Function at 0x4a2490
Capabilities:
Check for software breakpoints
Parse pe header

Disassembly:
cmp dword [esp + 0x28], 1
jne 0x4a24b2
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push 0x63ec40
push ecx
mov dword [eax], 0x9a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi], 0x3e8
jbe 0x4a2622
push str.4D5A
push 0
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a253b
push str.54686973206973206120547275655479706520666F6E742C206E6F7420612070726F6772616D2E
push 0x4e
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a253b
push str.4E45
push 0x80
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a253b
push str.464F4E54444952
push 0xed
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a253b
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
push 0x63ebc8
push eax
mov dword [edx], 0x14f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
ret
cmp dword [edi], 0x3e8
jbe 0x4a2622
push str.4D5A
push 0
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.0040000000504500004C
push 0x3b
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.72737263000000
push 0x139
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.402E697473
push 0x15f
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.560053005F00560045005200530049004F004E005F0049004E0046004F
push 0x1ee
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.53007400720069006E006700460069006C00650049006E0066006F
push 0x24a
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.460069006C006500560065007200730069006F006E
push 0x286
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
push str.460069006C0065004400650073006300720069007000740069006F006E000000000043006F006D00700069006C00650064
push 0x2ea
push esi
call fcn.0049e810
add esp, 0xc
test eax, eax
je 0x4a2622
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
push 0x63ea8c
push edx
mov dword [ecx], 0x14e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
ret
push ebp
mov ebp, dword [edi]
cmp ebp, 0x21
jbe 0x4a2699
mov cl, byte [esi]
test cl, cl
jne 0x4a26e5
cmp byte [esi + 1], cl
jne 0x4a2699
cmp byte [esi + 2], 1
jne 0x4a2699
cmp byte [esi + 3], cl
jne 0x4a2699
cmp byte [esi + 5], cl
jne 0x4a2699
cmp byte [esi + 9], cl
jne 0x4a2699
cmp byte [esi + 0xb], cl
jne 0x4a2699
cmp byte [esi + 0xd], cl
jne 0x4a2699
cmp byte [esi + 0x11], cl
jne 0x4a2699
cmp byte [esi + 0x14], cl
jne 0x4a2699
cmp byte [esi + 0x15], cl
jne 0x4a2699
cmp byte [esi + 0x19], cl
jne 0x4a2699
cmp byte [esi + 0x1b], cl
jne 0x4a2699
cmp byte [esi + 0x1d], cl
jne 0x4a2699
cmp byte [esi + 0x21], cl
jne 0x4a2699
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
push 0x63ea88
push ecx
mov dword [eax], 5
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebp
pop edi
pop esi
ret
mov cl, byte [esi]
test cl, cl
jne 0x4a26e5
cmp byte [esi + 1], 0xbf
jne 0x4a26e5
cmp byte [esi + 2], cl
jne 0x4a26e5
cmp byte [esi + 3], cl
jne 0x4a26e5
cmp byte [esi + 6], 0x54
jne 0x4a26e5
cmp byte [esi + 7], 0x43
jne 0x4a26e5
cmp byte [esi + 8], 0x53
jne 0x4a26e5
cmp byte [esi + 9], 0x4f
jne 0x4a26e5
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
push 0x63ea84
push eax
mov dword [edx], 7
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebp
pop edi
pop esi
ret
push ebx
cmp cl, 0x30
jne 0x4a2703
cmp byte [esi + 4], 6
jne 0x4a2703
cmp byte [esi + 5], 9
jne 0x4a2703
cmp byte [esi + 6], 0x2a
jne 0x4a2703
cmp byte [esi + 7], 0x86
je 0x4a271d
mov bl, byte [esi + 5]
cmp bl, 6
jne 0x4a273c
cmp byte [esi + 6], 9
jne 0x4a273c
cmp byte [esi + 7], 0x2a
jne 0x4a273c
cmp byte [esi + 8], 0x86
jne 0x4a273c
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63ea80
push edx
mov dword [ecx], 0xc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov dl, byte [esi + 2]
cmp dl, 0x43
jne 0x4a2773
cmp byte [esi + 3], 0x54
jne 0x4a2773
cmp byte [esi + 4], 5
jne 0x4a2773
test bl, bl
jne 0x4a2773
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63ea7c
push ecx
mov dword [eax], 0x10
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp ebp, 0x45
jbe 0x4a28ce
test cl, cl
jne 0x4a28ce
cmp byte [esi + 1], cl
jne 0x4a28ce
cmp dl, 2
jne 0x4a28ce
cmp byte [esi + 3], cl
jne 0x4a28ce
test bl, bl
jne 0x4a28ce
mov al, 0x20
cmp byte [esi + 6], al
jne 0x4a28ce
cmp byte [esi + 7], al
jne 0x4a28ce
cmp byte [esi + 9], bl
jne 0x4a28ce
cmp byte [esi + 0xb], bl
jne 0x4a28ce
cmp byte [esi + 0xd], bl
jne 0x4a28ce
cmp byte [esi + 0x10], bl
jne 0x4a28ce
cmp byte [esi + 0x11], bl
jne 0x4a28ce
cmp byte [esi + 0x13], bl
jne 0x4a28ce
cmp byte [esi + 0x14], bl
jne 0x4a28ce
cmp byte [esi + 0x15], bl
jne 0x4a28ce
cmp byte [esi + 0x18], bl
jne 0x4a28ce
cmp byte [esi + 0x19], bl
jne 0x4a28ce
cmp byte [esi + 0x1b], bl
jne 0x4a28ce
cmp byte [esi + 0x1d], bl
jne 0x4a28ce
cmp byte [esi + 0x1f], bl
jne 0x4a28ce
cmp byte [esi + 0x20], bl
jne 0x4a28ce
cmp byte [esi + 0x21], bl
jne 0x4a28ce
cmp byte [esi + 0x25], bl
jne 0x4a28ce
cmp byte [esi + 0x27], bl
jne 0x4a28ce
cmp byte [esi + 0x28], bl
jne 0x4a28ce
cmp byte [esi + 0x29], bl
jne 0x4a28ce
cmp byte [esi + 0x2c], bl
jne 0x4a28ce
cmp byte [esi + 0x2d], bl
jne 0x4a28ce
cmp byte [esi + 0x2f], bl
jne 0x4a28ce
cmp byte [esi + 0x30], bl
jne 0x4a28ce
cmp byte [esi + 0x31], bl
jne 0x4a28ce
cmp byte [esi + 0x33], bl
jne 0x4a28ce
cmp byte [esi + 0x35], bl
jne 0x4a28ce
cmp byte [esi + 0x37], bl
jne 0x4a28ce
cmp byte [esi + 0x38], bl
jne 0x4a28ce
cmp byte [esi + 0x39], bl
jne 0x4a28ce
cmp byte [esi + 0x3c], bl
jne 0x4a28ce
cmp byte [esi + 0x3d], bl
jne 0x4a28ce
cmp byte [esi + 0x3e], bl
jne 0x4a28ce
cmp byte [esi + 0x3f], bl
jne 0x4a28ce
cmp byte [esi + 0x40], bl
jne 0x4a28ce
cmp byte [esi + 0x41], bl
jne 0x4a28ce
cmp byte [esi + 0x45], bl
jne 0x4a28ce
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63ea78
push eax
mov dword [edx], 0x11
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp cl, 0x49
jne 0x4a2903
cmp byte [esi + 1], 0x44
jne 0x4a2903
cmp dl, 0x33
jne 0x4a2903
cmp byte [esi + 4], 0
jne 0x4a2903
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63ea74
push edx
mov dword [ecx], 0x17
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp cl, 0x4c
jne 0x4a290e
cmp byte [esi + 1], 1
je 0x4a2919
cmp cl, 0xc0
jne 0x4a2960
cmp byte [esi + 1], 1
jne 0x4a2960
cmp byte [esi + 0xe], 0
jne 0x4a2960
cmp byte [esi + 0xf], 0
jne 0x4a2960
push ebp
push str.NETMANIAC
push esi
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a33dd
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63ea64
push ecx
mov dword [eax], 0x1b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x3c]
jmp 0x4a33f5
test dl, dl
jne 0x4a2993
cmp byte [esi + 3], dl
jne 0x4a2993
cmp byte [esi + 4], 2
jne 0x4a2993
cmp bl, 0x5a
jne 0x4a2993
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63ea60
push eax
mov dword [edx], 0x2c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push str.__PS_Adobe
lea ebx, [esi + 6]
call fcn.004dd6c0
push eax
push str.__PS_Adobe
push ebx
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4a29d2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63ea50
push edx
mov dword [ecx], 0x30
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [ebx], 0xca
jne 0x4a2a08
cmp byte [esi + 7], 0xc0
jne 0x4a2a08
cmp byte [esi + 8], 0xa6
jne 0x4a2a08
cmp byte [esi + 9], 0x60
jne 0x4a2a08
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push str.Virus_Signature
push ecx
mov dword [eax], 0x5b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push str._____BEGIN_CERTIFICATE_
call fcn.004dd6c0
mov edi, dword [esp + 0x34]
push eax
push str._____BEGIN_CERTIFICATE_
push edi
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4a2a48
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63ea24
push eax
mov dword [edx], 0x60
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi], 0
jne 0x4a2a8a
cmp byte [esi + 1], 4
jne 0x4a2a8a
cmp byte [esi + 2], 0
jne 0x4a2a8a
cmp byte [esi + 3], 0
jne 0x4a2a8a
cmp byte [esi + 0xc], 0xa
jne 0x4a2a8a
cmp byte [esi + 0xd], 0
jne 0x4a2a8a
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63ea20
push edx
mov dword [ecx], 0x65
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4a2ad2
push 0x6283e8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4a2ad2
cmp byte [esi], al
jne 0x4a2ad2
cmp byte [esi + 1], al
jne 0x4a2ad2
cmp byte [esi + 2], 1
jne 0x4a2ad2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push str.EXE_ICON_File
push ecx
mov dword [eax], 0x6a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi], 0xd
jne 0x4a2b29
cmp byte [esi + 1], 0
jne 0x4a2b29
mov al, 0x3f
cmp byte [ebx], al
jne 0x4a2ae9
cmp byte [esi + 7], 0
je 0x4a2af4
cmp byte [esi + 8], al
jne 0x4a2b29
cmp byte [esi + 9], 0
jne 0x4a2b29
cmp byte [esi + 0xa], al
jne 0x4a2aff
cmp byte [esi + 0xb], 0
je 0x4a2b0a
cmp byte [esi + 0xc], al
jne 0x4a2b29
cmp byte [esi + 0xd], 0
jne 0x4a2b29
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63ea0c
push eax
mov dword [edx], 0x72
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi + 4], 0x53
jne 0x4a2b5f
cmp byte [esi + 5], 0x43
jne 0x4a2b5f
cmp byte [ebx], 0x43
jne 0x4a2b5f
cmp byte [esi + 7], 0x41
jne 0x4a2b5f
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63ea08
push edx
mov dword [ecx], 0x73
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 4
lea eax, [esi + 8]
push str.sdbf
push eax
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a2b95
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e9fc
push ecx
mov dword [eax], 0x76
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov cl, byte [esi + 4]
cmp cl, 0xef
jne 0x4a2bcd
cmp byte [esi + 5], 0xcd
jne 0x4a2bcd
cmp byte [ebx], 0xab
jne 0x4a2bcd
cmp byte [esi + 7], 0x89
jne 0x4a2bcd
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e9f8
push eax
mov dword [edx], 0x7b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov al, byte [esi]
cmp al, 3
jne 0x4a2bfe
cmp byte [esi + 2], 2
jne 0x4a2bfe
cmp byte [esi + 3], 9
jne 0x4a2bfe
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push str.SBSI_DAT
push edx
mov dword [ecx], 0x81
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp al, 0x30
jne 0x4a2c32
mov al, 0x82
cmp byte [esi + 1], al
jne 0x4a2c32
cmp cl, 0x30
jne 0x4a2c32
cmp byte [esi + 5], al
jne 0x4a2c32
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e9e8
push ecx
mov dword [eax], 0x83
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi + 1], 0xf3
lea ebp, [esi + 1]
jne 0x4a2c66
cmp byte [esi + 2], 0x9f
jne 0x4a2c66
cmp byte [esi + 3], 0x77
jne 0x4a2c66
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e9e4
push eax
mov dword [edx], 0x84
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi + 6], 0xd3
jne 0x4a2c9d
cmp byte [esi + 7], 0x11
jne 0x4a2c9d
cmp byte [esi + 8], 0x9c
jne 0x4a2c9d
cmp byte [esi + 9], 0x26
jne 0x4a2c9d
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e9e0
push edx
mov dword [ecx], 0x86
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push str.Pqtch
call fcn.004dd6c0
push eax
lea eax, [edi + 3]
push str.Pqtch
push eax
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4a2cdc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push str.QTCH
push edx
mov dword [ecx], 0x8e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0x2a
push edi
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4a2d35
push 6
lea edi, [eax + 1]
push 0x63e9c8
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a2d16
push 7
push str.Feature
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a2d35
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e9bc
push ecx
mov dword [eax], 0x99
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp dword [esp + 0x38], 0xffffffff
mov bl, 0xff
jne 0x4a2e7e
mov edx, dword [esp + 0x18]
cmp dword [edx], 0x100
jbe 0x4a2e7e
cmp byte [esi], 0x4d
jne 0x4a2e7e
cmp byte [ebp], 0x5a
jne 0x4a2e7e
cmp byte [esi + 5], 0
jne 0x4a2e7e
cmp byte [esi + 6], 0
jne 0x4a2e7e
cmp byte [esi + 7], 0
jne 0x4a2e7e
cmp byte [esi + 9], 0
jne 0x4a2e7e
cmp byte [esi + 0xa], 0
jne 0x4a2e7e
cmp byte [esi + 0xb], 0
jne 0x4a2e7e
cmp byte [esi + 0xc], bl
jne 0x4a2e7e
cmp byte [esi + 0xd], bl
jne 0x4a2e7e
cmp byte [esi + 0xf], 0
jne 0x4a2e7e
cmp byte [esi + 0x14], 0
jne 0x4a2e7e
cmp byte [esi + 0x15], 0
jne 0x4a2e7e
cmp byte [esi + 0x16], 0
jne 0x4a2e7e
cmp byte [esi + 0x17], 0
jne 0x4a2e7e
cmp byte [esi + 0x18], 0x40
jne 0x4a2e7e
cmp byte [esi + 0x19], 0
jne 0x4a2e7e
cmp byte [esi + 0x1a], 0
jne 0x4a2e7e
cmp byte [esi + 0x1b], 0
jne 0x4a2e7e
add esi, 0x100
xor ebp, ebp
xor ebx, ebx
mov edi, 0x100
cmp byte [esi], 0x46
jne 0x4a2e49
push 7
push str.FONTDIR
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a2e32
lea ebp, [eax + 1]
jmp 0x4a2e49
push 7
push str.FONTRES
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a2e49
lea ebx, [eax + 1]
inc esi
sub edi, 1
jne 0x4a2e14
test ebp, ebp
je 0x4a33ff
test ebx, ebx
je 0x4a33ff
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63ec40
push ecx
mov dword [eax], 0x9a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push str.Standard
lea edi, [esi + 4]
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4a2eb8
cmp byte [esi + 0xd], 0x4a
je 0x4a2eb8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push str.ACCD
push eax
mov dword [edx], 0x9c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov al, byte [esi]
cmp al, 2
jne 0x4a2eee
cmp byte [edi], 0x53
jne 0x4a2eee
cmp byte [esi + 5], 0x44
jne 0x4a2eee
cmp byte [esi + 6], 0x4d
jne 0x4a2eee
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e994
push edx
mov dword [ecx], 0x9f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
test al, al
jne 0x4a2f22
cmp byte [edi], 0x4b
jne 0x4a2f22
cmp byte [esi + 5], 0x43
jne 0x4a2f22
cmp byte [esi + 6], 0x4d
jne 0x4a2f22
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e990
push ecx
mov dword [eax], 0xa1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push str.NSB1
call fcn.004dd6c0
push eax
push str.NSB1
push edi
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4a2f5e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e984
push eax
mov dword [edx], 0xa8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
push str.Bud1
push edi
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a2f91
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push str.DS_Store
push edx
mov dword [ecx], 0xc8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi + 8], bl
jne 0x4a2fdc
cmp byte [esi + 9], bl
jne 0x4a2fdc
cmp byte [esi + 0xa], bl
jne 0x4a2fdc
cmp byte [esi + 0xb], bl
jne 0x4a2fdc
cmp byte [esi + 0xc], 0
jne 0x4a2fdc
cmp byte [esi + 0xd], 0
jne 0x4a2fdc
cmp byte [esi + 0xe], 0
jne 0x4a2fdc
cmp byte [esi + 0xf], 0
jne 0x4a2fdc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e96c
push ecx
mov dword [eax], 0xd8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
push str.RECR
push ebp
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a300f
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push str.META
push eax
mov dword [edx], 0xde
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
lea eax, [esi + 2]
push str.WBRK
push eax
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a3045
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e9e4
push edx
mov dword [ecx], 0x108
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
lea edi, [esi + 3]
push str._Work
push edi
call fcn.0049e940
add esp, 0xc
test eax, eax
je 0x4a33be
push 0
lea eax, [esi + 2]
push str._Work
push eax
call fcn.0049e940
add esp, 0xc
test eax, eax
je 0x4a33be
push 0
push str.GPDS
push ebp
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a30ae
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e940
push ecx
mov dword [eax], 0x10a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
push str.MySQL
push edi
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a30e1
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push str.MySQL_Dump
push eax
mov dword [edx], 0x10e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
push str.Win4
lea ebx, [esi + 4]
push ebx
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a3117
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e920
push edx
mov dword [ecx], 0x10f
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4a316b
push 4
push str..MUI
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a316b
push eax
lea eax, [esi + 0xa0]
push str.Rich
push eax
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a316b
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e90c
push edx
mov dword [ecx], 0x11e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov al, byte [esi]
cmp al, 1
je 0x4a3175
cmp al, 2
jne 0x4a319f
cmp byte [esi + 2], 0x50
jne 0x4a319f
cmp byte [edi], 0x48
jne 0x4a319f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e908
push ecx
mov dword [eax], 0x12c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp al, 6
je 0x4a31a7
cmp al, 7
jne 0x4a31d1
cmp byte [esi + 2], 0x48
jne 0x4a31d1
cmp byte [edi], 0x59
jne 0x4a31d1
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e904
push eax
mov dword [edx], 0x12e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
push 0
push str.COREL
push ebp
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a3204
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e8f8
push edx
mov dword [ecx], 0x138
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov al, byte [esi]
cmp al, 0xfe
jne 0x4a323b
cmp byte [ebp], 1
jne 0x4a323b
cmp byte [esi + 5], 0
jne 0x4a323b
cmp byte [esi + 6], 0
jne 0x4a323b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e8f4
push ecx
mov dword [eax], 0x141
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp al, 1
jne 0x4a3270
cmp byte [esi + 0xc], 0x33
jne 0x4a3270
cmp byte [esi + 0xd], 0x7f
jne 0x4a3270
cmp byte [esi + 0xe], 0x7c
jne 0x4a3270
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e8f0
push eax
mov dword [edx], 0x14a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [ebp], 0
jne 0x4a32ac
push 0
lea ecx, [esi + 0xc]
push str.BEAC
push ecx
call fcn.0049e940
add esp, 0xc
test eax, eax
jne 0x4a32ac
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e8e4
push eax
mov dword [edx], 0x14c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 8
jbe 0x4a332c
cmp byte [esi], 5
jne 0x4a332c
cmp byte [ebp], 0
jne 0x4a332c
cmp byte [esi + 2], 0
jne 0x4a332c
cmp byte [edi], 0
jne 0x4a332c
cmp byte [ebx], 1
jne 0x4a332c
cmp byte [esi + 5], 0
jne 0x4a332c
cmp byte [esi + 6], 1
jne 0x4a332c
cmp byte [esi + 7], 0
jne 0x4a332c
cmp byte [esi + 8], 0
jne 0x4a332c
push str.pictures
call fcn.004dd6c0
neg eax
sbb eax, eax
inc eax
push eax
lea edx, [esi + 0xe]
push str.pictures
push edx
call fcn.0049e940
add esp, 0x10
test eax, eax
je 0x4a332c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push 0x63e8d4
push ecx
mov dword [eax], 0x34
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
cmp byte [esi], 0
jne 0x4a335a
cmp byte [ebp], 1
jne 0x4a335a
cmp byte [esi + 2], 0
jne 0x4a335a
cmp byte [edi], 0
jne 0x4a335a
cmp byte [esi + 0xc], 0x44
jne 0x4a335a
cmp byte [esi + 0xd], 0x53
jne 0x4a335a
cmp byte [esi + 0xe], 0x49
jne 0x4a335a
cmp byte [esi + 0xf], 0x47
je 0x4a339f
mov al, byte [esi + 0xc]
cmp al, 0x4f
jne 0x4a3373
cmp byte [esi + 0xd], 0x53
jne 0x4a3373
cmp byte [esi + 0xe], 0x2f
jne 0x4a3373
cmp byte [esi + 0xf], 0x32
je 0x4a339f
cmp al, 0x4c
jne 0x4a3389
cmp byte [esi + 0xd], 0x54
jne 0x4a3389
cmp byte [esi + 0xe], 0x53
jne 0x4a3389
cmp byte [esi + 0xf], 0x48
je 0x4a339f
cmp al, 0x42
jne 0x4a33ff
cmp byte [esi + 0xd], 0x41
jne 0x4a33ff
cmp byte [esi + 0xe], 0x53
jne 0x4a33ff
cmp byte [esi + 0xf], 0x45
jne 0x4a33ff
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push 0x63e8d0
push eax
mov dword [edx], 0x57
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push 0x63e8cc
push edx
mov dword [ecx], 0x109
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
pop ebp
pop edi
pop esi
ret
mov eax, dword [esp + 0x20]
mov dword [edi], 0
test eax, eax
je 0x4a33f1
mov dword [eax], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a33ff
mov dword [eax], 1
pop ebx
pop ebp
pop edi
pop esi
ret