + 0x12d]
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x208], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov dword [ebp - 0x1cc], eax
add esp, 8
mov byte [esi + eax + 0x12c], 0
mov al, byte [ebp - 0x1e0]
and al, 0xf
mov dword [ebp - 0x1d8], 0
cmp al, 3
jne 0x4c77d4
test dword [ebx + 0x28], 0x4000
mov esi, 0x4ea868
mov eax, 0x4ea86c
cmove esi, eax
jmp 0x4c77d9
mov esi, 0x4eb673
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4c7800
push 0x4ea870
push eax
push 0x4ea870
lea eax, [ebp - 0x194]
push 0x64
push eax
call fcn.0047f200
add esp, 0x14
mov ebx, eax
jmp 0x4c7805
mov ebx, 0x4eb673
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x4c7835
push 0x4ea874
push eax
push 0x4ea874
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.0047f200
add esp, 0x14
mov edi, eax
jmp 0x4c783a
mov edi, 0x4eb673
cmp dword [ebp - 0x200], 0
je 0x4c7863
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [eax + 0x4c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7850
sub ecx, edx
mov edx, dword [ebp - 0x200]
add edx, ecx
jmp 0x4c7868
mov edx, 0x4eb673
mov eax, dword [ebp - 0x1d4]
mov ecx, 0x4eb673
push esi
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 0x1e4]
push ecx
mov ecx, dword [ebp - 0x1f0]
push ebx
push dword [ebp - 0x1f8]
mov ebx, dword [ebp + 8]
push dword [ebp - 0x1ec]
push edi
push dword [eax + 0x24]
mov eax, ebx
push edx
and eax, 0xefffffff
push eax
movzx eax, word [ecx + 0xe]
push 0x4e5594
push eax
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xa]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 6]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str._04d__02d__02d__02d:_02d:_02d._03d_t_s_t_04X_t_s_t_d_s_t_s_t__s_s__t_s_t_s
push dword [ebp - 0x208]
push dword [ebp - 0x1cc]
call fcn.00482630
mov edi, dword [ebp - 0x1ec]
mov esi, eax
add esp, 0x50
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1e4], esi
mov edx, edi
mov ecx, 0x590100
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c7920
test al, al
je 0x4c791c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c7920
add ecx, 2
add edx, 2
test al, al
jne 0x4c7900
xor eax, eax
jmp 0x4c7925
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c793f
mov edx, 0x590100
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4c7932
mov edi, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1d8]
test ebx, 0x800
jne 0x4c7973
push edi
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.004c51f0
mov esi, dword [ebp - 0x1e4]
add esp, 0x10
jmp 0x4c7998
push 0x4f20b4
push 0x4f20b4
push 0x4f20b4
push edi
push 0x4f20b4
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.0047bfe0
add esp, 0x1c
mov eax, dword [ebp - 0x1d8]
add eax, 2
cmp eax, esi
jl 0x4c79c5
inc eax
push eax
push dword [ebp - 0x1cc]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov ecx, dword [ebp - 0x1d8]
add esp, 8
mov dword [ebp - 0x1cc], eax
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 0x1cc]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4c79d0
mov ax, word [0x4ef3c8]
mov word [ecx], ax
mov al, byte [0x4ef3ca]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x1e8]
test byte [eax + 0xc], 1
je 0x4c7a80
push dword [ebp - 0x1cc]
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
push 1
mov dword [ebp - 0x1c8], eax
lea eax, [ebp - 0x1c8]
push 0
push eax
call fcn.0047cc00
mov edx, dword [ebp - 0x1c8]
add esp, 0x10
mov ecx, edx
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7a30
push 0
lea eax, [ebp - 0x1a4]
sub ecx, esi
push eax
push ecx
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
cmp dword [ebp - 0x1c8], 0
je 0x4c7a80
lea eax, [ebp - 0x1c8]
push eax
call fcn.0047e900
push dword [ebp - 0x1c8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
mov dword [ebp - 0x1c8], 0
cmp dword [0x58fd5c], 0
je 0x4c7c26
cmp dword [ebp - 0x1fc], 0
je 0x4c7ad4
push 0xd
push dword [ebp - 0x1cc]
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x4c7ad4
nop word [eax + eax]
cmp byte [eax + 1], 0xa
lea ecx, [eax + 1]
jne 0x4c7ac5
cmp byte [eax + 2], 0
je 0x4c7ac5
mov byte [eax], 0xab
mov byte [ecx], 0xbb
push 0xd
push ecx
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x4c7ab0
mov edx, dword [ebp - 0x1cc]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7ae0
push 0
lea eax, [ebp - 0x1a4]
sub ecx, esi
push eax
push ecx
push edx
push dword [0x58fd5c]
call dword [0x595e5c]
test eax, eax
jne 0x4c7c26
mov eax, dword [0x52e820]
test eax, eax
je 0x4c7b19
mov esi, dword [eax + 0x190]
jmp 0x4c7b1f
mov esi, dword [0x52e824]
push str.Error_writing_to_logfile__s:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047f8c0
add esp, 8
push eax
push 0x58fe90
push str.Error_writing_to_logfile__s:__s
push dword [0x52e820]
push esi
push 0
push 0x5d1
push str.Message.c
push 0x2000003
call fcn.004c66b0
add esp, 0x28
push dword [0x58fd5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x58fd5c], 0
jmp 0x4c7c26
push 0x64
lea eax, [ebp - 0x130]
push 0x5f
push eax
call sub.VCRUNTIME140.dll_memset
mov ax, word [0x4ef3c8]
lea ecx, [ebp - 0x130]
mov word [ebp - 0xcc], ax
lea edx, [ecx + 1]
mov al, byte [0x4ef3ca]
add esp, 0xc
mov byte [ebp - 0xca], al
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7bb0
push 0
lea eax, [ebp - 0x1a4]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x130]
push eax
push esi
call dword [0x595e5c]
test eax, eax
jne 0x4c7c26
mov eax, dword [0x52e820]
test eax, eax
je 0x4c7be6
mov esi, dword [eax + 0x190]
jmp 0x4c7bec
mov esi, dword [0x52e824]
push str.Error_writing_to_logfile__s:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047f8c0
add esp, 8
push eax
push 0x58fe90
push str.Error_writing_to_logfile__s:__s
push dword [0x52e820]
push esi
push 0
push 0x5db
jmp 0x4c7b4e
mov edi, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1d0], 0
mov ebx, dword [ebp - 0x1c4]
jne 0x4c7d24
test ebx, ebx
je 0x4c7d24
mov ecx, edi
test edi, edi
je 0x4c7cf2
mov al, byte [edi]
test al, al
je 0x4c7cf2
mov dl, al
mov esi, ecx
mov al, dl
cmp dl, 0x11
jae 0x4c7cb3
cmp dl, 9
jb 0x4c7c6a
cmp dl, 0xd
jbe 0x4c7caf
movsx eax, dl
inc ecx
dec eax
cmp eax, 0xe
ja case.0x4c7c7b.8
movzx eax, byte [eax + 0x4c7ddc]
jmp dword [eax*4 + 0x4c7dc8]
lea ecx, [esi + 2]
jmp case.0x4c7c7b.8
lea ecx, [esi + 0x11]
jmp case.0x4c7c7b.8
xor eax, eax
nop
cmp byte [ecx], 0x20
jle 0x4c7c9c
inc eax
inc ecx
cmp eax, 8
jl 0x4c7c90
cmp byte [ecx], 3
jne case.0x4c7c7b.8
inc ecx
jmp case.0x4c7c7b.8
lea ecx, [esi + 7]
mov al, byte [ecx]
mov dl, al
test al, al
jne 0x4c7c57
test al, al
je 0x4c7cf2
cmp al, 0x20
jg 0x4c7cf2
cmp al, 0xd
je 0x4c7cf2
cmp al, 0xa
je 0x4c7cf2
movsx eax, al
inc ecx
sub eax, 9
je 0x4c7cd2
sub eax, 2
je 0x4c7cd2
sub eax, 1
jne 0x4c7cec
cmp byte [ecx], 0x23
jne 0x4c7cec
mov al, byte [ecx + 1]
inc ecx
cmp al, 0x30
jl 0x4c7cec
nop
cmp al, 0x39
ja 0x4c7cec
mov al, byte [ecx + 1]
inc ecx
cmp al, 0x30
jge 0x4c7ce0
mov al, byte [ecx]
test al, al
jne 0x4c7cb3
push 0x5e5
push str.Message.c
mov eax, ecx
sub eax, edi
cmp ecx, edi
push sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
push eax
mov eax, 0x4eb673
cmova eax, edi
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.0047ce40
add esp, 0x18
mov esi, ebx
jmp 0x4c7d2a
mov esi, ebx
test ebx, ebx
je 0x4c7d39
cmp byte [ebx], 0
mov ecx, dword [ebp - 0x1fc]
jne 0x4c7118
cmp dword [ebp - 0x1d0], 0
je 0x4c7d66
lea eax, [ebp - 0x1d0]
push eax
call fcn.0047e900
push dword [ebp - 0x1d0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
mov dword [ebp - 0x1d0], 0
mov dword [0x58fc50], 0
cmp dword [ebp - 0x1d4], 0
je 0x4c7d9d
lea eax, [ebp - 0x1d4]
push eax
call fcn.0047e900
push dword [ebp - 0x1d4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
mov dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1cc]
test eax, eax
je 0x4c7db0
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x204]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret