Function at 0x41c1a0
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x158
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, eax
mov dword [ebp - 0x12c], eax
call fcn.00408a30
mov dword [esp + 4], 0x90
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
je 0x41c2d4
mov ebx, eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x130], eax
call eax
mov eax, dword [ebp - 0xc4]
sub esp, 4
mov edx, 1
mov byte [ebx + 0x79], 1
mov dword [ebx + 0x84], 3
test eax, eax
cmove eax, edx
mov dword [ebx + 0x80], eax
mov dword [esp + 4], 1
mov dword [esp], 0x100
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [ebx + 0x88], eax
je 0x41c2d4
mov byte [eax], 0xa
lea eax, [ebp - 0x11c]
mov dword [esp], edi
mov dword [esp + 0xc], 0x426520
mov dword [esp + 8], str.e:r:s:z:a:n:m:b:o:v:j:5:7:SflVh_
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 4], esi
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x11c], 0
call fcn.0040a580
lea ecx, [ebx + 0x60]
lea edx, [ebx + 0x5c]
cmp eax, 0xffffffff
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], edx
je 0x41cc95
add edi, 1
cmp eax, 0x7a
ja case.0x41c2b6.4
jmp dword [eax*4 + 0x426268]
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x41c439
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str._n__X__Memory_allocation_error__n
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
mov dword [ebp - 0x12c], 2
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov byte [ebx + 0x78], 1
lea esi, [esi]
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], 0x426520
mov dword [esp + 8], str.e:r:s:z:a:n:m:b:o:v:j:5:7:SflVh_
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call fcn.0040a580
cmp eax, 0xffffffff
jne 0x41c2aa
mov eax, dword [ebp - 0x12c]
cmp eax, dword [0x42102c]
je 0x41cc25
mov dword [esp + 8], str._n_____Unknown_extra_argument_s___n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
mov eax, dword [ebx + 0x88]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov dword [esp + 8], str.1.4.2
mov dword [esp + 4], str._n_Pixiewps__s_WPS_pixie_dust_attack_tool_n_Copyright__c__2015_2017__wiire__wi7ire_gmail.com__n_n_Usage:__s__arguments__n_n_Required_arguments:_n_n____e____pke_________:_Enrollee_public_key_n____r____pkr_________:_Registrar_public_key_n____s____e_hash1_____:_Enrollee_hash_1_n____z____e_hash2_____:_Enrollee_hash_2_n____a____authkey_____:_Authentication_session_key_n____n____e_nonce_____:_Enrollee_nonce_n_n_Optional_arguments:_n_n____m____r_nonce_____:_Registrar_nonce_n____b____e_bssid_____:_Enrollee_BSSID_n____v____verbosity___:_Verbosity_level_1_3__1_is_quietest____________3__n____o____output______:_Write_output_to_file_n____j____jobs________:_Number_of_parallel_threads_to_use__________Auto__n_n____h________________:_Display_this_usage_screen_n_____help____________:_Verbose_help_and_more_usage_examples_n____V____version_____:_Display_version_n_n_____mode_N__..._N___:_Mode_selection__comma_separated____________Auto__n_____start__mm__yyyy_:_Starting_date______________only_mode_3___1_day__n_____end____mm__yyyy_:_Ending_date________________only_mode_3____1_day__n____f____force_______:_Bruteforce_full_range______only_mode_3__n_n_Miscellaneous_arguments:_n_n____7____m7_enc______:_Recover_encrypted_settings_from_M7__only_mode_3__n____5____m5_enc______:_Recover_secret_nonce_from_M5________only_mode_3__n_n_Example__use___help_for_more_:_n_n_pixiewps__e__pke___r__pkr___s__e_hash1___z__e_hash2___a__authkey___n__e_nonce__n_s
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [ebp - 0x12c], 3
jmp 0x41c2f6
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x20
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_hash_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
lea eax, [ebx + 0x84]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp], eax
call fcn.00407150
test eax, eax
jne 0x41c4b3
mov eax, dword [ebx + 0x84]
sub eax, 1
cmp eax, 2
jbe case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_verbosity_level_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x10], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0xc0
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_registrar_public_key_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x425a57
add eax, 0x20
mov dword [esp + 8], eax
mov eax, dword [0x42cf10]
mov dword [esp], eax
call sub.msvcrt.dll_freopen
test eax, eax
jne case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Failed_to_open_file_for_writing_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x24], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x10
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_enrollee_nonce_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x28], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x10
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_registrar_nonce_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
lea eax, [ebx + 0x80]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp], eax
call fcn.00407150
test eax, eax
jne 0x41c688
cmp dword [ebx + 0x80], 0
jg case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_number_of_jobs_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov byte [ebx + 0x7a], 1
jmp case.0x41c2b6.108
mov dword [esp], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0xc], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0xc0
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_enrollee_public_key_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 6
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x50], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 6
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_enrollee_MAC_address_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x20], eax
je 0x41c2d4
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x20
mov dword [esp], eax
call fcn.00406f50
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_authentication_session_key_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, edi
cmp al, 1
jbe 0x41cb27
mov dword [esp + 8], str._n_____Bad_use_of_argument___version___V___n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0x100
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x58], eax
je 0x41c2d4
mov edx, dword [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00407030
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_m7_encrypted_settings_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp], 0x100
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x54], eax
je 0x41c2d4
mov ecx, dword [ebp - 0x138]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407030
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_m5_encrypted_settings_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [ebp - 0x11c]
mov dword [esp], 0x425b6d
shl eax, 4
mov eax, dword [eax + 0x426520]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x41c2b6.104
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp], eax
call fcn.00407300
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_ending_point_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [ebp - 0x11c]
mov dword [esp], str.start
shl eax, 4
mov eax, dword [eax + 0x426520]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x41c2b6.104
lea eax, [ebp - 0x124]
mov dword [esp + 4], eax
mov eax, dword [0x42cf10]
mov dword [esp], eax
call fcn.00407300
test eax, eax
je case.0x41c2b6.108
mov eax, dword [0x42cf10]
mov dword [esp + 8], str._n_____Bad_starting_point_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [ebp - 0x11c]
mov dword [esp], str.mode
shl eax, 4
mov eax, dword [eax + 0x426520]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x41c2b6.104
mov eax, dword [0x42cf10]
xor ecx, ecx
mov dword [ebp - 0x140], eax
mov edx, eax
mov eax, edi
mov byte [ebp - 0x13c], al
movzx eax, byte [edx]
test al, al
je 0x41cb17
cmp al, 0x35
jle 0x41caf0
mov eax, dword [ebp - 0x140]
mov dword [esp + 8], str._n_____Bad_modes_____s_n_n
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [ebp - 0x11c]
mov dword [esp], str.help
shl eax, 4
mov eax, dword [eax + 0x426520]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x41c2b6.104
mov eax, dword [str.eCos_Knuth]
mov dword [esp + 8], str.1.4.2
mov dword [esp + 4], str._n_Pixiewps__s_WPS_pixie_dust_attack_tool_n_Copyright__c__2015_2017__wiire__wi7ire_gmail.com__n_n_Description_of_arguments:_n_n__e____pke_n_n_____Enrollees_DH_public_key__found_in_M1._n_n__r____pkr_n_n_____Registrars_DH_public_key__found_in_M2._n_n__s____e_hash1_n_n_____Enrollee_hash_1__found_in_M3._Its_the_hash_of_the_first_half_of_the_PIN._n_n__z____e_hash2_n_n_____Enrollee_hash_2__found_in_M3._Its_the_hash_of_the_second_half_of_the_PIN._n_n__a____authkey_n_n_____Authentication_session_key._Although_for_this_parameter_a_modified_version_of_Reaver_or_Bully_is_needed__it_can_be_avoided_by_specifying_small_Diffie_Hellman_keys_in_both_Reaver_and_Pixiewps_and_supplying___e_nonce____r_nonce_and___e_bssid._n_n_____pixiewps__e__pke___s__e_hash1___z__e_hash2___S__n__e_nonce___m__r_nonce___b__e_bssid__n_n__n____e_nonce_n_n_____Enrollees_nonce__found_in_M1._n_n__m____r_nonce_n_n_____Registrars_nonce__found_in_M2._Used_with_other_parameters_to_compute_the_session_keys._n_n__b____e_bssid_n_n_____Enrollees_BSSID._Used_with_other_parameters_to_compute_the_session_keys._n_n__S____dh_small__deprecated__n_n_____Small_Diffie_Hellman_keys._The_same_option_must_be_specified_in_Reaver_too._Some_Access_Points_seem_to_be_buggy_and_dont_behave_correctly_with_this_option._Avoid_using_it_with_Reaver_when_possible_n_n___mode_N__..._N__n_n_____Select_modes__comma_separated__experimental_modes_are_not_used_unless_specified_:_n_n_________1___s__n_________2___s__n_________3___s__n_________4___s___Experimental__n_________5___s______Experimental__n_n___start__mm__yyyy_n___end____mm__yyyy_n_n_____Starting_and_ending_dates_for_mode_3._They_are_interchangeable._If_only_one_is_specified__the_current_time_will_be_used_for_the_other._The_earliest_possible_date_is_01_1970__corresponding_to_0__Unix_epoch_time___the_latest_is_02_2038__corresponding_to_0x7FFFFFFF._If___force_is_used_then_pixiewps_will_start_from_the_current_time_and_go_back_all_the_way_to_0._n_n__7____m7_enc_n_n_____Encrypted_settings__found_in_M7._Recover_Enrollees_WPA_PSK_and_secret_nonce_2._This_feature_only_works_on_some_Access_Points_vulnerable_to_mode_3._n_n_____pixiewps__e__pke___r__pkr___n__e_nonce___m__r_nonce___b__e_bssid___7__enc7____mode_3_n_n__5____m5_enc_n_n_____Encrypted_settings__found_in_M5._Recover_Enrollees_secret_nonce_1._This_option_must_be_used_in_conjunction_with___m7_enc._If___e_hash1_and___e_hash2_are_also_specified__pixiewps_will_also_recover_the_WPS_PIN._n_n_____pixiewps__e__pke___r__pkr___n__e_nonce___m__r_nonce___b__e_bssid___7__enc7___5__enc5____mode_3_n_____pixiewps__e__pke___r__pkr___n__e_nonce___m__r_nonce___b__e_bssid___7__enc7___5__enc5___s__e_hash1___z__e_hash2____mode_3_n_n
mov dword [esp + 0x1c], eax
mov eax, dword [str.eCos_simplest]
mov dword [esp + 0x18], eax
mov eax, dword [str.RTL819x]
mov dword [esp + 0x14], eax
mov eax, dword [str.eCos_simple]
mov dword [esp + 0x10], eax
mov eax, dword [str.RT_MT_CL]
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
jmp 0x41c3fd
mov eax, dword [esi]
mov dword [esp + 4], str.Run__s__h_for_help._n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
jmp 0x41c3fd
movzx edi, cl
sub eax, 0x30
add ecx, 1
mov byte [edi + 0x42c040], al
lea eax, [edx + 1]
mov edi, eax
movzx eax, byte [edx + 1]
test al, al
jne 0x41edc0
mov edx, edi
jmp 0x41ca14
movzx edi, byte [ebp - 0x13c]
mov byte [ebx + 0x79], 0
jmp case.0x41c2b6.108
lea eax, [ebp - 0xd8]
lea edi, [ebp - 0xd8]
mov dword [esp], eax
call dword [ebp - 0x130]
mov edx, dword [ebp - 0xc4]
push eax
lea eax, [ebp - 0x104]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x12c], edx
call fcn.0040a6c0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sub.msvcrt.dll_gmtime
mov ecx, 9
mov esi, eax
lea eax, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xf8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x425adc
mov dword [esp + 4], 0x1e
mov dword [esp], esi
call sub.msvcrt.dll_strftime
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x425adf
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
mov dword [esp + 4], str.1.4.2
mov dword [esp], str.Pixiewps__s
call fcn.004052d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [ebp - 0x12c]
mov eax, 1
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._n_n____System_time:__lu___s_UTC__n____Number_of_cores_available:__u_n_n
test edx, edx
cmove edx, eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00406ef0
jmp 0x41c3fd
mov eax, edi
test al, al
je case.0x41c2b6.104
cmp dword [ebx + 0x58], 0
je 0x41ccac
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x41cc72
