Function at 0x455ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x1c], eax
push edi
test eax, eax
jle 0x4577d5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x455ae0
push dword [ecx + esi*4]
lea ebx, [ecx + esi*4]
push str._nop
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x455af9
call fcn.00455940
push dword [ebx]
push str._persist
call edi
push dword [ebx]
neg eax
push str.persist
sbb al, al
and byte [0x53eb69], al
call edi
movzx ecx, byte [0x53eb69]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._remove
mov byte [0x53eb69], cl
call edi
test eax, eax
jne 0x455b3e
call fcn.00461040
push dword [ebx]
push str.update
call edi
test eax, eax
je 0x455b58
push dword [ebx]
push str._update
call edi
test eax, eax
jne 0x455b5d
call fcn.004613e0
push dword [ebx]
push str._jobid
call edi
mov ebx, dword [ebp - 0x1c]
test eax, eax
jne 0x455bee
lea eax, [esi + 1]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jge 0x455bee
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 4]
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x455b86
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455ba0
sub ecx, dword [ebp - 0x18]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4a0
push eax
lea eax, [ecx + 1]
push eax
push 0x560d70
call fcn.004bb4ef
add esp, 0x14
push 0x560d70
push str.Received_new_job__jobid_:__S_n
call fcn.004bc829
add esp, 8
cmp byte [0x53eb69], 0
je 0x455beb
call fcn.00460e40
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
push dword [ecx + esi*4]
lea eax, [ecx + esi*4]
push str._remote
mov dword [ebp - 0x24], eax
call edi
test eax, eax
jne 0x45603f
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x45603f
cmp byte [0x53eb75], 0
je 0x45778b
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455c34
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec4c], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x455c56
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455c70
sub ecx, dword [ebp - 0x24]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec4c]
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x455ca2
lea eax, [ebp - 0x2c]
sub edx, ecx
mov ecx, dword [0x53ec4c]
push eax
sar edx, 1
push 0
call fcn.00453900
mov ecx, dword [ebp - 0x2c]
add esp, 8
test ecx, ecx
jg 0x455cd4
mov esi, dword [ebp - 0x18]
jmp 0x457751
call fcn.00455630
mov edx, dword [ebx + 4]
mov esi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x455ce1
lea eax, [ebp - 0x2c]
sub edx, ecx
mov ecx, dword [0x53ec4c]
push eax
sar edx, 1
push esi
call fcn.00453900
push dword [0x53ebf0]
mov dword [ebp - 0x10], 0
mov byte [ebp - 5], 1
call dword [sym.imp.PGPsdk.dll_PGPOLastOption]
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x10]
push eax
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPOAllocatedOutputBuffer]
add esp, 0x10
push eax
push 1
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPOInputFormat]
add esp, 8
push eax
push dword [ebp - 0x2c]
push esi
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPOInputBuffer]
add esp, 0xc
push eax
lea eax, [ebp - 5]
push eax
push 0x45db40
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPOEventHandler]
add esp, 0xc
push eax
push dword [0x53eba4]
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPOKeyDBRef]
add esp, 8
push eax
push dword [0x53ebf0]
call dword [sym.imp.PGPsdk.dll_PGPDecode]
mov eax, dword [0x53ec4c]
add esp, 0x1c
test eax, eax
je 0x455db6
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x455dce
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x455dd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebx + 4]
push 0x51f4a0
push 0x1000
push 0x1000
push 0x54cd60
call fcn.004bb4ef
add esp, 0x14
cmp byte [ebp - 5], 0
jne 0x457763
cmp byte [0x53eb69], 0
je 0x455e0b
call fcn.00460e40
mov eax, dword [0x560df8]
test eax, eax
je 0x455e2a
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x560df8], 0
mov eax, dword [0x560df0]
test eax, eax
je 0x455e49
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x560df0], 0
mov esi, dword [ebp - 0xc]
add esi, 0xfffffffe
mov dword [ebp - 0x24], esi
lea ecx, [esi*2 + 2]
call fcn.00455630
push dword [ebp - 0x10]
lea ecx, [esi + 1]
mov ebx, eax
push 0x51f514
push 0xffffffffffffffff
push ecx
push ebx
call fcn.004bb4ef
add esp, 0x14
push dword [ebp - 0x10]
call dword [sym.imp.PGPsdk.dll_PGPFreeData]
mov eax, 0x50
mov byte [0x560d6c], 0
mov word [0x560df4], ax
add esp, 4
mov eax, dword [ebp - 0x24]
xor esi, esi
mov dword [0x560df8], ebx
cmp eax, 7
jbe 0x455ed4
push 7
push str.http:__
push ebx
call fcn.004bcca1
add esp, 0xc
test eax, eax
jne 0x455ed1
mov eax, 0x50
mov esi, 7
mov word [0x560df4], ax
lea eax, [ebx + 0xe]
mov dword [0x560df8], eax
mov eax, dword [ebp - 0x24]
cmp eax, 8
jbe 0x455f0d
push 8
push str.https:__
push ebx
call fcn.004bcca1
add esp, 0xc
test eax, eax
jne 0x455f0a
mov eax, 0x1bb
mov byte [0x560d6c], 1
mov word [0x560df4], ax
add esi, 8
lea eax, [ebx + 0x10]
mov dword [0x560df8], eax
mov eax, dword [ebp - 0x24]
cmp esi, eax
jae 0x455f65
movzx ecx, word [ebx + esi*2]
cmp ecx, 0x2f
je 0x455f5e
cmp ecx, 0x3a
je 0x455f26
inc esi
cmp esi, eax
jb 0x455f11
jmp 0x455f65
xor ecx, ecx
mov word [ebx + esi*2], cx
inc esi
lea ecx, [ebx + esi*2]
test ecx, ecx
je 0x455f65
cmp esi, eax
jae 0x455f65
cmp word [ebx + esi*2], 0x2f
je 0x455f46
inc esi
cmp esi, eax
jb 0x455f38
jmp 0x455f65
xor eax, eax
mov word [ebx + esi*2], ax
inc esi
push ecx
call fcn.004bce50
add esp, 4
mov word [0x560df4], ax
jmp 0x455f65
xor eax, eax
mov word [ebx + esi*2], ax
inc esi
push dword [0x560df8]
lea eax, [ebx + esi*2]
mov dword [0x560df0], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov dword [ebp - 0x24], eax
lea esi, [eax + eax]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x14], edx
test edx, edx
je 0x457852
mov ecx, edx
test esi, esi
je 0x455faf
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec esi
jne 0x455fa6
mov eax, dword [ebp - 0x24]
push eax
push dword [0x560df8]
push eax
push edx
call fcn.004bb667
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov dword [0x560df8], eax
push dword [0x560df0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov dword [ebp - 0x14], eax
lea esi, [eax + eax]
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x24], edx
test edx, edx
je 0x457852
mov ecx, edx
test esi, esi
je 0x45600c
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec esi
jne 0x456003
mov eax, dword [ebp - 0x14]
push eax
push dword [0x560df0]
push eax
push edx
call fcn.004bb667
mov eax, dword [ebp - 0x24]
add esp, 0x10
mov dword [0x560df0], eax
test ebx, ebx
je 0x45603c
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ebx, [eax + esi*4]
push str._out
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
je 0x456063
push dword [ebx]
push str.out
call edi
test eax, eax
jne 0x456094
mov ebx, dword [ebp - 0x1c]
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x456097
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
push 0x1000
push 0x55ed60
call fcn.004bb73b
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov byte [0x53eb77], 1
jmp 0x456097
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea eax, [eax + esi*4]
push 0x51f558
mov dword [ebp - 0x14], eax
call edi
test eax, eax
je 0x4560bf
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
push str._poll
call edi
test eax, eax
jne 0x4560df
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x4560df
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call fcn.004bce50
mov esi, dword [ebp - 0x18]
add esp, 4
mov dword [0x53eb60], eax
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea eax, [eax + esi*4]
push 0x51f570
mov dword [ebp - 0x14], eax
call edi
test eax, eax
je 0x456107
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
push str._netpoll
call edi
test eax, eax
jne 0x456127
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x456127
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call fcn.004bce50
mov esi, dword [ebp - 0x18]
add esp, 4
mov dword [0x53eb5c], eax
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea eax, [eax + esi*4]
push str._zlib
mov dword [ebp - 0x14], eax
call edi
test eax, eax
jne 0x456179
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x456179
mov esi, dword [ebp - 0x14]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jge 0x4577e8
push dword [esi + 4]
call fcn.004bce50
add esp, 4
mov dword [0x53ebf4], eax
cmp eax, 9
ja 0x4577e8
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea eax, [eax + esi*4]
push str._split
mov dword [ebp - 0x14], eax
call edi
test eax, eax
jne 0x4561e7
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x4561e7
mov esi, dword [ebp - 0x14]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 7
jl 0x457809
push dword [esi + 4]
call fcn.004bce50
add esp, 4
mov dword [0x53ed5c], eax
cmp eax, 0xfffff
jb 0x4561cd
cmp eax, 0xf900000
jbe 0x4561e4
push str.split_size_invalid__using_default_261095424_n
call fcn.004bc829
add esp, 4
mov dword [0x53ed5c], 0xf900000
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ebx, [eax + esi*4]
push str._dns
call edi
push dword [ebx]
neg eax
push str.dns
sbb al, al
and byte [0x53eb6e], al
call edi
movzx ecx, byte [0x53eb6e]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._netserv
mov byte [0x53eb6e], cl
call edi
push dword [ebx]
neg eax
push str.netserv
sbb al, al
and byte [0x53eb70], al
call edi
movzx ecx, byte [0x53eb70]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._arp
mov byte [0x53eb70], cl
call edi
push dword [ebx]
neg eax
push str.arp
sbb al, al
and byte [0x53eb72], al
call edi
movzx ecx, byte [0x53eb72]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._netstat
mov byte [0x53eb72], cl
call edi
push dword [ebx]
neg eax
push str.netstat
sbb al, al
and byte [0x53eb71], al
call edi
movzx ecx, byte [0x53eb71]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._chrmprf
mov byte [0x53eb71], cl
call edi
push dword [ebx]
neg eax
push str.chrmprf
sbb al, al
and byte [0x53eb6b], al
call edi
movzx ecx, byte [0x53eb6b]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._actcache
mov byte [0x53eb6b], cl
call edi
push dword [ebx]
neg eax
push str.actcache
sbb al, al
and byte [0x53eb6a], al
call edi
movzx ecx, byte [0x53eb6a]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._name
mov byte [0x53eb6a], cl
call edi
push dword [ebx]
neg eax
push 0x51f71c
sbb al, al
and byte [0x53eb74], al
call edi
movzx ecx, byte [0x53eb74]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._proc
mov byte [0x53eb74], cl
call edi
push dword [ebx]
neg eax
push str.proc
sbb al, al
and byte [0x53eb73], al
call edi
movzx ecx, byte [0x53eb73]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._shr
mov byte [0x53eb73], cl
call edi
movzx ecx, byte [0x53eb6c]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str.shr
mov byte [0x53eb6c], cl
call edi
movzx ecx, byte [0x53eb6c]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._login
mov byte [0x53eb6c], cl
call edi
push dword [ebx]
neg eax
push str.login
sbb al, al
and byte [0x53eb6d], al
call edi
movzx ecx, byte [0x53eb6d]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._wmi
mov byte [0x53eb6d], cl
call edi
push dword [ebx]
neg eax
push str.wmi
sbb al, al
and byte [0x53eb6f], al
call edi
movzx ecx, byte [0x53eb6f]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._mem
mov byte [0x53eb6f], cl
call edi
neg eax
push dword [ebx]
sbb al, al
and byte [0x53eb9c], al
push str.mem
call edi
movzx ecx, byte [0x53eb9c]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._vsc
mov byte [0x53eb9c], cl
call edi
push dword [ebx]
neg eax
push str.vsc
sbb al, al
and byte [0x53eb79], al
call edi
movzx ecx, byte [0x53eb79]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push 0x51f7c0
mov byte [0x53eb79], cl
call edi
movzx ecx, byte [0x53eb9b]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._osquery
mov byte [0x53eb9b], cl
call edi
push dword [ebx]
neg eax
push str._osquerycmd
sbb al, al
and byte [0x53eb9b], al
call edi
test eax, eax
je 0x4564e3
push dword [ebx]
push str.osquerycmd
call edi
test eax, eax
jne 0x456601
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456601
mov esi, dword [ebx + 4]
mov ecx, esi
mov byte [0x53eb9b], 1
mov dword [ebp - 0x38], 0
lea edx, [ecx + 2]
jmp 0x456510
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456510
sub ecx, edx
mov edx, esi
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp - 0x14], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456527
sub edx, dword [ebp - 0x14]
lea eax, [ecx + 1]
push esi
sar edx, 1
push 0x51f4d8
push eax
lea eax, [edx + 1]
push eax
push 0x53fd60
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
jmp 0x456560
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456560
lea eax, [ebp - 0x38]
sub edx, ecx
push eax
sar edx, 1
mov ecx, 0x53fd60
push 0
call fcn.00453900
mov esi, dword [ebp - 0x38]
add esp, 8
test esi, esi
jg 0x456591
mov esi, dword [ebp - 0x18]
jmp 0x457751
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x457852
mov ecx, eax
test esi, esi
je 0x4565bb
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec esi
jne 0x4565b2
mov edx, dword [ebx + 4]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4565c1
lea eax, [ebp - 0x38]
sub edx, ecx
push eax
push dword [ebp - 0x14]
sar edx, 1
mov ecx, 0x53fd60
call fcn.00453900
mov eax, dword [ebp - 0x38]
add esp, 8
cmp eax, 0x6000
jae 0x457866
mov esi, dword [ebp - 0x18]
mov byte [eax + 0x53fd60], 0
jmp 0x457751
push dword [ebx]
push 0x51f818
call edi
movzx ecx, byte [0x53eb9a]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._needle
mov byte [0x53eb9a], cl
call edi
push dword [ebx]
neg eax
push str._needlecmd
sbb al, al
and byte [0x53eb9a], al
call edi
test eax, eax
je 0x456652
push dword [ebx]
push str.needlecmd
call edi
test eax, eax
jne 0x456762
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456762
mov esi, dword [ebx + 4]
mov ecx, esi
mov byte [0x53eb9a], 1
mov dword [ebp - 0x28], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456677
sub ecx, edx
mov edx, esi
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp - 0x14], eax
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456690
sub edx, dword [ebp - 0x14]
lea eax, [ecx + 1]
push esi
sar edx, 1
push 0x51f4d8
push eax
lea eax, [edx + 1]
push eax
push 0x53ed60
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4566c1
lea eax, [ebp - 0x28]
sub edx, ecx
push eax
sar edx, 1
mov ecx, 0x53ed60
push 0
call fcn.00453900
mov esi, dword [ebp - 0x28]
add esp, 8
test esi, esi
jg 0x4566f2
mov esi, dword [ebp - 0x18]
jmp 0x457751
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x457852
mov ecx, eax
test esi, esi
je 0x45671c
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec esi
jne 0x456713
mov edx, dword [ebx + 4]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456722
lea eax, [ebp - 0x28]
sub edx, ecx
push eax
push dword [ebp - 0x14]
sar edx, 1
mov ecx, 0x53ed60
call fcn.00453900
mov eax, dword [ebp - 0x28]
add esp, 8
cmp eax, 0x1000
jae 0x457866
mov esi, dword [ebp - 0x18]
mov byte [eax + 0x53ed60], 0
jmp 0x457751
push dword [ebx]
push str.recurse
call edi
movzx ecx, byte [0x53eb7a]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._ext
mov byte [0x53eb7a], cl
call edi
test eax, eax
je 0x4567a0
push dword [ebx]
push str.ext
call edi
test eax, eax
jne 0x456844
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456844
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4567b5
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x457852
mov ecx, eax
test esi, esi
je 0x4567f1
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec esi
jne 0x4567e8
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x560dfc], eax
lea ecx, [edx + 2]
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456800
sub edx, ecx
mov ecx, esi
sar edx, 1
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456814
sub ecx, ebx
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4a0
push eax
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x14]
call fcn.004bb4ef
mov esi, dword [ebp - 0x18]
add esp, 0x14
jmp 0x457751
push dword [ebx]
push str._tar
call edi
test eax, eax
je 0x456862
push dword [ebx]
push str.tar
call edi
test eax, eax
jne 0x456912
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456912
mov ecx, dword [ebx + 4]
mov byte [0x53eb7e], 1
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456880
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec4c], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4568a2
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4568c0
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec4c]
call fcn.004bb430
mov ecx, dword [ebx + 4]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4568f2
mov eax, dword [0x53ec4c]
sub ecx, edx
mov esi, dword [ebp - 0x18]
sar ecx, 1
mov byte [ecx + eax], 0
jmp 0x457751
push dword [ebx]
push str._files
call edi
test eax, eax
je 0x456930
push dword [ebx]
push str.files
call edi
test eax, eax
jne 0x456a38
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456a38
mov ecx, dword [ebx + 4]
mov byte [0x53eb7d], 1
mov dword [ebp - 0x34], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456953
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec48], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456975
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456990
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec48]
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4569c2
lea eax, [ebp - 0x34]
sub edx, ecx
mov ecx, dword [0x53ec48]
push eax
sar edx, 1
push 0
call fcn.00453900
mov ecx, dword [ebp - 0x34]
add esp, 8
test ecx, ecx
jg 0x4569f4
mov esi, dword [ebp - 0x18]
jmp 0x457751
call fcn.00455630
mov edx, dword [ebx + 4]
mov esi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456a01
lea eax, [ebp - 0x34]
sub edx, ecx
mov ecx, dword [0x53ec48]
push eax
sar edx, 1
push esi
call fcn.00453900
mov eax, dword [ebp - 0x34]
add esp, 8
mov dword [0x53ec48], esi
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x18]
jmp 0x457751
push dword [ebx]
push str._dir
call edi
test eax, eax
je 0x456a56
push dword [ebx]
push str.dir
call edi
test eax, eax
jne 0x456b68
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456b68
mov ecx, dword [ebx + 4]
mov byte [0x53eb7b], 1
mov dword [ebp - 0x3c], 0
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456a80
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec44], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456aa2
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456ac0
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec44]
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456af2
lea eax, [ebp - 0x3c]
sub edx, ecx
mov ecx, dword [0x53ec44]
push eax
sar edx, 1
push 0
call fcn.00453900
mov ecx, dword [ebp - 0x3c]
add esp, 8
test ecx, ecx
jg 0x456b24
mov esi, dword [ebp - 0x18]
jmp 0x457751
call fcn.00455630
mov edx, dword [ebx + 4]
mov esi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456b31
lea eax, [ebp - 0x3c]
sub edx, ecx
mov ecx, dword [0x53ec44]
push eax
sar edx, 1
push esi
call fcn.00453900
mov eax, dword [ebp - 0x3c]
add esp, 8
mov dword [0x53ec44], esi
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x18]
jmp 0x457751
push dword [ebx]
push str._File_
call edi
test eax, eax
je 0x456b86
push dword [ebx]
push str.dirext
call edi
test eax, eax
jne 0x456c32
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456c32
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
jmp 0x456ba0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456ba0
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec40], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456bc2
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456be0
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec40]
call fcn.004bb430
mov ecx, dword [ebx + 4]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456c12
mov eax, dword [0x53ec40]
sub ecx, edx
mov esi, dword [ebp - 0x18]
sar ecx, 1
mov byte [eax + ecx], 0
jmp 0x457751
push dword [ebx]
push str._reg
call edi
test eax, eax
je 0x456c50
push dword [ebx]
push str.reg
call edi
test eax, eax
jne 0x456d02
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x456d02
mov ecx, dword [ebx + 4]
mov byte [0x53eb7c], 1
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456c70
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov esi, dword [ebx + 4]
mov edx, esi
mov dword [0x53ec3c], eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456c92
sub edx, ecx
mov ecx, esi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456cb0
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec3c]
call fcn.004bb430
mov ecx, dword [ebx + 4]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456ce2
mov eax, dword [0x53ec3c]
sub ecx, edx
mov esi, dword [ebp - 0x18]
sar ecx, 1
mov byte [eax + ecx], 0
jmp 0x457751
push dword [ebx]
push str.disk
call edi
test eax, eax
jne 0x456dce
mov byte [0x53eb9e], al
lea eax, [esi + 2]
mov byte [0x53eb76], 1
cmp dword [ebp - 0x1c], eax
jl 0x456dba
mov ecx, dword [ebx + 4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x456dba
cmp eax, 0x2b
je 0x456dba
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456d46
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov ecx, dword [ebx + 4]
mov edx, eax
mov dword [0x53ec50], edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456d70
push dword [ebx + 4]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push 0x51f4d8
push 0xffffffffffffffff
lea eax, [ecx + 1]
push eax
push edx
call fcn.004bb430
mov ecx, dword [ebx + 4]
add esp, 0x14
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456da0
mov eax, dword [0x53ec50]
sub ecx, edx
sar ecx, 1
mov byte [eax + ecx], 0
jmp 0x456dce
mov ecx, 2
call fcn.00455630
mov dword [0x53ec50], eax
mov word [eax], 0x63
push dword [ebx]
push str._mount
call edi
test eax, eax
jne 0x456ef1
cmp byte [0x53eb76], al
jne 0x456ef1
add esi, 2
mov byte [0x53eb9e], 1
mov byte [0x53eb9c], al
cmp dword [ebp - 0x1c], esi
jle 0x45786b
push str._MOUNT_MODE__n
call fcn.004bc829
mov eax, dword [ebp - 0x20]
add esp, 4
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456e20
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov edx, eax
mov eax, dword [ebp - 0x20]
mov dword [0x53ec50], edx
mov ecx, dword [eax + esi*4]
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456e50
mov eax, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push dword [eax + esi*4]
push 0x51f4d8
push 0xffffffffffffffff
lea eax, [ecx + 1]
push eax
push edx
call fcn.004bb430
mov eax, dword [ebp - 0x20]
add esp, 0x14
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456e83
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
push dword [0x53ec50]
call fcn.004bbb14
mov eax, dword [ebp - 0x20]
add esp, 8
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456eb0
mov eax, dword [0x53ec50]
sub ecx, edx
sar ecx, 1
mov byte [eax + ecx], 0
push dword [ebx + 4]
push 0x100
push 0x561418
call fcn.004bb73b
add esp, 0xc
push str.127.0.0.1
push 0x10
push 0x561208
call fcn.004bb6e6
add esp, 0xc
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ebx, [eax + esi*4]
push str.page
call edi
movzx ecx, byte [0x53eb99]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._page
mov byte [0x53eb99], cl
call edi
push dword [ebx]
neg eax
push str.hiberfil
sbb al, al
and byte [0x53eb99], al
call edi
movzx ecx, byte [0x53eb86]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._hiberfil
mov byte [0x53eb86], cl
call edi
push dword [ebx]
neg eax
push str._mft
sbb al, al
and byte [0x53eb86], al
call edi
push dword [ebx]
neg eax
push str.mft
sbb al, al
and byte [0x53eb98], al
call edi
movzx ecx, byte [0x53eb98]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._usn
mov byte [0x53eb98], cl
call edi
push dword [ebx]
neg eax
push str.usn
sbb al, al
and byte [0x53eb97], al
call edi
movzx ecx, byte [0x53eb97]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._mbr
mov byte [0x53eb97], cl
call edi
push dword [ebx]
neg eax
push str.mbr
sbb al, al
and byte [0x53eb96], al
call edi
movzx ecx, byte [0x53eb96]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._soft
mov byte [0x53eb96], cl
call edi
push dword [ebx]
neg eax
push str.soft
sbb al, al
and byte [0x53eb95], al
call edi
movzx ecx, byte [0x53eb95]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._sec
mov byte [0x53eb95], cl
call edi
push dword [ebx]
neg eax
push str.sec
sbb al, al
and byte [0x53eb93], al
call edi
movzx ecx, byte [0x53eb93]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._sys
mov byte [0x53eb93], cl
call edi
push dword [ebx]
neg eax
push str.sys
sbb al, al
and byte [0x53eb94], al
call edi
movzx ecx, byte [0x53eb94]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._sam
mov byte [0x53eb94], cl
call edi
push dword [ebx]
neg eax
push str.sam
sbb al, al
and byte [0x53eb92], al
call edi
movzx ecx, byte [0x53eb92]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._def
mov byte [0x53eb92], cl
call edi
push dword [ebx]
neg eax
push str.def
sbb al, al
and byte [0x53eb91], al
call edi
movzx ecx, byte [0x53eb91]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._ntds
mov byte [0x53eb91], cl
call edi
push dword [ebx]
neg eax
push str.ntds
sbb al, al
and byte [0x53eb90], al
call edi
movzx ecx, byte [0x53eb90]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._wins
mov byte [0x53eb90], cl
call edi
neg eax
sbb al, al
and byte [0x53eb8f], al
push dword [ebx]
push str.wins
call edi
movzx ecx, byte [0x53eb8f]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._sru
mov byte [0x53eb8f], cl
call edi
push dword [ebx]
neg eax
push str.sru
sbb al, al
and byte [0x53eb78], al
call edi
movzx ecx, byte [0x53eb78]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._lnk
mov byte [0x53eb78], cl
call edi
push dword [ebx]
neg eax
push str.lnk
sbb al, al
and byte [0x53eb8e], al
call edi
movzx ecx, byte [0x53eb8e]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._jmp
mov byte [0x53eb8e], cl
call edi
push dword [ebx]
neg eax
push str.jmp
sbb al, al
and byte [0x53eb8d], al
call edi
movzx ecx, byte [0x53eb8d]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._users
mov byte [0x53eb8d], cl
call edi
push dword [ebx]
neg eax
push str.users
sbb al, al
and byte [0x53eb8c], al
call edi
movzx ecx, byte [0x53eb8c]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._hist
mov byte [0x53eb8c], cl
call edi
push dword [ebx]
neg eax
push str.hist
sbb al, al
and byte [0x53eb7f], al
call edi
movzx ecx, byte [0x53eb7f]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._pref
mov byte [0x53eb7f], cl
call edi
push dword [ebx]
neg eax
push str.pref
sbb al, al
and byte [0x53eb8b], al
call edi
movzx ecx, byte [0x53eb8b]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._evt
mov byte [0x53eb8b], cl
call edi
push dword [ebx]
neg eax
push str.evt
sbb al, al
and byte [0x53eb8a], al
call edi
movzx ecx, byte [0x53eb8a]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._avlogs
mov byte [0x53eb8a], cl
call edi
push dword [ebx]
neg eax
push str.avlogs
sbb al, al
and byte [0x53eb89], al
call edi
movzx ecx, byte [0x53eb89]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._tasks
mov byte [0x53eb89], cl
call edi
push dword [ebx]
neg eax
push str.tasks
sbb al, al
and byte [0x53eb87], al
call edi
movzx ecx, byte [0x53eb87]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str.net
mov byte [0x53eb87], cl
call edi
movzx ecx, byte [0x53eb85]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._net
mov byte [0x53eb85], cl
call edi
push dword [ebx]
neg eax
push str.bits
sbb al, al
and byte [0x53eb85], al
call edi
movzx ecx, byte [0x53eb84]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._bits
mov byte [0x53eb84], cl
call edi
neg eax
sbb al, al
and byte [0x53eb84], al
push dword [ebx]
push str.nochecks
call edi
test eax, eax
je 0x4573a7
push dword [ebx]
push str._nochecks
call edi
test eax, eax
jne 0x4573ae
mov byte [0x53eb66], 1
push dword [ebx]
push str.silent
call edi
test eax, eax
je 0x4573c8
push dword [ebx]
push str._silent
call edi
test eax, eax
jne 0x4573cf
mov byte [0x53eb65], 1
push dword [ebx]
push str.fmtlog
call edi
movzx ecx, byte [0x53eb64]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._fmtlog
mov byte [0x53eb64], cl
call edi
push dword [ebx]
neg eax
push str.days
sbb al, al
and byte [0x53eb64], al
call edi
test eax, eax
je 0x45741c
push dword [ebx]
push str._days
call edi
test eax, eax
jne 0x45743a
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x1c]
jge 0x45743a
push dword [ebx + 4]
call fcn.004bce50
mov esi, dword [ebp - 0x14]
add esp, 4
mov dword [0x53eb4c], eax
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ebx, [eax + esi*4]
push 0x51fc8c
call edi
test eax, eax
jne 0x457568
lea eax, [esi + 1]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jge 0x457568
mov ecx, dword [ebx + 4]
mov byte [0x53eb83], 1
mov dword [ebp - 0x30], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457475
sub ecx, edx
sar ecx, 1
inc ecx
call fcn.00455630
mov ecx, dword [ebx + 4]
mov edx, ecx
mov dword [0x53ec38], eax
lea eax, [edx + 2]
mov dword [ebp - 0x14], eax
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4574a0
sub edx, dword [ebp - 0x14]
lea eax, [ecx + 2]
sar edx, 1
mov dword [ebp - 0x14], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4574b6
push dword [ebx + 4]
sub ecx, dword [ebp - 0x14]
lea eax, [edx + 1]
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push dword [0x53ec38]
call fcn.004bb430
mov edx, dword [ebx + 4]
add esp, 0x14
lea ecx, [edx + 2]
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4574f0
lea eax, [ebp - 0x30]
sub edx, ecx
mov ecx, dword [0x53ec38]
push eax
sar edx, 1
push 0
call fcn.00453900
mov ecx, dword [ebp - 0x30]
add esp, 8
test ecx, ecx
jg 0x457522
mov esi, dword [ebp - 0x18]
jmp 0x457751
call fcn.00455630
mov edx, dword [ebx + 4]
mov ecx, eax
mov dword [ebp - 0x18], ecx
lea eax, [edx + 2]
mov dword [ebp - 0x14], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x457535
sub edx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push eax
push ecx
mov ecx, dword [0x53ec38]
sar edx, 1
call fcn.00453900
mov ecx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [ebp - 0x30]
mov dword [0x53ec38], ecx
mov byte [ecx + eax], 0
push dword [ebx]
push str._yara
call edi
push dword [ebx]
neg eax
push str.yaraoffline
sbb al, al
and byte [0x53eb83], al
call edi
movzx ecx, byte [0x53eb82]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._yaraoffline
mov byte [0x53eb82], cl
call edi
push dword [ebx]
neg eax
push str._yaracompile
sbb al, al
and byte [0x53eb82], al
call edi
test eax, eax
je 0x4575c8
push dword [ebx]
push str.yaracompile
call edi
test eax, eax
jne 0x457628
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x1c]
jge 0x457628
mov esi, dword [ebx + 4]
mov edx, esi
mov byte [0x53eb81], 1
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4575e2
sub edx, ecx
mov ecx, esi
sar edx, 1
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4575f6
sub ecx, ebx
lea eax, [edx + 1]
push esi
sar ecx, 1
push 0x51f4d8
push eax
lea eax, [ecx + 1]
push eax
push 0x53ec58
call fcn.004bb430
mov esi, dword [ebp - 0x14]
add esp, 0x14
jmp 0x457751
push dword [ebx]
push 0x51fd14
call edi
movzx ecx, byte [0x53eb80]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str.filehash
mov byte [0x53eb80], cl
call edi
movzx ecx, byte [0x53eb68]
test eax, eax
push dword [ebx]
mov eax, 1
cmove ecx, eax
push str._filehash
mov byte [0x53eb68], cl
call edi
push dword [ebx]
neg eax
push str.crd
sbb al, al
and byte [0x53eb68], al
call edi
test eax, eax
jne 0x457740
call fcn.00455940
mov byte [0x53eb9f], 1
mov byte [0x53eb98], 1
mov byte [0x53eb85], 1
mov byte [0x53eb90], 1
mov byte [0x53eb9b], 1
mov byte [0x53eb94], 1
mov byte [0x53eb95], 1
mov byte [0x53eb93], 1
mov byte [0x53eb92], 1
mov byte [0x53eb91], 1
mov byte [0x53eb68], 1
mov byte [0x53eb8b], 1
mov byte [0x53eb8a], 1
mov byte [0x53eb87], 1
mov byte [0x53eb89], 1
mov byte [0x53eb84], 1
mov byte [0x53eb78], 1
mov byte [0x53eb7f], 1
mov byte [0x53eb6b], 1
mov byte [0x53eb6a], 1
mov byte [0x53eb8c], 1
mov byte [0x53eb8e], 1
mov byte [0x53eb8d], 1
mov byte [0x53eb88], 1
mov byte [0x53eb80], 1
push dword [ebx]
push 0x51fd58
call edi
test eax, eax
je 0x45782a
inc esi
cmp esi, dword [ebp - 0x1c]
jge 0x4577d5
mov ecx, dword [ebp - 0x20]
jmp 0x455ae0
push str.Expected_a_base64_encoded__PGP_signed__URI_for__remote_n
call fcn.004bc829
add esp, 4
mov byte [0x53eb75], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
mov byte [0x53eb75], 1
call fcn.00455940
push str.00000000000000
xorps xmm0, xmm0
mov dword [0x53ec54], 0
push 0x10
push 0x561208
movlpd qword [0x560d60], xmm0
mov dword [0x560d68], 0
call fcn.004716e0
mov edx, dword [ebp - 0x1c]
add esp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.00455ab0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.Invalid_compression_level_n
call fcn.004bc829
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.split_size_must_be_defined_in_bytes_and_greater_than_1048576_n
call fcn.004bc829
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.REACT_2.1.0
push str._n_S_n_nFLAGS:_nmem_tEnable_winpmem_acquisition_n_nOPTIONS:_n_out__path__tChange_the_default_output_destination_path_n_ext__ext__tChange_the_default_output_file_extension._n_split__bytes__tChange_the_default__249mb__output_file_split_size_in_bytes._n_remote__base64__tPGP_signed_URI_hosting_react_controller_n_nMOUNT_MODE_n_mount__name___drives__tProcess_mounted_logical_drives__eg.__mount_host1_ef_n
call fcn.004bc829
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.Failed_to_allocate_memory_on_process_heap_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
call fcn.004bbfd4
push str.react.exe__mount__system_name___mounted_drive_letters__neg:_react.exe__mount_C02NM61AG3QD_ef_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
int3