Function at 0x493bf2
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x190
push ebx
push esi
lea eax, [ebp + 0x74]
push edi
push eax
mov dword [ebp + 0x50], ecx
call fcn.0043fe57
mov al, byte [ebp + 0x7c]
xor ebx, ebx
cmp al, 1
pop ecx
mov byte [ebp + 0x5f], al
jne 0x493c1c
mov byte [ebp + 0x5f], bl
lea ecx, [ebp + 0x14]
sete byte [ebp + 0x7c]
call fcn.0044658e
lea ecx, [ebp + 0x20]
call fcn.0044658e
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe57
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x493c44
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004494ac
add esp, 0xc
cmp byte [ebp + 0x7c], 0
je 0x493c64
mov eax, dword [ebp + 0x14]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x14]
push eax
call fcn.00402f5e
movsx eax, byte [ebp + 0x7c]
lea edi, [eax + eax]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x14]
add eax, edi
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
mov dword [ebp + 0xc], edi
je 0x493c99
mov esi, 0x80070057
jmp 0x493e22
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004494ff
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x493cc3
cmp si, 0x3b
jne 0x493cc7
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x5f], 0
mov byte [ebp + 0x4f], 0
jne 0x493e3e
push dword [ebp + 0x20]
push str.WINVER
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x493d03
push dword [ebp + 0x20]
push 0x4d2c90
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x493e3e
mov byte [ebp + 0x4f], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe57
mov eax, dword [ebp + 0x74]
xor esi, esi
xor edi, edi
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x38], ebx
jne 0x493d26
or dword [ebp + 0x38], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x493d4b
lea ecx, [eax + 2]
cmp word [ecx], bx
mov byte [ebp + 0x4f], 1
jne 0x493d46
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x4f], 0x2a
jmp 0x493d4b
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, bx
mov dword [ebp + 0x10], ecx
jne 0x493d62
cmp byte [ebp + 0x4f], 0
je 0x493de6
mov dword [ebp + 0x7c], ebx
cmp word [eax], 0x2a
je 0x493d71
cmp byte [ebp + 0x4f], 0x2a
jne 0x493dbe
mov eax, dword [ebp + 0x50]
cmp byte [eax + 0x92], 0
push 0x12
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
jne 0x493da5
test byte [eax + 9], 0xf
jne 0x493da5
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00459284
jmp 0x493db8
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00457f62
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 1
push ebx
push ebx
push dword [ebp + 0x38]
push eax
call fcn.00407df0
add esp, 0x14
lea ecx, [ebp + 0x7c]
mov esi, eax
mov edi, edx
call fcn.0043fe25
cmp byte [ebp + 0x4f], 0
jne 0x493de6
cmp word [ebp + 0x10], bx
jne 0x493e0b
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x1c], edi
call fcn.00442da6
cmp byte [ebp + 0x4f], 0
mov esi, eax
mov edi, edx
je 0x493e0b
movzx eax, word [ebp + 0x18]
shld edi, esi, 0x10
cdq
shl esi, 0x10
or esi, eax
or edi, edx
push str.0x_I64X
push dword [ebp + 0x34]
push edi
push esi
push dword [ebp + 0x50]
call fcn.00448bfa
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x20]
call fcn.0043fe25
lea ecx, [ebp + 0x14]
call fcn.0043fe25
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x20]
push 0x4d2c40
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x493e67
push dword [ebp + 0x34]
call fcn.0040a82a
push eax
push dword [ebp + 0x50]
call fcn.00448c7f
add esp, 0xc
jmp 0x493e20
cmp si, bx
je 0x493e76
cmp si, 0x2c
jne 0x493c8f
cmp byte [ebp + 0x5f], 0
je 0x493e86
cmp byte [ebp + 0x5f], 2
jne 0x494426
push dword [ebp + 0x14]
lea ecx, [ebp + 0x30]
call fcn.004505eb
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x30]
je 0x493e9f
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe57
push dword [ebp + 0x20]
push str.FVER
call fcn.004412b6
add esp, 0xc
test al, al
je 0x493fb9
lea ecx, [ebp + 0x60]
call fcn.0044658e
push dword [ebp + 0x74]
mov dword [ebp + 0x58], ebx
call fcn.004135f9
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x18], 1
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.004403c2
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x493f25
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ff
mov eax, dword [ebp + 0x64]
mov di, word [eax]
mov eax, dword [ebp + 0x7c]
add esp, 0x10
mov dword [ebp + 0x34], ebx
cmp word [eax], bx
je 0x493f44
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00493b7a
pop ecx
pop ecx
push dword [ebp + 0x18]
lea eax, [ebp + 0x34]
push eax
mov ax, di
neg ax
lea ecx, [ebp + 0x58]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00407df0
mov ecx, dword [ebp + 0x50]
add esp, 0x14
push dword [ebp + 0x60]
push esi
call fcn.00445c44
cmp di, bx
je 0x493f91
push dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x64]
call fcn.00445c44
mov esi, dword [ebp + 0x34]
lea ecx, [ebp + 0x64]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
call fcn.0043fe25
lea ecx, [ebp + 0x30]
call fcn.0043fe25
jmp 0x493e22
push dword [ebp + 0x20]
push str.FTIME
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x4941e4
push dword [ebp + 0x74]
call fcn.004135f9
pop ecx
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x34], eax
call fcn.0044658e
lea ecx, [ebp + 0x58]
call fcn.0044658e
lea ecx, [ebp + 0x54]
call fcn.0044658e
lea eax, [edi + esi]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x38], ebx
jmp 0x494098
push 6
lea eax, [ebp + 0x68]
push eax
push str._local
call fcn.004485c7
add esp, 0xc
test al, al
je 0x494031
cmp byte [ebp + 0x7c], 0
je 0x49402b
sub dword [ebp + 0x68], 2
mov eax, dword [ebp + 0x68]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x494095
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4d0f58
call fcn.004485c7
add esp, 0xc
test al, al
je 0x49404e
or byte [ebp + 0x7c], 4
jmp 0x494095
push 4
lea eax, [ebp + 0x68]
push eax
push str._ws1
call fcn.004485c7
add esp, 0xc
test al, al
je 0x49406b
or byte [ebp + 0x7c], 8
jmp 0x494095
push 5
lea eax, [ebp + 0x68]
push eax
push str._link
call fcn.004485c7
add esp, 0xc
test al, al
je 0x49408b
mov dword [ebp + 0x38], 1
jmp 0x494095
lea eax, [ebp + 0x68]
push eax
call fcn.00408f31
pop ecx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
je 0x494002
cmp byte [ebp + 0x7c], 0
je 0x4940ad
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4940de
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], si
jne 0x4940fb
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x38], ebx
lea esi, [ebp - 0xa4]
je 0x494143
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x34]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.00405c6d
cmp dword [ebp + 0x64], ebx
je 0x494136
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x50]
call fcn.00402d2b
jmp 0x494156
lea eax, [ebp - 0xa4]
push eax
push ebx
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x4941ab
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x50]
call fcn.0044a0f4
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0044a0f4
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x54]
push dword [ebp + 0x50]
call fcn.0044a0f4
add esp, 0x30
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
jmp 0x4943a8
mov ecx, dword [ebp + 0x50]
mov esi, 0x4c6a64
push esi
push dword [ebp + 0x60]
call fcn.00445c44
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x58]
call fcn.00445c44
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x54]
call fcn.00445c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp + 0x54]
jmp 0x493f97
push dword [ebp + 0x20]
push str.FATTR
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x49441e
push dword [ebp + 0x74]
call fcn.004135f9
cmp byte [ebp + 0x7c], 0
pop ecx
mov edi, eax
je 0x494211
mov word [esi], 0x26
lea ecx, [ebp + 0x44]
call fcn.0044658e
lea ecx, [ebp + 0x60]
call fcn.0044658e
lea ecx, [ebp + 0x58]
call fcn.0044658e
lea ecx, [ebp + 0x54]
call fcn.0044658e
lea ecx, [ebp + 0x64]
call fcn.0044658e
push 0x2c
mov dword [ebp + 0x68], esi
pop esi
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x494300
cmp byte [ebp + 0x7c], 0
je 0x494269
mov word [eax], 0x26
jmp 0x49426e
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x494300
cmp byte [ebp + 0x7c], 0
je 0x494294
mov word [eax], 0x26
jmp 0x494299
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x494300
cmp byte [ebp + 0x7c], 0
je 0x4942bf
mov word [eax], 0x26
jmp 0x4942c4
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x494300
cmp byte [ebp + 0x7c], 0
je 0x4942ea
mov word [eax], 0x26
jmp 0x4942ef
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004494ac
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4943ba
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x44]
mov esi, dword [ebp + 0x50]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.00448c7f
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x60]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.00448c7f
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x58]
and eax, edi
push eax
push esi
call fcn.00448c7f
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x54]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.00448c7f
push dword [ebp - 0x1c]
lea eax, [ebp - 0x80]
push str.0x_lX
push eax
mov word [ebp - 0x80], bx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x64]
mov ecx, esi
call fcn.00445c44
lea ecx, [ebp + 0x64]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
call fcn.0043fe25
lea ecx, [ebp + 0x30]
call fcn.0043fe25
jmp 0x493e20
mov edi, dword [ebp + 0x50]
mov esi, 0x4c6a64
push esi
push dword [ebp + 0x44]
mov ecx, edi
call fcn.00445c44
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.00445c44
push esi
push dword [ebp + 0x58]
mov ecx, edi
call fcn.00445c44
push esi
push dword [ebp + 0x54]
mov ecx, edi
call fcn.00445c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x64]
mov esi, eax
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
jmp 0x493fa7
lea ecx, [ebp + 0x30]
call fcn.0043fe25
cmp byte [ebp + 0x5f], 0
jne 0x493e20
push dword [ebp + 0x14]
lea ecx, [ebp + 0x44]
call fcn.004505eb
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe57
mov esi, dword [ebp + 0x20]
push esi
push str.DROPFILE
call fcn.004412b6
add esp, 0xc
test al, al
je 0x494536
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
call fcn.00453c1f
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.0044658e
lea ecx, [ebp + 0x58]
call fcn.0044658e
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x64], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x64]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x4944c7
cmp byte [ebp + 0x7c], 0
je 0x4944b0
mov word [eax], 0x26
jmp 0x4944b5
inc eax
inc eax
mov dword [ebp + 0x64], eax
push 0x2c
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.004494ac
add esp, 0xc
lea ecx, [ebp + 0x54]
call fcn.0044658e
lea ecx, [ebp + 0x24]
call fcn.0044658e
mov esi, dword [ebp + 0x58]
xor eax, eax
cmp word [esi], bx
je 0x4944e4
lea eax, [ebp + 0x24]
mov ecx, dword [ebp + 0x3c]
or ecx, dword [ebp + 0x40]
je 0x4944fc
push eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x3c]
call fcn.00404a34
add esp, 0xc
push dword [ebp + 0x54]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x60]
call fcn.00445c44
push dword [ebp + 0x24]
mov ecx, dword [ebp + 0x50]
push esi
call fcn.00445c44
lea ecx, [ebp + 0x24]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
jmp 0x494ba8
push esi
push str.FPOS
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x494748
push dword [ebp + 0x74]
call fcn.004135f9
mov dword [ebp + 0x54], eax
lea eax, [ebp + 0x54]
push eax
call fcn.0043fe57
push dword [ebp + 0x54]
call fcn.004111a0
add esp, 0xc
lea ecx, [ebp + 0x48]
call fcn.0044658e
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x54]
call fcn.00413993
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x48]
mov esi, dword [ebp + 0x44]
pop ecx
pop ecx
push 0x26
mov dword [ebp + 0x54], eax
pop edi
je 0x494596
mov word [esi], di
lea ecx, [ebp + 0x28]
call fcn.0044658e
lea ecx, [ebp + 0x68]
call fcn.0044658e
lea ecx, [ebp + 0x30]
call fcn.0044658e
lea ecx, [ebp + 0x60]
call fcn.0044658e
lea ecx, [ebp + 0x58]
call fcn.0044658e
lea ecx, [ebp + 0x64]
call fcn.0044658e
lea ecx, [ebp + 0x24]
call fcn.0044658e
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x4945fa
mov word [eax], di
jmp 0x4945ff
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x494625
mov word [eax], di
jmp 0x49462a
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x494650
mov word [eax], di
jmp 0x494655
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x494677
mov word [eax], di
jmp 0x49467c
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x49469e
mov word [eax], di
jmp 0x4946a3
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4946db
test bl, bl
je 0x4946c5
mov word [eax], di
jmp 0x4946ca
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004494ac
add esp, 0xc
push dword [ebp + 0x24]
push dword [ebp + 0x64]
push dword [ebp + 0x58]
push dword [ebp + 0x60]
push dword [ebp + 0x30]
push dword [ebp + 0x68]
push dword [ebp + 0x28]
push dword [ebp + 0x54]
push dword [ebp + 0x50]
call fcn.0043e88a
add esp, 0x24
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.0043fe25
lea ecx, [ebp + 0x64]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
call fcn.0043fe25
lea ecx, [ebp + 0x30]
call fcn.0043fe25
lea ecx, [ebp + 0x68]
call fcn.0043fe25
lea ecx, [ebp + 0x28]
call fcn.0043fe25
lea ecx, [ebp + 0x48]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
jmp 0x493faf
push esi
push 0x4d2bfc
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x49478b
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
call fcn.00453c1f
pop ecx
pop ecx
push dword [ebp + 0x44]
push dword [ebp + 0x18]
call fcn.00404ea4
pop ecx
push eax
push dword [ebp + 0x50]
call fcn.00448c7f
add esp, 0xc
jmp 0x494bad
push esi
push str.ISADMIN
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x4947a6
push dword [ebp + 0x44]
call fcn.004a147a
jmp 0x49477a
push esi
push str.fvar
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x494bb5
push 5
push esi
push 0x4d2be0
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x494bb5
push esi
push str.PWIN
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x494947
lea ecx, [ebp + 0x48]
call fcn.0044658e
lea ecx, [ebp + 0x54]
call fcn.0044658e
mov eax, dword [ebp + 0x44]
push ebx
mov dword [ebp + 0x38], eax
push 0x2c
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0043b04c
push 0x2c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.004494ac
add esp, 0x1c
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
call fcn.0047f1ca
test eax, eax
pop ecx
pop ecx
je 0x494847
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0047f1ca
test eax, eax
pop ecx
pop ecx
je 0x494860
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x3c], 3
mov dword [ebp + 0x40], ebx
call fcn.0047f1ca
pop ecx
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x64], eax
je 0x494911
cmp dword [ebp + 0x3c], 3
jne 0x4948aa
cmp dword [ebp + 0x40], 0
jne 0x4948aa
mov eax, dword [ebp + 0x54]
cmp word [eax], 0
je 0x494911
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x4948ca
push dword [ebp + 0x64]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4948d3
push 0xfffffffffffffff0
mov dword [ebp + 0x64], eax
push eax
call ebx
test eax, 0x40000000
jne 0x4948b7
cmp dword [ebp + 0x3c], 3
jne 0x4948df
cmp dword [ebp + 0x40], 0
je 0x494911
mov ebx, dword [ebp + 0x64]
and dword [ebp + 0x18], 0
and dword [ebp + 0x1c], 0
lea eax, [ebp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x3c]
sub edi, dword [ebp + 0x1c]
sub esi, dword [ebp + 0x18]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x494911
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x48]
push dword [ebp + 0x7c]
push dword [ebp + 0x50]
call fcn.004a8333
push dword [ebp + 0x54]
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call fcn.004a8333
add esp, 0x18
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x48]
call fcn.0043fe25
xor ebx, ebx
jmp 0x494bad
push esi
push str.PEBIT
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x494bad
mov eax, dword [ebp + 0x44]
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x38], eax
call fcn.0044658e
lea ecx, [ebp + 0x54]
call fcn.0044658e
push ebx
push 0x2c
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0043b04c
push 0x2c
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.004494ac
or dword [ebp + 0x3c], 0xffffffff
or dword [ebp + 0x40], 0xffffffff
push 0xd
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4c6a64
push eax
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x10], ebx
call fcn.0041a9b6
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], bx
je 0x494b50
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x4949ef
cmp cx, 0x2f
je 0x4949ef
push edx
call fcn.004b3b0b
test eax, eax
pop ecx
je 0x494a12
jmp 0x4949f2
mov word [eax], bx
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x64]
call fcn.004466b2
push str._version.dll
lea ecx, [ebp + 0x64]
call fcn.004465fa
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x74], eax
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x58], ebx
call fcn.00405c6d
cmp dword [ebp + 0x58], ebx
mov dword [ebp + 0x60], esi
je 0x494b48
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x7c], ebx
call fcn.004465ac
mov edi, dword [ebp + 0x34]
push esi
push ebx
push edi
call fcn.004b4520
add esp, 0xc
push ebx
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push dword [ebp + 0x58]
call esi
test eax, eax
je 0x494b40
cmp dword [ebp + 0x7c], 0x40
jb 0x494b40
cmp word [edi], 0x5a4d
jne 0x494b40
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x494aba
push ebx
push ebx
push eax
push dword [ebp + 0x58]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00441183
add esp, 0x10
push ebx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push dword [ebp + 0x58]
mov dword [ebp + 0x7c], ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x494b40
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x40], edi
jne 0x494b10
cmp edi, 0x8664
jne 0x494aef
mov dword [ebp + 0x60], 0x4d2bac
jmp 0x494b40
cmp ecx, eax
jne 0x494b10
cmp edi, 0x14c
je 0x494b39
cmp ecx, eax
jne 0x494b10
cmp edi, 0x200
jne 0x494b10
mov dword [ebp + 0x60], str.ia64
jmp 0x494b40
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x494b40
cmp edi, 0x137
je 0x494b39
cmp ecx, eax
jne 0x494b40
cmp edi, 0x1b0
je 0x494b39
cmp ecx, eax
jne 0x494b40
cmp edi, 0xe7
jne 0x494b40
mov dword [ebp + 0x60], 0x4d2b98
lea ecx, [ebp + 0x34]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.00402d2b
push dword [ebp + 0x60]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x48]
call fcn.00445c44
cmp dword [ebp + 0x40], ebx
jg 0x494b7c
jl 0x494b6a
cmp dword [ebp + 0x3c], ebx
ja 0x494b7c
mov ecx, dword [ebp + 0x50]
push str._0x000000000001
push dword [ebp + 0x54]
call fcn.00445c44
jmp 0x494b95
push str.0x_012I64X
push dword [ebp + 0x54]
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
push dword [ebp + 0x50]
call fcn.00448bfa
add esp, 0x14
lea ecx, [ebp + 0x64]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x48]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
jmp 0x4943b0
mov eax, dword [ebp + 0x20]
cmp word [eax + 8], 0x2b
lea ecx, [ebp + 0x24]
setne bl
dec bl
and ebx, 0x2b
call fcn.0044658e
lea ecx, [ebp + 0x58]
call fcn.0044658e
mov eax, dword [ebp + 0x44]
xor esi, esi
test bl, bl
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x28], 0x4c6a64
mov dword [ebp + 0x64], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x5f], 0
je 0x494c11
push 2
lea eax, [ebp + 0x54]
push eax
push 0x4d1d7c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x494c11
mov byte [ebp + 0x5f], 1
mov eax, dword [ebp + 0x54]
push 0x3b
mov dword [ebp + 0x34], eax
push 0x2c
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x1c], esi
call fcn.004494ff
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, si
je 0x494c64
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x494c64
push esi
push 0x2c
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043b04c
mov eax, dword [ebp + 0x24]
add esp, 0x10
cmp word [eax], si
je 0x494c64
mov dword [ebp + 0x64], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.004139d3
or dword [ebp + 0x30], 0xffffffff
or edi, 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x68], esi
je 0x494e24
lea ecx, [ebp + 0x60]
call fcn.0044658e
mov eax, dword [ebp + 0x54]
cmp word [eax], si
mov dword [ebp + 0x28], esi
je 0x494cb2
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.00449a42
pop ecx
pop ecx
mov al, byte [ebp + 0x5f]
neg al
lea ecx, [ebp + 0x7c]
sbb eax, eax
and eax, 0x4e3d84
push eax
call fcn.0043a64e
cmp byte [ebp + 0x5f], 0
je 0x494cfa
mov ecx, dword [ebp + 0x50]
push esi
push 0xffffffffffffffff
push esi
push dword [ebp + 0x74]
call fcn.00411019
cmp eax, esi
mov dword [ebp + 0x74], esi
je 0x494cf1
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov edi, dword [eax + 0x10]
mov dword [ebp + 0x30], esi
jmp 0x494d18
mov dword [ebp + 0x68], 1
jmp 0x494d18
lea eax, [ebp + 0x2c]
push eax
mov eax, dword [ebp + 0x20]
add eax, 0xa
push eax
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0045ef51
mov edi, dword [ebp + 0x2c]
add esp, 0x10
cmp dword [ebp + 0x30], esi
jl 0x494dcb
jg 0x494d2b
cmp edi, esi
jb 0x494dcb
mov eax, dword [ebp + 0x34]
cmp word [eax], si
je 0x494d85
mov eax, dword [0x4e3224]
cmp eax, esi
mov dword [ebp + 0x68], 0x7f
jne 0x494d6c
push esi
push 0x4e3224
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0044131f
mov eax, dword [0x4e3224]
add esp, 0x10
cmp eax, esi
jne 0x494d6c
or eax, 0xffffffff
mov dword [0x4e3224], eax
cmp eax, 0xffffffff
je 0x494dcb
push dword [ebp + 0x18]
mov dword [ebp + 0x68], esi
push edi
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x58]
call eax
jmp 0x494dc8
mov eax, dword [0x4e3230]
cmp eax, esi
jne 0x494db7
push esi
push 0x4e3230
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableW
call fcn.0044131f
mov eax, dword [0x4e3230]
add esp, 0x10
cmp eax, esi
jne 0x494db7
or eax, 0xffffffff
mov dword [0x4e3230], eax
cmp eax, 0xffffffff
je 0x494dcb
push edi
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x58]
call eax
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x7c], esi
je 0x494dd9
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x48], esi
jne 0x494dec
cmp dword [ebp + 0x68], esi
jg 0x494dec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x28]
call fcn.0043fe25
lea ecx, [ebp + 0x60]
call fcn.0043fe25
lea ecx, [ebp + 0x10]
call fcn.0043fe25
lea ecx, [ebp + 0x58]
call fcn.0043fe25
lea ecx, [ebp + 0x24]
call fcn.0043fe25
lea ecx, [ebp + 0x44]
call fcn.0043fe25
mov esi, dword [ebp + 0x68]
jmp 0x493e22
push 0x1000
lea ecx, [ebp + 0x30]
call fcn.004465ac
lea ecx, [ebp + 0x38]
call fcn.0044658e
push esi
push 0x2c
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.0043b04c
mov eax, dword [ebp + 0x54]
add esp, 0x10
cmp word [eax], si
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x48], 0x4d06a8
mov ebx, 0x2000
mov edi, str.Kernel32.DLL
je 0x494edf
mov eax, dword [0x4e3228]
cmp eax, esi
mov dword [ebp + 0x68], 0x7f
jne 0x494e9d
push esi
push 0x4e3228
push edi
push str.GetFirmwareEnvironmentVariableExW
call fcn.0044131f
mov eax, dword [0x4e3228]
add esp, 0x10
cmp eax, esi
jne 0x494e9d
or eax, 0xffffffff
mov dword [0x4e3228], eax
cmp eax, 0xffffffff
je 0x494edf
lea ecx, [ebp + 0x18]
push ecx
push ebx
push dword [ebp + 0x30]
push dword [ebp + 0x64]
push dword [ebp + 0x58]
call eax
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x494ed6
push dword [ebp + 0x18]
lea eax, [ebp - 0x124]
push 0x4c6b48
push eax
mov dword [ebp + 0x48], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x494f1d
mov dword [ebp + 0x48], str.FAIL
jmp 0x494f1d
push esi
push 0x4e322c
push edi
push str.GetFirmwareEnvironmentVariableW
mov dword [ebp + 0x68], 0x78
call fcn.0044131f
mov eax, dword [0x4e322c]
add esp, 0x10
cmp eax, esi
mov dword [ebp + 0x60], esi
je 0x494f1d
cmp eax, 0xffffffff
je 0x494f1d
push ebx
push dword [ebp + 0x30]
mov dword [ebp + 0x68], esi
push dword [ebp + 0x64]
push dword [ebp + 0x58]
call eax
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0xc]
lea edi, [ecx + eax]
mov eax, dword [ebp + 0x50]
movsx ebx, byte [eax + 9]
mov ax, word [edi]
or ebx, dword [ebp + 0x40]
cmp ax, 0x26
jne 0x494f3e
or ebx, 2
jmp 0x494f59
cmp ax, 0x24
je 0x494f55
cmp ax, 0x5e
je 0x494f55
cmp ax, 0x2e
jne 0x494f59
or ebx, 4
jmp 0x494f57
xor ebx, ebx
inc edi
inc edi
cmp byte [ebp + 0x7c], 0
je 0x494f66
dec edi
dec edi
mov word [edi], 0x26
cmp dword [ebp + 0x60], 0
je 0x494fe7
mov eax, 0x2000
cmp dword [ebp + 0x60], eax
jbe 0x494f79
mov dword [ebp + 0x60], eax
test ebx, ebx
jne 0x494fdf
mov eax, dword [ebp + 0x30]
mov esi, dword [ebp + 0x60]
and dword [ebp + 0x30], ebx
inc esi
mov dword [ebp + 0x64], eax
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x30]
call fcn.004465d3
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x30]
add eax, 0xfffffff6
dec esi
test esi, esi
mov dword [ebp + 0x7c], eax
jle 0x494fcf
mov dword [ebp + 0x28], esi
mov esi, dword [ebp + 0x40]
movzx eax, byte [esi]
add dword [ebp + 0x7c], 0xa
push eax
push 0x4cc240
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x28]
jne 0x494fb0
mov eax, dword [ebp + 0x7c]
and word [eax - 2], 0
lea ecx, [ebp + 0x64]
call fcn.0043fe25
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x28], eax
jmp 0x494ff6
cmp dword [ebp + 0x68], 0
jg 0x494ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
test bl, 3
je 0x495015
push 0
lea eax, [ebp + 0x30]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x28]
push edi
push dword [ebp + 0x50]
call fcn.004542d6
add esp, 0x18
jmp 0x495021
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x50]
push edi
call fcn.00445c44
mov eax, dword [ebp + 0x34]
cmp word [eax], 0
je 0x495036
push dword [ebp + 0x48]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.00445c44
lea ecx, [ebp + 0x38]
call fcn.0043fe25
lea ecx, [ebp + 0x30]
jmp 0x494df7