cmp dword [ebx + 0x10], 0
je 0x41cc72
cmp dword [ebx + 0x24], 0
je 0x41cc72
cmp dword [ebx + 0x28], 0
je 0x41cc72
cmp dword [ebx + 0x50], 0
je 0x41cc72
xor eax, eax
movzx ecx, byte [eax + 0x42c040]
test cl, cl
je 0x41cc72
cmp cl, 3
je 0x41cd46
add eax, 1
cmp eax, 5
jne 0x41cc56
mov dword [esp + 8], str._n_____Must_specify___pke____pkr____e_nonce____r_nonce____bssid_and___mode_3__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov eax, dword [ebp - 0x12c]
cmp dword [0x42102c], eax
jne 0x41c357
jmp case.0x41c2b6.104
mov edx, dword [ebx + 0x10]
test edx, edx
je 0x41edd0
cmp byte [ebx + 0x78], 0
lea eax, [edx + 0xbd]
je 0x41ccd3
jmp 0x41cd9b
sub eax, 1
cmp edx, eax
je 0x41ce1f
cmp byte [eax], 0
je 0x41ccc8
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x41cdfc
cmp dword [ebx + 0x18], 0
je 0x41cdfc
cmp dword [ebx + 0x1c], 0
je 0x41cdfc
mov edx, dword [ebx + 0x24]
test edx, edx
je 0x41cdfc
cmp dword [ebx + 0x20], 0
je 0x41cdbe
cmp byte [ebx + 0x7a], 0
je 0x41d904
cmp dword [ebp - 0x124], 0xffffffff
je 0x41d8f7
mov dword [esp + 8], str._n_____Cannot_specify___start_or___end_if___force_is_selected__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0x426840
mov dword [esp], edx
call sub.msvcrt.dll_memcmp
test eax, eax
mov dword [ebp - 0x12c], eax
je 0x41ce35
mov dword [esp + 4], 0x425c6f
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n_____Model_not_supported__n_n
call fcn.004052d0
mov dword [ebp - 0x12c], 4
jmp 0x41c2f6
mov dword [esp + 8], str._n_____Options___dh_small_and___pkr_are_mutually_exclusive__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
cmp byte [ebx + 0x78], 0
jne 0x41cdec
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0x426840
mov dword [esp], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcmp
test eax, eax
mov edx, dword [ebp - 0x12c]
jne 0x41cdfc
cmp dword [ebx + 0x50], 0
je 0x41cdfc
cmp dword [ebx + 0x28], 0
jne 0x41cd0c
mov dword [esp + 8], str._n_____Not_all_required_arguments_have_been_supplied__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
cmp byte [edx + 0xbf], 2
jne 0x41ccd8
mov byte [ebx + 0x78], 1
jmp 0x41ccd8
mov dword [esp], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov edx, eax
mov dword [ebx + 0x14], eax
je 0x41c2d4
mov eax, 0x55
mov edi, edx
mov ecx, 0xc0
rep stosb byte es:[edi], al
mov dword [esp], 0xc0
mov dword [ebp - 0xf8], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x38], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x3c], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x20], eax
je 0x41c2d4
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x40], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x44], eax
je 0x41c2d4
lea eax, [ebp - 0x114]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x134], eax
call fcn.0040a6c0
lea eax, [ebp - 0xf8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0xc0
mov dword [esp + 0x10], 0x4266e0
mov dword [esp + 0xc], 0xc0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 4], 0xc0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.00407570
mov edx, dword [ebx + 0x38]
mov eax, edi
call fcn.0041be41
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x50]
mov dword [edi + 8], edx
mov edx, dword [eax]
mov dword [edi + 0x10], edx
movzx eax, word [eax + 4]
mov word [edi + 0x14], ax
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 8]
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [edi + 0x1e], edx
mov edx, dword [ebx + 0x3c]
mov dword [edi + 0x22], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0x16], esi
mov dword [edi + 0x1a], ecx
mov ecx, 0x26
mov dword [esp], edx
mov edx, edi
mov esi, edi
call fcn.00407c10
mov dword [esp + 4], edi
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call fcn.00408740
mov edi, dword [ebx + 0x20]
mov edx, esi
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x130], edx
mov esi, dword [edx + 0x24]
mov eax, dword [ebx + 0x40]
mov edi, dword [edx + 0x20]
mov ecx, dword [edx + 0x28]
mov edx, dword [edx + 0x2c]
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x130]
mov dword [eax + 8], ecx
mov dword [eax], edi
mov ecx, 8
mov dword [eax + 0xc], edx
mov edi, dword [ebx + 0x44]
add esi, 0x30
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x60]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x58]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call fcn.004087f0
mov esi, eax
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sub.msvcrt.dll_free
test esi, esi
je 0x41ed91
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x41edfd
mov edx, dword [ebx + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call fcn.004087f0
mov edi, eax
mov eax, dword [ebx + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_free
test edi, edi
je 0x41d8c8
cmp dword [ebx + 0x18], 0
je 0x41d8bc
cmp dword [ebx + 0x1c], 0
je 0x41d8bc
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x48], eax
je 0x41c2d4
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x2c], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x30], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x34], eax
je 0x41c2d4
mov dword [esp], eax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
xor edx, edx
call fcn.00407c10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x425d0e
mov eax, dword [ebx + 0x5c]
mov dword [esp], edi
sub eax, 0x10
mov dword [esp + 4], eax
call fcn.004086c0
test eax, eax
je 0x41d88d
mov ecx, dword [ebx + 0x48]
mov edx, dword [eax + 4]
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], edx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x144], edx
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], edx
mov edx, dword [ebp - 0x144]
mov dword [eax + 4], ecx
mov ecx, eax
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x140]
mov dword [ecx + 0xc], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x425d11
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
sub eax, 0x10
mov dword [esp + 4], eax
call fcn.004086c0
test eax, eax
je 0x41d5f6
mov ecx, dword [ebx + 0x4c]
mov edx, dword [eax + 4]
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], edx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x144], edx
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], edx
mov edx, dword [ebp - 0x144]
mov dword [eax + 4], ecx
mov ecx, eax
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x140]
mov edx, ebx
mov dword [ecx + 0xc], eax
mov eax, ebx
call fcn.0041c167
mov byte [ebp - 0x138], al
lea edx, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], edx
mov dword [ebp - 0x13c], edx
call fcn.0040a6c0
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x13c]
mov dword [esp + 8], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00407490
mov dword [esp + 4], str.1.4.2
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
cmp dword [ebx + 0x84], 1
jg 0x41d4b8
mov edx, dword [ebx + 0x60]
sub edx, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x425e04
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.004086c0
test eax, eax
je 0x41d2cc
movzx edx, word [eax + 2]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x130]
rol dx, 8
mov dword [esp], eax
movzx edx, dx
mov dword [esp + 8], edx
mov dword [ebp - 0x134], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x134]
mov byte [eax + edx], 0
mov dword [esp + 4], eax
mov dword [esp], str._n____SSID:______s
call fcn.004052d0
cmp byte [ebp - 0x138], 0
jne 0x41d2ea
cmp byte [ebx], 0
jne 0x41d4a3
mov dword [esp], str._n____WPS_pin:___empty_
call fcn.004052d0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x425e67
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
sub eax, 0x10
mov dword [esp + 4], eax
call fcn.004086c0
test eax, eax
je 0x41d492
movzx edx, word [eax + 2]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x130]
rol dx, 8
mov dword [esp], eax
movzx edx, dx
mov dword [esp + 8], edx
mov dword [ebp - 0x134], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x134]
mov byte [eax + edx], 0
mov dword [esp + 4], eax
mov dword [esp], str._n____WPA_PSK:___s
call fcn.004052d0
mov eax, dword [ebp - 0xd4]
mov ecx, 0x3e8
mov dword [esp], str._n_n____Time_taken:__lu_s__lu_ms_n_n
cdq
idiv ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41d395
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x41d3a4
mov dword [esp], eax
call sub.msvcrt.dll_free
test edi, edi
je 0x41d3f3
mov dword [esp], edi
call sub.msvcrt.dll_free
cmp dword [ebx + 0x18], 0
je 0x41d3f3
cmp dword [ebx + 0x1c], 0
je 0x41d3f3
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x41c2f6
mov dword [esp], str._n_____WPA_PSK_not_found_
call fcn.004052d0
jmp 0x41d35e
mov dword [esp + 4], ebx
mov dword [esp], str._n____WPS_pin:___s
call fcn.004052d0
jmp 0x41d2ea
mov eax, dword [str.RTL819x]
mov dword [esp + 4], 3
mov dword [esp], str._n_____Mode:______d___s_
mov dword [esp + 8], eax
call fcn.004052d0
cmp dword [ebx + 0x84], 2
jg 0x41d625
cmp dword [ebx + 0x84], 1
jle 0x41d25c
test edi, edi
je 0x41d56a
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x425d0e
mov eax, dword [ebx + 0x5c]
mov dword [esp], edi
sub eax, 0x10
mov dword [esp + 4], eax
call fcn.004086c0
test eax, eax
mov dword [ebp - 0x134], eax
je 0x41d56a
mov dword [esp], str._n____ES1:
call fcn.004052d0
mov edx, dword [ebp - 0x134]
lea eax, [edx + 4]
xor edx, edx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], edx
movzx eax, byte [eax + edx]
mov dword [esp], 0x4258c0
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
add edx, 1
cmp edx, 0x10
jne 0x41d53c
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x425d11
mov edx, dword [ebx + 0x60]
mov dword [esp], esi
lea eax, [edx - 0x10]
mov dword [ebp - 0x134], edx
mov dword [esp + 4], eax
call fcn.004086c0
test eax, eax
mov edx, dword [ebp - 0x134]
je 0x41d25f
mov dword [esp], str._n____ES2:
mov dword [ebp - 0x134], eax
call fcn.004052d0
mov ecx, dword [ebp - 0x134]
xor edx, edx
lea eax, [ecx + 4]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], edx
movzx eax, byte [eax + edx]
mov dword [esp], 0x4258c0
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
add edx, 1
cmp edx, 0x10
jne 0x41d5c3
jmp 0x41d25c
mov dword [esp + 4], 0x425c6f
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n__x__Unexpected_error____m7_enc___n_n
call fcn.004052d0
mov dword [ebp - 0x12c], 4
jmp 0x41c2f6
mov dword [esp], str._n____DHKey:
call fcn.004052d0
mov ecx, dword [ebx + 0x38]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x20
jne 0x41d636
mov dword [esp], str._n____KDK:
call fcn.004052d0
mov ecx, dword [ebx + 0x3c]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x20
jne 0x41d67b
mov dword [esp], str._n____AuthKey:
call fcn.004052d0
mov ecx, dword [ebx + 0x20]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x20
jne 0x41d6c0
mov dword [esp], str._n____EMSK:
call fcn.004052d0
mov ecx, dword [ebx + 0x44]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x20
jne 0x41d705
mov dword [esp], str._n____KWKey:
call fcn.004052d0
mov ecx, dword [ebx + 0x40]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x10
jne 0x41d74a
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0x425dce
mov edx, dword [ebx + 0x60]
mov dword [esp], esi
sub edx, 0x10
mov dword [esp + 4], edx
call fcn.004086c0
test eax, eax
je 0x41d7f1
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x130]
mov eax, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [ecx], eax
mov dword [esp], str._n____KWA:
call fcn.004052d0
xor edx, edx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], edx
movzx eax, byte [eax + edx]
mov dword [esp], 0x4258c0
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x134]
add edx, 1
cmp edx, 8
jne 0x41d7c3
cmp byte [ebp - 0x138], 0
jne 0x41d4e2
mov dword [esp], str._n____PSK1:
call fcn.004052d0
mov ecx, dword [ebx + 0x2c]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x10
jne 0x41d80f
mov dword [esp], str._n____PSK2:
call fcn.004052d0
mov ecx, dword [ebx + 0x30]
xor edx, edx
movzx eax, byte [ecx + edx]
mov dword [esp], 0x4258c0
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [esp + 4], eax
call fcn.004052d0
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
add edx, 1
cmp edx, 0x10
jne 0x41d854
jmp 0x41d4e2
mov dword [esp + 4], 0x425c6f
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n__x__Unexpected_error____m5_enc___n_n
call fcn.004052d0
mov dword [ebp - 0x12c], 4
jmp 0x41c2f6
mov byte [ebp - 0x138], 1
jmp 0x41d1fd
mov dword [esp + 4], 0x425c6f
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n__x__Unexpected_error_while_decrypting____m5_enc___n_n
call fcn.004052d0
mov dword [ebp - 0x12c], 4
jmp 0x41c2f6
cmp dword [ebp - 0x120], 0xffffffff
jne 0x41cd23
cmp byte [ebx + 0x79], 0
mov dword [ebp - 0x12c], edx
je 0x41d940
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0x426840
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
test eax, eax
mov edx, dword [ebp - 0x12c]
jne 0x41d981
mov byte [0x42c040], 3
mov byte [0x42c041], 0
lea eax, [ebp - 0x114]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x134], eax
call fcn.0040a6c0
xor eax, eax
jmp 0x41d971
cmp dl, 3
je 0x41d9c9
add eax, 1
cmp eax, 5
je 0x41da13
movzx edx, byte [eax + 0x42c040]
test dl, dl
jne 0x41d960
jmp 0x41da13
mov byte [0x42c040], 1
cmp byte [edx], 0
js 0x41eff0
cmp byte [edx + 4], 0
js 0x41eff0
cmp byte [edx + 8], 0
js 0x41eff0
cmp byte [edx + 0xc], 0
js 0x41eff0
mov byte [0x42c041], 3
mov byte [0x42c042], 2
mov byte [0x42c043], 0
jmp 0x41d940
mov edx, dword [ebp - 0x114]
lea eax, [edx - 0x15180]
lea ecx, [edx + 0x15180]
mov dword [ebx + 0x74], eax
mov eax, dword [ebp - 0x124]
mov dword [ebx + 0x70], ecx
cmp eax, 0xffffffff
je 0x41efd9
mov edx, dword [ebp - 0x120]
cmp edx, 0xffffffff
je 0x41f045
cmp eax, edx
je 0x41ee0b
jge 0x41dd99
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], eax
movzx eax, byte [ebx + 0x78]
test al, al
mov byte [ebp - 0x12c], al
je 0x41da2b
cmp dword [ebx + 0x10], 0
je 0x41dda4
cmp dword [ebx + 0x20], 0
je 0x41e1cb
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x48], eax
je 0x41c2d4
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x2c], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x30], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x34], eax
je 0x41c2d4
mov dword [esp], eax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
xor edx, edx
call fcn.00407c10
cmp byte [ebx + 0x79], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
je 0x41dff2
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0x426840
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x41df7d
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x48]
mov esi, dword [edx]
mov edi, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x4c]
mov esi, dword [edx]
mov edi, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 0xc], edx
mov dword [eax + 8], ecx
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
jne 0x41dff2
mov byte [ebp - 0x12c], 3
lea esi, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0040a6c0
mov eax, dword [ebp - 0x134]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x104]
mov dword [esp], eax
call fcn.00407490
mov dword [esp + 4], str.1.4.2
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
cmp dword [ebx + 0x84], 1
jle 0x41dc2e
movzx eax, byte [ebp - 0x12c]
mov dword [esp], str._n_____Mode:______u___s_
mov edx, dword [eax*4 + 0x420fd8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004052d0
cmp dword [ebx + 0x84], 2
jg 0x41ddd4
cmp dword [ebx + 0x84], 1
jle 0x41dc2e
mov dword [esp], str._n____ES1:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x48]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x10
jne 0x41dbe5
mov dword [esp], str._n____ES2:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x4c]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x10
jne 0x41dc12
cmp byte [ebx], 0
jne 0x41df68
mov dword [esp], str._n____WPS_pin:___empty_
call fcn.004052d0
mov eax, dword [ebp - 0x100]
mov ecx, 0x3e8
mov dword [esp], str._n_n____Time_taken:__lu_s__lu_ms_n_n
cdq
idiv ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x41dc93
mov dword [esp + 4], eax
mov dword [esp], 0x426264
call fcn.004052d0
mov eax, dword [ebx + 0x8c]
mov dword [esp], eax
call sub.msvcrt.dll_free
movzx eax, byte [ebp - 0x12c]
xor edi, edi
sub eax, 4
cmp al, 1
ja 0x41dcaf
mov dword [esp], str._____Looks_like_you_have_some_interesting_data__Please_consider_contributing_with_your_data_to_improve_pixiewps._Follow_the_instructions_on_http:__0x0.st_tm___Thank_you__n_n
call fcn.004052d0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x84], 2
jle 0x41dd81
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, edi
movzx eax, al
mov dword [ebp - 0x12c], eax
jmp 0x41c2f6
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], edx
jmp 0x41da13
mov dword [esp], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov edx, eax
mov dword [ebx + 0x10], eax
je 0x41c2d4
mov ecx, 0xbf
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov byte [edx + 0xbf], 2
jmp 0x41da2b
cmp byte [ebp - 0x12c], 3
mov eax, dword [ebx + 0x64]
je 0x41ee43
test eax, eax
jne 0x41ee2e
mov dword [esp], str._n____Seed_N1:___
call fcn.004052d0
mov eax, dword [ebx + 0x68]
mov dword [esp], str._n____Seed_ES1:_0x_08x
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x6c]
mov dword [esp], str._n____Seed_ES2:_0x_08x
mov dword [esp + 4], eax
call fcn.004052d0
cmp dword [ebx + 0x38], 0
je 0x41df09
mov dword [esp], str._n____DHKey:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x38]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x20
jne 0x41de39
mov dword [esp], str._n____KDK:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x3c]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x20
jne 0x41de66
mov dword [esp], str._n____AuthKey:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x20]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x20
jne 0x41de93
mov dword [esp], str._n____EMSK:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x44]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x20
jne 0x41dec0
mov dword [esp], str._n____KWKey:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x40]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x10
jne 0x41deed
mov dword [esp], str._n____PSK1:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x2c]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x10
jne 0x41df1a
mov dword [esp], str._n____PSK2:
xor esi, esi
call fcn.004052d0
mov edi, dword [ebx + 0x30]
movzx eax, byte [edi + esi]
mov dword [esp], 0x4258c0
add esi, 1
mov dword [esp + 4], eax
call fcn.004052d0
cmp esi, 0x10
jne 0x41df47
jmp 0x41dbcb
mov dword [esp + 4], ebx
mov dword [esp], str._n____WPS_pin:___s
call fcn.004052d0
jmp 0x41dc43
mov edi, dword [ebx + 0x48]
xor eax, eax
mov ecx, 4
mov edx, ebx
rep stosd dword es:[edi], eax
mov ecx, 4
mov edi, dword [ebx + 0x4c]
rep stosd dword es:[edi], eax
mov eax, ebx
call fcn.0041c167
test eax, eax
jne 0x41daf9
mov edi, dword [ebx + 0x24]
mov edx, 0xf
movzx ecx, byte [edi + edx]
mov esi, 8
mov dword [ebp - 0x12c], edx
mov edx, ecx
add eax, eax
shr cl, 1
and edx, 1
test dl, dl
je 0x41dfd0
xor eax, 0x80000057
or eax, 1
sub esi, 1
jne 0x41dfbb
mov edx, dword [ebp - 0x12c]
sub edx, 1
cmp edx, 0xffffffff
jne 0x41dfac
mov dword [ebx + 0x64], eax
mov byte [ebp - 0x12c], 1
jmp 0x41db49
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
movzx eax, byte [eax + 0x42c040]
test al, al
je 0x41e045
cmp al, 1
je 0x41e98b
cmp al, 2
je 0x41e6a1
cmp al, 3
je 0x41e62e
cmp al, 4
je 0x41e4a2
cmp al, 5
je 0x41e40d
add byte [ebp - 0x12c], 1
movzx eax, byte [ebp - 0x12c]
cmp al, 4
jbe 0x41dff9
lea esi, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0040a6c0
mov eax, dword [ebp - 0x134]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x104]
mov dword [esp], eax
call fcn.00407490
mov dword [esp + 4], str.1.4.2
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n_____WPS_pin_not_found_
call fcn.004052d0
mov eax, dword [ebp - 0x100]
mov ecx, 0x3e8
mov dword [esp], str._n_n____Time_taken:__lu_s__lu_ms_n_n
cdq
idiv ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x41e0e7
mov dword [esp + 4], eax
mov dword [esp], 0x426264
call fcn.004052d0
mov eax, dword [ebx + 0x8c]
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp byte [ebx + 0x7c], 0
jne 0x41e1b5
mov esi, dword [ebx + 0x24]
mov dword [esp + 8], 2
mov dword [esp + 4], 0x42619c
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x41e133
lea eax, [esi + 4]
mov dword [esp + 8], 2
mov dword [esp + 4], 0x42619c
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x41e1b5
lea eax, [esi + 2]
mov dword [esp + 8], 2
mov dword [esp + 4], 0x42619c
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x41e171
lea eax, [esi + 6]
mov dword [esp + 8], 2
mov dword [esp + 4], 0x42619c
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x41e1b5
cmp byte [esi], 0
jne 0x41e188
cmp byte [esi + 4], 0
jne 0x41e188
cmp byte [esi + 8], 0
jne 0x41e188
cmp byte [esi + 0xc], 0
je 0x41e1b5
cmp byte [esi + 3], 0
mov edi, 1
jne 0x41dcaf
cmp byte [esi + 7], 0
jne 0x41dcaf
cmp byte [esi + 0xb], 0
jne 0x41dcaf
cmp byte [esi + 0xf], 0
jne 0x41dcaf
mov dword [esp], str._____Looks_like_you_have_some_interesting_data__Please_consider_contributing_with_your_data_to_improve_pixiewps._Follow_the_instructions_on_http:__0x0.st_tm___Thank_you__n_n
mov edi, 1
call fcn.004052d0
jmp 0x41dcaf
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
mov dword [ebx + 0x38], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x3c], eax
je 0x41c2d4
cmp byte [ebp - 0x12c], 0
jne 0x41e3fe
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0x426840
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x41e36c
mov eax, dword [ebx + 0x24]
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xcc], eax
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0xd0], edx
mov edx, dword [eax]
mov dword [ebp - 0xc8], edx
movzx eax, word [eax + 4]
mov word [ebp - 0xc4], ax
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
mov esi, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xba], edx
mov edx, dword [ebx + 0x3c]
mov dword [ebp - 0xb6], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0xbe], ecx
mov ecx, 0x26
mov dword [ebp - 0xc2], esi
mov dword [esp], edx
lea edx, [ebp - 0xd8]
call fcn.00407c10
lea eax, [ebp - 0xd8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call fcn.00408740
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x20], eax
je 0x41c2d4
cmp dword [ebx + 0x84], 2
mov ecx, 8
mov edi, eax
lea esi, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
jle 0x41e351
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
mov dword [ebx + 0x40], eax
je 0x41c2d4
mov dword [esp], 0x20
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebx + 0x44], eax
je 0x41c2d4
mov edx, dword [ebp - 0xb8]
mov ecx, 8
mov edi, eax
mov dword [esi], edx
mov edx, dword [ebp - 0xb4]
mov dword [esi + 4], edx
mov edx, dword [ebp - 0xb0]
mov dword [esi + 8], edx
mov edx, dword [ebp - 0xac]
mov dword [esi + 0xc], edx
lea esi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
jmp 0x41da35
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x41da35
mov dword [esp], 0xc0
mov dword [ebp - 0xf8], 0xc0
call sub.msvcrt.dll_malloc
test eax, eax
mov edx, eax
mov dword [ebx + 0x14], eax
je 0x41c2d4
mov edi, edx
mov eax, 0x55
mov ecx, 0xc0
rep stosb byte es:[edi], al
lea eax, [ebp - 0xf8]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0xc0
mov dword [esp + 0x10], 0x4266e0
mov dword [esp + 0xc], 0xc0
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 4], 0xc0
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.00407570
mov edx, dword [ebx + 0x38]
lea eax, [ebp - 0xd8]
call fcn.0041be41
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x41e22b
mov eax, dword [ebx + 0xc]
mov edx, esi
call fcn.0041be41
jmp 0x41e22b
mov edi, dword [ebx + 0x24]
test edi, edi
je 0x41e033
xor ecx, ecx
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x130], ecx
jmp 0x41e432
add esi, 1
cmp esi, 0x10
je 0x41e512
xor edx, edx
mov ecx, 0xadc8
div ecx
imul eax, eax, 0xd47
imul edx, edx, 0xbc8f
sub edx, eax
mov eax, edx
lea edx, [edx + 0x7fffffff]
test eax, eax
cmovs eax, edx
cmp byte [edi + esi], al
je 0x41e426
mov ecx, dword [ebp - 0x130]
add ecx, 1
cmp ecx, 0xffffffff
jne 0x41e41a
cmp dword [ebx + 0x64], 0
je 0x41e033
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
je 0x41e590
mov byte [ebx + 0x7c], 5
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
jmp 0x41e033
mov esi, dword [ebx + 0x24]
test esi, esi
je 0x41e033
xor edx, edx
mov eax, edx
xor ecx, ecx
jmp 0x41e4c1
add ecx, 1
cmp ecx, 0x10
je 0x41e5d2
imul eax, eax, 0x41c64e6d
add eax, 0x3039
cmp byte [esi + ecx], al
je 0x41e4b5
add edx, 1
cmp edx, 0xffffffff
jne 0x41e4af
cmp dword [ebx + 0x64], 0
je 0x41e033
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
je 0x41e616
mov byte [ebx + 0x7c], 4
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
jmp 0x41e033
mov ecx, dword [ebp - 0x130]
mov dword [ebx + 0x68], eax
mov edi, 0xadc8
mov dword [ebx + 0x64], ecx
xor ecx, ecx
xor edx, edx
mov esi, dword [ebx + 0x48]
div edi
add esi, ecx
imul eax, eax, 0xd47
imul edx, edx, 0xbc8f
sub edx, eax
mov eax, edx
lea edx, [edx + 0x7fffffff]
test eax, eax
cmovs eax, edx
add ecx, 1
cmp ecx, 0x10
mov byte [esi], al
jne 0x41e525
mov dword [ebx + 0x6c], eax
xor ecx, ecx
mov edi, 0xadc8
xor edx, edx
mov esi, dword [ebx + 0x4c]
div edi
add esi, ecx
imul eax, eax, 0xd47
imul edx, edx, 0xbc8f
sub edx, eax
mov eax, edx
lea edx, [edx + 0x7fffffff]
test eax, eax
cmovs eax, edx
add ecx, 1
cmp ecx, 0x10
mov byte [esi], al
jne 0x41e55d
jmp 0x41e469
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 5
mov dword [ebp - 0x130], eax
lea esi, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0040a6c0
mov eax, dword [ebp - 0x134]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x130]
jmp 0x41db73
mov dword [ebx + 0x64], edx
mov dword [ebx + 0x68], eax
xor edx, edx
imul eax, eax, 0x41c64e6d
mov ecx, dword [ebx + 0x48]
add eax, 0x3039
mov byte [ecx + edx], al
add edx, 1
cmp edx, 0x10
jne 0x41e5da
mov dword [ebx + 0x6c], eax
xor edx, edx
imul eax, eax, 0x41c64e6d
mov ecx, dword [ebx + 0x4c]
add eax, 0x3039
mov byte [ecx + edx], al
add edx, 1
cmp edx, 0x10
jne 0x41e5f8
jmp 0x41e4d9
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 4
mov dword [ebp - 0x130], eax
jmp 0x41e5a3
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x41e033
cmp byte [ebx + 0x79], 0
je 0x41e92d
cmp byte [ebx + 0x78], 0
je 0x41e80a
cmp dword [ebx + 0x8c], 0
jne 0x41e033
mov dword [esp + 4], 1
mov dword [esp], 0x100
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [ebx + 0x8c], eax
je 0x41c2d4
mov dword [esp + 0xc], 3
mov dword [esp + 8], str._____Small_DH_keys_is_not_supported_for_mode__d__n_n
mov dword [esp + 4], 0x100
mov dword [esp], eax
call fcn.00406f20
jmp 0x41e033
mov edi, dword [ebx + 0x24]
test edi, edi
je 0x41e033
movzx eax, byte [edi]
xor ecx, ecx
mov dword [ebp - 0x130], ebx
shl eax, 0x19
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov esi, 1
or eax, ecx
jmp 0x41e6d7
add esi, 1
cmp esi, 0x10
je 0x41e747
imul eax, eax, 0xc2a29a69
sub eax, 0x2c23e982
mov edx, eax
imul eax, eax, 0x41c64e6d
and edx, 0xfffc0000
shr edx, 0xb
add eax, 0x3039
mov ebx, eax
shr ebx, 0x19
add edx, ebx
cmp dl, byte [edi + esi]
je 0x41e6cf
add ecx, 1
cmp ecx, 0x2000000
jne 0x41e6c0
mov ebx, dword [ebp - 0x130]
cmp dword [ebx + 0x6c], 0
je 0x41e033
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
je 0x41e7f2
mov byte [ebx + 0x7c], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
jmp 0x41e033
mov ebx, dword [ebp - 0x130]
xor edx, edx
mov dword [ebx + 0x68], eax
imul eax, eax, 0x41c64e6d
add eax, 0x3039
mov ecx, eax
imul eax, eax, 0x41c64e6d
and ecx, 0xffe00000
add eax, 0x3039
mov esi, eax
imul eax, eax, 0x41c64e6d
and esi, 0xfffc0000
shr esi, 0xb
add ecx, esi
mov esi, dword [ebx + 0x48]
add eax, 0x3039
mov edi, eax
shr edi, 0x19
add ecx, edi
mov byte [esi + edx], cl
add edx, 1
cmp edx, 0x10
jne 0x41e752
mov dword [ebx + 0x6c], eax
xor edx, edx
imul eax, eax, 0x41c64e6d
add eax, 0x3039
mov ecx, eax
imul eax, eax, 0x41c64e6d
and ecx, 0xffe00000
add eax, 0x3039
mov esi, eax
imul eax, eax, 0x41c64e6d
and esi, 0xfffc0000
shr esi, 0xb
add ecx, esi
mov esi, dword [ebx + 0x4c]
add eax, 0x3039
mov edi, eax
shr edi, 0x19
add ecx, edi
mov byte [esi + edx], cl
add edx, 1
cmp edx, 0x10
jne 0x41e7a2
jmp 0x41e715
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 2
mov dword [ebp - 0x130], eax
jmp 0x41e5a3
mov edx, dword [ebx + 0x10]
lea eax, [edx + 0xbd]
cmp byte [eax], 0
jne 0x41e82c
sub eax, 1
cmp eax, edx
jne 0x41e813
cmp byte [eax + 0xbf], 2
je 0x41e64d
mov edx, dword [ebx + 0x24]
cmp byte [edx], 0
js 0x41e033
cmp byte [edx + 4], 0
js 0x41e033
cmp byte [edx + 8], 0
js 0x41e033
cmp byte [edx + 0xc], 0
js 0x41e033
mov eax, dword [ebx + 0x74]
mov ecx, 4
mov edi, 0x42c06c
mov esi, dword [ebx + 0x80]
mov dword [0x42c07c], ebx
mov dword [0x42c064], 3
mov dword [0x42c084], 0
mov dword [0x42c068], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [0x42c060], esi
movzx eax, byte [edx + ecx]
or eax, dword [ecx + 0x42c06c]
shl eax, 8
mov dword [ecx + 0x42c06c], eax
movzx edi, byte [edx + ecx + 1]
or eax, edi
shl eax, 8
mov dword [ecx + 0x42c06c], eax
movzx edi, byte [edx + ecx + 2]
add ecx, 4
or eax, edi
shl eax, 8
mov dword [ecx + 0x42c068], eax
movzx edi, byte [edx + ecx - 1]
or eax, edi
cmp ecx, 0x10
mov dword [ecx + 0x42c068], eax
jne 0x41e892
shl esi, 3
mov dword [esp], esi
xor esi, esi
call sub.msvcrt.dll_malloc
mov edi, dword [ebx + 0x70]
mov dword [0x42c080], eax
cmp esi, dword [ebx + 0x80]
jge 0x41eb03
mov eax, dword [0x42c080]
lea eax, [eax + esi*8]
add esi, 1
mov dword [eax + 4], edi
mov dword [esp + 0xc], eax
sub edi, 0x3e8
mov dword [esp + 8], 0x408130
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00418f40
jmp 0x41e8ef
mov edx, dword [ebx + 0x48]
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [edx], edi
mov dword [edx + 4], esi
mov dword [edx + 8], ecx
mov dword [edx + 0xc], eax
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x4c]
mov edi, dword [edx]
mov esi, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
mov dword [eax + 8], ecx
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
jne 0x41e643
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 3
mov dword [ebp - 0x130], eax
jmp 0x41e5a3
cmp byte [ebx + 0x79], 0
je 0x41ea29
mov eax, dword [ebx + 0x24]
mov edx, 0xf
mov esi, ebx
mov dword [ebp - 0x130], eax
xor eax, eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x138], edx
movzx ebx, byte [ecx + edx]
mov ecx, 8
mov edi, ebx
add eax, eax
shr bl, 1
and edi, 1
mov edx, edi
test dl, dl
je 0x41e9d3
xor eax, 0x80000057
or eax, 1
sub ecx, 1
jne 0x41e9bc
mov edx, dword [ebp - 0x138]
sub edx, 1
cmp edx, 0xffffffff
jne 0x41e9a7
mov ebx, esi
mov edx, eax
xor esi, esi
mov dword [ebp - 0x138], 8
xor ecx, ecx
jmp 0x41ea1e
xor edx, 0x80000057
mov edi, 1
shr edx, 1
or edx, 0x80000000
add ecx, ecx
or ecx, edi
sub dword [ebp - 0x138], 1
je 0x41eaaa
test dl, 1
jne 0x41e9fa
shr edx, 1
xor edi, edi
jmp 0x41ea0d
mov edi, dword [ebx + 0x48]
xor eax, eax
mov ecx, 4
mov edx, ebx
rep stosd dword es:[edi], eax
mov ecx, 4
mov edi, dword [ebx + 0x4c]
rep stosd dword es:[edi], eax
mov eax, ebx
call fcn.0041c167
test eax, eax
jne 0x41e995
mov edi, dword [ebx + 0x24]
mov edx, 0xf
movzx ecx, byte [edi + edx]
mov esi, 8
mov dword [ebp - 0x12c], edx
mov edx, ecx
add eax, eax
shr cl, 1
and edx, 1
test dl, dl
je 0x41ea7c
xor eax, 0x80000057
or eax, 1
sub esi, 1
jne 0x41ea67
mov edx, dword [ebp - 0x12c]
sub edx, 1
cmp edx, 0xffffffff
jne 0x41ea58
mov dword [ebx + 0x64], eax
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 1
mov dword [ebp - 0x130], eax
jmp 0x41e5a3
mov edi, dword [ebp - 0x130]
cmp byte [edi + esi], cl
jne 0x41e033
add esi, 1
cmp esi, 0x10
jne 0x41e9ec
mov dword [ebx + 0x64], eax
mov edi, 0xf
mov esi, dword [ebx + 0x4c]
xor ecx, ecx
add esi, edi
mov dword [ebp - 0x130], esi
xor esi, esi
jmp 0x41eaee
add eax, eax
xor edx, edx
shl edx, cl
add ecx, 1
or esi, edx
cmp ecx, 8
je 0x41eb69
test eax, eax
jns 0x41eade
add eax, eax
mov edx, 1
xor eax, 0x80000057
or eax, 1
jmp 0x41eae2
call fcn.0041be04
test eax, eax
mov dword [ebx + 0x64], eax
jne 0x41ebc1
cmp byte [ebx + 0x7a], 0
jne 0x41e033
cmp dword [ebx + 0x8c], 0
jne 0x41e033
mov dword [esp + 4], 1
mov dword [esp], 0x100
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [ebx + 0x8c], eax
je 0x41c2d4
mov dword [esp + 8], str._____The_AP__might_be__vulnerable._Try_again_with___force_or_with_another__newer__set_of_data._n_n
mov dword [esp + 4], 0x100
mov dword [esp], eax
call fcn.00406f20
jmp 0x41e033
mov edx, dword [ebp - 0x130]
sub edi, 1
mov ecx, esi
cmp edi, 0xffffffff
mov byte [edx], cl
jne 0x41eacd
mov dword [ebx + 0x6c], eax
mov edi, 0xf
mov esi, dword [ebx + 0x48]
xor ecx, ecx
add esi, edi
mov dword [ebp - 0x130], esi
xor esi, esi
jmp 0x41ebac
add eax, eax
xor edx, edx
shl edx, cl
add ecx, 1
or esi, edx
cmp ecx, 8
je 0x41ec4c
test eax, eax
jns 0x41eb98
add eax, eax
mov edx, 1
xor eax, 0x80000057
or eax, 1
jmp 0x41eb9c
xor eax, eax
mov ecx, 4
mov edi, 0x42c06c
mov edx, dword [ebx + 0x80]
mov dword [0x42c07c], ebx
rep stosd dword es:[edi], eax
mov dword [0x42c068], 0xffffffff
mov dword [0x42c064], 0xfffffffd
lea eax, [edx*8]
mov dword [0x42c060], edx
mov dword [0x42c084], 0
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0x42c080], eax
xor eax, eax
cmp eax, dword [ebx + 0x80]
jge 0x41ec94
mov edx, dword [0x42c080]
lea esi, [eax + 1]
lea edx, [edx + eax*8]
mov dword [edx + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x408130
mov dword [esp + 4], 0
mov dword [esp], edx
call fcn.00418f40
mov eax, esi
jmp 0x41ec15
mov edx, dword [ebp - 0x130]
sub edi, 1
mov ecx, esi
cmp edi, 0xffffffff
mov byte [edx], cl
jne 0x41eb87
mov dword [ebx + 0x68], eax
mov edx, ebx
mov eax, ebx
call fcn.0041c167
test eax, eax
je 0x41ed65
mov byte [ebx + 0x7c], 1
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
jmp 0x41e033
mov edx, dword [ebx + 0x64]
lea eax, [ebp - 0xd8]
call fcn.004051f0
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x130], eax
mov edx, eax
mov eax, ebx
call fcn.00407fa0
test eax, eax
je 0x41ecfe
mov eax, dword [ebx + 0x64]
mov esi, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
mov edi, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xcc]
mov dword [0x42c084], eax
mov eax, dword [ebx + 0x48]
mov dword [eax], edi
mov dword [eax + 4], esi
mov edi, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov ecx, 9
lea esi, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
call fcn.0041be04
mov eax, dword [0x42c084]
test eax, eax
je 0x41eb13
mov eax, dword [0x42c084]
xor esi, esi
mov dword [ebx + 0x68], eax
lea eax, [ebp - 0xf8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0xf8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x4c]
add edx, esi
call fcn.004051f0
mov edx, ebx
mov eax, ebx
call fcn.0041bed0
test eax, eax
jne 0x41ed7d
add esi, 1
cmp esi, 0xa
jne 0x41ed2c
jmp 0x41eb13
lea eax, [ebp - 0x104]
mov byte [ebp - 0x12c], 1
mov dword [ebp - 0x130], eax
jmp 0x41e5a3
mov eax, dword [ebx + 0x68]
mov byte [ebp - 0x12c], 3
add eax, esi
mov dword [ebx + 0x6c], eax
jmp 0x41e5a3
mov dword [esp + 4], 0x425c6f
mov dword [esp], str._n_Pixiewps__s_n
call fcn.004052d0
mov dword [esp], str._n__x__Unexpected_error_while_decrypting____m7_enc___n_n
call fcn.004052d0
mov dword [ebp - 0x12c], 4
jmp 0x41c2f6
cmp al, 0x2c
jne 0x41ca27
add edx, 2
jmp 0x41ca14
cmp byte [ebx + 0x78], 0
jne 0x41ccd8
mov dword [esp + 8], str._n_____Either___pkr_or___dh_small_must_be_specified__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
xor edi, edi
mov byte [ebp - 0x138], 1
jmp 0x41d1fd
mov dword [esp + 8], str._n_____Starting_and_Ending_points_must_be_different__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
mov dword [esp + 4], eax
mov dword [esp], str._n____Seed_N1:__0x_08x
call fcn.004052d0
jmp 0x41ddf8
test eax, eax
je 0x41efb0
mov dword [esp + 4], eax
mov dword [esp], str._n____Seed_N1:___u
lea edi, [ebp - 0xd8]
call fcn.004052d0
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.msvcrt.dll_gmtime
mov ecx, 9
mov esi, eax
lea edx, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xf8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x425adc
mov dword [esp + 4], 0x1e
mov dword [ebp - 0x130], edx
mov dword [esp], eax
call sub.msvcrt.dll_strftime
lea eax, [ebp - 0xf8]
mov dword [esp], str.___s_UTC_
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x68]
mov dword [esp], str._n____Seed_ES1:__u
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.msvcrt.dll_gmtime
mov edx, dword [ebp - 0x130]
mov esi, eax
mov ecx, 9
lea eax, [ebp - 0xf8]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x425adc
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call sub.msvcrt.dll_strftime
lea eax, [ebp - 0xf8]
mov dword [esp], str.___s_UTC_
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x6c]
mov dword [esp], str._n____Seed_ES2:__u
mov dword [esp + 4], eax
call fcn.004052d0
mov eax, dword [ebx + 0x6c]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.msvcrt.dll_gmtime
mov edx, dword [ebp - 0x130]
mov esi, eax
mov ecx, 9
lea eax, [ebp - 0xf8]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x425adc
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call sub.msvcrt.dll_strftime
lea eax, [ebp - 0xf8]
mov dword [esp], str.___s_UTC_
mov dword [esp + 4], eax
call fcn.004052d0
jmp 0x41de1e
mov dword [esp], str._n____Seed_N1:___
call fcn.004052d0
mov dword [esp], str._n____Seed_ES1:__
call fcn.004052d0
mov dword [esp], str._n____Seed_ES2:__
call fcn.004052d0
jmp 0x41de1e
mov eax, dword [ebp - 0x120]
cmp eax, 0xffffffff
je 0x41f026
cmp ecx, eax
jle 0x41f003
mov dword [ebx + 0x74], eax
jmp 0x41da13
mov byte [0x42c041], 2
mov byte [0x42c042], 0
jmp 0x41d940
mov dword [esp + 8], str._n_____Bad_Ending_point__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104
cmp byte [ebx + 0x7a], 0
je 0x41da13
add edx, 0x2a300
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x70], edx
jmp 0x41da13
cmp ecx, eax
jg 0x41efe8
mov dword [esp + 8], str._n_____Bad_Starting_point__n_n
mov dword [esp + 4], 0x100
mov eax, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.00406f20
jmp case.0x41c2b6.104