Function at 0x48f159
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x18c
push ebx
push esi
lea eax, [ebp + 0x74]
push edi
push eax
mov dword [ebp + 0x50], ecx
call fcn.0043e611
mov al, byte [ebp + 0x7c]
xor ebx, ebx
cmp al, 1
pop ecx
mov byte [ebp + 0x4b], al
jne 0x48f183
mov byte [ebp + 0x4b], bl
lea ecx, [ebp + 0x10]
sete byte [ebp + 0x7c]
call fcn.00444e32
lea ecx, [ebp + 0x1c]
call fcn.00444e32
lea eax, [ebp + 0x74]
push eax
call fcn.0043e611
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x48f1ab
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00447c46
add esp, 0xc
cmp byte [ebp + 0x7c], 0
je 0x48f1cb
mov eax, dword [ebp + 0x10]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ecb
movsx eax, byte [ebp + 0x7c]
mov dword [ebp + 0x18], eax
lea edi, [eax + eax]
mov eax, dword [ebp + 0x10]
add eax, edi
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
je 0x48f1fd
mov esi, 0x80070057
jmp 0x48f386
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00447c99
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x48f227
cmp si, 0x3b
jne 0x48f22b
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x4b], 0
mov byte [ebp + 0x57], 0
jne 0x48f3a2
push dword [ebp + 0x1c]
push str.WINVER
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x48f267
push dword [ebp + 0x1c]
push 0x4cc858
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48f3a2
mov byte [ebp + 0x57], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x74]
xor esi, esi
xor edi, edi
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], ebx
jne 0x48f28a
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x48f2af
lea ecx, [eax + 2]
cmp word [ecx], bx
mov byte [ebp + 0x57], 1
jne 0x48f2aa
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x57], 0x2a
jmp 0x48f2af
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, bx
mov dword [ebp + 0xc], ecx
jne 0x48f2c6
cmp byte [ebp + 0x57], 0
je 0x48f34a
mov dword [ebp + 0x7c], ebx
cmp word [eax], 0x2a
je 0x48f2d5
cmp byte [ebp + 0x57], 0x2a
jne 0x48f322
mov eax, dword [ebp + 0x50]
cmp byte [eax + 0x92], 0
push 0x12
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
jne 0x48f309
test byte [eax + 9], 0xf
jne 0x48f309
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0045654f
jmp 0x48f31c
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0045522d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 1
push ebx
push ebx
push dword [ebp + 0x3c]
push eax
call fcn.004081ee
add esp, 0x14
lea ecx, [ebp + 0x7c]
mov esi, eax
mov edi, edx
call fcn.0043e679
cmp byte [ebp + 0x57], 0
jne 0x48f34a
cmp word [ebp + 0xc], bx
jne 0x48f36f
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], edi
call fcn.004414d2
cmp byte [ebp + 0x57], 0
mov esi, eax
mov edi, edx
je 0x48f36f
movzx eax, word [ebp + 0x20]
shld edi, esi, 0x10
cdq
shl esi, 0x10
or esi, eax
or edi, edx
push str.0x_I64X
push dword [ebp + 0x38]
push edi
push esi
push dword [ebp + 0x50]
call fcn.00447418
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x1c]
call fcn.0043e679
lea ecx, [ebp + 0x10]
call fcn.0043e679
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x1c]
push str.ispe
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48f3cb
push dword [ebp + 0x38]
call fcn.0040a6f1
push eax
push dword [ebp + 0x50]
call fcn.0044749d
add esp, 0xc
jmp 0x48f384
cmp si, bx
je 0x48f3da
cmp si, 0x2c
jne 0x48f1f3
cmp byte [ebp + 0x4b], 0
je 0x48f3ea
cmp byte [ebp + 0x4b], 2
jne 0x48f99a
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044e66d
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x44]
je 0x48f403
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.0043e611
push dword [ebp + 0x1c]
push str.FVER
call fcn.0043fb03
add esp, 0xc
test al, al
je 0x48f51d
lea ecx, [ebp + 0x60]
call fcn.00444e32
push dword [ebp + 0x74]
mov dword [ebp + 0x5c], ebx
call fcn.0041310a
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.0043ec0f
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x48f489
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c99
mov eax, dword [ebp + 0x64]
mov di, word [eax]
mov eax, dword [ebp + 0x7c]
add esp, 0x10
mov dword [ebp + 0x38], ebx
cmp word [eax], bx
je 0x48f4a8
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0048f0e1
pop ecx
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp + 0x38]
push eax
mov ax, di
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.004081ee
mov ecx, dword [ebp + 0x50]
add esp, 0x14
push dword [ebp + 0x60]
push esi
call fcn.0044451e
cmp di, bx
je 0x48f4f5
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x64]
call fcn.0044451e
mov esi, dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
call fcn.0043e679
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x44]
call fcn.0043e679
jmp 0x48f386
push dword [ebp + 0x1c]
push str.FTIME
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48f758
push dword [ebp + 0x74]
call fcn.0041310a
pop ecx
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
call fcn.00444e32
lea ecx, [ebp + 0x60]
call fcn.00444e32
lea ecx, [ebp + 0x4c]
call fcn.00444e32
lea eax, [edi + esi]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x3c], ebx
jmp 0x48f5fc
push 6
lea eax, [ebp + 0x68]
push eax
push str._local
call fcn.00446de5
add esp, 0xc
test al, al
je 0x48f595
cmp byte [ebp + 0x7c], 0
je 0x48f58f
sub dword [ebp + 0x68], 2
mov eax, dword [ebp + 0x68]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x48f5f9
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4cabe4
call fcn.00446de5
add esp, 0xc
test al, al
je 0x48f5b2
or byte [ebp + 0x7c], 4
jmp 0x48f5f9
push 4
lea eax, [ebp + 0x68]
push eax
push str._ws1
call fcn.00446de5
add esp, 0xc
test al, al
je 0x48f5cf
or byte [ebp + 0x7c], 8
jmp 0x48f5f9
push 5
lea eax, [ebp + 0x68]
push eax
push 0x4cc198
call fcn.00446de5
add esp, 0xc
test al, al
je 0x48f5ef
mov dword [ebp + 0x3c], 1
jmp 0x48f5f9
lea eax, [ebp + 0x68]
push eax
call fcn.00405b6e
pop ecx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
je 0x48f566
cmp byte [ebp + 0x7c], 0
je 0x48f611
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f642
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], si
jne 0x48f65f
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x3c], ebx
lea esi, [ebp - 0xa0]
je 0x48f6a7
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.00405bea
cmp dword [ebp + 0x64], ebx
je 0x48f69a
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x4c]
call fcn.00402cb0
jmp 0x48f6ba
lea eax, [ebp - 0xa0]
push eax
push ebx
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x48f70f
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0044882d
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x50]
call fcn.0044882d
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x50]
call fcn.0044882d
add esp, 0x30
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x58]
jmp 0x48f91c
mov ecx, dword [ebp + 0x50]
mov esi, 0x4c0a1c
push esi
push dword [ebp + 0x58]
call fcn.0044451e
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x60]
call fcn.0044451e
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x4c]
call fcn.0044451e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x58]
jmp 0x48f50b
push dword [ebp + 0x1c]
push str.FATTR
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48f992
push dword [ebp + 0x74]
call fcn.0041310a
cmp byte [ebp + 0x7c], 0
pop ecx
mov edi, eax
je 0x48f785
mov word [esi], 0x26
lea ecx, [ebp + 0x64]
call fcn.00444e32
lea ecx, [ebp + 0x58]
call fcn.00444e32
lea ecx, [ebp + 0x60]
call fcn.00444e32
lea ecx, [ebp + 0x4c]
call fcn.00444e32
lea ecx, [ebp + 0x5c]
call fcn.00444e32
push 0x2c
mov dword [ebp + 0x68], esi
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f874
cmp byte [ebp + 0x7c], 0
je 0x48f7dd
mov word [eax], 0x26
jmp 0x48f7e2
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f874
cmp byte [ebp + 0x7c], 0
je 0x48f808
mov word [eax], 0x26
jmp 0x48f80d
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f874
cmp byte [ebp + 0x7c], 0
je 0x48f833
mov word [eax], 0x26
jmp 0x48f838
