Function at 0x4560f7
Capabilities:
Get uefi variable
Parse credit card information
Parse pe header
Read file on windows
Set uefi variable

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x188
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x58], ecx
call fcn.00439c95
mov al, byte [ebp + 0x7c]
cmp al, 1
pop ecx
mov byte [ebp + 0x4b], al
jne 0x45611d
mov byte [ebp + 0x4b], 0
push ebx
cmp al, 1
push esi
sete bl
push edi
lea ecx, [ebp + 0x1c]
mov byte [ebp + 0x7c], bl
call fcn.0043fd9a
lea ecx, [ebp + 0x28]
call fcn.0043fd9a
lea eax, [ebp + 0x74]
push eax
call fcn.00439c95
test bl, bl
pop ecx
je 0x45614a
sub dword [ebp + 0x74], 2
push 0x3d
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004429d8
add esp, 0xc
test bl, bl
je 0x456168
mov eax, dword [ebp + 0x1c]
mov word [eax], 0x26
mov ecx, dword [ebp + 0x58]
push 0
lea eax, [ebp + 0x1c]
push eax
call fcn.00402e5f
movsx eax, bl
lea edi, [eax + eax]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x1c]
lea ebx, [edi + eax]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x3d
mov dword [ebp + 0x4c], ebx
je 0x45619b
mov esi, 0x80070057
jmp 0x45632d
add dword [ebp + 0x74], 2
push 0x3b
push 0x2c
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00442a2b
mov eax, dword [ebp + 0x74]
mov si, word [eax]
add esp, 0x10
cmp si, 0x2c
je 0x4561c5
cmp si, 0x3b
jne 0x4561c9
add dword [ebp + 0x74], 2
cmp byte [ebp + 0x4b], 0
mov byte [ebp + 0x57], 0
jne 0x456349
push dword [ebp + 0x28]
push str.WINVER
call fcn.0043af97
test al, al
pop ecx
pop ecx
jne 0x456205
push dword [ebp + 0x28]
push 0x4b7630
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456349
mov byte [ebp + 0x57], 0x2a
lea eax, [ebp + 0x74]
push eax
call fcn.00439c95
mov eax, dword [ebp + 0x74]
xor edi, edi
xor ebx, ebx
cmp word [eax], 0x5e
pop ecx
mov dword [ebp + 0x34], edi
jne 0x456228
or dword [ebp + 0x34], 0xffffffff
inc eax
inc eax
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2b
jne 0x45624d
lea ecx, [eax + 2]
cmp word [ecx], di
mov byte [ebp + 0x57], 1
jne 0x456248
mov word [eax], 0x2a
mov eax, dword [ebp + 0x74]
mov byte [ebp + 0x57], 0x2a
jmp 0x45624d
mov eax, ecx
mov dword [ebp + 0x74], eax
xor ecx, ecx
mov cx, word [eax]
cmp cx, di
mov dword [ebp + 0x18], ecx
jne 0x456264
cmp byte [ebp + 0x57], 0
je 0x4562eb
mov dword [ebp + 0x7c], edi
cmp word [eax], 0x2a
je 0x456273
cmp byte [ebp + 0x57], 0x2a
jne 0x4562c4
mov eax, dword [ebp + 0x58]
cmp byte [eax + 0x92], 0
push 0x11
pop ecx
mov esi, str._SystemRoot_System32kernel32.dll
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x4562aa
test byte [eax + 9], 0xf
jne 0x4562aa
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0044ec85
jmp 0x4562be
mov ecx, dword [ebp + 0x58]
push 1
push 0
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0044dca2
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x74], eax
push 0
push dword [ebp + 0x34]
push eax
call fcn.00407963
add esp, 0xc
lea ecx, [ebp + 0x7c]
mov ebx, eax
mov edi, edx
call fcn.00439cfd
cmp byte [ebp + 0x57], 0
jne 0x4562eb
cmp word [ebp + 0x18], 0
jne 0x456316
mov esi, ebx
mov dword [ebp + 0x24], edi
call fcn.0043c7f6
cmp byte [ebp + 0x57], 0
mov ebx, eax
mov edi, edx
je 0x456316
shld edi, ebx, 0x10
shl ebx, 0x10
and esi, 0xffff
xor eax, eax
or esi, ebx
or eax, edi
mov ebx, esi
mov edi, eax
push str.0x_I64X
push dword [ebp + 0x4c]
push edi
push ebx
push dword [ebp + 0x58]
call fcn.004421b0
add esp, 0x14
xor esi, esi
lea ecx, [ebp + 0x28]
call fcn.00439cfd
lea ecx, [ebp + 0x1c]
call fcn.00439cfd
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
push dword [ebp + 0x28]
push str.ispe
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456370
push ebx
call fcn.00409b42
push eax
push dword [ebp + 0x58]
call fcn.00442235
add esp, 0xc
jmp 0x45632b
test si, si
je 0x45637f
cmp si, 0x2c
jne 0x456191
cmp byte [ebp + 0x4b], 0
je 0x45638f
cmp byte [ebp + 0x4b], 2
jne 0x4568ff
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x44]
call fcn.00448399
cmp byte [ebp + 0x7c], 0
mov esi, dword [ebp + 0x44]
je 0x4563a8
mov word [esi], 0x26
lea eax, [ebp + 0x74]
push eax
call fcn.00439c95
mov ebx, dword [ebp + 0x28]
push ebx
push str.FVER
call fcn.0043af97
add esp, 0xc
test al, al
je 0x456482
lea ecx, [ebp + 0x60]
call fcn.0043fd9a
push dword [ebp + 0x74]
xor ebx, ebx
mov dword [ebp + 0x5c], ebx
call fcn.00411f27
push 0x3b
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x7c]
push 0x2c
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x7c], esi
xor edi, edi
call fcn.0043a11e
mov eax, dword [ebp + 0x7c]
add esp, 0x10
cmp word [eax], bx
je 0x456424
mov word [eax], bx
inc eax
inc eax
push 0x3b
mov dword [ebp + 0x7c], eax
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00442a2b
mov eax, dword [ebp + 0x68]
mov di, word [eax]
add esp, 0x10
mov ax, di
neg ax
lea ecx, [ebp + 0x5c]
sbb eax, eax
and eax, ecx
push eax
mov ax, word [esi]
neg ax
lea ecx, [ebp + 0x60]
sbb eax, eax
and eax, ecx
push eax
push dword [ebp + 0x74]
call fcn.00407963
mov ecx, dword [ebp + 0x58]
add esp, 0xc
push dword [ebp + 0x60]
push esi
call fcn.0043f62b
cmp di, bx
je 0x45646a
push dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x68]
call fcn.0043f62b
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
jmp 0x45687f
push ebx
push str.FTIME
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x4566c2
push dword [ebp + 0x74]
call fcn.00411f27
pop ecx
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x4c], eax
call fcn.0043fd9a
lea ecx, [ebp + 0x50]
call fcn.0043fd9a
lea ecx, [ebp + 0x68]
call fcn.0043fd9a
lea eax, [edi + esi]
xor ebx, ebx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x34], ebx
jmp 0x456561
push 6
lea eax, [ebp + 0x64]
push eax
push str._local
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4564fa
cmp byte [ebp + 0x7c], 0
je 0x4564f4
sub dword [ebp + 0x64], 2
mov eax, dword [ebp + 0x64]
mov word [eax], 0x26
or byte [ebp + 0x7c], 2
jmp 0x45655e
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4b75c0
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x456517
or byte [ebp + 0x7c], 4
jmp 0x45655e
push 4
lea eax, [ebp + 0x64]
push eax
push str._ws1
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x456534
or byte [ebp + 0x7c], 8
jmp 0x45655e
push 5
lea eax, [ebp + 0x64]
push eax
push str._link
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x456554
mov dword [ebp + 0x34], 1
jmp 0x45655e
lea eax, [ebp + 0x64]
push eax
call fcn.00405444
pop ecx
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x2d
je 0x4564cb
cmp byte [ebp + 0x7c], 0
je 0x456576
mov word [esi], 0x26
push 0x2c
pop esi
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x64]
add esp, 0xc
cmp word [eax], si
jne 0x4565a7
add dword [ebp + 0x64], 2
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.004429d8
add esp, 0xc
mov eax, dword [ebp + 0x64]
cmp word [eax], si
jne 0x4565c4
add dword [ebp + 0x64], 2
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.004429d8
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x34], ebx
lea esi, [ebp - 0x9c]
je 0x45660c
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x64], ebx
call fcn.004054c4
cmp dword [ebp + 0x64], ebx
je 0x4565ff
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
lea ecx, [ebp + 0x64]
lea esi, [ebp - 0x48]
call fcn.00402c5b
jmp 0x45661f
lea eax, [ebp - 0x9c]
push eax
push ebx
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, eax
cmp edi, ebx
je 0x45666c
push dword [ebp + 0x7c]
lea eax, [esi + 4]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x58]
call fcn.00443450
push dword [ebp + 0x7c]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x58]
call fcn.00443450
push dword [ebp + 0x7c]
add esi, 0xc
push esi
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.00443450
add esp, 0x30
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x50]
jmp 0x456475
mov ecx, dword [ebp + 0x58]
mov esi, 0x4ae9fc
push esi
push dword [ebp + 0x60]
call fcn.0043f62b
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x50]
call fcn.0043f62b
mov ecx, dword [ebp + 0x58]
push esi
push dword [ebp + 0x68]
call fcn.0043f62b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x68]
mov esi, eax
call fcn.00439cfd
lea ecx, [ebp + 0x50]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
call fcn.00439cfd
lea ecx, [ebp + 0x44]
call fcn.00439cfd
jmp 0x45632d
push ebx
push str.FATTR
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x4568f5
push dword [ebp + 0x74]
call fcn.00411f27
mov bl, byte [ebp + 0x7c]
test bl, bl
pop ecx
mov edi, eax
je 0x4566ee
mov word [esi], 0x26
lea ecx, [ebp + 0x64]
call fcn.0043fd9a
lea ecx, [ebp + 0x60]
call fcn.0043fd9a
lea ecx, [ebp + 0x50]
call fcn.0043fd9a
lea ecx, [ebp + 0x68]
call fcn.0043fd9a
lea ecx, [ebp + 0x5c]
call fcn.0043fd9a
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4567d5
test bl, bl
je 0x456744
mov word [eax], 0x26
jmp 0x456749
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4567d5
test bl, bl
je 0x45676d
mov word [eax], 0x26
jmp 0x456772
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4567d5
test bl, bl
je 0x456796
mov word [eax], 0x26
jmp 0x45679b
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x4567d5
test bl, bl
je 0x4567bf
mov word [eax], 0x26
jmp 0x4567c4
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x456891
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x64]
mov esi, dword [ebp + 0x58]
xor edi, edi
shr eax, 5
inc edi
and eax, edi
push eax
push esi
call fcn.00442235
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x60]
shr eax, 1
and eax, edi
push eax
push esi
call fcn.00442235
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x50]
and eax, edi
push eax
push esi
call fcn.00442235
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x68]
shr eax, 2
and eax, edi
push eax
push esi
call fcn.00442235
push dword [ebp - 0x14]
and word [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push str.0x_lX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x3c
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0043f62b
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x50]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
call fcn.00439cfd
lea ecx, [ebp + 0x64]
call fcn.00439cfd
lea ecx, [ebp + 0x44]
call fcn.00439cfd
jmp 0x45632b
mov edi, dword [ebp + 0x58]
mov esi, 0x4ae9fc
push esi
push dword [ebp + 0x64]
mov ecx, edi
call fcn.0043f62b
push esi
push dword [ebp + 0x60]
mov ecx, edi
call fcn.0043f62b
push esi
push dword [ebp + 0x50]
mov ecx, edi
call fcn.0043f62b
push esi
push dword [ebp + 0x68]
mov ecx, edi
call fcn.0043f62b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x5c]
mov esi, eax
call fcn.00439cfd
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x50]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
call fcn.00439cfd
lea ecx, [ebp + 0x64]
jmp 0x4566b0
lea ecx, [ebp + 0x44]
call fcn.00439cfd
jmp 0x456902
mov ebx, dword [ebp + 0x28]
cmp byte [ebp + 0x4b], 0
push 0x26
pop edi
jne 0x45632b
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x64]
call fcn.00448399
lea eax, [ebp + 0x74]
push eax
call fcn.00439c95
push ebx
push str.DROPFILE
call fcn.0043af97
add esp, 0xc
test al, al
je 0x456a11
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
xor ebx, ebx
push eax
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
call fcn.0044b318
pop ecx
pop ecx
lea ecx, [ebp + 0x60]
call fcn.0043fd9a
lea ecx, [ebp + 0x50]
call fcn.0043fd9a
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x4569a2
cmp byte [ebp + 0x7c], bl
je 0x45698b
mov word [eax], di
jmp 0x456990
inc eax
inc eax
mov dword [ebp + 0x5c], eax
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.004429d8
add esp, 0xc
lea ecx, [ebp + 0x68]
call fcn.0043fd9a
lea ecx, [ebp + 0x30]
call fcn.0043fd9a
mov esi, dword [ebp + 0x50]
xor eax, eax
cmp word [esi], bx
je 0x4569bf
lea eax, [ebp + 0x30]
mov ecx, dword [ebp + 0x3c]
or ecx, dword [ebp + 0x40]
je 0x4569d7
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x3c]
call fcn.00404817
add esp, 0xc
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x60]
call fcn.0043f62b
push dword [ebp + 0x30]
mov ecx, dword [ebp + 0x58]
push esi
call fcn.0043f62b
lea ecx, [ebp + 0x30]
call fcn.00439cfd
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x50]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
jmp 0x457085
push ebx
push str.FPOS
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456c20
push dword [ebp + 0x74]
call fcn.00411f27
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00439c95
push dword [ebp + 0x68]
call fcn.0040fed5
add esp, 0xc
lea ecx, [ebp + 0x4c]
call fcn.0043fd9a
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x68]
call fcn.004122c1
mov bl, byte [ebp + 0x7c]
test bl, bl
mov eax, dword [ebp + 0x4c]
mov esi, dword [ebp + 0x64]
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
je 0x456a6e
mov word [esi], di
lea ecx, [ebp + 0x38]
call fcn.0043fd9a
lea ecx, [ebp + 0x2c]
call fcn.0043fd9a
lea ecx, [ebp + 0x44]
call fcn.0043fd9a
lea ecx, [ebp + 0x60]
call fcn.0043fd9a
lea ecx, [ebp + 0x50]
call fcn.0043fd9a
lea ecx, [ebp + 0x5c]
call fcn.0043fd9a
lea ecx, [ebp + 0x30]
call fcn.0043fd9a
push 0x2c
mov dword [ebp + 0x7c], esi
pop esi
push esi
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456ad2
mov word [eax], di
jmp 0x456ad7
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456afd
mov word [eax], di
jmp 0x456b02
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456b28
mov word [eax], di
jmp 0x456b2d
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456b4f
mov word [eax], di
jmp 0x456b54
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456b76
mov word [eax], di
jmp 0x456b7b
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
mov eax, dword [ebp + 0x7c]
add esp, 0xc
cmp word [eax], si
jne 0x456bb3
test bl, bl
je 0x456b9d
mov word [eax], di
jmp 0x456ba2
inc eax
inc eax
mov dword [ebp + 0x7c], eax
push esi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004429d8
add esp, 0xc
push dword [ebp + 0x30]
push dword [ebp + 0x5c]
push dword [ebp + 0x50]
push dword [ebp + 0x60]
push dword [ebp + 0x44]
push dword [ebp + 0x2c]
push dword [ebp + 0x38]
push dword [ebp + 0x68]
push dword [ebp + 0x58]
call fcn.004387db
add esp, 0x24
lea ecx, [ebp + 0x30]
mov esi, eax
call fcn.00439cfd
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
lea ecx, [ebp + 0x50]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
call fcn.00439cfd
lea ecx, [ebp + 0x44]
call fcn.00439cfd
lea ecx, [ebp + 0x2c]
call fcn.00439cfd
lea ecx, [ebp + 0x38]
call fcn.00439cfd
lea ecx, [ebp + 0x4c]
call fcn.00439cfd
lea ecx, [ebp + 0x64]
jmp 0x4566b8
push ebx
push str.PPID
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456c65
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0044b318
pop ecx
pop ecx
push dword [ebp + 0x64]
push dword [ebp + 0x20]
call fcn.00404c82
pop ecx
push eax
push dword [ebp + 0x58]
call fcn.00442235
add esp, 0xc
jmp 0x45708a
push ebx
push str.ISADMIN
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456c80
push dword [ebp + 0x64]
call fcn.0048cbe5
jmp 0x456c54
push ebx
push str.fvar
call fcn.0043af97
test al, al
pop ecx
pop ecx
jne 0x457092
push 5
push ebx
push 0x4b7570
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x457092
push ebx
push str.PWIN
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x456e1d
lea ecx, [ebp + 0x4c]
call fcn.0043fd9a
lea ecx, [ebp + 0x68]
call fcn.0043fd9a
mov eax, dword [ebp + 0x64]
xor esi, esi
push esi
mov dword [ebp + 0x34], eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004352a9
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004429d8
add esp, 0x1c
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x40], esi
call fcn.0040547b
test eax, eax
pop ecx
pop ecx
je 0x456d23
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0040547b
test eax, eax
pop ecx
pop ecx
je 0x456d3c
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x14], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x3c], 3
call fcn.0040547b
pop ecx
pop ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
test eax, eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x5c], eax
je 0x456dee
cmp dword [ebp + 0x3c], 3
jne 0x456d87
cmp dword [ebp + 0x40], 0
jne 0x456d87
mov eax, dword [ebp + 0x68]
cmp word [eax], 0
je 0x456dee
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 0x7c]
jmp 0x456da7
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x456db0
push 0xfffffffffffffff0
mov dword [ebp + 0x5c], eax
push eax
call ebx
test eax, 0x40000000
jne 0x456d94
cmp dword [ebp + 0x3c], 3
jne 0x456dbc
cmp dword [ebp + 0x40], 0
je 0x456dee
mov ebx, dword [ebp + 0x5c]
and dword [ebp + 0x20], 0
and dword [ebp + 0x24], 0
lea eax, [ebp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp + 0x3c]
sub edi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x20]
push edi
push esi
push ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPointEx]
test eax, eax
je 0x456dee
mov dword [ebp + 0x7c], eax
push dword [ebp + 0x4c]
push dword [ebp + 0x7c]
push dword [ebp + 0x58]
call fcn.0044846b
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.0044846b
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x4c]
jmp 0x457085
push ebx
push str.PEBIT
call fcn.0043af97
test al, al
pop ecx
pop ecx
je 0x45708a
mov eax, dword [ebp + 0x64]
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x34], eax
call fcn.0043fd9a
lea ecx, [ebp + 0x68]
call fcn.0043fd9a
xor edi, edi
push edi
push 0x2c
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004352a9
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004429d8
or dword [ebp + 0x3c], 0xffffffff
or dword [ebp + 0x40], 0xffffffff
push 0xd
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x74]
mov esi, 0x4ae9fc
push eax
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x18], edi
call fcn.0041a38c
mov eax, dword [ebp + 0x74]
add esp, 0x28
cmp word [eax], di
je 0x45702b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2 - 2]
mov cx, word [eax]
cmp cx, 0x5c
je 0x456ec7
cmp cx, 0x2f
je 0x456ec7
push edx
call fcn.00499edd
test eax, eax
pop ecx
je 0x456eea
jmp 0x456eca
mov word [eax], di
push 0xffffffffffffffff
push dword [ebp + 0x74]
lea ecx, [ebp + 0x5c]
call fcn.0043febe
push str._version.dll
lea ecx, [ebp + 0x5c]
call fcn.0043fe06
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 0x74]
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0x4c], edi
call fcn.004054c4
mov ebx, dword [ebp + 0x4c]
cmp ebx, edi
mov dword [ebp + 0x60], esi
je 0x457023
and dword [ebp + 0x7c], edi
mov esi, 0x1000
push esi
lea ecx, [ebp + 0x2c]
call fcn.0043fdb8
push esi
push edi
mov edi, dword [ebp + 0x2c]
push edi
call fcn.0049a7e0
add esp, 0xc
push 0
lea eax, [ebp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push ebx
call esi
test eax, eax
je 0x45701b
cmp dword [ebp + 0x7c], 0x40
jb 0x45701b
cmp word [edi], 0x5a4d
jne 0x45701b
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
jbe 0x456f95
xor ecx, ecx
push ecx
push ecx
push eax
push ebx
mov dword [edi], ecx
mov dword [edi + 4], ecx
call fcn.0043ae64
and dword [ebp + 0x7c], 0
add esp, 0x10
push 0
lea eax, [ebp + 0x7c]
push eax
push 8
push edi
push ebx
call esi
xor eax, eax
lea ecx, [eax + 8]
cmp ecx, dword [ebp + 0x7c]
ja 0x45701b
mov ecx, dword [edi + eax]
mov edi, dword [edi + eax + 4]
and edi, 0xffff
mov eax, 0x4550
cmp ecx, eax
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x40], edi
jne 0x456feb
cmp edi, 0x8664
jne 0x456fca
mov dword [ebp + 0x60], 0x4b753c
jmp 0x45701b
cmp ecx, eax
jne 0x456feb
cmp edi, 0x14c
je 0x457014
cmp ecx, eax
jne 0x456feb
cmp edi, 0x200
jne 0x456feb
mov dword [ebp + 0x60], str.ia64
jmp 0x45701b
mov eax, 0x3c05454e
cmp ecx, eax
jne 0x45701b
cmp edi, 0x137
je 0x457014
cmp ecx, eax
jne 0x45701b
cmp edi, 0x1b0
je 0x457014
cmp ecx, eax
jne 0x45701b
cmp edi, 0xe7
jne 0x45701b
mov dword [ebp + 0x60], 0x4b7528
lea ecx, [ebp + 0x2c]
call fcn.00439cfd
lea ecx, [ebp + 0x4c]
call fcn.00402c5b
push dword [ebp + 0x60]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x38]
call fcn.0043f62b
cmp dword [ebp + 0x40], 0
jg 0x457059
jl 0x457047
cmp dword [ebp + 0x3c], 0
ja 0x457059
mov ecx, dword [ebp + 0x58]
push str._0x000000000001
push dword [ebp + 0x68]
call fcn.0043f62b
jmp 0x457072
push str.0x_012I64X
push dword [ebp + 0x68]
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
push dword [ebp + 0x58]
call fcn.004421b0
add esp, 0x14
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
lea ecx, [ebp + 0x68]
call fcn.00439cfd
lea ecx, [ebp + 0x38]
call fcn.00439cfd
lea ecx, [ebp + 0x64]
jmp 0x456887
mov esi, dword [ebp + 0x28]
cmp word [esi + 8], 0x2b
lea ecx, [ebp + 0x30]
setne bl
dec bl
and ebx, 0x2b
call fcn.0043fd9a
lea ecx, [ebp + 0x60]
call fcn.0043fd9a
mov eax, dword [ebp + 0x64]
xor edi, edi
test bl, bl
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x38], 0x4ae9fc
mov dword [ebp + 0x68], str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov byte [ebp + 0x7f], 0
je 0x4570ee
push 2
lea eax, [ebp + 0x50]
push eax
push 0x4b749c
call fcn.00441bc4
add esp, 0xc
test al, al
je 0x4570ee
mov byte [ebp + 0x7f], 1
mov eax, dword [ebp + 0x50]
push 0x3b
mov dword [ebp + 0x2c], eax
push 0x2c
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x74]
push eax
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.00442a2b
mov eax, dword [ebp + 0x74]
mov ax, word [eax]
add esp, 0x10
cmp ax, di
je 0x457141
add dword [ebp + 0x74], 2
cmp ax, 0x3b
jne 0x457141
push edi
push 0x2c
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004352a9
mov eax, dword [ebp + 0x30]
add esp, 0x10
cmp word [eax], di
je 0x457141
mov dword [ebp + 0x68], eax
push 0x80
push 2
push str.SeSystemEnvironmentPrivilege
call fcn.00412301
or dword [ebp + 0x40], 0xffffffff
and dword [ebp + 0x4c], 0
and dword [ebp + 0x44], 0
or edi, 0xffffffff
add esp, 0xc
test bl, bl
mov dword [ebp + 0x3c], edi
je 0x4572c7
lea ecx, [ebp + 0x14]
call fcn.0043fd9a
mov eax, dword [ebp + 0x50]
xor ebx, ebx
cmp word [eax], bx
mov dword [ebp + 0x5c], ebx
je 0x457193
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.00442f35
pop ecx
pop ecx
mov al, byte [ebp + 0x7f]
neg al
lea ecx, [ebp + 0x38]
sbb eax, eax
and eax, 0x4c9c14
push eax
call fcn.00434914
cmp byte [ebp + 0x7f], 0
je 0x4571db
mov ecx, dword [ebp + 0x58]
push ebx
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x74]
call fcn.0040fd4e
cmp eax, ebx
mov dword [ebp + 0x74], ebx
je 0x4571d2
mov ecx, dword [eax + 4]
mov dword [ebp + 0x74], ecx
mov edi, dword [eax + 0x10]
mov dword [ebp + 0x40], ebx
jmp 0x4571f6
mov dword [ebp + 0x44], 1
jmp 0x4571f6
lea eax, [ebp + 0x3c]
push eax
add esi, 0xa
push esi
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00452e55
mov edi, dword [ebp + 0x3c]
add esp, 0x10
cmp dword [ebp + 0x40], ebx
jl 0x45726e
jg 0x457201
cmp edi, ebx
jb 0x45726e
mov eax, dword [ebp + 0x2c]
cmp word [eax], bx
je 0x45725b
mov eax, dword [0x4c9158]
cmp eax, ebx
mov dword [ebp + 0x44], 0x7f
jne 0x457242
push ebx
push 0x4c9158
push str.Kernel32.DLL
push str.SetFirmwareEnvironmentVariableExW
call fcn.0043afc7
mov eax, dword [0x4c9158]
add esp, 0x10
cmp eax, ebx
jne 0x457242
or eax, 0xffffffff
mov dword [0x4c9158], eax
cmp eax, 0xffffffff
je 0x45726e
push dword [ebp + 0x20]
mov dword [ebp + 0x44], ebx
push edi
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x60]
call eax
jmp 0x45726b
push edi
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
mov dword [ebp + 0x4c], eax
cmp dword [ebp + 0x38], ebx
je 0x45727c
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x4c], ebx
jne 0x45728f
cmp dword [ebp + 0x44], ebx
jg 0x45728f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x44], eax
lea ecx, [ebp + 0x5c]
call fcn.00439cfd
lea ecx, [ebp + 0x14]
call fcn.00439cfd
lea ecx, [ebp + 0x18]
call fcn.00439cfd
lea ecx, [ebp + 0x60]
call fcn.00439cfd
lea ecx, [ebp + 0x30]
call fcn.00439cfd
lea ecx, [ebp + 0x64]
call fcn.00439cfd
mov esi, dword [ebp + 0x44]
jmp 0x45632d
push 0x1000
lea ecx, [ebp + 0x7c]
call fcn.0043fdb8
lea ecx, [ebp + 0x34]
call fcn.0043fd9a
xor esi, esi
push esi
push 0x2c
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.004352a9
mov eax, dword [ebp + 0x50]
add esp, 0x10
cmp word [eax], si
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x4c], 0x4b7434
je 0x457387
mov eax, dword [0x4c915c]
cmp eax, esi
mov dword [ebp + 0x44], 0x7f
jne 0x457340
push esi
push 0x4c915c
push str.Kernel32.DLL
push str.GetFirmwareEnvironmentVariableExW
call fcn.0043afc7
mov eax, dword [0x4c915c]
add esp, 0x10
cmp eax, esi
jne 0x457340
or eax, 0xffffffff
mov dword [0x4c915c], eax
cmp eax, 0xffffffff
je 0x457387
lea ecx, [ebp + 0x20]
push ecx
mov edi, 0x2000
push edi
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
push dword [ebp + 0x60]
call eax
cmp eax, esi
mov dword [ebp + 0x68], eax
je 0x45737e
push dword [ebp + 0x20]
lea eax, [ebp - 0x11c]
push str.0x_X
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x45739f
mov dword [ebp + 0x4c], str.FAIL
jmp 0x45739f
mov edi, 0x2000
push edi
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebp + 0x58]
movsx ebx, byte [ecx + 9]
mov eax, dword [ebp + 0x34]
mov cx, word [eax]
or ebx, dword [ebp + 0x14]
cmp cx, 0x26
mov dword [ebp + 0x5c], eax
jne 0x4573bd
or ebx, 2
jmp 0x4573dc
cmp cx, 0x24
je 0x4573d4
cmp cx, 0x5e
je 0x4573d4
cmp cx, 0x2e
jne 0x4573dc
or ebx, 4
jmp 0x4573d6
xor ebx, ebx
add eax, 2
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x68], esi
je 0x45744e
cmp dword [ebp + 0x68], edi
jbe 0x4573e9
mov dword [ebp + 0x68], edi
cmp ebx, esi
jne 0x457446
mov esi, dword [ebp + 0x68]
mov edi, dword [ebp + 0x7c]
and dword [ebp + 0x7c], 0
inc esi
lea eax, [esi + esi*4]
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x40], edi
call fcn.0043fddf
mov dword [ebp + 0x14], edi
mov edi, dword [ebp + 0x7c]
add edi, 0xfffffff6
dec esi
test esi, esi
jle 0x457437
mov dword [ebp + 0x38], esi
mov esi, dword [ebp + 0x14]
movzx eax, byte [esi]
push eax
add edi, 0xa
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
dec dword [ebp + 0x38]
jne 0x45741b
and word [edi - 2], 0
lea ecx, [ebp + 0x40]
call fcn.00439cfd
xor esi, esi
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x38], eax
jmp 0x45745c
cmp dword [ebp + 0x44], esi
jg 0x45745c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x44], eax
test bl, 3
je 0x45747c
push esi
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.0044b72d
add esp, 0x18
jmp 0x45748a
push dword [ebp + 0x38]
mov ecx, dword [ebp + 0x58]
push dword [ebp + 0x5c]
call fcn.0043f62b
mov eax, dword [ebp + 0x2c]
cmp word [eax], si
je 0x45749e
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x58]
push eax
call fcn.0043f62b
lea ecx, [ebp + 0x34]
call fcn.00439cfd
lea ecx, [ebp + 0x7c]
jmp 0x45729a