Function at 0x4549dc
Capabilities:
Parse credit card information
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xd8
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x58], ecx
call fcn.00437e65
mov al, byte [ebp + 0x7c]
cmp al, 1
pop ecx
mov byte [ebp + 0x57], al
jne 0x454a02
mov byte [ebp + 0x57], 0
push ebx
cmp al, 1
sete bl
push esi
lea ecx, [ebp + 0x24]
mov byte [ebp + 0x7c], bl
call fcn.0043dd7e
lea ecx, [ebp + 0x28]
call fcn.0043dd7e
lea eax, [ebp + 0x74]
push eax
call fcn.00437e65
test bl, bl
pop ecx
je 0x454a2e
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004408ab
add esp, 0xc
test bl, bl
je 0x454a4c
mov eax, dword [ebp + 0x24]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x58]
push 0
lea eax, [ebp + 0x24]
push eax
call fcn.00402d33
mov eax, dword [ebp + 0x24]
movsx esi, bl
shl esi, 1
lea ebx, [esi + eax]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
mov dword [ebp + 0x30], ebx
je 0x454a7b
mov esi, 0x80070057
jmp 0x455895
add dword [ebp + 0x74], 2
push edi
push 0x3b
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004408fe
mov eax, dword [ebp + 0x74]
mov di, word [eax]
add esp, 0x10
cmp di, 0x2c
je 0x454aa6
cmp di, 0x3b
jne 0x454aaa
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x57], 0
mov byte [ebp + 0x67], 0
jne 0x454c11
push dword [ebp + 0x28]
push str.WINVER
call fcn.004391ba
test al, al
pop ecx
pop ecx
jne 0x454ae6
push dword [ebp + 0x28]
push 0x4af280
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x454c11
mov byte [ebp + 0x67], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.00437e65
mov eax, dword [ebp + 0x74]
xor edi, edi
xor ebx, ebx
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x3c], edi
jne 0x454b09
or dword [ebp + 0x3c], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x454b2e
lea ecx, [eax + 2]
cmp word [ecx], di
mov byte [ebp + 0x67], 1
jne 0x454b29
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x67], 0x2a
jmp 0x454b2e
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, di
mov dword [ebp + 0x34], ecx
jne 0x454b45
cmp byte [ebp + 0x67], 0
je 0x454bcc
mov dword [ebp + 0x7c], edi
cmp word [eax], 0x2a
je 0x454b54
cmp byte [ebp + 0x67], 0x2a
jne 0x454ba5
mov eax, dword [ebp + 0x58]
cmp byte [eax + 0x92], 0
push 0x11
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x454b8b
test byte [eax + 9], 0xf
jne 0x454b8b
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044c7f3
jmp 0x454b9f
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044bafc
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 0
push dword [ebp + 0x3c]
push eax
call fcn.0040764f
add esp, 0xc
lea ecx, [ebp + 0x7c]
mov ebx, eax
mov edi, edx
call fcn.00437e1a
cmp byte [ebp + 0x67], 0
jne 0x454bcc
cmp word [ebp + 0x34], 0
jne 0x454bf7
mov esi, ebx
mov dword [ebp + 0x3c], edi
call fcn.0043aaf4
cmp byte [ebp + 0x67], 0
mov ebx, eax
mov edi, edx
je 0x454bf7
shld edi, ebx, 0x10
shl ebx, 0x10
and esi, 0xffff
xor eax, eax
or esi, ebx
or eax, edi
mov ebx, esi
mov edi, eax
push str.0x_I64X
push dword [ebp + 0x30]
push edi
push ebx
push dword [ebp + 0x58]
call fcn.004401e1
add esp, 0x14
jmp 0x455892
push dword [ebp + 0x28]
push str.ispe
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x454c3b
push ebx
call fcn.00409558
push eax
push dword [ebp + 0x58]
call fcn.00440266
add esp, 0xc
jmp 0x455892
test di, di
je 0x454c50
cmp di, 0x2c
je 0x454c50
mov esi, 0x80070057
jmp 0x455894
cmp byte [ebp + 0x57], 0
je 0x454c60
cmp byte [ebp + 0x57], 2
jne 0x45512a
push dword [ebp + 0x24]
lea ecx, [ebp + 0x50]
call fcn.00446497
cmp byte [ebp + 0x7c], 0
mov edi, dword [ebp + 0x50]
je 0x454c79
mov word [edi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.00437e65
mov ebx, dword [ebp + 0x28]
push ebx
push str.FVER
call fcn.004391ba
add esp, 0xc
test al, al
je 0x454d53
lea ecx, [ebp + 0x4c]
call fcn.0043dd7e
push dword [ebp + 0x74]
xor ebx, ebx
mov dword [ebp + 0x5c], ebx
call fcn.0041161a
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x7c], edi
xor esi, esi
call fcn.00438346
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x454cf5
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408fe
mov eax, dword [ebp + 0x68]
mov si, word [eax]
add esp, 0x10
mov ax, si
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [edi]
neg ax
lea ecx, [ebp + 0x4c]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.0040764f
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push dword [ebp + 0x4c]
push edi
call fcn.0043d658
cmp si, bx
je 0x454d3b
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x68]
call fcn.0043d658
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
jmp 0x4550af
push ebx
push str.FTIME
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x454eef
push dword [ebp + 0x74]
call fcn.0041161a
pop ecx
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.0043dd7e
lea ecx, [ebp + 0x4c]
call fcn.0043dd7e
lea ecx, [ebp + 0x44]
call fcn.0043dd7e
push 6
lea eax, [ebp + 0x60]
push eax
add esi, edi
push str._local
mov dword [ebp + 0x60], esi
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x454dbd
cmp byte [ebp + 0x7c], 0
je 0x454db9
sub dword [ebp + 0x60], 2
mov eax, dword [ebp + 0x60]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
push 3
lea eax, [ebp + 0x60]
push eax
push 0x4af214
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x454dd8
or byte [ebp + 0x7c], 4
push 4
lea eax, [ebp + 0x60]
push eax
push str._ws1
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x454df3
or byte [ebp + 0x7c], 8
cmp byte [ebp + 0x7c], 0
je 0x454dfe
mov word [edi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], si
jne 0x454e2f
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004408ab
add esp, 0xc
mov eax, dword [ebp + 0x60]
cmp word [eax], si
jne 0x454e4c
add dword [ebp + 0x60], 2
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004408ab
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x454ebc
push dword [ebp + 0x7c]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.004412fe
push dword [ebp + 0x7c]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x58]
call fcn.004412fe
push dword [ebp + 0x7c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x58]
call fcn.004412fe
add esp, 0x30
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
jmp 0x455894
mov ecx, dword [ebp + 0x58]
mov esi, 0x4a69d4
push esi
push dword [ebp + 0x68]
call fcn.0043d658
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x4c]
call fcn.0043d658
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x44]
call fcn.0043d658
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x454e97
push ebx
push str.FATTR
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x455120
push dword [ebp + 0x74]
call fcn.0041161a
mov bl, byte [ebp + 0x7c]
test bl, bl
pop ecx
mov dword [ebp + 0x3c], eax
je 0x454f1c
mov word [edi], 0x26
lea ecx, [ebp + 0x60]
call fcn.0043dd7e
lea ecx, [ebp + 0x44]
call fcn.0043dd7e
lea ecx, [ebp + 0x4c]
call fcn.0043dd7e
lea ecx, [ebp + 0x68]
call fcn.0043dd7e
lea ecx, [ebp + 0x5c]
call fcn.0043dd7e
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
mov dword [ebp + 0x7c], edi
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x455003
test bl, bl
je 0x454f72
mov word [eax], 0x26
jmp 0x454f77
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x455003
test bl, bl
je 0x454f9b
mov word [eax], 0x26
jmp 0x454fa0
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x455003
test bl, bl
je 0x454fc4
mov word [eax], 0x26
jmp 0x454fc9
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x455003
test bl, bl
je 0x454fed
mov word [eax], 0x26
jmp 0x454ff2
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4550bc
mov eax, dword [ebp - 8]
push dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.00440266
mov eax, dword [ebp - 8]
push dword [ebp + 0x44]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.00440266
mov eax, dword [ebp - 8]
push dword [ebp + 0x4c]
and eax, edi
push eax
push esi
call fcn.00440266
mov eax, dword [ebp - 8]
push dword [ebp + 0x68]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.00440266
push dword [ebp - 8]
and word [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push str.0x_lX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0043d658
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x60]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
jmp 0x45588d
mov edi, dword [ebp + 0x58]
mov esi, 0x4a69d4
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0043d658
push esi
push dword [ebp + 0x44]
mov ecx, edi
call fcn.0043d658
push esi
push dword [ebp + 0x4c]
mov ecx, edi
call fcn.0043d658
push esi
push dword [ebp + 0x68]
mov ecx, edi
call fcn.0043d658
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x60]
jmp 0x454eaa
lea ecx, [ebp + 0x50]
call fcn.00437e1a
jmp 0x45512d
mov ebx, dword [ebp + 0x28]
cmp byte [ebp + 0x57], 0
push 0x26
pop edi
jne 0x455892
push dword [ebp + 0x24]
lea ecx, [ebp + 0x60]
call fcn.00446497
lea eax, [ebp + 0x74]
push eax
call fcn.00437e65
push ebx
push str.DROPFILE
call fcn.004391ba
add esp, 0xc
test al, al
je 0x45523c
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
xor ebx, ebx
push eax
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], ebx
call fcn.00449426
pop ecx
pop ecx
lea ecx, [ebp + 0x50]
call fcn.0043dd7e
lea ecx, [ebp + 0x44]
call fcn.0043dd7e
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x4551cd
cmp byte [ebp + 0x7c], bl
je 0x4551b6
mov word [eax], di
jmp 0x4551bb
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004408ab
add esp, 0xc
lea ecx, [ebp + 0x4c]
call fcn.0043dd7e
lea ecx, [ebp + 0x68]
call fcn.0043dd7e
mov esi, dword [ebp + 0x44]
xor eax, eax
cmp word [esi], bx
je 0x4551ea
lea eax, [ebp + 0x68]
mov ecx, dword [ebp + 0x38]
or ecx, dword [ebp + 0x3c]
je 0x455202
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x38]
call fcn.0040468f
add esp, 0xc
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x50]
call fcn.0043d658
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x58]
push esi
call fcn.0043d658
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
jmp 0x455885
push ebx
push str.FPOS
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x45544b
push dword [ebp + 0x74]
call fcn.0041161a
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00437e65
push dword [ebp + 0x68]
call fcn.0040f54c
add esp, 0xc
lea ecx, [ebp + 0x3c]
call fcn.0043dd7e
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x68]
call fcn.004119b4
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x3c]
mov esi, dword [ebp + 0x60]
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
je 0x455299
mov word [esi], di
lea ecx, [ebp + 0x34]
call fcn.0043dd7e
lea ecx, [ebp + 0x30]
call fcn.0043dd7e
lea ecx, [ebp + 0x20]
call fcn.0043dd7e
lea ecx, [ebp + 0x50]
call fcn.0043dd7e
lea ecx, [ebp + 0x44]
call fcn.0043dd7e
lea ecx, [ebp + 0x4c]
call fcn.0043dd7e
lea ecx, [ebp + 0x5c]
call fcn.0043dd7e
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x4552fd
mov word [eax], di
jmp 0x455302
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x455328
mov word [eax], di
jmp 0x45532d
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x455353
mov word [eax], di
jmp 0x455358
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x45537a
mov word [eax], di
jmp 0x45537f
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x4553a1
mov word [eax], di
jmp 0x4553a6
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4553de
test bl, bl
je 0x4553c8
mov word [eax], di
jmp 0x4553cd
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004408ab
add esp, 0xc
push dword [ebp + 0x5c]
push dword [ebp + 0x4c]
push dword [ebp + 0x44]
push dword [ebp + 0x50]
push dword [ebp + 0x20]
push dword [ebp + 0x30]
push dword [ebp + 0x34]
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.004369d8
add esp, 0x24
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp + 0x44]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
lea ecx, [ebp + 0x20]
call fcn.00437e1a
lea ecx, [ebp + 0x30]
call fcn.00437e1a
lea ecx, [ebp + 0x34]
call fcn.00437e1a
lea ecx, [ebp + 0x3c]
call fcn.00437e1a
lea ecx, [ebp + 0x60]
jmp 0x454eb2
push ebx
push str.PPID
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x455490
and dword [ebp + 0x38], 0
and dword [ebp + 0x3c], 0
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00449426
pop ecx
pop ecx
push dword [ebp + 0x60]
push dword [ebp + 0x38]
call fcn.00404afa
pop ecx
push eax
push dword [ebp + 0x58]
call fcn.00440266
add esp, 0xc
jmp 0x45588a
push ebx
push str.ISADMIN
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x4554ab
push dword [ebp + 0x60]
call fcn.00487abf
jmp 0x45547f
push ebx
push str.PWIN
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x45561d
lea ecx, [ebp + 0x3c]
call fcn.0043dd7e
lea ecx, [ebp + 0x68]
call fcn.0043dd7e
mov eax, dword [ebp + 0x60]
xor esi, esi
push esi
mov dword [ebp + 0x34], eax
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00433754
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004408ab
add esp, 0x1c
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x30], esi
call fcn.0046fb37
test eax, eax
pop ecx
pop ecx
je 0x455523
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0046fb37
test eax, eax
pop ecx
pop ecx
je 0x45553c
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x20], eax
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x20]
and dword [ebp + 0x30], 0
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x2c], 3
call fcn.0046fb37
pop ecx
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
test eax, eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x4555ee
cmp dword [ebp + 0x2c], 3
jne 0x455587
cmp dword [ebp + 0x30], 0
jne 0x455587
mov eax, dword [ebp + 0x68]
cmp word [eax], 0
je 0x4555ee
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x4555a7
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4555b0
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x455594
cmp dword [ebp + 0x2c], 3
jne 0x4555bc
cmp dword [ebp + 0x30], 0
je 0x4555ee
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x48], 0
and dword [ebp + 0x4c], 0
lea eax, [ebp + 0x48]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x2c]
sub edi, dword [ebp + 0x4c]
sub esi, dword [ebp + 0x48]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x4555ee
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x3c]
push dword [ebp + 0x7c]
push dword [ebp + 0x58]
call fcn.00446569
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.00446569
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x3c]
jmp 0x455885
push ebx
push str.PEBIT
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x45588a
mov eax, dword [ebp + 0x60]
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x30], eax
call fcn.0043dd7e
lea ecx, [ebp + 0x68]
call fcn.0043dd7e
xor edi, edi
push edi
push 0x2c
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.00433754
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.004408ab
or dword [ebp + 0x40], 0xffffffff
or dword [ebp + 0x44], 0xffffffff
push 0xd
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4a69d4
push eax
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x4c], edi
call fcn.00419202
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], di
je 0x45582b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x4556c7
cmp cx, 0x2f
je 0x4556c7
push edx
call fcn.004925aa
test eax, eax
pop ecx
je 0x4556ea
jmp 0x4556ca
mov word [eax], di
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.0043dea2
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.0043ddea
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x3c], edi
call fcn.004051d2
mov ebx, dword [ebp + 0x3c]
cmp ebx, edi
mov dword [ebp + 0x50], esi
je 0x455823
and dword [ebp + 0x7c], edi
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x20]
call fcn.0043dd9c
push esi
push edi
mov edi, dword [ebp + 0x20]
push edi
call fcn.00492e00
add esp, 0xc
push 0
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push ebx
call esi
test eax, eax
je 0x45581b
cmp dword [ebp + 0x7c], 0x40
jb 0x45581b
cmp word [edi], 0x5a4d
jne 0x45581b
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x455795
xor ecx, ecx
push ecx
push ecx
push eax
push ebx
mov dword [edi], ecx
mov dword [edi + 4], ecx
call fcn.0043908b
and dword [ebp + 0x7c], 0
add esp, 0x10
push 0
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x45581b
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x40], ecx
mov dword [ebp + 0x44], edi
jne 0x4557eb
cmp edi, 0x8664
jne 0x4557ca
mov dword [ebp + 0x50], 0x4af1ac
jmp 0x45581b
cmp ecx, eax
jne 0x4557eb
cmp edi, 0x14c
je 0x455814
cmp ecx, eax
jne 0x4557eb
cmp edi, 0x200
jne 0x4557eb
mov dword [ebp + 0x50], str.ia64
jmp 0x45581b
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x45581b
cmp edi, 0x137
je 0x455814
cmp ecx, eax
jne 0x45581b
cmp edi, 0x1b0
je 0x455814
cmp ecx, eax
jne 0x45581b
cmp edi, 0xe7
jne 0x45581b
mov dword [ebp + 0x50], 0x4af198
lea ecx, [ebp + 0x20]
call fcn.00437e1a
lea ecx, [ebp + 0x3c]
call fcn.00402b5a
push dword [ebp + 0x50]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x34]
call fcn.0043d658
cmp dword [ebp + 0x44], 0
jg 0x455859
jl 0x455847
cmp dword [ebp + 0x40], 0
ja 0x455859
mov ecx, dword [ebp + 0x58]
push str._0x000000000001
push dword [ebp + 0x68]
call fcn.0043d658
jmp 0x455872
push str.0x_012I64X
push dword [ebp + 0x68]
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004401e1
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
lea ecx, [ebp + 0x34]
call fcn.00437e1a
lea ecx, [ebp + 0x60]
call fcn.00437e1a
xor esi, esi
pop edi
lea ecx, [ebp + 0x28]
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc