Function at 0x10050f30
Capabilities:
Check for software breakpoints
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2f6c]
mov eax, 0x2f6c
call fcn.10126240
push 0xfffffffffffffffe
push 0x1016e268
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x2f68], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x2f74]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 0x2f80]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x2f7c]
mov dword [ebp - 0x44], edx
cmp eax, ecx
je 0x10052d17
mov ebx, eax
movzx eax, byte [ebx]
push eax
call fcn.10110cf8
add esp, 4
cmp eax, 0x4d
jne 0x10051125
movzx ecx, byte [ebx + 1]
push ecx
call fcn.10110cf8
add esp, 4
cmp eax, 0x5a
jne 0x10051125
mov edi, dword [ebx + 0x3c]
cmp byte [ebx + 4], 0
jne 0x10050fe7
cmp byte [ebx + 5], 0
je 0x10051008
mov dword [ebp - 0x1c], 1
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1005100b
cmp byte [ebx], 0
jne 0x1005100b
push 0x101480e0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1005100b
mov ebx, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10051ab0
mov byte [ebp + 0x2f58], al
mov dword [ebp + 0x2f59], eax
mov byte [ebp + 0x2f5d], al
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x28], eax
je 0x10051066
mov edx, dword [ebp - 0x28]
push edx
call fcn.1010f06f
mov esi, eax
push 0
push edi
mov edi, dword [ebp - 0x28]
push edi
call fcn.1010f167
push edi
push 6
push 1
lea eax, [ebp + 0x2f58]
push eax
call fcn.1010eeb5
push 0
push esi
push edi
call fcn.1010f167
add esp, 0x2c
jmp 0x100510a6
mov dword [ebp - 0x60], eax
push 1
push 0
push 0
push 0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov ebx, eax
push 0
push 0
push edi
push 0
call esi
lea ecx, [ebp - 0x60]
mov edx, 6
lea esi, [ebp + 0x2f58]
xor edi, edi
call fcn.10032840
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebp + 0x2f5c]
mov byte [ebp - 0x4c], cl
mov dl, byte [ebp + 0x2f5d]
mov byte [ebp - 0x4b], dl
movzx eax, byte [ebp + 0x2f58]
push eax
call fcn.10110cf8
add esp, 4
cmp eax, 0x50
jne 0x10051ab0
movzx ecx, byte [ebp + 0x2f59]
push ecx
call fcn.10110cf8
add esp, 4
cmp eax, 0x45
jne 0x10051ab0
cmp byte [ebp + 0x2f5a], 0
jne 0x10051ab0
cmp byte [ebp + 0x2f5b], 0
jne 0x10051ab0
test ebx, ebx
je 0x10051119
cmp byte [ebx], 0
jne 0x10051119
push 0x101480e0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 1
jmp 0x10052d17
mov al, byte [ebx]
cmp al, 0xd7
jne 0x10051155
cmp byte [ebx + 1], 0xcd
jne 0x10051155
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10051149
cmp byte [eax], 0
jne 0x10051149
push 0x101539b8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 2
jmp 0x10052d17
cmp al, 0x50
jne 0x10051538
cmp byte [ebx + 1], 0x4b
jne 0x10051538
cmp byte [ebx + 2], 3
jne 0x10051538
cmp byte [ebx + 3], 4
jne 0x10051538
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x10051193
cmp byte [edi], 0
jne 0x10051193
push 0x10149cf8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 3
lea esi, [ebx + 0x1e]
cmp byte [esi], 0x5b
jne 0x100511f3
cmp byte [ebx + 0x1f], 0x43
jne 0x100511f3
push 0x13
push str._Content_Types_.xml
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100511f3
mov ecx, dword [ebp - 0x30]
call fcn.10050b30
mov esi, eax
test edi, edi
je 0x100511e1
test esi, esi
je 0x100511d5
push 0x101539bc
jmp 0x100511da
push str.OOXML
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
neg esi
sbb esi, esi
and esi, 0xe
add esi, 0x11
mov dword [ebp - 0x1c], esi
jmp 0x10052d17
cmp byte [esi], 0x6d
jne 0x1005122e
cmp byte [ebx + 0x1f], 0x69
jne 0x1005122e
push 0x2f
push str.mimetypeapplication_vnd.oasis.opendocument.text
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x1005122e
test edi, edi
je 0x10051222
push 0x101539f8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x17
jmp 0x10052d17
mov bl, 0x6e
mov edi, dword [ebp - 0x24]
cmp byte [esi], 0x69
jne 0x100512ad
cmp byte [edi + 0x1f], bl
jne 0x10051270
push 9
push str.index.xml
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051270
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10051264
push str.PAGES
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x1c
jmp 0x10052d17
cmp byte [esi], 0x69
jne 0x100512ad
cmp byte [edi + 0x1f], bl
jne 0x100512ad
push 0xa
push str.index.apxl
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100512ad
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100512a1
push str.NUMBERS
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x1c
jmp 0x10052d17
cmp byte [esi], 0x70
jne 0x100512eb
cmp byte [edi + 0x1f], 0x72
jne 0x100512eb
push 0x11
push str.presentation.apxl
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100512eb
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100512df
push 0x10153a38
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x1c
jmp 0x10052d17
cmp byte [esi], 0x4d
jne 0x1005130a
cmp byte [edi + 0x1f], 0x45
jne 0x1005130a
push 9
push str.META_INF_
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
je 0x10051335
cmp byte [esi], 0x6f
jne 0x100513f2
cmp byte [edi + 0x1f], 0x72
jne 0x100513f2
push 4
push str.org_
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100513f2
lea eax, [edi + 0x45]
cmp byte [eax], 0x69
jne 0x10051376
cmp byte [edi + 0x46], 0x6d
jne 0x10051376
push 9
push str.images_PK
push eax
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051376
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005136a
push str.EPUB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x26
jmp 0x10052d17
xor edi, edi
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x10051397
cmp byte [eax], 0
je 0x10051397
push 0x2e
push eax
call fcn.1010e930
add esp, 8
mov edi, eax
mov dword [ebp - 0x54], edi
test edi, edi
je 0x100513d3
cmp byte [esi], 0x4d
jne 0x100513d3
mov edx, dword [ebp - 0x24]
cmp byte [edx + 0x1f], 0x45
jne 0x100513d3
push 9
push str.META_INF_
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100513d3
push str..APK
push edi
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10051519
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100513e6
push 0x1014a838
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x24
jmp 0x10052d17
cmp byte [esi], 0x6d
jne 0x10051415
cmp byte [edi + 0x1f], 0x69
jne 0x10051415
push 0x18
push str.mimetypeapplication_epub
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
je 0x10051357
cmp byte [esi], 0x41
jne 0x10051437
cmp byte [edi + 0x1f], bl
jne 0x10051437
push 0xf
push str.AndroidManifest
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
je 0x10051519
cmp dword [ebp + 0x2f78], 0x100
jbe 0x10051ab3
mov byte [ebp + 0x2e00], 0
push 0x13f
push 0
lea eax, [ebp + 0x2e01]
push eax
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0x3c], 0
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100514b3
push ebx
call fcn.1010f06f
mov esi, eax
push 2
push 0xffffff00
push ebx
call fcn.1010f167
add esp, 0x10
test eax, eax
jne 0x100514f4
push ebx
push 0x100
push 1
lea ecx, [ebp + 0x2e00]
push ecx
call fcn.1010eeb5
mov dword [ebp - 0x3c], eax
push 0
push esi
push ebx
call fcn.1010f167
add esp, 0x1c
jmp 0x100514f4
push 1
push 0
push 0
push 0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov ebx, eax
push 2
push 0
push 0xffffff00
push 0
call esi
lea ecx, [ebp - 0x3c]
mov edx, 0x100
lea esi, [ebp + 0x2e00]
xor edi, edi
call fcn.10032840
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp - 0x24]
push 0
push 0
mov edx, dword [ebp - 0x3c]
push edx
push str.META_INF_
lea eax, [ebp + 0x2e00]
push eax
call fcn.10047440
add esp, 0x14
cmp eax, 0xffffffff
je 0x10051ab3
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005152c
push 0x10153a44
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x25
jmp 0x10052d17
mov esi, ebx
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, 0x20
je 0x10052cf5
cmp al, 9
je 0x10052cf5
cmp al, 0xa0
je 0x10052cf5
cmp al, 0xd
je 0x10052cf5
cmp al, 0xa
je 0x10052cf5
push 5
mov eax, str.begin
mov ecx, esi
call fcn.100318e0
add esp, 4
test eax, eax
jne 0x100515b9
mov al, byte [esi + 5]
cmp al, 0x20
je 0x1005158b
cmp al, 9
je 0x1005158b
cmp al, 0xa0
jne 0x100515b9
test edi, edi
je 0x10051595
mov dword [edi], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100515ad
cmp byte [eax], 0
jne 0x100515ad
push str.UUENCODED
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 4
jmp 0x10052d17
push str.Standard_Jet_DB
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebx + 4]
mov eax, str.Standard_Jet_DB
call fcn.100318e0
add esp, 4
test eax, eax
jne 0x100515fd
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100515f1
cmp byte [eax], 0
jne 0x100515f1
push str.JETDB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 5
jmp 0x10052d17
cmp byte [ebx], 0x52
jne 0x10051638
cmp byte [ebx + 1], 0x61
jne 0x10051638
cmp byte [ebx + 2], 0x72
jne 0x10051638
cmp byte [ebx + 3], 0x21
jne 0x10051638
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005162c
cmp byte [eax], 0
jne 0x1005162c
push 0x10149dd8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 6
jmp 0x10052d17
push str.wscript
mov ecx, ebx
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x1005167a
test edi, edi
je 0x10051656
mov dword [edi], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005166e
cmp byte [eax], 0
jne 0x1005166e
push str.WSCRIPT
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 9
jmp 0x10052d17
cmp byte [ebx], 0x58
jne 0x100516bf
cmp byte [ebx + 1], 0x35
jne 0x100516bf
cmp byte [ebx + 2], 0x4f
jne 0x100516bf
cmp byte [ebx + 3], 0x21
jne 0x100516bf
test edi, edi
je 0x1005169b
mov dword [edi], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100516b3
cmp byte [eax], 0
jne 0x100516b3
push str.EICAR
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0xb
jmp 0x10052d17
push str.autorun
mov ecx, ebx
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10051701
test edi, edi
je 0x100516dd
mov dword [edi], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100516f5
cmp byte [eax], 0
jne 0x100516f5
push 0x1014a61c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0xd
jmp 0x10052d17
mov al, byte [ebx]
cmp al, 0x4d
jne 0x1005173d
cmp byte [ebx + 1], 0x53
jne 0x1005173d
cmp byte [ebx + 2], 0x43
jne 0x1005173d
cmp byte [ebx + 3], 0x46
jne 0x1005173d
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10051731
cmp byte [eax], 0
jne 0x10051731
push 0x10149ddc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0xe
jmp 0x10052d17
cmp al, 0x7b
jne 0x10051776
lea ecx, [ebx + 1]
mov eax, 0x10149de0
call fcn.10031940
test eax, eax
jne 0x10051776
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005176a
cmp byte [eax], 0
jne 0x1005176a
push 0x10149cf4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0xf
jmp 0x10052d17
cmp byte [ebx], 0xd0
jne 0x10051af3
cmp byte [ebx + 1], 0xcf
jne 0x10051af3
cmp byte [ebx + 2], 0x11
jne 0x10051af3
cmp byte [ebx + 3], 0xe0
jne 0x10051af3
cmp byte [ebx + 4], 0xa1
jne 0x10051af3
cmp byte [ebx + 5], 0xb1
jne 0x10051af3
cmp byte [ebx + 6], 0x1a
jne 0x10051af3
cmp byte [ebx + 7], 0xe1
jne 0x10051af3
cmp dword [ebp + 0x2f78], 0x400
jbe 0x10051a8b
mov byte [ebp + 0x2900], 0
push 0x4ff
push 0
lea ecx, [ebp + 0x2901]
push ecx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0x40], 0
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x10051841
push edi
call fcn.1010f06f
mov esi, eax
push 2
push 0xfffffc00
push edi
call fcn.1010f167
add esp, 0x10
test eax, eax
jne 0x1005187e
push edi
push 0x400
push 1
lea edx, [ebp + 0x2900]
push edx
call fcn.1010eeb5
mov dword [ebp - 0x40], eax
push 0
push esi
push edi
call fcn.1010f167
add esp, 0x1c
jmp 0x1005187e
push 1
push 0
push 0
xor edi, edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov ebx, eax
push 2
push edi
push 0xfffffc00
push edi
call esi
lea ecx, [ebp - 0x40]
mov edx, 0x400
lea esi, [ebp + 0x2900]
call fcn.10032840
push edi
push edi
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edi, edi
mov bl, 0x6f
mov dword [ebp - 0x58], edi
cmp edi, dword [ebp - 0x40]
jae 0x10051a8b
lea esi, [ebp + edi + 0x2900]
mov al, byte [esi]
cmp al, 0x50
jne 0x100518f9
cmp byte [ebp + edi + 0x2901], 0
jne 0x10051a85
cmp byte [ebp + edi + 0x2902], bl
jne 0x10051a85
push 0x13
push str.PowerPoint_Document
push esi
call fcn.10112117
add esp, 0xc
test eax, eax
jne 0x10051a85
mov dword [ebp - 0x1c], 0x12
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10051a8e
cmp byte [esi], al
jne 0x10051a8e
push 0x10153ac8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10051a8e
cmp al, 0x42
jne 0x1005195c
cmp byte [ebp + edi + 0x2901], 0
jne 0x10051a85
cmp byte [ebp + edi + 0x2902], bl
jne 0x10051a85
push 4
push 0x10153acc
push esi
call fcn.10110d24
add esp, 0xc
test eax, eax
jne 0x10051a85
mov dword [ebp - 0x1c], 0x13
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10051a8e
cmp byte [esi], 0
jne 0x10051a8e
push 0x10153ad8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10051a8e
cmp al, 0x57
jne 0x100519cc
mov al, byte [ebp + edi + 0x2901]
test al, al
jne 0x10051981
cmp byte [ebp + edi + 0x2902], bl
jne 0x10051a85
push 8
push 0x10153adc
jmp 0x1005191f
cmp al, bl
jne 0x10051a85
push 0xd
push str.Word.Document
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051a85
mov dword [ebp - 0x1c], 0x14
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10051a8e
cmp byte [esi], al
jne 0x10051a8e
push 0x10153b00
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10051a8e
cmp al, 0x4d
jne 0x10051a85
cmp byte [ebp + edi + 0x2901], 0x69
jne 0x10051a85
mov edx, str.Microsoft_Excel
mov ecx, esi
lea esp, [esp]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10051a10
test al, al
je 0x10051a0c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10051a10
add ecx, 2
add edx, 2
test al, al
jne 0x100519f0
xor eax, eax
jmp 0x10051a15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10051930
mov edx, str.Microsoft_Excel_2003_Worksheet
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10051a44
test al, al
je 0x10051a40
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10051a44
add ecx, 2
add edx, 2
test al, al
jne 0x10051a24
xor eax, eax
jmp 0x10051a49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10051930
mov ecx, str.Microsoft_Excel_2003
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10051a7b
test dl, dl
je 0x10051a74
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10051a7b
add eax, 2
add ecx, 2
test dl, dl
jne 0x10051a58
xor eax, eax
jmp 0x10051928
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x10051928
inc edi
jmp 0x10051882
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], 0
jne 0x10051ab0
mov dword [ebp - 0x1c], 0x16
test esi, esi
je 0x10051ab0
cmp byte [esi], 0
jne 0x10051ab0
push 0x101480f8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x10051af7
cmp byte [edi], 0x89
jne 0x10051af7
cmp byte [edi + 1], 0x50
jne 0x10051af7
cmp byte [edi + 2], 0x4e
jne 0x10051af7
mov esi, dword [ebp - 0x20]
cmp byte [edi + 3], 0x47
jne 0x10051afa
mov ebx, 0x19
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10051afa
cmp byte [esi], 0
jne 0x10051afa
push 0x10149cf0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10051afa
mov edi, ebx
jmp 0x10051ab3
mov esi, dword [ebp - 0x20]
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x37
jne 0x10051b45
cmp byte [edi + 1], 0x7a
jne 0x10051b45
cmp byte [edi + 2], 0xbc
jne 0x10051b45
cmp byte [edi + 3], 0xaf
jne 0x10051b45
cmp byte [edi + 4], 0x27
jne 0x10051b45
cmp byte [edi + 5], 0x1c
jne 0x10051b45
test esi, esi
je 0x10051b39
cmp byte [esi], bl
jne 0x10051b39
push 0x10149d68
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x20
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
lea ecx, [edi + 7]
cmp byte [ecx], bl
je 0x10051b87
push 7
mov eax, str.ACE
call fcn.100318e0
add esp, 4
test eax, eax
jne 0x10051b87
test esi, esi
je 0x10051b7b
cmp byte [esi], al
jne 0x10051b7b
push 0x10149cb4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x21
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x1f
jne 0x10051bba
cmp byte [edi + 1], 0x8b
jne 0x10051bba
test esi, esi
je 0x10051bae
cmp byte [esi], bl
jne 0x10051bae
push 0x10149cfc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x22
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x42
jne 0x10051bf3
cmp byte [edi + 1], 0x5a
jne 0x10051bf3
cmp byte [edi + 2], 0x68
jne 0x10051bf3
test esi, esi
je 0x10051be7
cmp byte [esi], bl
jne 0x10051be7
push str.BZIP2
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x23
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
lea eax, [edi + 0x3c]
cmp byte [eax], 0x42
jne 0x10051c3d
cmp byte [edi + 0x3d], 0x4f
jne 0x10051c3d
push 8
push str.BOOKMOBI
push eax
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051c3d
test esi, esi
je 0x10051c31
cmp byte [esi], al
jne 0x10051c31
push str.MOBI
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x27
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x7f
jne 0x10051c7c
cmp byte [edi + 1], 0x45
jne 0x10051c7c
cmp byte [edi + 2], 0x4c
jne 0x10051c7c
cmp byte [edi + 3], 0x46
jne 0x10051c7c
test esi, esi
je 0x10051c70
cmp byte [esi], bl
jne 0x10051c70
push 0x10153b68
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x28
jmp 0x10052d17
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x47
jne 0x10051cb8
cmp byte [edi + 1], 0x49
jne 0x10051cb8
cmp byte [edi + 2], 0x46
jne 0x10051cb8
cmp byte [edi + 3], 0x38
jne 0x10051cb8
mov ebx, 0x2a
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10051cb8
cmp byte [esi], 0
jne 0x10051cb8
push 0x10149ce8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0x42
jne 0x10051ce8
cmp byte [edi + 1], 0x4d
jne 0x10051ce8
mov ebx, 0x2b
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10051ce8
cmp byte [esi], 0
jne 0x10051ce8
push 0x10149cec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10051d63
cmp byte [edi], 0xff
jne 0x10051d29
cmp byte [edi + 1], 0xd8
jne 0x10051d29
cmp byte [edi + 2], 0xff
jne 0x10051d29
mov al, byte [edi + 3]
cmp al, 0xdb
je 0x10051d0c
cmp al, 0xe0
je 0x10051d0c
cmp al, 0xe1
jne 0x10051d29
mov ebx, 0x2c
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10051d29
cmp byte [esi], 0
jne 0x10051d29
push 0x10149d60
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10051d63
mov bl, 0xfa
cmp byte [edi], 0xce
jne 0x10051d65
cmp byte [edi + 1], bl
jne 0x10051d65
cmp byte [edi + 2], 0xed
jne 0x10051d65
cmp byte [edi + 3], 0xfe
jne 0x10051d65
mov dword [ebp - 0x1c], 0x2d
test esi, esi
je 0x10051d65
cmp byte [esi], 0
jne 0x10051d65
push str.MachoI32
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10051d65
mov bl, 0xfa
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 0xcf
jne 0x10051da1
cmp byte [edi + 1], bl
jne 0x10051da1
cmp byte [edi + 2], 0xed
jne 0x10051da1
cmp byte [edi + 3], 0xfe
jne 0x10051da1
mov dword [ebp - 0x1c], 0x2e
test esi, esi
je 0x10051da1
cmp byte [esi], 0
jne 0x10051da1
push str.MachoI64
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi + 3], 0xce
jne 0x10051ddd
cmp byte [edi + 2], bl
jne 0x10051ddd
cmp byte [edi + 1], 0xed
jne 0x10051ddd
cmp byte [edi], 0xfe
jne 0x10051ddd
mov dword [ebp - 0x1c], 0x2f
test esi, esi
je 0x10051ddd
cmp byte [esi], 0
jne 0x10051ddd
push str.MachoP32
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi + 3], 0xcf
jne 0x10051e19
cmp byte [edi + 2], bl
jne 0x10051e19
cmp byte [edi + 1], 0xed
jne 0x10051e19
cmp byte [edi], 0xfe
jne 0x10051e19
mov dword [ebp - 0x1c], 0x30
test esi, esi
je 0x10051e19
cmp byte [esi], 0
jne 0x10051e19
push str.MachoP64
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 0xca
jne 0x10051e56
cmp byte [edi + 1], 0xfe
jne 0x10051e56
cmp byte [edi + 2], 0xba
jne 0x10051e56
cmp byte [edi + 3], 0xbe
jne 0x10051e56
mov dword [ebp - 0x1c], 0x31
test esi, esi
je 0x10051e56
cmp byte [esi], 0
jne 0x10051e56
push str.MachoUni
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 3
jne 0x10051eab
cmp byte [edi + 1], 0
jne 0x10051eab
cmp byte [edi + 2], 8
jne 0x10051eab
cmp byte [edi + 3], 0
jne 0x10051eab
cmp byte [edi + 8], 1
jne 0x10051eab
cmp byte [edi + 9], 0
jne 0x10051eab
cmp byte [edi + 0xa], 0x1c
jne 0x10051eab
cmp byte [edi + 0xb], 0
jne 0x10051eab
mov dword [ebp - 0x1c], 0x32
test esi, esi
je 0x10051eab
cmp byte [esi], 0
jne 0x10051eab
push str.AXML
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 0x64
jne 0x10051efa
cmp byte [edi + 1], 0x65
jne 0x10051efa
cmp byte [edi + 2], 0x78
jne 0x10051efa
cmp byte [edi + 3], 0xa
jne 0x10051efa
cmp byte [edi + 4], 0x30
jne 0x10051efa
cmp byte [edi + 5], 0x33
jne 0x10051efa
cmp byte [edi + 7], 0
jne 0x10051efa
mov dword [ebp - 0x1c], 0x33
test esi, esi
je 0x10051efa
cmp byte [esi], 0
jne 0x10051efa
push 0x10153bb0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 0x49
jne 0x10051f49
cmp byte [edi + 1], 0x54
jne 0x10051f49
cmp byte [edi + 2], 0x53
jne 0x10051f49
cmp byte [edi + 3], 0x46
jne 0x10051f49
cmp byte [edi + 5], 0
jne 0x10051f49
cmp byte [edi + 6], 0
jne 0x10051f49
cmp byte [edi + 7], 0
jne 0x10051f49
mov dword [ebp - 0x1c], 0x34
test esi, esi
je 0x10051f49
cmp byte [esi], 0
jne 0x10051f49
push 0x10153bb4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
push 0xb
push str.__PS_Adobe_
push edi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051f99
push 6
push str._EPSF_
lea eax, [edi + 0xe]
push eax
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10051f99
mov dword [ebp - 0x1c], 0x35
test esi, esi
je 0x10051f99
cmp byte [esi], al
jne 0x10051f99
push 0x10153bcc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
cmp byte [edi], 0x46
jne 0x10051fd8
cmp byte [edi + 1], 0x4f
jne 0x10051fd8
cmp byte [edi + 2], 0x52
jne 0x10051fd8
cmp byte [edi + 3], 0x4d
jne 0x10051fd8
cmp byte [edi + 4], 0
jne 0x10051fd8
mov dword [ebp - 0x1c], 0x36
test esi, esi
je 0x10051fd8
cmp byte [esi], 0
jne 0x10051fd8
push 0x10153bd0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052013
push 7
push str.ftyp3gp
lea ecx, [edi + 4]
push ecx
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10052013
mov ebx, 0x37
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10052016
cmp byte [esi], al
jne 0x10052016
push 0x10153bdc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10052016
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x100520f1
push 7
push str.ftypM4A
lea edx, [edi + 4]
push edx
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10052051
mov ebx, 0x38
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10052051
cmp byte [esi], al
jne 0x10052051
push 0x10153be8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x100520f1
push 7
push str.ftypM4V
lea eax, [edi + 4]
push eax
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x1005208c
mov ebx, 0x39
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x1005208c
cmp byte [esi], al
jne 0x1005208c
push 0x10153bf4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x100520f1
lea esi, [edi + 4]
push 8
push str.ftypMSNV
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
je 0x100520cf
push 8
push str.ftypisom
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
je 0x100520cf
push 8
push str.ftypmp42
push esi
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x100520f1
mov ebx, 0x3a
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x100520f7
cmp byte [esi], 0
jne 0x100520f7
push 0x10153c1c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x100520f7
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x10052331
push 6
push str.ftypqt
lea ecx, [edi + 4]
push ecx
call fcn.1010f2df
add esp, 0xc
test eax, eax
jne 0x10052132
mov ebx, 0x3b
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10052132
cmp byte [esi], al
jne 0x10052132
push 0x10153c28
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x4d
jne 0x1005216e
cmp byte [edi + 1], 0x54
jne 0x1005216e
cmp byte [edi + 2], 0x68
jne 0x1005216e
cmp byte [edi + 3], 0x64
jne 0x1005216e
mov ebx, 0x3c
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x1005216e
cmp byte [esi], 0
jne 0x1005216e
push 0x10153c2c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x38
jne 0x100521aa
cmp byte [edi + 1], 0x42
jne 0x100521aa
cmp byte [edi + 2], 0x50
jne 0x100521aa
cmp byte [edi + 3], 0x53
jne 0x100521aa
mov ebx, 0x3d
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x100521aa
cmp byte [esi], 0
jne 0x100521aa
push 0x10153c30
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x7e
jne 0x100521e5
cmp byte [edi + 1], 0x42
jne 0x100521e5
cmp byte [edi + 2], 0x4b
jne 0x100521e5
cmp byte [edi + 3], bl
jne 0x100521e5
mov ebx, 0x3e
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x100521e5
cmp byte [esi], 0
jne 0x100521e5
push 0x10153c34
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x53
jne 0x10052249
cmp byte [edi + 1], 0x49
jne 0x10052249
cmp byte [edi + 2], 0x54
jne 0x10052249
cmp byte [edi + 3], 0x21
jne 0x10052249
cmp byte [edi + 4], bl
jne 0x10052249
cmp byte [edi + 6], bl
jne 0x10052249
cmp byte [edi + 0xa], 0x72
jne 0x10052249
cmp byte [edi + 0xb], 0x4c
jne 0x10052249
cmp byte [edi + 0xc], 0x61
jne 0x10052249
cmp byte [edi + 0xd], 0x75
jne 0x10052249
cmp byte [edi + 0xe], 2
jne 0x10052249
mov ebx, 0x3f
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x10052249
cmp byte [esi], 0
jne 0x10052249
push 0x10149cbc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], bl
jne 0x100522c8
mov eax, str.APPLaust_
mov dword [ebp - 0x50], eax
cmp byte [eax], 0
je 0x10052265
inc eax
jmp 0x1005225a
sub eax, str.APPLaust_
push eax
lea ecx, [edi + 0x41]
mov eax, str.APPLaust_
call fcn.100318e0
add esp, 4
test eax, eax
jne 0x100522c8
mov eax, str.StuffIt
mov dword [ebp - 0x68], eax
cmp byte [eax], 0
je 0x1005228f
inc eax
jmp 0x10052284
sub eax, str.StuffIt
push eax
lea ecx, [edi + 0x80]
mov eax, str.StuffIt
call fcn.100318e0
add esp, 4
test eax, eax
jne 0x100522c8
mov ebx, 0x40
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x100522c8
cmp byte [esi], al
jne 0x100522c8
push 0x10149cd4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x42
jne 0x100522fa
cmp byte [edi + 1], 0x5a
jne 0x100522fa
cmp byte [edi + 2], 0x68
jne 0x100522fa
mov ebx, 0x41
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x100522fa
cmp byte [esi], 0
jne 0x100522fa
push 0x10149cb8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
jne 0x10052331
cmp byte [edi], 0x49
jne 0x10052331
mov ebx, 0x44
cmp byte [edi + 1], bl
jne 0x10052336
cmp byte [edi + 2], 0x33
jne 0x10052336
mov dword [ebp - 0x1c], 0x42
test esi, esi
je 0x10052336
cmp byte [esi], 0
jne 0x10052336
push 0x10149cd8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10052336
mov ebx, 0x44
cmp dword [ebp - 0x1c], 0
jne 0x10052766
mov al, byte [edi]
cmp al, 0x43
je 0x1005234a
cmp al, 0x46
jne 0x10052372
cmp byte [edi + 1], 0x57
jne 0x10052372
cmp byte [edi + 2], 0x53
jne 0x10052372
mov dword [ebp - 0x1c], 0x43
test esi, esi
je 0x10052372
cmp byte [esi], 0
jne 0x10052372
push 0x10149c94
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x100523db
cmp byte [edi + 1], 0x49
jne 0x100523db
cmp byte [edi + 2], 0x46
jne 0x100523db
cmp byte [edi + 3], 0x46
jne 0x100523db
cmp byte [edi + 8], 0x57
jne 0x100523db
cmp byte [edi + 9], 0x41
jne 0x100523db
cmp byte [edi + 0xa], 0x56
jne 0x100523db
cmp byte [edi + 0xb], 0x45
jne 0x100523db
cmp byte [edi + 0xc], 0x66
jne 0x100523db
cmp byte [edi + 0xd], 0x6d
jne 0x100523db
cmp byte [edi + 0xe], 0x74
jne 0x100523db
cmp byte [edi + 0xf], 0x20
jne 0x100523db
mov dword [ebp - 0x1c], ebx
test esi, esi
je 0x100523db
cmp byte [esi], 0
jne 0x100523db
push 0x10153c38
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x10052448
cmp byte [edi + 1], 0x49
jne 0x10052448
cmp byte [edi + 2], 0x46
jne 0x10052448
cmp byte [edi + 3], 0x46
jne 0x10052448
cmp byte [edi + 8], 0x41
jne 0x10052448
cmp byte [edi + 9], 0x56
jne 0x10052448
cmp byte [edi + 0xa], 0x49
jne 0x10052448
cmp byte [edi + 0xb], 0x20
jne 0x10052448
cmp byte [edi + 0xc], 0x4c
jne 0x10052448
cmp byte [edi + 0xd], 0x49
jne 0x10052448
cmp byte [edi + 0xe], 0x53
jne 0x10052448
cmp byte [edi + 0xf], 0x54
jne 0x10052448
mov dword [ebp - 0x1c], 0x45
test esi, esi
je 0x10052448
cmp byte [esi], 0
jne 0x10052448
push 0x10149d64
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x100524b3
cmp byte [edi + 1], 0x49
jne 0x100524b3
cmp byte [edi + 2], 0x46
jne 0x100524b3
cmp byte [edi + 3], 0x46
jne 0x100524b3
cmp byte [edi + 8], 0x43
jne 0x100524b3
cmp byte [edi + 9], bl
jne 0x100524b3
cmp byte [edi + 0xa], bl
jne 0x100524b3
cmp byte [edi + 0xb], 0x41
jne 0x100524b3
cmp byte [edi + 0xc], 0x66
jne 0x100524b3
cmp byte [edi + 0xd], 0x6d
jne 0x100524b3
cmp byte [edi + 0xe], 0x74
jne 0x100524b3
cmp byte [edi + 0xf], 0x20
jne 0x100524b3
mov dword [ebp - 0x1c], 0x46
test esi, esi
je 0x100524b3
cmp byte [esi], 0
jne 0x100524b3
push 0x10153c3c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x10052520
cmp byte [edi + 1], 0x49
jne 0x10052520
cmp byte [edi + 2], 0x46
jne 0x10052520
cmp byte [edi + 3], 0x46
jne 0x10052520
cmp byte [edi + 8], 0x51
jne 0x10052520
cmp byte [edi + 9], 0x4c
jne 0x10052520
cmp byte [edi + 0xa], 0x43
jne 0x10052520
cmp byte [edi + 0xb], 0x4d
jne 0x10052520
cmp byte [edi + 0xc], 0x66
jne 0x10052520
cmp byte [edi + 0xd], 0x6d
jne 0x10052520
cmp byte [edi + 0xe], 0x74
jne 0x10052520
cmp byte [edi + 0xf], 0x20
jne 0x10052520
mov dword [ebp - 0x1c], 0x47
test esi, esi
je 0x10052520
cmp byte [esi], 0
jne 0x10052520
push 0x10153c40
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x1005258c
cmp byte [edi + 1], 0x49
jne 0x1005258c
cmp byte [edi + 2], 0x46
jne 0x1005258c
cmp byte [edi + 3], 0x46
jne 0x1005258c
cmp byte [edi + 8], 0x52
jne 0x1005258c
cmp byte [edi + 9], 0x4d
jne 0x1005258c
cmp byte [edi + 0xa], 0x49
jne 0x1005258c
cmp byte [edi + 0xb], bl
jne 0x1005258c
cmp byte [edi + 0xc], 0x64
jne 0x1005258c
cmp byte [edi + 0xd], 0x61
jne 0x1005258c
cmp byte [edi + 0xe], 0x74
jne 0x1005258c
cmp byte [edi + 0xf], 0x61
jne 0x1005258c
mov dword [ebp - 0x1c], 0x48
test esi, esi
je 0x1005258c
cmp byte [esi], 0
jne 0x1005258c
push 0x10153c44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x100525e1
cmp byte [edi + 1], 0x49
jne 0x100525e1
cmp byte [edi + 2], 0x46
jne 0x100525e1
cmp byte [edi + 3], 0x46
jne 0x100525e1
cmp byte [edi + 8], 0x57
jne 0x100525e1
cmp byte [edi + 9], 0x45
jne 0x100525e1
cmp byte [edi + 0xa], 0x42
jne 0x100525e1
cmp byte [edi + 0xb], 0x50
jne 0x100525e1
mov dword [ebp - 0x1c], 0x49
test esi, esi
je 0x100525e1
cmp byte [esi], 0
jne 0x100525e1
push str.WEBP
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x52
jne 0x1005261e
cmp byte [edi + 1], 0x49
jne 0x1005261e
cmp byte [edi + 2], 0x46
jne 0x1005261e
cmp byte [edi + 3], 0x46
jne 0x1005261e
mov dword [ebp - 0x1c], 0x4a
test esi, esi
je 0x1005261e
cmp byte [esi], 0
jne 0x1005261e
push 0x10153c50
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
mov al, byte [edi]
cmp al, 0x49
jne 0x1005264e
cmp byte [edi + 1], 0x20
jne 0x10052639
cmp byte [edi + 2], al
je 0x10052678
cmp al, 0x49
jne 0x1005264e
cmp byte [edi + 1], al
jne 0x1005264e
cmp byte [edi + 2], 0x2a
jne 0x1005264e
cmp byte [edi + 3], 0
je 0x10052678
cmp al, 0x4d
jne 0x10052694
cmp byte [edi + 1], al
jne 0x10052663
cmp byte [edi + 2], 0
jne 0x10052663
cmp byte [edi + 3], 0x2a
je 0x10052678
cmp al, 0x4d
jne 0x10052694
cmp byte [edi + 1], al
jne 0x10052694
cmp byte [edi + 2], 0
jne 0x10052694
cmp byte [edi + 3], 0x2b
jne 0x10052694
mov dword [ebp - 0x1c], 0x4b
test esi, esi
je 0x10052694
cmp byte [esi], 0
jne 0x10052694
push 0x10153c54
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
cmp byte [edi], 0x4c
jne 0x100526d1
cmp byte [edi + 1], 0x5a
jne 0x100526d1
cmp byte [edi + 2], 0x49
jne 0x100526d1
cmp byte [edi + 3], 0x50
jne 0x100526d1
mov dword [ebp - 0x1c], 0x4c
test esi, esi
je 0x100526d1
cmp byte [esi], 0
jne 0x100526d1
push str.LZIP
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0
jne 0x10052766
mov esi, dword [str._PDF_]
mov dx, word [0x10149c9c]
mov word [ebp + 0x2f54], dx
lea ecx, [ebp + 0x2f40]
mov eax, dword [edi]
mov dword [ebp + 0x2f40], eax
mov edx, dword [edi + 4]
mov dword [ebp + 0x2f44], edx
mov eax, dword [edi + 8]
mov dword [ebp + 0x2f48], eax
mov edx, dword [edi + 0xc]
mov dword [ebp + 0x2f4c], edx
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x70], ecx
cmp edx, 0xb
jae 0x10052733
mov al, byte [ecx]
cmp al, 0x20
je 0x1005272f
cmp al, 9
jne 0x10052733
inc ecx
inc edx
jmp 0x1005271a
cmp dword [ecx], esi
jne 0x10052766
mov al, byte [ebp + 0x2f54]
cmp al, byte [ecx + 4]
jne 0x10052766
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1005275a
cmp byte [eax], 0
jne 0x1005275a
push 0x10149ca0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x10
jmp 0x10052d17
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x10052d17
cmp byte [edi], 0x30
jne 0x100527c3
cmp byte [edi + 1], 0x26
jne 0x100527c3
cmp byte [edi + 2], 0xb2
jne 0x100527c3
cmp byte [edi + 3], 0x75
jne 0x100527c3
cmp byte [edi + 4], 0x8e
jne 0x100527c3
cmp byte [edi + 5], 0x66
jne 0x100527c3
cmp byte [edi + 6], 0xcf
jne 0x100527c3
cmp byte [edi + 7], 0x11
jne 0x100527c3
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100527b7
cmp byte [eax], bl
jne 0x100527b7
push 0x10153c58
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0xa
jmp 0x10052d17
test ebx, ebx
jne 0x10052d17
cmp dword [ebp + 0x2f78], 0x8006
jbe 0x10052a15
mov byte [ebp + 0x2f60], bl
xor eax, eax
mov dword [ebp + 0x2f61], eax
mov byte [ebp + 0x2f65], al
mov dword [ebp - 0x48], eax
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x10052835
push edi
call fcn.1010f06f
mov esi, eax
push ebx
push 0x8001
push edi
call fcn.1010f167
add esp, 0x10
test eax, eax
jne 0x10052870
push edi
push 5
push 1
lea ecx, [ebp + 0x2f60]
push ecx
call fcn.1010eeb5
mov dword [ebp - 0x48], eax
push ebx
push esi
push edi
call fcn.1010f167
add esp, 0x1c
jmp 0x10052870
push 1
push 0
push 0
xor edi, edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov ebx, eax
push edi
push edi
push 0x8001
push edi
call esi
lea ecx, [ebp - 0x48]
lea edx, [edi + 5]
lea esi, [ebp + 0x2f60]
call fcn.10032840
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [ebp - 0x1c]
mov ecx, str.BEA01
lea eax, [ebp + 0x2f60]
jmp 0x10052880
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100528a0
test dl, dl
je 0x1005289c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100528a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052880
xor eax, eax
jmp 0x100528a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.BOOT2
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100528d8
test dl, dl
je 0x100528d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100528d8
add eax, 2
add ecx, 2
test dl, dl
jne 0x100528b8
xor eax, eax
jmp 0x100528dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.CD001
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10052910
test dl, dl
je 0x1005290c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10052910
add eax, 2
add ecx, 2
test dl, dl
jne 0x100528f0
xor eax, eax
jmp 0x10052915
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.CDW02
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10052948
test dl, dl
je 0x10052944
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10052948
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052928
xor eax, eax
jmp 0x1005294d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.NSR02
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10052980
test dl, dl
je 0x1005297c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10052980
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052960
xor eax, eax
jmp 0x10052985
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.NSR03
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100529b4
test dl, dl
je 0x100529b0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100529b4
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052994
xor eax, eax
jmp 0x100529b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100529f1
mov ecx, str.TEA01
lea eax, [ebp + 0x2f60]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100529e8
test dl, dl
je 0x100529e4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100529e8
add eax, 2
add ecx, 2
test dl, dl
jne 0x100529c8
xor eax, eax
jmp 0x100529ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10052a15
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10052a09
cmp byte [eax], 0
jne 0x10052a09
push 0x10149de8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1c], 0x29
jmp 0x10052d17
test ebx, ebx
jne 0x10052d17
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x80], esi
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x80]
call fcn.1005c190
add esp, 8
mov al, byte [esi]
test al, al
je 0x10052d17
cmp al, 0x3c
jne 0x10052ae2
mov eax, str.__xml_version
mov ecx, esi
call fcn.10031940
mov ecx, esi
test eax, eax
jne 0x10052a85
push str._office:document
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10052ae2
mov dword [ebp - 0x1c], 0x18
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10052ae2
cmp byte [eax], bl
jne 0x10052ae2
push str.ODFXML
jmp 0x10052adb
mov eax, 0x10153cb0
call fcn.10031940
test eax, eax
je 0x10052ac3
mov eax, str.__DOCTYPE
mov ecx, esi
call fcn.10031940
test eax, eax
je 0x10052ac3
mov eax, str._html
mov ecx, esi
call fcn.10031940
test eax, eax
je 0x10052ac3
mov eax, str._meta
mov ecx, esi
call fcn.10031940
test eax, eax
jne 0x10052ae2
mov dword [ebp - 0x1c], 0x1a
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10052ae2
cmp byte [eax], 0
jne 0x10052ae2
push str.HTML
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
mov dword [ebp - 0x6c], ebx
xor edi, edi
mov dword [ebp - 0x5c], edi
xor esi, esi
mov dword [ebp - 0x7c], esi
cmp esi, dword [ebp - 0x44]
jae 0x10052b3f
mov ecx, dword [ebp - 0x24]
mov al, byte [ecx + esi]
cmp al, 9
je 0x10052b27
cmp al, 0xa
je 0x10052b27
cmp al, 0xd
je 0x10052b27
cmp al, 0x92
je 0x10052b27
cmp al, 0x95
je 0x10052b27
cmp al, 0x20
jb 0x10052b1b
cmp al, 0x7e
jbe 0x10052b27
mov dword [ebp - 0x6c], 0
jmp 0x10052d17
movzx eax, al
call fcn.100423a0
test eax, eax
je 0x10052b37
inc edi
mov dword [ebp - 0x5c], edi
cmp edi, 0x10
ja 0x10052b3f
inc esi
jmp 0x10052af1
test ebx, ebx
je 0x10052d17
mov byte [ebp], 0
push 0x28ff
push 0
lea edx, [ebp + 1]
push edx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0x2c], 0
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x10052ba0
push edi
call fcn.1010f06f
mov esi, eax
push 0
push 0
push edi
call fcn.1010f167
push edi
push 0x2800
push 1
lea eax, [ebp]
push eax
call fcn.1010eeb5
mov dword [ebp - 0x2c], eax
push 0
push esi
push edi
call fcn.1010f167
add esp, 0x2c
jmp 0x10052bd3
push 1
push 0
push 0
xor edi, edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
mov ebx, eax
push edi
push edi
push edi
push edi
call esi
lea ecx, [ebp - 0x2c]
mov edx, 0x2800
lea esi, [ebp]
call fcn.10032840
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x34], ebx
lea ecx, [ebp]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005c190
add esp, 8
xor eax, eax
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
cmp eax, esi
jae 0x10052c23
lea edx, [ebp + eax]
mov cl, byte [edx]
cmp cl, 0xa
je 0x10052c68
cmp cl, 0xd
je 0x10052c68
sub esi, eax
push esi
push edx
lea ecx, [ebp]
push ecx
call fcn.101162d0
add esp, 0xc
mov dword [ebp - 0x2c], esi
xor edi, edi
mov dword [ebp - 0x38], edi
cmp edi, dword [ebp - 0x2c]
jae 0x10052c9d
cmp byte [ebp + edi], 0xa
jne 0x10052c6b
lea eax, [edi + 1]
cmp eax, 0xffffffff
je 0x10052c9a
lea esi, [ebp + eax]
mov al, byte [esi]
cmp al, 0xd
je 0x10052c9d
cmp al, 0xa
je 0x10052c9d
test ebx, ebx
jne 0x10052c73
mov eax, str.Date:
mov ecx, esi
call fcn.10031940
test eax, eax
jne 0x10052c73
mov ebx, 1
mov dword [ebp - 0x64], ebx
jmp 0x10052c94
inc eax
jmp 0x10052bf9
test edi, edi
jne 0x10052c9a
xor eax, eax
jmp 0x10052c3c
cmp dword [ebp - 0x34], 0
jne 0x10052c90
mov eax, str.From:
mov ecx, esi
call fcn.10031940
test eax, eax
jne 0x10052c90
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x10052c9a
cmp dword [ebp - 0x34], 0
jne 0x10052c9d
inc edi
jmp 0x10052c25
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10052d17
cmp byte [esi], 0
jne 0x10052d17
test ebx, ebx
je 0x10052cc8
cmp dword [ebp - 0x34], 0
je 0x10052cc8
mov dword [ebp - 0x1c], 0x1d
push 0x10149de4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10052d17
mov eax, str._ping_info_
mov ecx, dword [ebp - 0x24]
call fcn.10031940
test eax, eax
jne 0x10052ce0
mov dword [ebp - 0x1c], eax
mov byte [esi], al
jmp 0x10052d17
mov dword [ebp - 0x1c], 0x1b
push 0x10153cfc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10052d17
inc esi
jmp 0x1005153a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2f68]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x2f6c
mov esp, ebp
pop ebp
ret