Function at 0x4882b7
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x18c
push ebx
push esi
lea eax, [ebp + 0x74]
push edi
push eax
mov dword [ebp + 0x50], ecx
call fcn.0043dcd9
mov al, byte [ebp + 0x7c]
xor ebx, ebx
cmp al, 1
pop ecx
mov byte [ebp + 0x4b], al
jne 0x4882e1
mov byte [ebp + 0x4b], bl
lea ecx, [ebp + 0x10]
sete byte [ebp + 0x7c]
call fcn.004441a1
lea ecx, [ebp + 0x1c]
call fcn.004441a1
lea eax, [ebp + 0x74]
push eax
call fcn.0043dcd9
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x488309
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00446f11
add esp, 0xc
cmp byte [ebp + 0x7c], 0
je 0x488329
mov eax, dword [ebp + 0x10]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ed1
movsx eax, byte [ebp + 0x7c]
mov dword [ebp + 0x18], eax
lea edi, [eax + eax]
mov eax, dword [ebp + 0x10]
add eax, edi
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
je 0x48835b
mov esi, 0x80070057
jmp 0x4884e4
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00446f64
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x488385
cmp si, 0x3b
jne 0x488389
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x4b], 0
mov byte [ebp + 0x57], 0
jne 0x488500
push dword [ebp + 0x1c]
push str.WINVER
call fcn.0043f15a
test al, al
pop ecx
pop ecx
jne 0x4883c5
push dword [ebp + 0x1c]
push 0x4c8320
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488500
mov byte [ebp + 0x57], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.0043dcd9
mov eax, dword [ebp + 0x74]
xor esi, esi
xor edi, edi
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], ebx
jne 0x4883e8
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x48840d
lea ecx, [eax + 2]
cmp word [ecx], bx
mov byte [ebp + 0x57], 1
jne 0x488408
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x57], 0x2a
jmp 0x48840d
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, bx
mov dword [ebp + 0xc], ecx
jne 0x488424
cmp byte [ebp + 0x57], 0
je 0x4884a8
mov dword [ebp + 0x7c], ebx
cmp word [eax], 0x2a
je 0x488433
cmp byte [ebp + 0x57], 0x2a
jne 0x488480
mov eax, dword [ebp + 0x50]
cmp byte [eax + 0x92], 0
push 0x12
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
jne 0x488467
test byte [eax + 9], 0xf
jne 0x488467
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00454bf7
jmp 0x48847a
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004538d5
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 1
push ebx
push ebx
push dword [ebp + 0x3c]
push eax
call fcn.00407c9c
add esp, 0x14
lea ecx, [ebp + 0x7c]
mov esi, eax
mov edi, edx
call fcn.0043dd41
cmp byte [ebp + 0x57], 0
jne 0x4884a8
cmp word [ebp + 0xc], bx
jne 0x4884cd
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], edi
call fcn.00440aaa
cmp byte [ebp + 0x57], 0
mov esi, eax
mov edi, edx
je 0x4884cd
movzx eax, word [ebp + 0x20]
shld edi, esi, 0x10
cdq
shl esi, 0x10
or esi, eax
or edi, edx
push str.0x_I64X
push dword [ebp + 0x38]
push edi
push esi
push dword [ebp + 0x50]
call fcn.004466e3
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x1c]
call fcn.0043dd41
lea ecx, [ebp + 0x10]
call fcn.0043dd41
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x1c]
push str.ispe
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488529
push dword [ebp + 0x38]
call fcn.0040a1b6
push eax
push dword [ebp + 0x50]
call fcn.00446768
add esp, 0xc
jmp 0x4884e2
cmp si, bx
je 0x488538
cmp si, 0x2c
jne 0x488351
cmp byte [ebp + 0x4b], 0
je 0x488548
cmp byte [ebp + 0x4b], 2
jne 0x488af8
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044cf2d
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x44]
je 0x488561
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.0043dcd9
push dword [ebp + 0x1c]
push str.FVER
call fcn.0043f15a
add esp, 0xc
test al, al
je 0x48867b
lea ecx, [ebp + 0x60]
call fcn.004441a1
push dword [ebp + 0x74]
mov dword [ebp + 0x5c], ebx
call fcn.00412ce4
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.0043e29c
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x4885e7
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f64
mov eax, dword [ebp + 0x64]
mov di, word [eax]
mov eax, dword [ebp + 0x7c]
add esp, 0x10
mov dword [ebp + 0x38], ebx
cmp word [eax], bx
je 0x488606
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0048823f
pop ecx
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp + 0x38]
push eax
mov ax, di
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00407c9c
mov ecx, dword [ebp + 0x50]
add esp, 0x14
push dword [ebp + 0x60]
push esi
call fcn.004438ac
cmp di, bx
je 0x488653
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x64]
call fcn.004438ac
mov esi, dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
call fcn.0043dd41
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x44]
call fcn.0043dd41
jmp 0x4884e4
push dword [ebp + 0x1c]
push str.FTIME
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x4888b6
push dword [ebp + 0x74]
call fcn.00412ce4
pop ecx
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
call fcn.004441a1
lea ecx, [ebp + 0x60]
call fcn.004441a1
lea ecx, [ebp + 0x4c]
call fcn.004441a1
lea eax, [edi + esi]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x3c], ebx
jmp 0x48875a
push 6
lea eax, [ebp + 0x68]
push eax
push str._local
call fcn.004460ea
add esp, 0xc
test al, al
je 0x4886f3
cmp byte [ebp + 0x7c], 0
je 0x4886ed
sub dword [ebp + 0x68], 2
mov eax, dword [ebp + 0x68]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x488757
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4c68b4
call fcn.004460ea
add esp, 0xc
test al, al
je 0x488710
or byte [ebp + 0x7c], 4
jmp 0x488757
push 4
lea eax, [ebp + 0x68]
push eax
push str._ws1
call fcn.004460ea
add esp, 0xc
test al, al
je 0x48872d
or byte [ebp + 0x7c], 8
jmp 0x488757
push 5
lea eax, [ebp + 0x68]
push eax
push str._link
call fcn.004460ea
add esp, 0xc
test al, al
je 0x48874d
mov dword [ebp + 0x3c], 1
jmp 0x488757
lea eax, [ebp + 0x68]
push eax
call fcn.00408ddd
pop ecx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
je 0x4886c4
cmp byte [ebp + 0x7c], 0
je 0x48876f
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4887a0
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
add esp, 0xc
mov eax, dword [ebp + 0x68]
cmp word [eax], si
jne 0x4887bd
add dword [ebp + 0x68], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x3c], ebx
lea esi, [ebp - 0xa0]
je 0x488805
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x38]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.0040569f
cmp dword [ebp + 0x64], ebx
je 0x4887f8
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x4c]
call fcn.00402c9f
jmp 0x488818
lea eax, [ebp - 0xa0]
push eax
push ebx
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x48886d
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.00447ad6
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x50]
call fcn.00447ad6
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x50]
call fcn.00447ad6
add esp, 0x30
lea ecx, [ebp + 0x4c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
jmp 0x488a7a
mov ecx, dword [ebp + 0x50]
mov esi, 0x4bca2c
push esi
push dword [ebp + 0x58]
call fcn.004438ac
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x60]
call fcn.004438ac
mov ecx, dword [ebp + 0x50]
push esi
push dword [ebp + 0x4c]
call fcn.004438ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x4c]
mov esi, eax
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
jmp 0x488669
push dword [ebp + 0x1c]
push str.FATTR
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488af0
push dword [ebp + 0x74]
call fcn.00412ce4
cmp byte [ebp + 0x7c], 0
pop ecx
mov edi, eax
je 0x4888e3
mov word [esi], 0x26
lea ecx, [ebp + 0x64]
call fcn.004441a1
lea ecx, [ebp + 0x58]
call fcn.004441a1
lea ecx, [ebp + 0x60]
call fcn.004441a1
lea ecx, [ebp + 0x4c]
call fcn.004441a1
lea ecx, [ebp + 0x5c]
call fcn.004441a1
push 0x2c
mov dword [ebp + 0x68], esi
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4889d2
cmp byte [ebp + 0x7c], 0
je 0x48893b
mov word [eax], 0x26
jmp 0x488940
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4889d2
cmp byte [ebp + 0x7c], 0
je 0x488966
mov word [eax], 0x26
jmp 0x48896b
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4889d2
cmp byte [ebp + 0x7c], 0
je 0x488991
mov word [eax], 0x26
jmp 0x488996
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], si
jne 0x4889d2
cmp byte [ebp + 0x7c], 0
je 0x4889bc
mov word [eax], 0x26
jmp 0x4889c1
inc eax
inc eax
mov dword [ebp + 0x68], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00446f11
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x488a8c
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x64]
mov esi, dword [ebp + 0x50]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.00446768
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x58]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.00446768
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x60]
and eax, edi
push eax
push esi
call fcn.00446768
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x4c]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.00446768
push dword [ebp - 0x18]
lea eax, [ebp - 0x7c]
push str.0x_lX
push eax
mov word [ebp - 0x7c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.004438ac
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp + 0x4c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
call fcn.0043dd41
lea ecx, [ebp + 0x64]
call fcn.0043dd41
lea ecx, [ebp + 0x44]
call fcn.0043dd41
jmp 0x4884e2
mov edi, dword [ebp + 0x50]
mov esi, 0x4bca2c
push esi
push dword [ebp + 0x64]
mov ecx, edi
call fcn.004438ac
push esi
push dword [ebp + 0x58]
mov ecx, edi
call fcn.004438ac
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.004438ac
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.004438ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.0043dd41
lea ecx, [ebp + 0x4c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
call fcn.0043dd41
lea ecx, [ebp + 0x64]
jmp 0x488669
lea ecx, [ebp + 0x44]
call fcn.0043dd41
cmp byte [ebp + 0x4b], 0
jne 0x4884e2
push dword [ebp + 0x10]
lea ecx, [ebp + 0x44]
call fcn.0044cf2d
lea eax, [ebp + 0x74]
push eax
call fcn.0043dcd9
mov esi, dword [ebp + 0x1c]
push esi
push str.DROPFILE
call fcn.0043f15a
add esp, 0xc
test al, al
je 0x488c08
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
call fcn.0045030b
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.004441a1
lea ecx, [ebp + 0x4c]
call fcn.004441a1
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x488b99
cmp byte [ebp + 0x7c], 0
je 0x488b82
mov word [eax], 0x26
jmp 0x488b87
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00446f11
add esp, 0xc
lea ecx, [ebp + 0x64]
call fcn.004441a1
lea ecx, [ebp + 0x28]
call fcn.004441a1
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp word [esi], bx
je 0x488bb6
lea eax, [ebp + 0x28]
mov ecx, dword [ebp + 0x30]
or ecx, dword [ebp + 0x34]
je 0x488bce
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x30]
call fcn.0040498f
add esp, 0xc
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x60]
call fcn.004438ac
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x50]
push esi
call fcn.004438ac
lea ecx, [ebp + 0x28]
call fcn.0043dd41
lea ecx, [ebp + 0x64]
call fcn.0043dd41
lea ecx, [ebp + 0x4c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
jmp 0x488a7a
push esi
push str.FPOS
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488e12
push dword [ebp + 0x74]
call fcn.00412ce4
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043dcd9
push dword [ebp + 0x64]
call fcn.00410a39
add esp, 0xc
lea ecx, [ebp + 0x40]
call fcn.004441a1
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x64]
call fcn.0041307e
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x40]
mov esi, dword [ebp + 0x44]
pop ecx
pop ecx
push 0x26
mov dword [ebp + 0x64], eax
pop edi
je 0x488c68
mov word [esi], di
lea ecx, [ebp + 0x2c]
call fcn.004441a1
lea ecx, [ebp + 0x68]
call fcn.004441a1
lea ecx, [ebp + 0x58]
call fcn.004441a1
lea ecx, [ebp + 0x60]
call fcn.004441a1
lea ecx, [ebp + 0x4c]
call fcn.004441a1
lea ecx, [ebp + 0x5c]
call fcn.004441a1
lea ecx, [ebp + 0x28]
call fcn.004441a1
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488ccc
mov word [eax], di
jmp 0x488cd1
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488cf7
mov word [eax], di
jmp 0x488cfc
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488d22
mov word [eax], di
jmp 0x488d27
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488d49
mov word [eax], di
jmp 0x488d4e
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488d70
mov word [eax], di
jmp 0x488d75
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x488dad
test bl, bl
je 0x488d97
mov word [eax], di
jmp 0x488d9c
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00446f11
add esp, 0xc
push dword [ebp + 0x28]
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push dword [ebp + 0x68]
push dword [ebp + 0x2c]
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call fcn.0043c743
add esp, 0x24
lea ecx, [ebp + 0x28]
mov esi, eax
call fcn.0043dd41
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp + 0x4c]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
call fcn.0043dd41
lea ecx, [ebp + 0x68]
call fcn.0043dd41
lea ecx, [ebp + 0x2c]
call fcn.0043dd41
lea ecx, [ebp + 0x40]
jmp 0x488669
push esi
push str.PPID
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488e55
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
call fcn.0045030b
pop ecx
pop ecx
push dword [ebp + 0x44]
push dword [ebp + 0x20]
call fcn.00404dff
pop ecx
push eax
push dword [ebp + 0x50]
call fcn.00446768
add esp, 0xc
jmp 0x488a7f
push esi
push str.ISADMIN
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488e70
push dword [ebp + 0x44]
call fcn.00497fe4
jmp 0x488e44
push esi
push str.fvar
call fcn.0043f15a
test al, al
pop ecx
pop ecx
jne 0x489277
push 5
push esi
push 0x4c8270
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x489277
push esi
push str.PWIN
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x489011
lea ecx, [ebp + 0x40]
call fcn.004441a1
lea ecx, [ebp + 0x64]
call fcn.004441a1
mov eax, dword [ebp + 0x44]
push ebx
mov dword [ebp + 0x3c], eax
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00438fc8
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00446f11
add esp, 0x1c
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.00405656
test eax, eax
pop ecx
pop ecx
je 0x488f11
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00405656
test eax, eax
pop ecx
pop ecx
je 0x488f2a
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x34], eax
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x34]
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x14], 3
mov dword [ebp + 0x18], ebx
call fcn.00405656
pop ecx
pop ecx
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x488fdb
cmp dword [ebp + 0x14], 3
jne 0x488f74
cmp dword [ebp + 0x18], 0
jne 0x488f74
mov eax, dword [ebp + 0x64]
cmp word [eax], 0
je 0x488fdb
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x488f94
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x488f9d
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x488f81
cmp dword [ebp + 0x14], 3
jne 0x488fa9
cmp dword [ebp + 0x18], 0
je 0x488fdb
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x14]
sub edi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x20]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x488fdb
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x40]
push dword [ebp + 0x7c]
push dword [ebp + 0x50]
call fcn.0044cfff
push dword [ebp + 0x64]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.0044cfff
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0043dd41
lea ecx, [ebp + 0x40]
call fcn.0043dd41
xor ebx, ebx
jmp 0x488a7f
push esi
push str.PEBIT
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x488a7f
mov eax, dword [ebp + 0x44]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x3c], eax
call fcn.004441a1
lea ecx, [ebp + 0x64]
call fcn.004441a1
push ebx
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00438fc8
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00446f11
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
push 0xd
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4bca2c
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0xc], ebx
call fcn.00419ea1
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], bx
je 0x48921a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x4890b9
cmp cx, 0x2f
je 0x4890b9
push edx
call fcn.004a96f0
test eax, eax
pop ecx
je 0x4890dc
jmp 0x4890bc
mov word [eax], bx
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.004442c5
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x60], ebx
call fcn.0040569f
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], esi
je 0x489212
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x7c], ebx
call fcn.004441bf
mov edi, dword [ebp + 0x38]
push esi
push ebx
push edi
call fcn.004aa0a0
add esp, 0xc
push ebx
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push dword [ebp + 0x60]
call esi
test eax, eax
je 0x48920a
cmp dword [ebp + 0x7c], 0x40
jb 0x48920a
cmp word [edi], 0x5a4d
jne 0x48920a
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x489184
push ebx
push ebx
push eax
push dword [ebp + 0x60]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0043f027
add esp, 0x10
push ebx
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x48920a
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0x34], edi
jne 0x4891da
cmp edi, 0x8664
jne 0x4891b9
mov dword [ebp + 0x58], 0x4c823c
jmp 0x48920a
cmp ecx, eax
jne 0x4891da
cmp edi, 0x14c
je 0x489203
cmp ecx, eax
jne 0x4891da
cmp edi, 0x200
jne 0x4891da
mov dword [ebp + 0x58], str.ia64
jmp 0x48920a
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x48920a
cmp edi, 0x137
je 0x489203
cmp ecx, eax
jne 0x48920a
cmp edi, 0x1b0
je 0x489203
cmp ecx, eax
jne 0x48920a
cmp edi, 0xe7
jne 0x48920a
mov dword [ebp + 0x58], 0x4c8228
lea ecx, [ebp + 0x38]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.00402c9f
push dword [ebp + 0x58]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x40]
call fcn.004438ac
cmp dword [ebp + 0x34], ebx
jg 0x489246
jl 0x489234
cmp dword [ebp + 0x30], ebx
ja 0x489246
mov ecx, dword [ebp + 0x50]
push str._0x000000000001
push dword [ebp + 0x64]
call fcn.004438ac
jmp 0x48925f
push str.0x_012I64X
push dword [ebp + 0x64]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x50]
call fcn.004466e3
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp + 0x64]
call fcn.0043dd41
lea ecx, [ebp + 0x40]
jmp 0x488a7a
mov esi, dword [ebp + 0x1c]
cmp word [esi + 8], 0x2b
lea ecx, [ebp + 0x28]
setne bl
dec bl
and ebx, 0x2b
call fcn.004441a1
lea ecx, [ebp + 0x60]
call fcn.004441a1
mov eax, dword [ebp + 0x44]
xor edi, edi
test bl, bl
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], 0x4bca2c
mov dword [ebp + 0x64], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x7f], 0
je 0x4892d3
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4c76a4
call fcn.004460ea
add esp, 0xc
test al, al
je 0x4892d3
mov byte [ebp + 0x7f], 1
mov eax, dword [ebp + 0x4c]
push 0x3b
mov dword [ebp + 0x38], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.00446f64
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, di
je 0x489326
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x489326
push edi
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00438fc8
mov eax, dword [ebp + 0x28]
add esp, 0x10
cmp word [eax], di
je 0x489326
mov dword [ebp + 0x64], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.004130be
or dword [ebp + 0x30], 0xffffffff
or dword [ebp + 0x34], 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x68], edi
je 0x4894e6
lea ecx, [ebp + 0x58]
call fcn.004441a1
mov eax, dword [ebp + 0x4c]
cmp word [eax], di
mov dword [ebp + 0x5c], edi
je 0x489372
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.0044746e
pop ecx
pop ecx
mov al, byte [ebp + 0x7f]
neg al
lea ecx, [ebp + 0x2c]
sbb eax, eax
and eax, 0x4d8d1c
push eax
call fcn.004385e0
cmp byte [ebp + 0x7f], 0
je 0x4893bd
mov ecx, dword [ebp + 0x50]
push edi
push 0xffffffffffffffff
push edi
push dword [ebp + 0x74]
call fcn.004108b2
cmp eax, edi
mov dword [ebp + 0x74], edi
je 0x4893b4
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edi
jmp 0x4893d5
mov dword [ebp + 0x68], 1
jmp 0x4893d5
lea eax, [ebp + 0x30]
push eax
add esi, 0xa
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0045a96e
add esp, 0x10
cmp dword [ebp + 0x34], edi
jl 0x48948d
jg 0x4893e9
cmp dword [ebp + 0x30], edi
jb 0x48948d
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x489445
mov eax, dword [0x4d81f4]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x48942a
push edi
push 0x4d81f4
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0043f18a
mov eax, dword [0x4d81f4]
add esp, 0x10
cmp eax, edi
jne 0x48942a
or eax, 0xffffffff
mov dword [0x4d81f4], eax
cmp eax, 0xffffffff
je 0x48948d
push dword [ebp + 0x20]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
jmp 0x48948a
mov eax, dword [0x4d8200]
cmp eax, edi
jne 0x489477
push edi
push 0x4d8200
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableW
call fcn.0043f18a
mov eax, dword [0x4d8200]
add esp, 0x10
cmp eax, edi
jne 0x489477
or eax, 0xffffffff
mov dword [0x4d8200], eax
cmp eax, 0xffffffff
je 0x48948d
push dword [ebp + 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x2c], edi
je 0x48949b
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x40], edi
jne 0x4894ae
cmp dword [ebp + 0x68], edi
jg 0x4894ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp + 0x58]
call fcn.0043dd41
lea ecx, [ebp + 0xc]
call fcn.0043dd41
lea ecx, [ebp + 0x60]
call fcn.0043dd41
lea ecx, [ebp + 0x28]
call fcn.0043dd41
lea ecx, [ebp + 0x44]
call fcn.0043dd41
mov esi, dword [ebp + 0x68]
jmp 0x4884e4
push 0x1000
lea ecx, [ebp + 0x7c]
call fcn.004441bf
lea ecx, [ebp + 0x3c]
call fcn.004441a1
push edi
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00438fc8
mov eax, dword [ebp + 0x4c]
add esp, 0x10
cmp word [eax], di
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], 0x4c6138
mov esi, 0x2000
mov ebx, str.Kernel32.DLL
je 0x4895a1
mov eax, dword [0x4d81f8]
cmp eax, edi
mov dword [ebp + 0x68], 0x7f
jne 0x48955f
push edi
push 0x4d81f8
push ebx
push str.GetFirmwareEnvironmentVariableExW
call fcn.0043f18a
mov eax, dword [0x4d81f8]
add esp, 0x10
cmp eax, edi
jne 0x48955f
or eax, 0xffffffff
mov dword [0x4d81f8], eax
cmp eax, 0xffffffff
je 0x4895a1
lea ecx, [ebp + 0x20]
push ecx
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
cmp eax, edi
mov dword [ebp + 0x58], eax
je 0x489598
push dword [ebp + 0x20]
lea eax, [ebp - 0x120]
push 0x4bcb04
push eax
mov dword [ebp + 0x40], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4895df
mov dword [ebp + 0x40], str.FAIL
jmp 0x4895df
push edi
push 0x4d81fc
push ebx
push str.GetFirmwareEnvironmentVariableW
mov dword [ebp + 0x68], 0x78
call fcn.0043f18a
mov eax, dword [0x4d81fc]
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x58], edi
je 0x4895df
cmp eax, 0xffffffff
je 0x4895df
push esi
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], edi
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call eax
mov dword [ebp + 0x58], eax
mov ecx, dword [ebp + 0x50]
movsx ebx, byte [ecx + 9]
mov eax, dword [ebp + 0x3c]
mov cx, word [eax]
or ebx, dword [ebp + 0x18]
cmp cx, 0x26
mov dword [ebp + 0x5c], eax
jne 0x4895fd
or ebx, 2
jmp 0x48961c
cmp cx, 0x24
je 0x489614
cmp cx, 0x5e
je 0x489614
cmp cx, 0x2e
jne 0x48961c
or ebx, 4
jmp 0x489616
xor ebx, ebx
add eax, 2
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x58], edi
je 0x48968e
cmp dword [ebp + 0x58], esi
jbe 0x489629
mov dword [ebp + 0x58], esi
cmp ebx, edi
jne 0x489686
mov esi, dword [ebp + 0x58]
mov edi, dword [ebp + 0x7c]
and dword [ebp + 0x7c], 0
inc esi
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x64], edi
call fcn.004441e6
mov dword [ebp + 0x18], edi
mov edi, dword [ebp + 0x7c]
add edi, 0xfffffff6
dec esi
test esi, esi
jle 0x489677
mov dword [ebp + 0x2c], esi
mov esi, dword [ebp + 0x18]
movzx eax, byte [esi]
push eax
add edi, 0xa
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x2c]
jne 0x48965b
and word [edi - 2], 0
lea ecx, [ebp + 0x64]
call fcn.0043dd41
xor edi, edi
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], eax
jmp 0x48969c
cmp dword [ebp + 0x68], edi
jg 0x48969c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x68], eax
test bl, 3
je 0x4896bc
push edi
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x2c]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
call fcn.0045078d
add esp, 0x18
jmp 0x4896ca
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x50]
push dword [ebp + 0x5c]
call fcn.004438ac
mov eax, dword [ebp + 0x38]
cmp word [eax], di
je 0x4896de
push dword [ebp + 0x40]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.004438ac
lea ecx, [ebp + 0x3c]
call fcn.0043dd41
lea ecx, [ebp + 0x7c]
jmp 0x4894b9