Function at 0x454045
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xd8
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x58], ecx
call fcn.004379a9
mov al, byte [ebp + 0x7c]
cmp al, 1
pop ecx
mov byte [ebp + 0x57], al
jne 0x45406b
mov byte [ebp + 0x57], 0
push ebx
cmp al, 1
sete bl
push esi
lea ecx, [ebp + 0x24]
mov byte [ebp + 0x7c], bl
call fcn.0043d47d
lea ecx, [ebp + 0x28]
call fcn.0043d47d
lea eax, [ebp + 0x74]
push eax
call fcn.004379a9
test bl, bl
pop ecx
je 0x454097
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe29
add esp, 0xc
test bl, bl
je 0x4540b5
mov eax, dword [ebp + 0x24]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x58]
push 0
lea eax, [ebp + 0x24]
push eax
call fcn.00402d87
mov eax, dword [ebp + 0x24]
movsx esi, bl
shl esi, 1
lea ebx, [esi + eax]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
mov dword [ebp + 0x30], ebx
je 0x4540e4
mov esi, 0x80070057
jmp 0x454f0b
add dword [ebp + 0x74], 2
push edi
push 0x3b
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043fe7c
mov eax, dword [ebp + 0x74]
mov di, word [eax]
add esp, 0x10
cmp di, 0x2c
je 0x45410f
cmp di, 0x3b
jne 0x454113
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x57], 0
mov byte [ebp + 0x67], 0
jne 0x45427a
push dword [ebp + 0x28]
push str.WINVER
call fcn.00438bce
test al, al
pop ecx
pop ecx
jne 0x45414f
push dword [ebp + 0x28]
push 0x4aca18
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x45427a
mov byte [ebp + 0x67], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.004379a9
mov eax, dword [ebp + 0x74]
xor edi, edi
xor ebx, ebx
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], edi
jne 0x454172
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x454197
lea ecx, [eax + 2]
cmp word [ecx], di
mov byte [ebp + 0x67], 1
jne 0x454192
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x67], 0x2a
jmp 0x454197
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, di
mov dword [ebp + 0x34], ecx
jne 0x4541ae
cmp byte [ebp + 0x67], 0
je 0x454235
mov dword [ebp + 0x7c], edi
cmp word [eax], 0x2a
je 0x4541bd
cmp byte [ebp + 0x67], 0x2a
jne 0x45420e
mov eax, dword [ebp + 0x58]
cmp byte [eax + 0x92], 0
push 0x11
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x4541f4
test byte [eax + 9], 0xf
jne 0x4541f4
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044c004
jmp 0x454208
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044b30d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 0
push dword [ebp + 0x3c]
push eax
call fcn.00407532
add esp, 0xc
lea ecx, [ebp + 0x7c]
mov ebx, eax
mov edi, edx
call fcn.00437960
cmp byte [ebp + 0x67], 0
jne 0x454235
cmp word [ebp + 0x34], 0
jne 0x454260
mov esi, ebx
mov dword [ebp + 0x3c], edi
call fcn.0043a455
cmp byte [ebp + 0x67], 0
mov ebx, eax
mov edi, edx
je 0x454260
shld edi, ebx, 0x10
shl ebx, 0x10
and esi, 0xffff
xor eax, eax
or esi, ebx
or eax, edi
mov ebx, esi
mov edi, eax
push str.0x_I64X
push dword [ebp + 0x30]
push edi
push ebx
push dword [ebp + 0x58]
call fcn.0043f76f
add esp, 0x14
jmp 0x454f08
push dword [ebp + 0x28]
push str.ispe
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x4542a4
push ebx
call fcn.004093ba
push eax
push dword [ebp + 0x58]
call fcn.0043f7f4
add esp, 0xc
jmp 0x454f08
test di, di
je 0x4542b9
cmp di, 0x2c
je 0x4542b9
mov esi, 0x80070057
jmp 0x454f0a
cmp byte [ebp + 0x57], 0
je 0x4542c9
cmp byte [ebp + 0x57], 2
jne 0x454793
push dword [ebp + 0x24]
lea ecx, [ebp + 0x50]
call fcn.004457e4
cmp byte [ebp + 0x7c], 0
mov edi, dword [ebp + 0x50]
je 0x4542e2
mov word [edi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.004379a9
mov ebx, dword [ebp + 0x28]
push ebx
push str.FVER
call fcn.00438bce
add esp, 0xc
test al, al
je 0x4543bc
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
push dword [ebp + 0x74]
xor ebx, ebx
mov dword [ebp + 0x5c], ebx
call fcn.0041113a
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x7c], edi
xor esi, esi
call fcn.00437e54
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x45435e
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe7c
mov eax, dword [ebp + 0x68]
mov si, word [eax]
add esp, 0x10
mov ax, si
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [edi]
neg ax
lea ecx, [ebp + 0x4c]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00407532
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push dword [ebp + 0x4c]
push edi
call fcn.0043cd78
cmp si, bx
je 0x4543a4
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x68]
call fcn.0043cd78
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x5c]
call fcn.00437960
lea ecx, [ebp + 0x4c]
jmp 0x454718
push ebx
push str.FTIME
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454558
push dword [ebp + 0x74]
call fcn.0041113a
pop ecx
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.0043d47d
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
lea ecx, [ebp + 0x44]
call fcn.0043d47d
push 6
lea eax, [ebp + 0x60]
push eax
add esi, edi
push str._local
mov dword [ebp + 0x60], esi
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x454426
cmp byte [ebp + 0x7c], 0
je 0x454422
sub dword [ebp + 0x60], 2
mov eax, dword [ebp + 0x60]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
push 3
lea eax, [ebp + 0x60]
push eax
push 0x4ac9a8
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x454441
or byte [ebp + 0x7c], 4
push 4
lea eax, [ebp + 0x60]
push eax
push str._ws1
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x45445c
or byte [ebp + 0x7c], 8
cmp byte [ebp + 0x7c], 0
je 0x454467
mov word [edi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], si
jne 0x454498
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fe29
add esp, 0xc
mov eax, dword [ebp + 0x60]
cmp word [eax], si
jne 0x4544b5
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043fe29
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x454525
push dword [ebp + 0x7c]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.0044087c
push dword [ebp + 0x7c]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x58]
call fcn.0044087c
push dword [ebp + 0x7c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x58]
call fcn.0044087c
add esp, 0x30
lea ecx, [ebp + 0x44]
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x50]
call fcn.00437960
jmp 0x454f0a
mov ecx, dword [ebp + 0x58]
mov esi, 0x4a39d4
push esi
push dword [ebp + 0x68]
call fcn.0043cd78
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x4c]
call fcn.0043cd78
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x44]
call fcn.0043cd78
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x454500
push ebx
push str.FATTR
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454789
push dword [ebp + 0x74]
call fcn.0041113a
mov bl, byte [ebp + 0x7c]
test bl, bl
pop ecx
mov dword [ebp + 0x3c], eax
je 0x454585
mov word [edi], 0x26
lea ecx, [ebp + 0x60]
call fcn.0043d47d
lea ecx, [ebp + 0x44]
call fcn.0043d47d
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
lea ecx, [ebp + 0x68]
call fcn.0043d47d
lea ecx, [ebp + 0x5c]
call fcn.0043d47d
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], edi
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x45466c
test bl, bl
je 0x4545db
mov word [eax], 0x26
jmp 0x4545e0
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x45466c
test bl, bl
je 0x454604
mov word [eax], 0x26
jmp 0x454609
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x45466c
test bl, bl
je 0x45462d
mov word [eax], 0x26
jmp 0x454632
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x45466c
test bl, bl
je 0x454656
mov word [eax], 0x26
jmp 0x45465b
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x454725
mov eax, dword [ebp - 8]
push dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.0043f7f4
mov eax, dword [ebp - 8]
push dword [ebp + 0x44]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.0043f7f4
mov eax, dword [ebp - 8]
push dword [ebp + 0x4c]
and eax, edi
push eax
push esi
call fcn.0043f7f4
mov eax, dword [ebp - 8]
push dword [ebp + 0x68]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.0043f7f4
push dword [ebp - 8]
and word [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push str.0x_lX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0043cd78
lea ecx, [ebp + 0x5c]
call fcn.00437960
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x44]
call fcn.00437960
lea ecx, [ebp + 0x60]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x454f03
mov edi, dword [ebp + 0x58]
mov esi, 0x4a39d4
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0043cd78
push esi
push dword [ebp + 0x44]
mov ecx, edi
call fcn.0043cd78
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.0043cd78
push esi
push dword [ebp + 0x68]
mov ecx, edi
call fcn.0043cd78
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437960
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x44]
call fcn.00437960
lea ecx, [ebp + 0x60]
jmp 0x454513
lea ecx, [ebp + 0x50]
call fcn.00437960
jmp 0x454796
mov ebx, dword [ebp + 0x28]
cmp byte [ebp + 0x57], 0
push 0x26
pop edi
jne 0x454f08
push dword [ebp + 0x24]
lea ecx, [ebp + 0x60]
call fcn.004457e4
lea eax, [ebp + 0x74]
push eax
call fcn.004379a9
push ebx
push str.DROPFILE
call fcn.00438bce
add esp, 0xc
test al, al
je 0x4548a5
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
xor ebx, ebx
push eax
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], ebx
call fcn.00448773
pop ecx
pop ecx
lea ecx, [ebp + 0x50]
call fcn.0043d47d
lea ecx, [ebp + 0x44]
call fcn.0043d47d
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x454836
cmp byte [ebp + 0x7c], bl
je 0x45481f
mov word [eax], di
jmp 0x454824
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0043fe29
add esp, 0xc
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
lea ecx, [ebp + 0x68]
call fcn.0043d47d
mov esi, dword [ebp + 0x44]
xor eax, eax
cmp word [esi], bx
je 0x454853
lea eax, [ebp + 0x68]
mov ecx, dword [ebp + 0x38]
or ecx, dword [ebp + 0x3c]
je 0x45486b
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x38]
call fcn.00404599
add esp, 0xc
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0043cd78
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x58]
push esi
call fcn.0043cd78
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x44]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x454efb
push ebx
push str.FPOS
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454ab4
push dword [ebp + 0x74]
call fcn.0041113a
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.004379a9
push dword [ebp + 0x68]
call fcn.0040f0fb
add esp, 0xc
lea ecx, [ebp + 0x3c]
call fcn.0043d47d
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x68]
call fcn.004114d4
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x3c]
mov esi, dword [ebp + 0x60]
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
je 0x454902
mov word [esi], di
lea ecx, [ebp + 0x34]
call fcn.0043d47d
lea ecx, [ebp + 0x30]
call fcn.0043d47d
lea ecx, [ebp + 0x20]
call fcn.0043d47d
lea ecx, [ebp + 0x50]
call fcn.0043d47d
lea ecx, [ebp + 0x44]
call fcn.0043d47d
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
lea ecx, [ebp + 0x5c]
call fcn.0043d47d
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x454966
mov word [eax], di
jmp 0x45496b
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x454991
mov word [eax], di
jmp 0x454996
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x4549bc
mov word [eax], di
jmp 0x4549c1
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x4549e3
mov word [eax], di
jmp 0x4549e8
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x454a0a
mov word [eax], di
jmp 0x454a0f
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x454a47
test bl, bl
je 0x454a31
mov word [eax], di
jmp 0x454a36
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe29
add esp, 0xc
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x44]
push dword [ebp + 0x50]
push dword [ebp + 0x20]
push dword [ebp + 0x30]
push dword [ebp + 0x34]
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.00436739
add esp, 0x24
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x44]
call fcn.00437960
lea ecx, [ebp + 0x50]
call fcn.00437960
lea ecx, [ebp + 0x20]
call fcn.00437960
lea ecx, [ebp + 0x30]
call fcn.00437960
lea ecx, [ebp + 0x34]
call fcn.00437960
lea ecx, [ebp + 0x3c]
call fcn.00437960
lea ecx, [ebp + 0x60]
jmp 0x45451b
push ebx
push str.PPID
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454af9
and dword [ebp + 0x38], 0
and dword [ebp + 0x3c], 0
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00448773
pop ecx
pop ecx
push dword [ebp + 0x60]
push dword [ebp + 0x38]
call fcn.00404a04
pop ecx
push eax
push dword [ebp + 0x58]
call fcn.0043f7f4
add esp, 0xc
jmp 0x454f00
push ebx
push str.ISADMIN
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454b14
push dword [ebp + 0x60]
call fcn.00484485
jmp 0x454ae8
push ebx
push str.PWIN
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454c93
lea ecx, [ebp + 0x3c]
call fcn.0043d47d
lea ecx, [ebp + 0x68]
call fcn.0043d47d
mov eax, dword [ebp + 0x60]
xor edi, edi
push edi
mov dword [ebp + 0x34], eax
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004331cb
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0043fe29
add esp, 0x1c
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x30], edi
call fcn.004050d3
test eax, eax
pop ecx
pop ecx
je 0x454b8c
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004050d3
test eax, eax
pop ecx
pop ecx
je 0x454ba5
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], 3
mov dword [ebp + 0x30], edi
call fcn.004050d3
pop ecx
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, edi
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x454c64
cmp dword [ebp + 0x2c], 3
jne 0x454bf6
cmp dword [ebp + 0x30], 0
jne 0x454bf6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0
je 0x454c64
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
call edi
mov ebx, 0x40000000
jmp 0x454c1f
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x454c23
push 0xfffffffffffffff0
push eax
mov dword [ebp + 0x5c], eax
call edi
test ebx, eax
jne 0x454c0a
cmp dword [ebp + 0x2c], 3
jne 0x454c2f
cmp dword [ebp + 0x30], 0
je 0x454c64
mov edi, dword [ebp + 0x5c]
and dword [ebp + 0x48], 0
and dword [ebp + 0x4c], 0
lea eax, [ebp + 0x48]
push eax
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x44]
sub eax, dword [ebp + 0x4c]
sub esi, dword [ebp + 0x48]
push eax
push esi
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x454c64
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x3c]
push dword [ebp + 0x7c]
push dword [ebp + 0x58]
call fcn.004458b6
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.004458b6
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x3c]
jmp 0x454efb
push ebx
push str.PEBIT
call fcn.00438bce
test al, al
pop ecx
pop ecx
je 0x454f00
mov eax, dword [ebp + 0x60]
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x30], eax
call fcn.0043d47d
lea ecx, [ebp + 0x68]
call fcn.0043d47d
xor edi, edi
push edi
push 0x2c
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.004331cb
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043fe29
or dword [ebp + 0x40], 0xffffffff
or dword [ebp + 0x44], 0xffffffff
push 0xd
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4a39d4
push eax
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x4c], edi
call fcn.00418d74
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], di
je 0x454ea1
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x454d3d
cmp cx, 0x2f
je 0x454d3d
push edx
call fcn.0048ef50
test eax, eax
pop ecx
je 0x454d60
jmp 0x454d40
mov word [eax], di
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.0043d5a1
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.0043d4e9
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x3c], edi
call fcn.0040511c
mov ebx, dword [ebp + 0x3c]
cmp ebx, edi
mov dword [ebp + 0x50], esi
je 0x454e99
and dword [ebp + 0x7c], edi
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x20]
call fcn.0043d49b
push esi
push edi
mov edi, dword [ebp + 0x20]
push edi
call fcn.0048f7a0
add esp, 0xc
push 0
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
push ebx
call esi
test eax, eax
je 0x454e91
cmp dword [ebp + 0x7c], 0x40
jb 0x454e91
cmp word [edi], 0x5a4d
jne 0x454e91
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x454e0b
xor ecx, ecx
push ecx
push ecx
push eax
push ebx
mov dword [edi], ecx
mov dword [edi + 4], ecx
call fcn.00438aec
and dword [ebp + 0x7c], 0
add esp, 0x10
push 0
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x454e91
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x40], ecx
mov dword [ebp + 0x44], edi
jne 0x454e61
cmp edi, 0x8664
jne 0x454e40
mov dword [ebp + 0x50], 0x4ac940
jmp 0x454e91
cmp ecx, eax
jne 0x454e61
cmp edi, 0x14c
je 0x454e8a
cmp ecx, eax
jne 0x454e61
cmp edi, 0x200
jne 0x454e61
mov dword [ebp + 0x50], str.ia64
jmp 0x454e91
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x454e91
cmp edi, 0x137
je 0x454e8a
cmp ecx, eax
jne 0x454e91
cmp edi, 0x1b0
je 0x454e8a
cmp ecx, eax
jne 0x454e91
cmp edi, 0xe7
jne 0x454e91
mov dword [ebp + 0x50], 0x4ac92c
lea ecx, [ebp + 0x20]
call fcn.00437960
lea ecx, [ebp + 0x3c]
call fcn.00402b5a
push dword [ebp + 0x50]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x34]
call fcn.0043cd78
cmp dword [ebp + 0x44], 0
jg 0x454ecf
jl 0x454ebd
cmp dword [ebp + 0x40], 0
ja 0x454ecf
mov ecx, dword [ebp + 0x58]
push str._0x000000000001
push dword [ebp + 0x68]
call fcn.0043cd78
jmp 0x454ee8
push str.0x_012I64X
push dword [ebp + 0x68]
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.0043f76f
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.00437960
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x34]
call fcn.00437960
lea ecx, [ebp + 0x60]
call fcn.00437960
xor esi, esi
pop edi
lea ecx, [ebp + 0x28]
call fcn.00437960
lea ecx, [ebp + 0x24]
call fcn.00437960
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc