Function at 0x407b04
Capabilities:
Check for software breakpoints
Create process on windows
Encode data using base64
Encrypt data using speck
Get comspec environment variable
Open clipboard
Parse credit card information
Query environment variable
Write clipboard data

Disassembly:
call fcn.0040482d
dec eax
jne 0x404892
aas
add bl, al
add byte [eax], al
mov ax, 0xfd11
mov esi, 0x48dc00
sub ax, 0xfd11
mov bl, al
xor ecx, ecx
add esi, ecx
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x404aa9
dec bl
jns 0x404a8e
mov edi, 0x430e02
rep movsb byte es:[edi], byte [esi]
mov al, 0
stosb byte es:[edi], al
call fcn.0040d6e5
ret
call fcn.00406478
test byte [0x450709], 4
jne 0x4067a8
jmp 0x4067f2
mov bx, word [0x450707]
cmp byte [0x450709], 0x14
jne fcn.004067c4
mov edi, ebx
call fcn.00412e7f
mov bl, byte [edi]
mov bh, byte [edi + 1]
pushal
xor eax, eax
mov al, byte [ebp + 9]
sub al, byte [ebp + 1]
shl eax, 1
mov edi, dword [ebp + 4]
sub di, ax
push edi
call fcn.00412e7f
mov bl, byte [edi]
pop edi
inc di
call fcn.00412e7f
mov bh, byte [edi]
mov ebp, 0x42c01b
call fcn.004067c4
popal
ret
push ebp
mov ebp, 0x42c01b
mov esi, dword [0x450703]
sub esi, 2
cmp esi, 0x4506db
jae 0x406843
mov esi, 0x450701
mov bx, word [esi]
cmp bx, 0xffff
je 0x406863
mov word [esi], 0xffff
mov dword [0x450703], esi
call fcn.0040686c
call fcn.00407105
pop ebp
ret
mov bx, word [0x42c011]
jmp 0x406857
dec word [ebp + 4]
jmp fcn.004072f9
inc word [ebp + 4]
jmp 0x40693d
call fcn.00408f2f
je 0x40696b
cmp ebp, 0x42c07e
jne 0x406961
cmp byte [ebp + 8], 0x2c
jae 0x406a40
mov esi, 0x1b
jmp 0x406a93
cmp ebp, 0x42c07e
je 0x406998
cmp ebp, 0x42c144
je 0x406827
cmp ebp, 0x42c01b
je 0x406827
cmp ebp, 0x42c0e1
jne 0x4069b0
jmp 0x4069ab
cmp byte [ebp + 8], 0xb
mov al, 0x2a
je 0x4069b1
cmp byte [ebp + 8], 0x2c
mov al, 0x3b
je 0x4069b1
dec byte [ebp + 8]
jmp fcn.004063d0
ret
mov byte [ebp + 8], al
jmp 0x406a74
call fcn.00408f2f
je 0x4069dc
cmp ebp, 0x42c07e
jne 0x4069d2
cmp byte [ebp + 8], 0x2c
jb 0x406a40
nop
nop
nop
nop
mov esi, 0x1f
jmp 0x406a93
cmp ebp, 0x42c144
je 0x4067f8
cmp ebp, 0x42c01b
je 0x406798
cmp ebp, 0x42c07e
je 0x406a06
cmp ebp, 0x42c0e1
jne 0x406a1e
jmp 0x406a19
cmp byte [ebp + 8], 0x2a
mov al, 0xb
je 0x406a1f
cmp byte [ebp + 8], 0x3b
mov al, 0x2c
je 0x406a1f
inc byte [ebp + 8]
jmp fcn.004063d0
ret
mov byte [ebp + 8], al
jmp 0x406aa4
cmp ebp, 0x42c01b
jne 0x406a3f
mov al, byte [0x42e844]
xor byte [0x42e616], al
jmp fcn.00407105
ret
cmp ebp, 0x42c07e
jne 0x406a65
mov al, byte [ebp + 8]
cmp al, 0x2a
ja 0x406a57
sub al, 0xb
shr al, 1
add al, 0x2c
jmp 0x406a5d
sub al, 0x2c
shl al, 1
add al, 0xb
mov byte [ebp + 8], al
jmp fcn.004063d0
ret
call fcn.00408f2f
je 0x406a74
mov esi, 0x13
jmp 0x406a93
mov al, byte [ebp + 1]
cmp al, byte [ebp + 9]
je 0x406a84
dec byte [ebp + 9]
jmp fcn.004063d0
jmp dword [ebp + 0x2f]
call fcn.00408f2f
je 0x406aa4
mov esi, 0x17
mov byte [ebp + 0xa], 0
mov ebp, dword [ebp + esi]
mov byte [ebp + 0xa], 1
jmp fcn.004072f9
mov al, byte [ebp + 3]
cmp byte [ebp + 9], al
je 0x406ab4
inc byte [ebp + 9]
jmp fcn.004063d0
jmp dword [ebp + 0x33]
mov al, byte [ebp + 1]
cmp byte [ebp + 9], al
jne 0x406ac2
jmp dword [ebp + 0x27]
mov byte [ebp + 9], al
jmp fcn.004063d0
mov al, byte [ebp + 3]
cmp byte [ebp + 9], al
jne 0x406ac2
jmp dword [ebp + 0x2b]
cmp ebp, 0x42c01b
je 0x406b18
cmp ebp, 0x42c07e
je 0x406b18
cmp ebp, 0x42c144
je 0x406b57
ret
mov bx, word [ebp + 4]
add bx, 0x1ff
nop
nop
and bx, 0xfe00
sub bx, 0x200
nop
nop
mov word [ebp + 4], bx
mov al, byte [ebp + 1]
mov byte [ebp + 9], al
jmp fcn.004072f9
cmp ebp, 0x42c01b
je 0x406b57
cmp ebp, 0x42c07e
je 0x406b57
cmp ebp, 0x42c144
je 0x406b18
ret
mov bx, word [ebp + 4]
or bx, 0x1ff
inc bx
mov word [ebp + 4], bx
mov al, byte [ebp + 1]
mov byte [ebp + 9], al
jmp fcn.004072f9
cmp ebp, 0x42c01b
je 0x406b7a
ret
mov al, byte [ebp + 3]
sub al, byte [ebp + 1]
shr al, 1
add al, byte [ebp + 1]
cmp al, byte [ebp + 9]
je 0x406b94
call fcn.00406ba8
jmp fcn.004072f9
call fcn.004068f7
mov word [ebp + 4], di
mov al, byte [ebp + 1]
mov byte [ebp + 9], al
jmp fcn.004072f9
mov al, byte [ebp + 1]
mov byte [ebp + 9], al
xor eax, eax
mov word [ebp + 4], ax
jmp fcn.004072f9
cmp ebp, 0x42c144
je 0x406d27
mov al, byte [ebp + 3]
mov di, word [ebp + 0x3b]
mov byte [ebp + 9], al
mov word [ebp + 4], di
cmp ebp, 0x42c01b
je fcn.00406c92
jmp fcn.004072f9
jmp 0x406b71
call fcn.0040482d
add byte [ebx + 0x65], dl
popal
jb 0x406dd2
push 0x726f6620
cmp al, byte [eax]
mov cl, byte [0x44dec9]
and ecx, 0xff
je 0x406e08
cmp ebp, 0x42c0e1
je 0x406e08
nop
nop
nop
nop
call fcn.0040660e
call fcn.0040579a
call fcn.004068f7
mov esi, 0x44deca
call dword [ebp + 0x37]
mov byte [0x42c5f0], 1
mov dword [0x42c5ec], 0x400
dec dword [0x42c5ec]
jne 0x406dd5
mov dword [0x42c5ec], 0x400
call fcn.00408f60
jne 0x406e09
add byte [ebp + 0x34], dh
mov ebx, edi
call dword [ebp + 0x37]
push edi
mov edi, 0x44dc8f
call fcn.004043d4
pop edi
je 0x406e24
cmp di, bx
jae 0x406dbc
mov byte [0x42c5f0], 0
call fcn.0040482d
dec esi
outsd dx, dword [esi]
je 0x406e1d
outsw dx, word [esi]
jne 0x406e6f
add al, ch
enter 0xfffffffffffffff5, 0xffffffffffffffff
ret
call fcn.00408f8d
je 0x406e17
call fcn.00404104
jmp 0x406e09
mov byte [0x42c5f0], 0
call fcn.004063d0
ret
add al, ch
lodsd eax, dword [esi]
cmc
invalid
mov byte [0x42c5f0], 0
call fcn.0040686c
jmp fcn.004072f9
add al, ch
test byte [eax + eax], al
add byte [ebp - 0x18], bl
jle 0x406e7d
add byte [eax], al
stc
ret
popfd
clc
ret
mov eax, dword [0x42c25c]
or eax, eax
je 0x406ef4
mov esi, 0x27
jns 0x406ef0
neg eax
mov dword [0x42c25c], eax
mov esi, 0x2b
call dword [ebp + esi]
ret
push 0x20000001
push 0x46
push 0x106
push dword [0x42c2cb]
call sub.USER32.dll_SendMessageA
ret
call fcn.004084ab
inc byte [0x42c1a9]
jmp fcn.00407105
cmp ebp, 0x42c01b
jne 0x407589
call fcn.004068f7
call fcn.004045bd
je 0x407559
push edi
mov edi, 0x44dfbe
mov ebx, 4
call fcn.00404500
pop edi
jne 0x407589
mov word [esi], di
and word [esi], 0xffff
call fcn.004087ae
mov word [esi + 2], di
mov al, byte [0x42c23e]
mov byte [ebp + 0xb], al
mov al, byte [0x42c239]
jmp 0x407575
mov edi, 0x44dfc2
mov ebx, 4
call fcn.004044f5
mov al, byte [0x42c23b]
mov byte [ebp + 0xb], al
mov al, byte [0x42c238]
mov dh, byte [ebp + 8]
mov dl, byte [ebp + 9]
mov cx, 0x3c
call fcn.00404704
jmp fcn.0040473c
ret
mov di, word [0x42c011]
call fcn.0041399f
cmp byte [0x44dc8f], 0x6a
je 0x4075c3
cmp word [0x44dc8f], 0x7372
je 0x4075c3
cmp word [0x44dc8f], 0x6572
jne 0x4075d4
cmp byte [0x44dc91], 0x74
je 0x4075c3
jmp 0x4075d4
jmp 0x40760f
push ebp
mov ebp, 0x42c01b
call fcn.004068f7
pop ebp
mov word [0x42c1ae], di
mov byte [0x42c1ad], 0xff
call fcn.00407634
ret
call fcn.004070e8
jmp fcn.00407105
push ebp
mov ebp, 0x42c01b
call fcn.004068f7
pop ebp
mov word [0x42c011], di
jmp fcn.00407105
call fcn.004084fd
pushal
call fcn.0042942d
popal
call fcn.004074d8
call fcn.00407753
ret
pushal
movzx eax, word [0x42c00f]
mov dword [0x445ec0], eax
popal
jmp fcn.00407634
mov edi, 0x4077fb
jmp 0x40a7e7
mov al, 0xa
jmp 0x4079a4
mov byte [0x42c7a6], al
jmp 0x4079b2
cmp ah, 0
je 0x407b0e
jmp 0x407c1c
cmp al, 0x1b
je 0x406ef6
cmp al, 0xd
je 0x406d5f
cmp al, 3
je 0x406d76
cmp al, 4
je 0x407fcf
cmp al, 7
je 0x408177
cmp al, 0xc
je 0x407b5f
cmp al, 0xf
je 0x4097a2
cmp al, 0x12
je 0x404a7d
cmp al, 0x13
je 0x406d64
cmp al, 0x17
je 0x407b5f
cmp al, 0x1f
ja 0x4081bc
ret
ret
call fcn.0040664c
call fcn.0040b6ef
jmp fcn.00407105
call fcn.0040664c
mov al, 0
call fcn.0040afe8
jmp fcn.00407105
call fcn.0040664c
mov al, 1
call fcn.0040afe8
jmp fcn.00407105
call fcn.0040664c
mov al, byte [0x42fed9]
call fcn.0040afe8
jmp fcn.00407105
mov byte [0x42f875], 1
jmp 0x407bb5
mov byte [0x42f875], 0
call fcn.0040664c
call fcn.0040bb94
jmp fcn.00407105
call fcn.0040664c
jmp 0x40c562
call fcn.0040664c
call fcn.0040d8af
ret
call fcn.0040664c
call fcn.0040d80f
ret
call fcn.0040664c
call fcn.0040d794
ret
cmp ah, 0xb2
je 0x406a27
cmp ah, 0x21
je 0x406ef6
cmp ah, 0x3b
je fcn.004079ab
cmp ah, 0x3c
je 0x407513
cmp ah, 0x3d
je 0x40758a
cmp ah, 0x3e
je 0x4075c8
cmp ah, 0x3f
je 0x4075e8
cmp ah, 0x40
je 0x4075f2
cmp ah, 0x41
je 0x40760f
cmp ah, 0xe4
je 0x40760a
cmp ah, 0x42
je 0x407621
cmp ah, 0x43
je fcn.00407634
cmp ah, 0x44
je fcn.00408856
cmp ah, 0x57
je 0x407b91
cmp ah, 0x58
je 0x407bb5
cmp ah, 0xe5
je 0x407bae
cmp ah, 0xe6
je 0x407ba5
cmp ah, 0xb1
je 0x40781f
cmp ah, 0xaf
je 0x4087eb
cmp ax, 0xfd11
jb 0x407cd7
cmp ax, 0xfd19
jbe 0x404a81
cmp ah, 0x4b
je 0x406948
cmp ah, 0xe2
je 0x406948
cmp ah, 0x4d
je 0x4069b9
cmp ah, 0xe3
je 0x4069b9
cmp ah, 0x48
je 0x406a66
cmp ah, 0x50
je 0x406a87
cmp ah, 0x49
je 0x406ab7
cmp ah, 0x51
je 0x406aca
cmp ah, 0x73
je 0x406939
cmp ah, 0x74
je 0x406942
cmp ah, 0x84
je 0x406aff
cmp ah, 0x76
je 0x406b3e
cmp ah, 0x47
je 0x406d27
cmp ah, 0x77
je 0x406d27
cmp ah, 0x4f
je 0x406d38
cmp ah, 0x75
je 0x406d38
cmp ah, 0xbd
je fcn.00407634
cmp ax, 0xc900
jne 0x407d82
pushal
call fcn.00428769
popal
jmp fcn.00407634
cmp ah, 0xf3
je 0x407503
cmp ah, 0xd6
je 0x4081ce
cmp ah, 0xdb
je 0x407b60
cmp ah, 0xae
je 0x407b6f
cmp ah, 0xf8
je 0x407b80
cmp ah, 0xf9
je 0x407ef4
cmp ah, 0xe7
je 0x407fb6
cmp ah, 0xe8
je 0x407f9d
cmp ah, 0xe9
je 0x407f81
cmp ah, 0xea
je 0x407f88
cmp ah, 0xeb
je 0x407f8f
cmp ah, 0xec
je 0x407f96
cmp ah, 0x9f
je 0x406ed4
cmp ah, 0xa1
je 0x40a463
cmp ah, 0xca
je 0x40832c
cmp ah, 0xcb
je 0x40832c
cmp ah, 0xcc
je 0x40832c
cmp ah, 0xcd
je 0x40832c
cmp ah, 0xce
je 0x40832c
cmp ah, 0xcf
je 0x40832c
cmp ah, 0xf4
je 0x407f15
cmp ah, 0xf5
je 0x407f48
cmp ah, 0xf6
je 0x407f59
cmp ah, 0xf7
je 0x407f68
cmp ah, 0xed
je 0x407efe
cmp ah, 0xee
je 0x407f1c
cmp ah, 0xef
je 0x407f4f
cmp ah, 0xf0
je 0x407f60
cmp ah, 0xe1
je fcn.00407634
cmp ah, 0x12
je 0x407bce
cmp ah, 0xac
je fcn.00411b7b
cmp ah, 0xaa
je 0x411b53
cmp ah, 0xa2
je 0x411b4f
cmp ah, 0x9e
je 0x40dad9
cmp ah, 0xab
je fcn.0040cce4
cmp ah, 0xa0
je fcn.0040cf86
cmp ah, 0x59
je 0x407bc4
cmp ah, 0xd9
je 0x407bd9
cmp ah, 0xd5
je 0x407be4
cmp ah, 0xd7
je 0x4083ce
cmp ah, 0x9d
je 0x4077f1
ret
call fcn.0040aa9f
jmp fcn.00407105
cmp ebp, 0x42c01b
jne 0x407f15
mov al, byte [0x42cac0]
cmp al, byte [ebp + 9]
jne 0x407f3e
jmp 0x407513
mov ebx, 0x42c01b
jmp 0x407f6d
cmp ebp, 0x42c07e
jne 0x407f48
mov al, byte [0x42cabf]
cmp al, 0xb
jae 0x407f2f
mov al, 0xb
cmp al, 0x2b
jne 0x407f35
inc ax
cmp al, 0x3c
jne 0x407f3b
dec ax
mov byte [ebp + 8], al
mov al, byte [0x42cac0]
mov byte [ebp + 9], al
jmp 0x407f78
mov ebx, 0x42c07e
jmp 0x407f6d
cmp ebp, 0x42c0e1
jne 0x407f59
jmp 0x407f3b
mov ebx, 0x42c0e1
jmp 0x407f6d
cmp ebp, 0x42c144
je 0x407f3e
mov ebx, 0x42c144
mov byte [ebp + 0xa], 0
call fcn.004063d0
mov ebp, ebx
mov byte [ebp + 0xa], 1
jmp fcn.004063d0
mov ebx, 0x42c07e
jmp 0x407fbb
mov ebx, 0x42c07e
jmp 0x407fa2
mov ebx, 0x42c144
jmp 0x407fbb
mov ebx, 0x42c144
jmp 0x407fa2
mov ebx, 0x42c01b
mov byte [ebp + 0xa], 0
mov ebp, ebx
mov byte [ebp + 0xa], 1
call 0x406ab4
jmp fcn.004084fd
mov ebx, 0x42c01b
mov byte [ebp + 0xa], 0
mov ebp, ebx
mov byte [ebp + 0xa], 1
call 0x406a84
jmp fcn.004084fd
cmp ebp, 0x42c0e1
jne 0x407fd8
ret
push es
call fcn.004068f7
push ebp
call fcn.004045e7
pop ebp
lahf
push eax
push edi
call fcn.004087ae
mov dx, di
pop edi
and di, 0xffff
pop eax
cmp byte [0x42c7b4], 1
je 0x408057
sahf
jne 0x40801b
jb 0x40803e
call fcn.0040482d
pop edx
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte gs:[ecx + 0x6e], ch
and byte [edx + 0x6f], bh
outsb dx, byte [esi]
add cl, ch
add dword es:[eax], eax
add byte [eax + 0x42e68f3d], al
add byte [eax], al
cmp byte [0x42e68f], 0
jne 0x40809b
mov byte [0x42c7b4], 1
mov word [0x42c7b2], dx
mov word [0x42c7b0], di
jmp 0x408141
mov edi, 0x4506d6
mov ebx, 5
call fcn.004044f5
call fcn.00407105
jmp 0x408141
mov byte [0x42c7b4], 0
mov cx, di
sub cx, word [0x42c7b0]
mov ax, dx
sbb ax, word [0x42c7b2]
jb 0x408143
cmp ax, 0
jne 0x408143
mov dx, word [0x42c7b2]
call fcn.004068f7
mov ebx, edi
mov edi, dword [0x42c7b0]
jmp 0x408100
mov cl, byte [0x42e68f]
xor ax, ax
cmp cl, 1
je 0x4080bb
cmp cl, 2
mov al, 0x24
je 0x4080bb
cmp cl, 3
mov al, 0x80
je 0x4080bb
mov ax, 0xffff
mov ecx, 0x2000
push es
push edi
push eax
xor eax, eax
mov ax, dx
call fcn.00408792
pop eax
cmp byte [0x42e662], 1
je 0x4080e4
cmp byte [0x42e662], 2
je 0x4080e4
repne scasb al, byte es:[edi]
jmp 0x4080eb
shr ecx, 1
repne scasw ax, word es:[edi]
shl ecx, 1
neg ecx
add ecx, 0x2000
push ecx
call fcn.004068f7
pop ecx
mov ebx, edi
add ebx, ecx
pop edi
pop es
cmp cx, 0x2000
jae 0x408143
or cx, cx
je 0x408143
push edi
mov edi, 0x4506d1
push ebx
mov ebx, 5
push ecx
call fcn.00404500
pop ecx
pop ebx
pop edi
jne 0x408141
mov al, byte [0x42e662]
shl al, 6
or ch, al
mov byte [esi + 2], dl
mov word [esi], di
mov word [esi + 3], cx
call fcn.0040686c
call fcn.00407105
pop es
ret
call fcn.0040482d
inc esp
popal
je 0x4081ad
jp 0x4081bd
outsb dx, byte [esi]
and byte gs:[edi + ebp*2 + 0x6f], dh
and byte [edi + ebp*2 + 0x6e], ch
das
jae 0x4081c4
outsd dx, dword [esi]
jb 0x4081d3
das
arpl word [edx + 0x6f], si
jae 0x4081d8
and byte fs:[ecx], dh
dec ebx
and byte [edx + 0x6f], ah
jne 0x4081de
popal
jb 0x4081ed
add bl, ch
retf 0xb1e8
call fcn.0040482d
add byte [ecx + 0x64], al
jb 0x4081e7
jae 0x4081f7
and byte [edi + ebp*2 + 0x20], dh
jo 0x4081f9
jae 0x4081f5
je 0x4081f7
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [edi + ebp*2 + 0x3a], dh
add byte [esi + 0x44deca], bh
call fcn.0040423d
cmp cl, 0xff
je 0x4081b7
cmp cl, 0xfe
jae 0x4081b6
mov bx, ax
call fcn.0040686c
jmp fcn.004072f9
mov ebx, 0xe9ffffe6
inc ebx
int1
invalid
ret
jmp 0x404822
cmp ebp, 0x42c01b
jne 0x4082cc
std
sbb eax, eax
inc edx
add byte [edi], cl
test dword [ecx + eax], eax
add al, 1
add byte [eax], al
mov word [0x42c264], ax
cmp ebp, 0x42c01b
jne 0x408204
add byte [ebp + 0x2e], dh
call fcn.0040482d
add byte [ebp + 0x6e], al
invalid
je 0x408245
jb 0x408202
imul ebp, dword [esi + 0x73], 0x63757274
jne 0x40824c
je 0x408254
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [edi + ebp*2 + 0x20], dh
popal
jae 0x408267
insd dword es:[edi], dx
insd dword es:[edi], dx
bound ebp, qword [ebp]
cmp byte [0x44dec9], 0
insb byte es:[edi], dx
add byte gs:[eax + 0x44dec93d], al
add byte [eax + 0x44dec93d], al
add byte [eax], al
jne 0x408227
and al, 0xc3
ret
call fcn.0040482d
inc edi
outsd dx, dword [esi]
and byte [edi + ebp*2 + 0x20], dh
inc ebx
dec edi
inc esp
inc ebp
sub eax, 0x206e6977
imul si, word [edx + 0x73], 0x2c74
and byte [eax + 0x6c], dh
popal
jae 0x40828a
add bl, al
call fcn.00406e35
jae 0x40822f
ret
call fcn.004068f7
mov esi, 0x44deca
push ds
mov word [0x4432a0], di
mov word [0x4432a4], cs
mov dword [0x4432a2], 0x443220
mov byte [0x4432b4], 0
inc esp
add bh, al
add eax, 0x4432a2
and byte [edx], dh
inc esp
add dh, al
add byte [eax], ah
xor al, byte [eax + eax - 0x3a]
add eax, 0x4432b4
add bh, al
add eax, 0x44321c
or byte [eax], al
add byte [eax], al
xor al, byte [eax + eax]
mov dword [0x44321c], 8
call fcn.00415e55
cmp word [0x443214], 0
jne 0x408292
mov ecx, dword [0x44321c]
push es
mov esi, 0x443220
call fcn.00412e3c
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
pop es
pop ds
call fcn.00407105
jmp 0x406aa4
out dx, al
invalid
mov eax, 4
test word [0x443214], ax
pop ds
jne 0x4082b6
call fcn.0040482d
push eax
popal
jb 0x40830b
insd dword es:[edi], dx
je 0x408313
jb 0x4082d0
inc esi
popal
imul ebp, dword [eax + eax - 0x3d], 0xffc572e8
call dword [ebp + 0x6e]
call fcn.0040482d
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
and byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
add bl, al
cmp ebp, 0x42c07e
jne 0x40831a
inc edx
add byte [ebp + 0x46], dh
call fcn.004068f7
cmp byte [ebp + 8], 0x2a
ja 0x408307
mov bl, al
call fcn.00404174
jb 0x408361
nop
nop
nop
nop
mov al, bl
mov ah, 0xf0
test byte [ebp + 8], 1
je 0x4082fc
shl al, 4
rol ah, 4
push eax
call fcn.00412e3c
pop eax
and byte [ebx], ah
or al, byte [ebx]
push eax
call fcn.00412e3c
add byte [eax], al
pop eax
mov byte [ebx], al
call fcn.00407105
jmp 0x4069dc
invalid
cmp ebp, 0x42c144
je 0x408367
cmp ebp, 0x42c0e1
jne 0x408361
jmp 0x408367
sub ah, 0xca
movzx ebx, ah
cmp bl, 6
jae 0x408361
add ebx, ebx
mov eax, 1
mov cl, byte [ebx + 0x42c204]
shl al, cl
xor byte [0x42c001], al
push ebp
push dword [ebp + 0x3f]
call sub.USER32.dll_SetFocus
mov ebp, 0x42c0e1
call fcn.004072f9
pop ebp
ret
ret
jmp 0x404822
mov word [0x42c264], ax
call fcn.0040482d
add byte [ebp + 0x6e], al
je 0x4083dc
jb 0x408399
outsb dx, byte [esi]
ja 0x40839d
jbe 0x4083e0
insb byte es:[edi], dx
jne 0x4083e7
cmp al, byte [eax]
mov esi, 0x44deca
call fcn.0040423d
cmp cl, 0xfe
je 0x408361
ja 0x408362
xor ecx, ecx
mov cl, byte [ebp + 9]
sub cl, byte [ebp + 1]
or dword [edx], ebp
dec ebp
add dword [ecx + 0x42c144fd], eax
add byte [ecx + edx + 3], dh
leave
cmp ebp, 0x42c144
je 0x4083b6
add ecx, ecx
mov ebx, 0x42c001
add ebx, ecx
mov word [ebx], ax
jmp fcn.00407105
add ecx, ecx
neg ecx
mov edi, dword [ebp + 4]
add edi, ecx
push eax
call fcn.00412e3c
pop eax
mov word [ebx], ax
jmp fcn.00407105
pushal
call fcn.00409867
push 0x42ca20
push 0x407081
push eax
push 0x42c7b8
push dword [0x42ee6c]
inc eax
add byte [eax + 0x68], dl
mov eax, 0xff0042c7
xor eax, 0x42ee6c
out dx, al
inc edx
add al, ch
imul ebx, dword [eax], 2
add al, ch
mov cl, 0x14
add byte [eax], al
call sub.USER32.dll_DialogBoxIndirectParamA
call fcn.004098a5
popal
ret
cmp byte [0x42e857], 3
mov al, 0x1f
je 0x4087f8
mov al, 0x1e
jmp 0x4079a4
pushal
push 0x250
push 0x44dc78
push 0x4490fc
call sub.KERNEL32.DLL_GetEnvironmentVariableA
or eax, eax
je 0x4097cc
cmp eax, 0x250
jae 0x4097cc
mov esi, 0x44dc78
call fcn.0040974e
popal
ret
mov byte [0x42ed11], 0
mov byte [0x42ed12], 0
cmp byte [0x42ee75], 0
je 0x40a49f
call fcn.0040a392
call fcn.0040a3a8
jb 0x40a4aa
call fcn.0040a41b
call fcn.0040a42e
call fcn.0040a44b
call fcn.0040a457
call fcn.0040a227
call fcn.0040a266
call fcn.0040bb84
ret
je 0x40a495
inc byte [0x42ed11]
jmp 0x40a495
push 1
push 0
push 0
push edi
push 0x40a7fb
push 0
call sub.SHELL32.DLL_ShellExecuteA
ret
pushal
call fcn.0040c79a
mov edx, dword [0x42cb0c]
mov dword [0x42fde1], edx
mov ecx, eax
mov edx, 1
shl edx, cl
and edx, 0x1ff
mov dword [0x42fe13], edx
mov dword [0x42fe17], edx
cmp eax, 0x20
jne 0x40c59f
cmp byte [0x42fddc], 3
je 0x40c59f
mov al, 0x18
mov word [0x42fe01], ax
mov edx, dword [0x42caf0]
mov dword [0x42fdf7], edx
mul edx
shr eax, 3
mov edx, dword [0x42caf4]
neg edx
sub edx, 0x40
mov dword [0x42fdfb], edx
mul edx
mov ecx, dword [0x42fe13]
shl ecx, 2
add ecx, 0x36
mov dword [0x42fdef], ecx
mov dword [0x42fe07], eax
add eax, ecx
mov dword [0x42fde7], eax
push 0
call sub.USER32.dll_OpenClipboard
or eax, eax
je 0x40c723
call sub.USER32.dll_EmptyClipboard
mov eax, dword [0x42fde7]
sub eax, 0xe
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
je 0x408f19
push eax
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
mov esi, 0x42fe1f
mov edx, 0x42fdf3
mov ecx, 0x28
cmp byte [0x42fddc], 3
je 0x40c641
mov edx, 0x42fde5
mov ecx, 0x36
call fcn.0040c725
cmp dword [0x42fddd], 8
ja 0x40c6c5
cmp byte [0x42ed38], 0
je 0x40c68b
mov ecx, dword [0x42fde1]
mov edx, 0x42cd18
push ecx
push edx
movzx eax, byte [edx]
shl eax, 0x10
mov al, byte [edx + 2]
mov ah, byte [edx + 1]
mov edx, 0x42fe1b
mov dword [edx], eax
mov ecx, 4
call fcn.0040c725
pop edx
pop ecx
add edx, 4
loop 0x40c663
jmp 0x40c69e
mov edx, 0x42cb14
mov ecx, dword [0x42fde1]
shl ecx, 2
call fcn.0040c725
mov ecx, dword [0x42fe13]
sub ecx, dword [0x42fde1]
jecxz 0x40c6c5
push ecx
mov edx, 0x42fe1b
mov dword [edx], 0
mov ecx, 4
call fcn.0040c725
pop ecx
loop 0x40c6ac
mov ebx, dword [0x42d0d8]
mov eax, dword [0x42fdf7]
shr eax, 3
mul dword [0x42fddd]
mov ecx, eax
mov edx, dword [0x42fdfb]
dec edx
mul edx
mov edx, eax
add edx, ebx
mov ebx, dword [0x42fdfb]
call fcn.0040c73b
sub edx, ecx
dec ebx
jne 0x40c6ee
cmp byte [0x42fddc], 3
je 0x40c70d
mov esi, 0x42fe1f
call fcn.00409422
jmp 0x40c723
pop eax
push eax
push eax
call sub.KERNEL32.DLL_GlobalUnlock
pop eax
push eax
push 8
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
popal
ret
pushal
call fcn.0040bb84
mov al, byte [0x42dcf5]
push eax
mov byte [0x430be7], 1
mov byte [0x42dcf5], 1
call fcn.0040db64
mov esi, 0x430bbd
call fcn.00409248
mov ecx, 0x4000
call fcn.0040db59
call fcn.00409422
mov byte [0x42dcf5], 3
call fcn.0040db64
mov esi, 0x430bd2
call fcn.00409248
mov ecx, 0x4000
call fcn.0040db59
mov byte [0x430be7], 0
call fcn.0040db64
mov ecx, 0x4000
call fcn.0040db59
call fcn.00409422
pop eax
mov byte [0x42dcf5], al
call fcn.0040dab1
popal
ret
mov al, 0x3f
jmp 0x411b55
mov al, 0xbf
call fcn.0040a4b4
jb 0x411b7a
cmp byte [0x42e520], 0
je 0x411d16
push eax
call fcn.00411b24
call fcn.00411d3e
pop eax
call fcn.00411ecc
ret
pushal
call fcn.00409867
push 0x44ae8e
push 0x4098ce
push eax
push 0x44ae00
push dword [0x42ee6c]
call sub.USER32.dll_DialogBoxIndirectParamA
call fcn.004098a5
popal
ret