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x48f874
cmp byte [ebp + 0x7c], 0
je 0x48f85e
mov word [eax], 0x26
jmp 0x48f863
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00447c46
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x48f92e
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x64]
mov esi, dword [ebp + 0x50]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.0044749d
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x58]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.0044749d
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x60]
and eax, edi
push eax
push esi
call fcn.0044749d
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x4c]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.0044749d
push dword [ebp - 0x18]
lea eax, [ebp - 0x7c]
push str.0x_lX
push eax
mov word [ebp - 0x7c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0044451e
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x58]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.0043e679
lea ecx, [ebp + 0x44]
call fcn.0043e679
jmp 0x48f384
mov edi, dword [ebp + 0x50]
mov esi, 0x4c0a1c
push esi
push dword [ebp + 0x64]
mov ecx, edi
call fcn.0044451e
push esi
push dword [ebp + 0x58]
mov ecx, edi
call fcn.0044451e
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0044451e
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.0044451e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x58]
call fcn.0043e679
lea ecx, [ebp + 0x64]
jmp 0x48f50b
lea ecx, [ebp + 0x44]
call fcn.0043e679
cmp byte [ebp + 0x4b], 0
jne 0x48f384
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044e66d
lea eax, [ebp + 0x74]
push eax
call fcn.0043e611
mov esi, dword [ebp + 0x1c]
push esi
push str.DROPFILE
call fcn.0043fb03
add esp, 0xc
test al, al
je 0x48faaa
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
call fcn.00451a75
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.00444e32
lea ecx, [ebp + 0x4c]
call fcn.00444e32
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x48fa3b
cmp byte [ebp + 0x7c], 0
je 0x48fa24
mov word [eax], 0x26
jmp 0x48fa29
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00447c46
add esp, 0xc
lea ecx, [ebp + 0x64]
call fcn.00444e32
lea ecx, [ebp + 0x28]
call fcn.00444e32
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp word [esi], bx
je 0x48fa58
lea eax, [ebp + 0x28]
mov ecx, dword [ebp + 0x30]
or ecx, dword [ebp + 0x34]
je 0x48fa70
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x30]
call fcn.0040498f
add esp, 0xc
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x60]
call fcn.0044451e
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x50]
push esi
call fcn.0044451e
lea ecx, [ebp + 0x28]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
jmp 0x48f91c
push esi
push str.FPOS
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48fcb4
push dword [ebp + 0x74]
call fcn.0041310a
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043e611
push dword [ebp + 0x64]
call fcn.00410ed4
add esp, 0xc
lea ecx, [ebp + 0x40]
call fcn.00444e32
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x64]
call fcn.004134a4
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x40]
mov esi, dword [ebp + 0x44]
pop ecx
pop ecx
push 0x26
mov dword [ebp + 0x64], eax
pop edi
je 0x48fb0a
mov word [esi], di
lea ecx, [ebp + 0x2c]
call fcn.00444e32
lea ecx, [ebp + 0x68]
call fcn.00444e32
lea ecx, [ebp + 0x58]
call fcn.00444e32
lea ecx, [ebp + 0x60]
call fcn.00444e32
lea ecx, [ebp + 0x4c]
call fcn.00444e32
lea ecx, [ebp + 0x5c]
call fcn.00444e32
lea ecx, [ebp + 0x28]
call fcn.00444e32
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fb6e
mov word [eax], di
jmp 0x48fb73
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fb99
mov word [eax], di
jmp 0x48fb9e
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fbc4
mov word [eax], di
jmp 0x48fbc9
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fbeb
mov word [eax], di
jmp 0x48fbf0
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fc12
mov word [eax], di
jmp 0x48fc17
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x48fc4f
test bl, bl
je 0x48fc39
mov word [eax], di
jmp 0x48fc3e
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00447c46
add esp, 0xc
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push dword [ebp + 0x68]
push dword [ebp + 0x2c]
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call fcn.0043d06c
add esp, 0x24
lea ecx, [ebp + 0x28]
mov esi, eax
call fcn.0043e679
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x58]
call fcn.0043e679
lea ecx, [ebp + 0x68]
call fcn.0043e679
lea ecx, [ebp + 0x2c]
call fcn.0043e679
lea ecx, [ebp + 0x40]
jmp 0x48f50b
push esi
push str.PPID
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48fcf7
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
call fcn.00451a75
pop ecx
pop ecx
push dword [ebp + 0x44]
push dword [ebp + 0x20]
call fcn.00404dff
pop ecx
push eax
push dword [ebp + 0x50]
call fcn.0044749d
add esp, 0xc
jmp 0x48f921
push esi
push str.ISADMIN
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48fd12
push dword [ebp + 0x44]
call fcn.0049b973
jmp 0x48fce6
push esi
push str.fvar
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x490119
push 5
push esi
push 0x4cc7a8
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x490119
push esi
push str.PWIN
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48feb3
lea ecx, [ebp + 0x40]
call fcn.00444e32
lea ecx, [ebp + 0x64]
call fcn.00444e32
mov eax, dword [ebp + 0x44]
push ebx
mov dword [ebp + 0x3c], eax
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.004398f1
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00447c46
add esp, 0x1c
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.00405bc5
test eax, eax
pop ecx
pop ecx
je 0x48fdb3
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00405bc5
test eax, eax
pop ecx
pop ecx
je 0x48fdcc
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x34], eax
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x34]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], 3
mov dword [ebp + 0x18], ebx
call fcn.00405bc5
pop ecx
pop ecx
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x48fe7d
cmp dword [ebp + 0x14], 3
jne 0x48fe16
cmp dword [ebp + 0x18], 0
jne 0x48fe16
mov eax, dword [ebp + 0x64]
cmp word [eax], 0
je 0x48fe7d
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x48fe36
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x48fe3f
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x48fe23
cmp dword [ebp + 0x14], 3
jne 0x48fe4b
cmp dword [ebp + 0x18], 0
je 0x48fe7d
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x14]
sub edi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x20]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x48fe7d
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x40]
push dword [ebp + 0x7c]
push dword [ebp + 0x50]
call fcn.0044e73f
push dword [ebp + 0x64]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.0044e73f
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0043e679
lea ecx, [ebp + 0x40]
call fcn.0043e679
xor ebx, ebx
jmp 0x48f921
push esi
push str.PEBIT
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x48f921
mov eax, dword [ebp + 0x44]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x3c], eax
call fcn.00444e32
lea ecx, [ebp + 0x64]
call fcn.00444e32
push ebx
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.004398f1
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00447c46
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
push 0xd
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4c0a1c
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0xc], ebx
call fcn.0041a317
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], bx
je 0x4900bc
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x48ff5b
cmp cx, 0x2f
je 0x48ff5b
push edx
call fcn.004ad0f1
test eax, eax
pop ecx
je 0x48ff7e
jmp 0x48ff5e
mov word [eax], bx
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.00444f56
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x60], ebx
call fcn.00405bea
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], esi
je 0x4900b4
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x7c], ebx
call fcn.00444e50
mov edi, dword [ebp + 0x38]
push esi
push ebx
push edi
call fcn.004adaa0
add esp, 0xc
push ebx
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push dword [ebp + 0x60]
call esi
test eax, eax
je 0x4900ac
cmp dword [ebp + 0x7c], 0x40
jb 0x4900ac
cmp word [edi], 0x5a4d
jne 0x4900ac
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x490026
push ebx
push ebx
push eax
push dword [ebp + 0x60]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0043f9d0
add esp, 0x10
push ebx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x4900ac
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0x34], edi
jne 0x49007c
cmp edi, 0x8664
jne 0x49005b
mov dword [ebp + 0x58], 0x4cc774
jmp 0x4900ac
cmp ecx, eax
jne 0x49007c
cmp edi, 0x14c
je 0x4900a5
cmp ecx, eax
jne 0x49007c
cmp edi, 0x200
jne 0x49007c
mov dword [ebp + 0x58], str.ia64
jmp 0x4900ac
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x4900ac
cmp edi, 0x137
je 0x4900a5
cmp ecx, eax
jne 0x4900ac
cmp edi, 0x1b0
je 0x4900a5
cmp ecx, eax
jne 0x4900ac
cmp edi, 0xe7
jne 0x4900ac
mov dword [ebp + 0x58], 0x4cc760
lea ecx, [ebp + 0x38]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.00402cb0
push dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x40]
call fcn.0044451e
cmp dword [ebp + 0x34], ebx
jg 0x4900e8
jl 0x4900d6
cmp dword [ebp + 0x30], ebx
ja 0x4900e8
mov ecx, dword [ebp + 0x50]
push str._0x000000000001
push dword [ebp + 0x64]
call fcn.0044451e
jmp 0x490101
push str.0x_012I64X
push dword [ebp + 0x64]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x50]
call fcn.00447418
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.0043e679
lea ecx, [ebp + 0x40]
jmp 0x48f91c
mov esi, dword [ebp + 0x1c]
cmp word [esi + 8], 0x2b
lea ecx, [ebp + 0x28]
setne bl
dec bl
and ebx, 0x2b
call fcn.00444e32
lea ecx, [ebp + 0x60]
call fcn.00444e32
mov eax, dword [ebp + 0x44]
xor edi, edi
test bl, bl
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], 0x4c0a1c
mov dword [ebp + 0x64], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x7f], 0
je 0x490175
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4cb9dc
call fcn.00446de5
add esp, 0xc
test al, al
je 0x490175
mov byte [ebp + 0x7f], 1
mov eax, dword [ebp + 0x4c]
push 0x3b
mov dword [ebp + 0x38], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.00447c99
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, di
je 0x4901c8
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x4901c8
push edi
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004398f1
mov eax, dword [ebp + 0x28]
add esp, 0x10
cmp word [eax], di
je 0x4901c8
mov dword [ebp + 0x64], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.004134e4
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x68], edi
je 0x490388
lea ecx, [ebp + 0x58]
call fcn.00444e32
mov eax, dword [ebp + 0x4c]
cmp word [eax], di
mov dword [ebp + 0x5c], edi
je 0x490214
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004481c5
pop ecx
pop ecx
mov al, byte [ebp + 0x7f]
neg al
lea ecx, [ebp + 0x2c]
sbb eax, eax
and eax, 0x4dcd58
push eax
call fcn.00438ef3
cmp byte [ebp + 0x7f], 0
je 0x49025f
mov ecx, dword [ebp + 0x50]
push edi
push 0xffffffffffffffff
push edi
push dword [ebp + 0x74]
call fcn.00410d4d
cmp eax, edi
mov dword [ebp + 0x74], edi
je 0x490256
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edi
jmp 0x490277
mov dword [ebp + 0x68], 1
jmp 0x490277
lea eax, [ebp + 0x30]
push eax
add esi, 0xa
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0045bd15
add esp, 0x10
cmp dword [ebp + 0x34], edi
jl 0x49032f
jg 0x49028b
cmp dword [ebp + 0x30], edi
jb 0x49032f
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x4902e7
mov eax, dword [0x4dc20c]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x4902cc
push edi
push 0x4dc20c
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0043fb6c
mov eax, dword [0x4dc20c]
add esp, 0x10
cmp eax, edi
jne 0x4902cc
or eax, 0xffffffff
mov dword [0x4dc20c], eax
cmp eax, 0xffffffff
je 0x49032f
push dword [ebp + 0x20]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
jmp 0x49032c
mov eax, dword [0x4dc218]
cmp eax, edi
jne 0x490319
push edi
push 0x4dc218
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableW
call fcn.0043fb6c
mov eax, dword [0x4dc218]
add esp, 0x10
cmp eax, edi
jne 0x490319
or eax, 0xffffffff
mov dword [0x4dc218], eax
cmp eax, 0xffffffff
je 0x49032f
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x2c], edi
je 0x49033d
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x40], edi
jne 0x490350
cmp dword [ebp + 0x68], edi
jg 0x490350
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp + 0x58]
call fcn.0043e679
lea ecx, [ebp + 0xc]
call fcn.0043e679
lea ecx, [ebp + 0x60]
call fcn.0043e679
lea ecx, [ebp + 0x28]
call fcn.0043e679
lea ecx, [ebp + 0x44]
call fcn.0043e679
mov esi, dword [ebp + 0x68]
jmp 0x48f386
push 0x1000
lea ecx, [ebp + 0x7c]
call fcn.00444e50
lea ecx, [ebp + 0x3c]
call fcn.00444e32
push edi
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004398f1
mov eax, dword [ebp + 0x4c]
add esp, 0x10
cmp word [eax], di
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], 0x4ca3d0
mov esi, 0x2000
mov ebx, str.Kernel32.DLL
je 0x490443
mov eax, dword [0x4dc210]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x490401
push edi
push 0x4dc210
push ebx
push str.GetFirmwareEnvironmentVariableExW
call fcn.0043fb6c
mov eax, dword [0x4dc210]
add esp, 0x10
cmp eax, edi
jne 0x490401
or eax, 0xffffffff
mov dword [0x4dc210], eax
cmp eax, 0xffffffff
je 0x490443
lea ecx, [ebp + 0x20]
push ecx
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
cmp eax, edi
mov dword [ebp + 0x58], eax
je 0x49043a
push dword [ebp + 0x20]
lea eax, [ebp - 0x120]
push 0x4c0b00
push eax
mov dword [ebp + 0x40], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x490481
mov dword [ebp + 0x40], str.FAIL
jmp 0x490481
push edi
push 0x4dc214
push ebx
push str.GetFirmwareEnvironmentVariableW
mov dword [ebp + 0x68], 0x78
call fcn.0043fb6c
mov eax, dword [0x4dc214]
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x58], edi
je 0x490481
cmp eax, 0xffffffff
je 0x490481
push esi
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x58], eax
mov ecx, dword [ebp + 0x50]
movsx ebx, byte [ecx + 9]
mov eax, dword [ebp + 0x3c]
mov cx, word [eax]
or ebx, dword [ebp + 0x18]
cmp cx, 0x26
mov dword [ebp + 0x5c], eax
jne 0x49049f
or ebx, 2
jmp 0x4904be
cmp cx, 0x24
je 0x4904b6
cmp cx, 0x5e
je 0x4904b6
cmp cx, 0x2e
jne 0x4904be
or ebx, 4
jmp 0x4904b8
xor ebx, ebx
add eax, 2
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x58], edi
je 0x490530
cmp dword [ebp + 0x58], esi
jbe 0x4904cb
mov dword [ebp + 0x58], esi
cmp ebx, edi
jne 0x490528
mov esi, dword [ebp + 0x58]
mov edi, dword [ebp + 0x7c]
and dword [ebp + 0x7c], 0
inc esi
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x64], edi
call fcn.00444e77
mov dword [ebp + 0x18], edi
mov edi, dword [ebp + 0x7c]
add edi, 0xfffffff6
dec esi
test esi, esi
jle 0x490519
mov dword [ebp + 0x2c], esi
mov esi, dword [ebp + 0x18]
movzx eax, byte [esi]
push eax
add edi, 0xa
push 0x4c6140
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x2c]
jne 0x4904fd
and word [edi - 2], 0
lea ecx, [ebp + 0x64]
call fcn.0043e679
xor edi, edi
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], eax
jmp 0x49053e
cmp dword [ebp + 0x68], edi
jg 0x49053e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
test bl, 3
je 0x49055e
push edi
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x2c]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.00451f9e
add esp, 0x18
jmp 0x49056c
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x5c]
call fcn.0044451e
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x490580
push dword [ebp + 0x40]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0044451e
lea ecx, [ebp + 0x3c]
call fcn.0043e679
lea ecx, [ebp + 0x7c]
jmp 0x49035b