Function at 0x50d0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6598cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x70], ecx
xor edi, edi
mov dword [ebp - 4], edi
push str.ED38E9E9_1830_4f40_AA5A_6352BB5BC8F3
lea ecx, [ebp - 0x54]
call fcn.005b2cd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.005b2cb0
mov byte [ebp - 4], 2
wait
mov dword [ebp - 0x40], edi
mov byte [ebp - 4], 3
push 0x17
push edi
push 0x66ec28
lea ecx, [ebp - 0x40]
call fcn.00404c50
cmp eax, edi
jge 0x50d167
push str.pxmlDOM.CreateInstance____uuidof__MSXML2::DOMDocument30__
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x2a4]
push eax
call fcn.0060fb01
mov ecx, 0x16
mov word [ebp - 0x64], cx
mov dword [ebp - 0x5c], 1
mov bl, 4
mov byte [ebp - 4], bl
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x66eba8
call fcn.00404700
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.AgentsInfo
call fcn.00404700
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x40]
cmp ecx, edi
jne 0x50d1b5
push 0x80004003
call fcn.0060f000
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], bl
call fcn.00407690
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x64]
push ecx
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
call esi
mov dword [ebp - 0x24], edi
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x66eba8
call fcn.00404700
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x678c98
call fcn.00404680
mov byte [ebp - 4], 0xa
mov edx, 0x16
mov word [ebp - 0x10c], dx
mov dword [ebp - 0x104], 1
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x30]
cmp ecx, edi
jne 0x50d22b
push 0x80004003
call fcn.0060f000
lea eax, [ebp - 0x50]
push eax
call fcn.00502c90
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x28]
push edx
mov ecx, eax
call fcn.00403c70
mov byte [ebp - 4], 0xe
mov ecx, eax
call fcn.00407690
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x50]
cmp eax, edi
je 0x50d268
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x10c]
push eax
call esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx + 4]
je 0x50d71d
lea ecx, [eax + 0x10]
lea edx, [ebp - 0x3c]
push edx
call fcn.004dfc80
mov byte [ebp - 4], 0x12
mov edi, dword [ebp - 0x3c]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
lea ecx, [edi - 4]
cmp dword [ecx], 0
jl 0x50d2c7
cmp eax, dword [edi - 0x10]
jne 0x50d2c7
lea ebx, [edi - 0x10]
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x50d300
mov edx, dword [eax]
push 2
mov ecx, dword [edi - 0xc]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov ebx, eax
test ebx, ebx
jne 0x50d2e0
call fcn.00404070
mov eax, dword [edi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [edi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
push edi
lea edx, [eax + eax + 2]
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.0060fbd3
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c]
call fcn.004014a0
mov ecx, dword [ebp - 0x34]
push ecx
push 0x678c90
mov edx, dword [ebp - 0x28]
push edx
call fcn.005bea70
mov edi, dword [ebp - 0x24]
mov eax, dword [edi + 0x20]
mov ecx, 0x17
mov word [ebp - 0x20c], cx
mov dword [ebp - 0x204], eax
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x20c]
push edx
push 0x678c80
mov eax, dword [ebp - 0x28]
push eax
call fcn.005bec10
add esp, 0x18
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x20c]
push ecx
call esi
mov eax, dword [edi + 0x44]
push eax
lea ecx, [ebp - 0x84]
call fcn.004ffc20
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x84]
push edx
push 0x678c78
mov eax, dword [ebp - 0x28]
push eax
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x84]
push ecx
call esi
mov dword [ebp - 0x48], 0
mov edi, dword [edi + 0x24]
mov ebx, 1
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x24]
cmp edi, dword [eax + 0x28]
je 0x50d553
push ecx
mov ecx, esp
mov dword [ebp - 0x98], esp
push 0x66eba8
call fcn.00404700
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push str.Site
call fcn.00404700
mov byte [ebp - 4], 0x19
mov edx, 0x16
mov word [ebp - 0xcc], dx
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x50d411
push 0x80004003
call fcn.0060f000
lea eax, [ebp - 0x4c]
push eax
call fcn.00502c90
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov ecx, eax
call fcn.00403c70
mov byte [ebp - 4], 0x1d
mov ecx, eax
call fcn.00407690
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x50d44e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0xcc]
push eax
call esi
mov eax, dword [edi]
push eax
push 0x678c64
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005bea70
mov eax, dword [edi + 8]
mov edx, 0x13
mov word [ebp - 0xac], dx
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0xac]
push eax
push 0x678c54
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005bec10
add esp, 0x18
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0xac]
push edx
call esi
mov al, byte [edi + 0xc]
mov ecx, 0xb
mov word [ebp - 0xec], cx
movzx edx, al
neg edx
sbb edx, edx
mov word [ebp - 0xe4], dx
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0xec]
push eax
push str.inWhite
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0xec]
push edx
call esi
mov eax, dword [edi + 4]
push eax
push str.Redir
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005bea70
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x50d516
push 0x80004003
call fcn.0060f000
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x9c]
push eax
call fcn.00404e30
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x50d538
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x50d54b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
add edi, 0x10
jmp 0x50d3b0
mov edi, dword [eax + 0x34]
mov dword [ebp - 0x48], edi
lea esp, [esp]
cmp edi, dword [eax + 0x38]
je 0x50d6bf
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0x66eba8
call fcn.00404700
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x98], esp
push str.Process
call fcn.00404700
mov byte [ebp - 4], 0x24
mov eax, 0x16
mov word [ebp - 0x288], ax
mov dword [ebp - 0x280], ebx
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x50d5bb
push 0x80004003
call fcn.0060f000
lea edx, [ebp - 0x14]
push edx
call fcn.00502c90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x20]
push edx
mov ecx, eax
call fcn.00403c70
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.00407690
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x50d5f8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x288]
push eax
call esi
mov eax, dword [edi]
push eax
push str.Process
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.005bea70
mov al, byte [edi + 0xc]
mov edx, 0xb
mov word [ebp - 0x26c], dx
movzx eax, al
neg eax
sbb eax, eax
mov word [ebp - 0x264], ax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x26c]
push ecx
push str.inWhite
mov edx, dword [ebp - 0x20]
push edx
call fcn.005bec10
add esp, 0x18
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x26c]
push eax
call esi
mov eax, dword [edi + 4]
push eax
push str.Hash
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.005bea70
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x50d682
push 0x80004003
call fcn.0060f000
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.00404e30
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x50d69e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x50d6b1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
add edi, 0x10
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x24]
jmp 0x50d560
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x34]
call fcn.004014a0
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x49], 0
jne 0x50d280
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0x49], 0
jne 0x50d700
mov ecx, eax
mov dword [ebp - 0x74], ecx
mov eax, dword [ecx]
cmp byte [eax + 0x49], 0
je 0x50d6e3
mov dword [ebp - 0x24], ecx
jmp 0x50d280
mov eax, dword [ecx + 4]
cmp byte [eax + 0x49], 0
jne 0x50d715
cmp ecx, dword [eax + 8]
jne 0x50d715
mov ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x50d700
mov dword [ebp - 0x24], eax
jmp 0x50d280
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x50d72e
push 0x80004003
call fcn.0060f000
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00404e30
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50d74a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0x66eba8
call fcn.00404700
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0x678c10
call fcn.00404680
mov byte [ebp - 4], 0x2e
mov eax, 0x16
mov word [ebp - 0x11c], ax
mov dword [ebp - 0x114], 1
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x50d79d
push 0x80004003
call fcn.0060f000
lea edx, [ebp - 0x44]
push edx
call fcn.00502c90
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, eax
call fcn.00403c70
mov byte [ebp - 4], 0x32
mov ecx, eax
call fcn.00407690
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x50d7da
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x11c]
push eax
call esi
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebp - 0x2c], edx
mov bl, 0x3b
jmp 0x50d800
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
cmp eax, dword [ecx + 4]
je 0x50e311
mov edi, eax
lea edx, [ebp - 0x4c]
push edx
lea ecx, [edi + 0x10]
call fcn.004dfc80
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
mov dword [ebp - 0x20], eax
mov ecx, dword [eax]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov ecx, dword [ebp - 0x20]
add ecx, 0xc
cmp dword [ecx], 0
jl 0x50d850
mov edx, dword [ebp - 0x20]
cmp eax, dword [edx]
jne 0x50d850
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x50d89c
mov edx, dword [eax]
push 2
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 4]
push ecx
mov ecx, eax
mov edx, dword [edx]
call edx
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x50d86d
call fcn.00404070
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 4]
lea edx, [ecx + ecx + 2]
push edx
add eax, 0x10
push eax
lea eax, [ecx + ecx + 2]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x10
push ecx
call fcn.0060fbd3
add esp, 0x10
mov edx, dword [ebp - 0x34]
add edx, 0x10
mov dword [ebp - 0x50], edx
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x4c]
call fcn.004014a0
mov edx, dword [ebp - 0x50]
push edx
push 0x678c90
mov eax, dword [ebp - 0x18]
push eax
call fcn.005bea70
mov eax, dword [edi + 0x20]
mov ecx, 0x17
mov word [ebp - 0x12c], cx
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 0x3a
lea edx, [ebp - 0x12c]
push edx
push 0x678c80
mov eax, dword [ebp - 0x18]
push eax
call fcn.005bec10
add esp, 0x18
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x12c]
push ecx
call esi
push str.USBFileSize
lea ecx, [ebp + 0xc]
call fcn.0040bea0
mov byte [ebp - 4], bl
mov eax, dword [edi + 0x28]
mov edx, 0x13
mov word [ebp - 0x1cc], dx
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1cc]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x1cc]
push eax
call esi
push str.SpyOnUSB
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x2c]
mov ecx, 0x11
mov word [ebp - 0x14c], cx
mov byte [ebp - 0x144], al
mov byte [ebp - 4], 0x3d
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x14c]
push edx
call esi
push 0x6776d8
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x2d]
mov ecx, 0x11
mov word [ebp - 0x24c], cx
mov byte [ebp - 0x244], al
mov byte [ebp - 4], 0x3e
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x24c]
push edx
call esi
push str.CSLEnable
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x2e]
mov ecx, 0x11
mov word [ebp - 0x16c], cx
mov byte [ebp - 0x164], al
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x16c]
push edx
call esi
push str.CSWO
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x30]
mov ecx, 0x11
mov word [ebp - 0x1ec], cx
mov byte [ebp - 0x1e4], al
mov byte [ebp - 4], 0x40
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x1ec]
push edx
call esi
push str.CSQuota
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x34]
mov ecx, 0x13
mov word [ebp - 0x18c], cx
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 0x41
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x18c]
push edx
call esi
push str.CSPeriod
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x38]
mov ecx, 0x13
mov word [ebp - 0x22c], cx
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0x42
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x22c]
push edx
call esi
push str.SSLEnable
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x3c]
mov ecx, 0x11
mov word [ebp - 0x1ac], cx
mov byte [ebp - 0x1a4], al
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x1ac]
push edx
call esi
push str.SSWO
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x3d]
mov ecx, 0x11
mov word [ebp - 0xbc], cx
mov byte [ebp - 0xb4], al
mov byte [ebp - 4], 0x44
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0xbc]
push edx
call esi
push str.SSQuota
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x40]
mov ecx, 0x13
mov word [ebp - 0xdc], cx
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0xdc]
push edx
call esi
push str.SUQuota
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x44]
mov ecx, 0x13
mov word [ebp - 0xfc], cx
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 0x46
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0xfc]
push edx
call esi
push str.SSPeriod
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x48]
mov ecx, 0x13
mov word [ebp - 0x13c], cx
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 0x47
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x13c]
push edx
call esi
push 0x6776e0
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x4c]
mov ecx, 0x13
mov word [ebp - 0x15c], cx
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 0x48
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x15c]
push edx
call esi
push str.FSEXCL
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x50]
mov ecx, 0x11
mov word [ebp - 0x17c], cx
mov byte [ebp - 0x174], al
mov byte [ebp - 4], 0x49
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], bl
lea edx, [ebp - 0x17c]
push edx
call esi
push str.FSMA
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [edi + 0x52]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.005bea70
add esp, 0xc
push str.FSMP
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
add edi, 0x452
push edi
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bea70
add esp, 0xc
push str.APPS
lea ecx, [ebp + 0xc]
call fcn.00403420
mov ecx, 0x700724
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x4b
xor eax, eax
mov dword [ebp - 0x68], eax
mov edi, dword [ebp - 0x2c]
jmp 0x50de30
cmp eax, 0x96
jge 0x50de5f
movzx eax, word [edi + eax*2 + 0x852]
test ax, ax
je 0x50de5f
push eax
push 0x678c08
lea edx, [ebp - 0x3c]
push edx
call fcn.00414990
add esp, 0xc
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
jmp 0x50de30
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3c]
call fcn.004014f0
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bea70
add esp, 0xc
push str.StartLog
lea ecx, [ebp + 0xc]
call fcn.00403420
lea edx, [ebp - 0x64]
push edx
sub esp, 8
fld qword [edi + 0x980]
fstp qword [esp]
call fcn.00425380
push ecx
mov eax, esp
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov edx, dword [ebp - 0x60]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x5c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x58]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x278]
push eax
call fcn.0050b8d0
add esp, 0x14
mov byte [ebp - 4], 0x4c
cmp dword [eax + 0x14], 8
jb 0x50deda
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040bea0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x278]
call fcn.00405700
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.005bea70
add esp, 0xc
push str.EndLog
lea ecx, [ebp + 0xc]
call fcn.00403420
lea ecx, [ebp - 0x64]
push ecx
sub esp, 8
fld qword [edi + 0x988]
fstp qword [esp]
call fcn.00425380
push ecx
mov eax, esp
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
mov ecx, dword [ebp - 0x60]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x5c]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x58]
mov dword [eax + 0xc], ecx
lea edx, [ebp - 0x294]
push edx
call fcn.0050b8d0
add esp, 0x14
mov byte [ebp - 4], 0x4f
cmp dword [eax + 0x14], 8
jb 0x50df68
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004017e0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x294]
call fcn.00405700
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.005bea70
add esp, 0xc
push str.CLPQouta
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x990]
mov ecx, 0x13
mov word [ebp - 0x19c], cx
mov dword [ebp - 0x194], eax
mov byte [ebp - 4], 0x50
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x19c]
push edx
call esi
push str.CLPFileSize
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [edi + 0x994]
mov ecx, 0x13
mov word [ebp - 0x1bc], cx
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 4], 0x51
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x1bc]
push edx
call esi
push str.CLPEnableFiles
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x998]
mov ecx, 0x11
mov word [ebp - 0x1dc], cx
mov byte [ebp - 0x1d4], al
mov byte [ebp - 4], 0x52
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x1dc]
push edx
call esi
push str.CLPEnable
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x999]
mov ecx, 0x11
mov word [ebp - 0x1fc], cx
mov byte [ebp - 0x1f4], al
mov byte [ebp - 4], 0x53
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1fc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x1fc]
push edx
call esi
push str.SNEnable
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x99a]
mov ecx, 0x11
mov word [ebp - 0x21c], cx
mov byte [ebp - 0x214], al
mov byte [ebp - 4], 0x54
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x21c]
push edx
call esi
push str.SGray
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x99b]
mov ecx, 0x11
mov word [ebp - 0x23c], cx
mov byte [ebp - 0x234], al
mov byte [ebp - 4], 0x55
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x23c]
push edx
call esi
push str.SQual
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x99c]
mov ecx, 0x11
mov word [ebp - 0x25c], cx
mov byte [ebp - 0x254], al
mov byte [ebp - 4], 0x56
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x25c]
push edx
call esi
push str.SAppAct
lea ecx, [ebp + 0xc]
call fcn.00403420
mov al, byte [edi + 0x99d]
mov ecx, 0x11
mov word [ebp - 0x84], cx
mov byte [ebp - 0x7c], al
mov byte [ebp - 4], 0x57
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005bec10
add esp, 0xc
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x84]
push edx
call esi
push str.StartMessage
lea ecx, [ebp + 0xc]
call fcn.00403420
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [edi + 0xa1a]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004014f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.005bea70
add esp, 0xc
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1c]
call fcn.004014a0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
call fcn.004014a0
mov byte [ebp - 4], 0x39
lea ecx, [ebp + 0xc]
call fcn.004014a0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x50]
call fcn.004014a0
cmp byte [edi + 0xe91], 0
jne 0x50d800
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xe91], 0
jne 0x50e2f1
mov ecx, eax
mov dword [ebp - 0x94], ecx
mov eax, dword [ecx]
cmp byte [eax + 0xe91], 0
je 0x50e2d6
mov dword [ebp - 0x2c], ecx
jmp 0x50d800
mov eax, dword [ecx + 4]
cmp byte [eax + 0xe91], 0
jne 0x50e309
cmp ecx, dword [eax + 8]
jne 0x50e309
mov ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x50e2f1
mov dword [ebp - 0x2c], eax
jmp 0x50d800
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x50e322
push 0x80004003
call fcn.0060f000
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp + 0xc]
push edx
call fcn.00404e30
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50e33e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov edi, dword [ebp - 0x70]
add edi, 0xb74
push edi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
sub esp, 0x10
mov eax, esp
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x90]
push eax
call fcn.0050b8d0
add esp, 0x14
mov byte [ebp - 4], 0x58
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x50e388
mov eax, dword [eax]
push eax
push str.Modified
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.005bea70
add esp, 0xc
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x90]
call fcn.00405700
mov ecx, dword [ebp - 0x40]
test ecx, ecx
jne 0x50e3ba
push 0x80004003
call fcn.0060f000
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00404e30
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50e3d6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x59
mov byte [ebp - 4], 0x5a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx - 0xc]
test edx, edx
jne 0x50e435
lea eax, [ebp - 0x90]
push eax
call fcn.005bc840
mov ecx, eax
call fcn.005bcf10
mov byte [ebp - 4], 0x5b
cmp dword [eax + 0x14], edi
jb 0x50e41b
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x38]
call fcn.00403420
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x90]
call fcn.00405700
jmp 0x50e48a
lea eax, [ecx - 0x10]
mov edi, dword [ebp - 0x38]
add edi, 0xfffffff0
cmp eax, edi
je 0x50e48a
lea ebx, [edi + 0xc]
cmp dword [ebx], 0
jl 0x50e480
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x50e47d
push eax
call fcn.004011f0
add esp, 4
mov dword [ebp + 0xc], eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x50e472
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
mov dword [ebp - 0x38], ecx
jmp 0x50e48a
mov edx, dword [ecx - 0xc]
push edx
push ecx
lea ecx, [ebp - 0x38]
call fcn.00401670
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x84]
call fcn.004ffbe0
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x40]
test ecx, ecx
jne 0x50e4ae
push 0x80004003
call fcn.0060f000
lea eax, [ebp - 0x84]
push eax
call fcn.004ffcf0
mov edi, eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x84]
push ecx
call esi
test edi, edi
jns 0x50e4ef
push str.pxmlDOM__save__LPCTSTR__strPath.GetString___
push edi
lea ecx, [ebp - 0x2b4]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x2b4]
push edx
call fcn.0060fb01
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x38]
call fcn.004014a0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x50e50e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x50e521
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x50e534
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x50e547
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
wait
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.005b2bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.005b2cc0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x50e589
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc