Function at 0x49e3e0
Capabilities:
Get common file path
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8008e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
call fcn.0045cc10
push 1
mov ecx, esi
call fcn.0045cc30
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xfd]
mov byte [esi + 0x64], 1
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
push ecx
lea edx, [ebp - 0xd9]
lea esi, [eax + 0x98]
push ebx
push edx
lea ecx, [ebp - 0x160]
mov dword [ebp - 0xe8], esi
call fcn.004a0da0
cmp dword [esi + 0x24], ebx
je 0x49ea79
push ebx
push 0x2710
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.0042c390
add esi, 0x18
lea eax, [ebp - 0x9c]
push esi
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
call fcn.0044db00
add esp, 8
push ebx
push 1
push 0x80
push 3
push closesocket
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.004a0790
lea ecx, [ebp - 0x14]
push 1
lea edx, [ebp - 0xcc]
push ecx
lea eax, [ebp - 0x78]
push edx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
mov dword [ebp - 0x64], vtable.WWLib::CFileRead_1_.0
call fcn.005debe0
lea ecx, [ebp - 0x64]
call fcn.00430c00
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.00404f20
cmp dword [ebp - 0x78], ebx
je 0x49e518
push 0x146
push str.C:ReposBvSrcNoCrtLibdatavect.h
push 0x8fcf74
call fcn.006d2b10
add esp, 0xc
cmp dword [ebp - 0x70], 0x2710
jne 0x49e5a6
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004034c0
lea ecx, [ebp + 0xf]
mov byte [ebp - 4], 6
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], esi
call fcn.00478ac0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 7
mov dword [ebp - 0x64], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.File_too_big_for_a_profile_file.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.File_too_big_for_a_profile_file.
lea ecx, [ebp - 0x60]
call fcn.004030a0
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x340]
push edx
mov byte [ebp - 4], 8
call fcn.00432800
lea eax, [ebp - 0x340]
push 0x89b95c
push eax
mov dword [ebp - method.CryptBlockError.virtual_0], vtable.AException.0
call fcn.007ac5c6
cmp dword [ebp - 0x78], ebx
je 0x49e5c2
push 0x146
push str.C:ReposBvSrcNoCrtLibdatavect.h
push 0x8fcf74
call fcn.006d2b10
add esp, 0xc
mov eax, dword [ebp - 0x78]
mov esi, dword [ebp - 0x70]
cmp eax, ebx
je 0x49e5e3
push 0x13e
push str.C:ReposBvSrcNoCrtLibdatavect.h
push 0x8fcf74
call fcn.006d2b10
add esp, 0xc
mov edi, dword [ebp - 0x74]
lea ecx, [ebp - 0x3c]
call fcn.004413f0
shr esi, 1
push esi
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xa
call fcn.006d2730
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 0xb
cmp ecx, ebx
je 0x49ea41
lea eax, [ecx - 1]
cmp eax, ebx
je 0x49ea41
cmp dword [ebp - 0x3c], ebx
jne 0x49e623
cmp eax, ebx
ja 0x49e63d
push 0x96
push str.C:ReposBvSrcNoCrtLibNoCrtString.h
push str._af___i_length__
call fcn.006d2b10
mov ecx, dword [ebp - 0x34]
add esp, 0xc
mov edx, dword [ebp - 0x38]
cmp word [edx], 0xfeff
je 0x49e6cc
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004034c0
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x50], esi
call fcn.00478ac0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x64], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Unrecognized_profile_format.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Unrecognized_profile_format.
lea ecx, [ebp - 0x60]
call fcn.004030a0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
push ecx
lea ecx, [ebp - 0x2a8]
call fcn.00432800
lea edx, [ebp - 0x2a8]
push 0x89b95c
push edx
mov dword [ebp - method.CryptBlockError.virtual_0], vtable.AException.0
call fcn.007ac5c6
mov edi, 1
cmp ecx, ebx
je 0x49ea41
lea eax, [ecx - 1]
cmp edi, eax
jae 0x49ea41
cmp dword [ebp - 0x3c], ebx
je 0x49e703
push 0x96
push str.C:ReposBvSrcNoCrtLibNoCrtString.h
push str._af___i_length__
call fcn.006d2b10
mov ecx, dword [ebp - 0x34]
add esp, 0xc
mov eax, dword [ebp - 0x38]
cmp word [eax + edi*2], 0xd
je 0x49ea3b
cmp dword [ebp - 0x3c], ebx
jne 0x49e721
cmp ecx, ebx
je 0x49e721
lea eax, [ecx - 1]
cmp edi, eax
jb 0x49e73b
push 0x96
push str.C:ReposBvSrcNoCrtLibNoCrtString.h
push str._af___i_length__
call fcn.006d2b10
mov ecx, dword [ebp - 0x34]
add esp, 0xc
mov edx, dword [ebp - 0x38]
cmp word [edx + edi*2], 0xa
je 0x49ea3b
push 0xffffffffffffffff
push edi
push 0x9009ac
lea ecx, [ebp - 0x3c]
call fcn.006d2a60
mov esi, eax
cmp esi, edi
je 0x49e9ba
cmp esi, 0xffffffff
je 0x49e9ba
sub eax, edi
lea ecx, [ebp - 0x128]
push eax
push edi
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004a0260
lea edx, [ebp - 0x9c]
push eax
push edx
mov byte [ebp - 4], 0x14
call fcn.006d1cb0
add esp, 8
mov edi, eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x15
call fcn.004413f0
mov eax, dword [edi]
mov byte [ebp - 4], 0x16
cmp eax, ebx
je 0x49e7b6
mov dword [ebp - 0x114], eax
jmp 0x49e7c5
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp - 0x114]
call fcn.004a0aa0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x19
call fcn.00418540
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x18
call fcn.00418540
push 0xffffffffffffffff
mov ebx, esi
push esi
push 0x905c88
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], ebx
call fcn.006d2a60
mov edi, eax
mov eax, dword [ebp - 0x34]
cmp edi, 0xffffffff
jne 0x49e80d
test eax, eax
je 0x49e80b
lea edi, [eax - 1]
jmp 0x49e80d
xor edi, edi
mov esi, edi
sub esi, ebx
cmp esi, 2
jb 0x49e939
mov ecx, dword [ebp - 0x14]
lea ebx, [ecx + 2]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
jne 0x49e830
test eax, eax
je 0x49e830
dec eax
cmp ebx, eax
jb 0x49e847
push 0x96
push str.C:ReposBvSrcNoCrtLibNoCrtString.h
push str._af___i_length__
call fcn.006d2b10
add esp, 0xc
mov edx, dword [ebp - 0x38]
cmp word [edx + ebx*2], 0x3a
jne 0x49e939
mov eax, dword [ebp - 0x14]
push esi
lea ecx, [ebp - 0xc4]
push eax
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004a0260
mov esi, eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
call fcn.004413f0
mov eax, dword [esi]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x49e886
mov dword [ebp - 0x28], eax
jmp 0x49e893
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.004a0aa0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x21
call fcn.00418540
lea ecx, [ebp - 0xd8]
call fcn.004413f0
lea edx, [ebp - 0x114]
push eax
push edx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x22
call fcn.004a0dd0
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x23
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x22
call fcn.004a0940
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x21
call fcn.00418540
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
test eax, eax
jne 0x49e914
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x49e907
mov dword [ecx], eax
jmp 0x49e914
push 0xffffffffffffffff
lea edx, [ebp - 0x28]
push 0
push edx
call fcn.004a0ac0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
call fcn.00418540
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xb
call fcn.00418540
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
jmp 0x49e6d1
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004034c0
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x50], esi
call fcn.00478ac0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x64], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Invalid_profile_data.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Invalid_profile_data.
lea ecx, [ebp - 0x60]
call fcn.004030a0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
push ecx
lea ecx, [ebp - 0x210]
call fcn.00432800
lea edx, [ebp - 0x210]
push 0x89b95c
push edx
mov dword [ebp - method.CryptBlockError.virtual_0], vtable.AException.0
call fcn.007ac5c6
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004034c0
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x50], esi
call fcn.00478ac0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x64], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Invalid_profile_data.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Invalid_profile_data.
lea ecx, [ebp - 0x60]
call fcn.004030a0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x12
push ecx
lea ecx, [ebp - 0x2f4]
call fcn.00432800
lea edx, [ebp - 0x2f4]
push 0x89b95c
push edx
mov dword [ebp - method.CryptBlockError.virtual_0], vtable.AException.0
call fcn.007ac5c6
inc edi
jmp 0x49e6d1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00418540
mov eax, dword [ebp - 0x74]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x49ea70
mov edx, dword [ebp - 0x6c]
cmp edx, ebx
je 0x49ea70
mov ecx, dword [ebp - 0x68]
cmp ecx, ebx
je 0x49ea70
push edx
push eax
call ecx
mov eax, dword [ebp - 0x74]
add esp, 8
push eax
call fcn.007d7349
add esp, 4
push ebx
push ebx
push ebx
mov dword [ebp - 4], 1
call fcn.0049d3e0
add esp, 0xc
cmp eax, 6
jb 0x49ebb8
lea ecx, [ebp - 0x28]
call fcn.004413f0
push 0xffffffffffffffff
push str.autoreconnection_enabled
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x2f
call fcn.006d2730
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x30
call fcn.004413f0
lea ecx, [ebp - 0x28]
push eax
mov bl, 0x31
push ecx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0dd0
lea edx, [ebp - 0x80]
push eax
push edx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x32
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x30
call fcn.00418540
lea ecx, [esi + 0x20]
push 0xffffffffffffffff
push str.:i:0
push 0xffffffffffffffff
mov dword [ecx + 8], 0
call fcn.006d2730
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00418540
lea ecx, [ebp - 0x28]
call fcn.004413f0
push 0xffffffffffffffff
push 0x906ecc
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x33
call fcn.006d2730
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x34
call fcn.004413f0
push eax
lea eax, [ebp - 0x28]
mov bl, 0x35
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0dd0
lea ecx, [ebp - 0x80]
push eax
push ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x36
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x34
call fcn.00418540
lea ecx, [esi + 0x20]
mov dword [ecx + 8], 0
push 0xffffffffffffffff
push str.:i:0
push 0xffffffffffffffff
call fcn.006d2730
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00418540
mov edx, dword [ebp - 0xe8]
mov al, byte [edx + 0x3a]
test al, al
je 0x49f450
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x184]
add eax, 0x30
push eax
push ecx
call fcn.0044db00
add esp, 8
mov edx, dword [eax]
mov ecx, eax
mov byte [ebp - 4], 0x37
call dword [edx + 0x24]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.004413f0
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x38
call fcn.006d2730
push 1
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x3a
call fcn.00404f20
lea ecx, [ebp - 0x28]
call fcn.004413f0
push 0xffffffffffffffff
push 0x906ec4
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3b
call fcn.006d2730
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x3c
call fcn.004413f0
push 0xffffffffffffffff
push 0x906ec4
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x3d
call fcn.006d2730
push 0xffffffffffffffff
push 0
push 0x906918
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3e
call fcn.006d2a60
mov esi, eax
cmp esi, 0xffffffff
jne 0x49edf2
push eax
push 0
push 0x906ec0
lea ecx, [ebp - 0x78]
call fcn.006d2a60
mov esi, eax
cmp esi, 0xffffffff
jne 0x49edf2
push eax
lea eax, [ebp - 0x78]
push 0
push eax
lea ecx, [ebp - 0x114]
call fcn.004a0aa0
jmp 0x49eedc
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x49ee05
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x49ee05
dec eax
cmp esi, eax
jb 0x49ee1c
push 0x96
push str.C:ReposBvSrcNoCrtLibNoCrtString.h
push str._af___i_length__
call fcn.006d2b10
add esp, 0xc
mov ecx, dword [ebp - 0x74]
push esi
push 0
cmp word [ecx + esi*2], 0x5c
jne 0x49ee77
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x78]
push edx
call fcn.004a0260
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3f
call fcn.004a0aa0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x3e
call fcn.00418540
inc esi
push 0xffffffffffffffff
lea eax, [ebp - 0x9c]
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.004a0260
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x114]
jmp 0x49eec3
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x78]
call fcn.004a0260
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x41
call fcn.004a0aa0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x3e
call fcn.00418540
inc esi
push 0xffffffffffffffff
lea edx, [ebp - 0x9c]
push esi
push edx
lea ecx, [ebp - 0x78]
call fcn.004a0260
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
push 0
push eax
call fcn.004a0aa0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x3e
call fcn.00418540
lea ecx, [ebp - 0x128]
call fcn.004413f0
push 0xffffffffffffffff
push str.domain
push 0xffffffffffffffff
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x43
call fcn.006d2730
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x44
call fcn.004413f0
push eax
lea eax, [ebp - 0x128]
mov bl, 0x45
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0dd0
lea ecx, [ebp - 0x80]
push eax
push ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x46
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x44
call fcn.00418540
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
test eax, eax
jne 0x49ef75
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x49ef68
mov dword [ecx], eax
jmp 0x49ef75
push 0xffffffffffffffff
lea edx, [ebp - 0x28]
push 0
push edx
call fcn.004a0ac0
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x3e
call fcn.00418540
lea ecx, [ebp - 0x128]
call fcn.004413f0
push 0xffffffffffffffff
push str.username
push 0xffffffffffffffff
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x47
call fcn.006d2730
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x48
call fcn.004413f0
push eax
lea eax, [ebp - 0x128]
mov bl, 0x49
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0dd0
lea ecx, [ebp - 0x80]
push eax
push ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x4a
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x48
call fcn.00418540
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
test eax, eax
jne 0x49f023
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x49f013
mov dword [ecx], eax
jmp 0x49f023
push 0xffffffffffffffff
lea edx, [ebp - 0x114]
push 0
push edx
call fcn.004a0ac0
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x3e
call fcn.00418540
mov al, byte [0x951514]
test al, 1
jne 0x49f09d
mov dl, al
push 0xffffffffffffffff
or dl, 1
push str.Crypt32.dll
lea ecx, [ebp - 0x9c]
mov byte [0x951514], dl
call fcn.00419730
lea eax, [ebp - 0x9c]
push 1
push eax
push 1
mov ecx, 0x95150c
mov byte [ebp - 4], 0x4b
call fcn.0045cbe0
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x4d
call fcn.00404f20
push 0x49fe90
mov dword [0x95150c], 0x85ca24
mov byte [ebp - 4], 0x3e
call fcn.007ac037
add esp, 4
mov eax, dword [0x951510]
test eax, eax
je 0x49f429
push 1
push str.CryptProtectData
push eax
call fcn.0057d750
add esp, 0xc
test eax, eax
je 0x49f429
lea ecx, [ebp - 0x128]
call fcn.004034a0
mov dword [ebp - method.ucs2string.virtual_0], vtable.ucs2string.0
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x2b], 1
mov dword [ebp - 0x34], vtable.AutoCleanString_class_ucs2string_.0
mov esi, dword [ebp + 0x10]
mov byte [ebp - 4], 0x4f
test esi, esi
lea ecx, [ebp - 0x84]
je 0x49f13f
push 1
call fcn.004995c0
mov edx, dword [ebp - 0x80]
mov ecx, esi
push edx
mov byte [ebp - 4], 0x50
call fcn.0075e490
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x128]
push 0
push eax
push ecx
call fcn.00579c40
add esp, 0xc
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x4f
call fcn.00433170
jmp 0x49f22d
push 0
push 0
mov dword [ebp - 0x80], 0
call fcn.00435f60
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x84]
add eax, 0x48
mov bl, 0x51
push edx
push eax
mov byte [ebp - 4], bl
call fcn.005c7af0
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x49f219
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0xc4]
mov edi, eax
call fcn.004034c0
cmp edi, 0xffffffff
mov byte [ebp - 4], 0x52
mov dword [ebp - 0xc4], vtable.utf8string.0
jne 0x49f1aa
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
jmp 0x49f1ab
push edi
lea ecx, [ebp - 0xc0]
push esi
call fcn.004030a0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 0xc8], 0
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 0xc7], 1
mov dword [ebp - 0xd0], vtable.AutoCleanString_class_utf8string_.0
lea edx, [ebp - 0x128]
push 0
lea eax, [ebp - 0xc4]
push edx
push eax
mov byte [ebp - 4], 0x54
call fcn.00579c40
add esp, 0xc
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x53
call fcn.00433170
push 1
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], bl
call fcn.00404c40
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
push eax
push ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x4f
call fcn.00404f70
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x49f40c
lea edx, [eax + eax]
mov eax, dword [ebp - 0x120]
test eax, eax
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc8], 0x8522f8
je 0x49f25e
mov dword [ebp - 0xc8], eax
mov eax, dword [0x951510]
push 0
push str.CryptProtectData
push eax
call fcn.0057d750
add esp, 0xc
lea ecx, [ebp - 0xe4]
lea edx, [ebp - 0xcc]
push ecx
push 1
push 0
push 0
push 0
push 0x906e5c
push edx
call eax
test eax, eax
je 0x49f40c
lea ecx, [ebp - 0xc4]
call fcn.004413f0
push 0xffffffffffffffff
push 0x906e54
push 0xffffffffffffffff
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x55
call fcn.006d2730
mov eax, dword [ebp - 0xbc]
mov byte [ebp - 4], 0x56
test eax, eax
je 0x49f2cc
dec eax
jmp 0x49f2ce
xor eax, eax
mov ecx, dword [ebp - 0xe4]
lea edx, [eax + ecx*2 + 1]
lea ecx, [ebp - 0xc4]
push edx
call fcn.004a0ae0
mov ecx, 8
mov esi, 0x906e30
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe0]
cmp esi, eax
jae 0x49f348
xor eax, eax
mov al, byte [ecx + esi]
lea ecx, [ebp - 0xc4]
shr eax, 4
mov ax, word [ebp + eax*2 - 0x60]
push eax
push 1
push 0xffffffffffffffff
call fcn.006d2410
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xc4]
mov al, byte [edx + esi]
and eax, 0xf
mov ax, word [ebp + eax*2 - 0x60]
push eax
push 1
push 0xffffffffffffffff
call fcn.006d2410
inc esi
jmp 0x49f2f7
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x9c]
call fcn.004413f0
push 0xffffffffffffffff
push str.password_51
push 0xffffffffffffffff
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x57
call fcn.006d2730
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x58
call fcn.004413f0
lea edx, [ebp - 0x9c]
mov bl, 0x59
push eax
push edx
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], bl
call fcn.004a0dd0
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x5a
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x58
call fcn.00418540
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
test eax, eax
jne 0x49f3ee
mov eax, dword [ebp - 0xc4]
test eax, eax
je 0x49f3de
mov dword [ecx], eax
jmp 0x49f3ee
push 0xffffffffffffffff
lea edx, [ebp - 0xc4]
push 0
push edx
call fcn.004a0ac0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x56
call fcn.00418540
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x4f
call fcn.00418540
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x4e
call fcn.00433010
push 1
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x3e
call fcn.00404f20
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x3c
call fcn.00418540
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3a
call fcn.00418540
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00418540
lea ecx, [ebp - 0x28]
call fcn.004413f0
push 0xffffffffffffffff
push str.full_address
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x5b
call fcn.006d2730
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x114]
push eax
push ecx
mov byte [ebp - 4], 0x5c
call fcn.0044db00
add esp, 8
mov edx, dword [eax]
mov ecx, eax
mov byte [ebp - 4], 0x5d
call dword [edx + 0x24]
lea ecx, [ebp - 0x9c]
mov esi, eax
call fcn.004413f0
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x5e
call fcn.006d2730
lea eax, [ebp - 0x9c]
lea ecx, [ebp - 0x184]
push eax
push 0x906df4
push ecx
mov byte [ebp - 4], 0x5f
call fcn.004a1840
add esp, 0xc
mov edi, eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x60
call fcn.004413f0
lea edx, [ebp - 0x28]
mov bl, 0x61
push eax
push edx
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], bl
call fcn.004a0dd0
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x62
call fcn.004a0ca0
mov esi, dword [eax]
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], bl
call fcn.004a0940
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x60
call fcn.00418540
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
xor ebx, ebx
cmp eax, ebx
jne 0x49f541
mov eax, dword [edi]
cmp eax, ebx
je 0x49f538
mov dword [ecx], eax
jmp 0x49f541
push 0xffffffffffffffff
push ebx
push edi
call fcn.004a0ac0
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x5f
call fcn.00418540
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x5d
call fcn.00418540
push 1
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x5c
call fcn.00404f20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00418540
lea ecx, [ebp - 0xfc]
call fcn.004413f0
push ebx
push 0x10a
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x63
call fcn.004a0b80
cmp eax, ebx
jne 0x49f5b1
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xf4]
mov word [ecx + edx*2 - 2], bx
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
je 0x49f5be
dec eax
jmp 0x49f5c0
xor eax, eax
mov ecx, dword [ebp - 0xf8]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
push ecx
push eax
call esi
mov ecx, dword [ebp - 0xf4]
cmp ecx, ebx
je 0x49f5e0
dec ecx
cmp eax, ecx
jb 0x49f62e
add eax, 6
push ebx
push eax
lea ecx, [ebp - 0xfc]
call fcn.004a0b80
cmp eax, ebx
jne 0x49f605
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf4]
mov word [edx + eax*2 - 2], bx
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
je 0x49f612
dec eax
jmp 0x49f614
xor eax, eax
mov ecx, dword [ebp - 0xf8]
dec eax
push ecx
push eax
call esi
mov ecx, dword [ebp - 0xf4]
cmp ecx, ebx
je 0x49f632
dec ecx
cmp eax, ecx
jae 0x49f632
cmp eax, ebx
jne 0x49f697
lea ecx, [ebp - 0x9c]
call fcn.004034a0
push str.Creating_temporary_profile_file_failed:_GetTempPath__
mov byte [ebp - 4], 0x64
mov dword [ebp - 0x9c], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [ebp - 0x98]
push eax
push str.Creating_temporary_profile_file_failed:_GetTempPath__
call fcn.00403980
mov byte [ebp - 4], 0x65
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x9c]
push eax
push edx
lea ecx, [ebp - 0x390]
call fcn.005844f0
lea eax, [ebp - 0x390]
push 0x89b94c
push eax
call fcn.007ac5c6
inc eax
push ebx
push eax
lea ecx, [ebp - 0xfc]
call fcn.004a0b80
cmp eax, ebx
jne 0x49f6ba
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xf4]
mov word [ecx + edx*2 - 2], bx
lea ecx, [ebp - 0x13c]
call fcn.004413f0
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 0x66
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.006d43a0
cmp eax, ebx
jne 0x49f6e4
xor eax, eax
mov dword [ebp + 0x10], eax
jmp 0x49f6e7
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov dword [ebp - 0xcc], eax
je 0x49f703
lea ecx, [ebp - 0xc8]
push ecx
call fcn.006d4460
mov dword [ebp - 0xcc], eax
push ebx
push 0x10a
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x67
call fcn.004a0b80
cmp eax, ebx
jne 0x49f72d
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
mov word [edx + eax*2 - 2], bx
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
mov eax, dword [ebp - 0xf8]
jne 0x49f742
mov eax, 0x95120c
mov ecx, dword [ebp - 0x138]
push ecx
push ebx
push 0x906d7c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x49f7bf
lea ecx, [ebp - 0x9c]
call fcn.004034a0
push str.Creating_temporary_profile_file_failed:_GetTempFileName__
mov byte [ebp - 4], 0x68
mov dword [ebp - 0x9c], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
lea ecx, [ebp - 0x98]
push eax
push str.Creating_temporary_profile_file_failed:_GetTempFileName__
call fcn.00403980
mov byte [ebp - 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x9c]
push eax
push edx
lea ecx, [ebp - 0x3e0]
call fcn.005844f0
lea eax, [ebp - 0x3e0]
push 0x89b94c
push eax
call fcn.007ac5c6
mov eax, dword [ebp - 0x134]
cmp eax, ebx
mov eax, dword [ebp - 0x138]
jne 0x49f7d4
mov eax, 0x95120c
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x134], ebx
call fcn.006d2730
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
je 0x49f7f7
dec eax
jmp 0x49f7f9
xor eax, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x50]
push eax
push ecx
lea ecx, [ebp - 0x13c]
call fcn.004a0260
mov esi, eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x6a
call fcn.004413f0
mov eax, dword [esi]
mov byte [ebp - 4], 0x6b
cmp eax, ebx
je 0x49f82e
mov dword [ebp - 0x114], eax
jmp 0x49f83d
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x114]
call fcn.004a0aa0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x6d
call fcn.00418540
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x6e
call fcn.004413f0
push 0xfa1
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x6f
call fcn.004a0ae0
push 0xffffffffffffffff
push 0x8fa664
push 0xffffffffffffffff
lea ecx, [ebp - 0xc4]
call fcn.006d2730
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x160]
push edx
call fcn.005184e0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x15c]
cmp eax, ecx
je 0x49f8e1
add eax, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xc4]
call fcn.004a0aa0
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
add eax, 0x20
push ebx
push eax
lea ecx, [ebp - 0xc4]
call fcn.004a0aa0
push 0xffffffffffffffff
push 0x905c88
push 0xffffffffffffffff
lea ecx, [ebp - 0xc4]
call fcn.006d2730
lea ecx, [ebp + 0xc]
call fcn.004a0e70
jmp 0x49f88f
lea ecx, [ebp - 0x28]
call fcn.004034a0
push 0xffffffffffffffff
lea ecx, [ebp - 0x13c]
push ebx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x70
mov dword [ebp - 0x28], vtable.ucs2string.0
call fcn.004a04f0
lea ecx, [ebp - 0x198]
call fcn.0043aea0
push ebx
push 3
push 0x80
push 2
lea edx, [ebp - 0x28]
push 0x40000000
push edx
push 1
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x72
mov dword [ebp - method.WWLib::CEventSet_1_.virtual_0], vtable.WWLib::CFileOpen_1_.0
call fcn.005de630
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x74
call fcn.00404f20
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x68]
mov eax, dword [eax + 0x68]
cmp eax, ebx
jne 0x49f977
mov eax, dword [ebp - 0x13c]
cmp eax, ebx
je 0x49f968
mov dword [ecx], eax
jmp 0x49f977
push 0xffffffffffffffff
lea edx, [ebp - 0x13c]
push ebx
push edx
call fcn.004a0ac0
mov eax, dword [ebp - 0xbc]
cmp eax, ebx
je 0x49f986
lea edi, [eax - 1]
jmp 0x49f988
xor edi, edi
mov esi, dword [ebp - 0xc0]
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00456170
lea ecx, [ebp - 0x14]
push 1
lea edx, [ebp - 0x80]
push ecx
lea eax, [edi + edi]
push edx
push eax
push esi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x75
mov dword [ebp - 0xb0], vtable.WWLib::CFileWrite_1_.0
call fcn.005ded70
lea ecx, [ebp - 0xb0]
call fcn.00430c00
lea ecx, [ebp - 0x198]
call fcn.00430c00
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x6e
call fcn.00418540
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0x67
call fcn.00418540
mov eax, dword [ebp - 0xcc]
mov byte [ebp - 4], 0x66
cmp eax, ebx
je 0x49fa26
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.006d44b0
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x184]
push edx
push 0x8fdc48
push eax
call fcn.004a1840
add esp, 0xc
push str.___v:
lea ecx, [ebp - 0x50]
push eax
push ecx
mov byte [ebp - 4], 0x7b
call fcn.004a1950
add esp, 0xc
mov esi, eax
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x7c
call fcn.004413f0
mov eax, dword [esi]
mov byte [ebp - 4], 0x7d
cmp eax, ebx
je 0x49fa7a
mov dword [ebp - 0x150], eax
jmp 0x49fa89
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x150]
call fcn.004a0aa0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x80
call fcn.00418540
mov bl, 0x7f
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], bl
call fcn.00418540
mov edx, dword [ebp + 8]
lea ecx, [edx + 4]
call fcn.004a0a90
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.00692560
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0x81
test eax, eax
jne 0x49facb
mov eax, 0x8522f8
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.00404f20
mov esi, dword [ebp - 0xe8]
mov al, byte [esi + 0x2c]
test al, al
je 0x49fb19
call fcn.0049d610
test al, al
lea ecx, [ebp - 0x150]
push 0xffffffffffffffff
je 0x49fb0d
push str.__admin
jmp 0x49fb12
push str.__console
push 0xffffffffffffffff
call fcn.006d2730
mov al, byte [esi + 0x2d]
test al, al
je 0x49fb34
push 0xffffffffffffffff
push 0x906cd0
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
mov eax, dword [esi + 0x30]
test eax, eax
je 0x49fb91
push 0xffffffffffffffff
push str.__w:
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
mov edx, dword [esi + 0x30]
push 0
push 0xa
lea eax, [ebp - 0x9c]
push edx
push eax
call fcn.0044e7a0
add esp, 0x10
mov edx, dword [eax]
mov ecx, eax
mov byte [ebp - 4], 0x82
call dword [edx + 0x24]
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00404f20
mov eax, dword [esi + 0x34]
test eax, eax
je 0x49fbee
push 0xffffffffffffffff
push str.__h:
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
mov eax, dword [esi + 0x34]
push 0
push 0xa
lea ecx, [ebp - 0x9c]
push eax
push ecx
call fcn.0044e7a0
add esp, 0x10
mov edx, dword [eax]
mov ecx, eax
mov byte [ebp - 4], 0x83
call dword [edx + 0x24]
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00404f20
push 0
push 0
push 0
call fcn.0049d3e0
add esp, 0xc
cmp eax, 6
jb 0x49fc37
mov al, byte [esi + 0x38]
test al, al
je 0x49fc1c
push 0xffffffffffffffff
push str.__public
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
mov al, byte [esi + 0x39]
test al, al
je 0x49fc37
push 0xffffffffffffffff
push str.__span
push 0xffffffffffffffff
lea ecx, [ebp - 0x150]
call fcn.006d2730
push 0xffffffffffffffff
lea eax, [ebp - 0x150]
push 0
push eax
lea ecx, [ebp - 0x9c]
call fcn.004a0350
lea ecx, [ebp - 0x170]
lea edx, [ebp - 0x9c]
push ecx
push edx
mov byte [ebp - 4], 0x84
call fcn.0049ffa0
add esp, 8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
push 1
call fcn.00404f20
mov eax, dword [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x168]
mov byte [ebp - 4], 0x66
mov dword [eax + 0x5c], ecx
lea ecx, [ebp - 0x150]
mov dword [eax + 0x60], edx
call fcn.00418540
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x63
call fcn.00418540
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 1
call fcn.00418540
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0
call fcn.004a0850
push 0xffffffffffffffff
push str.Remote_Desktop_Connection_launched_successfully.
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 0xffffffff
call fcn.00419730
push 0
lea eax, [ebp - 0x9c]
push 2
push eax
mov dword [ebp - 4], 0x89
call fcn.0048ea40
add esp, 0xc
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], 0xffffffff
push 1
call fcn.00404f20
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret