Function at 0x40ec60
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416656
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x421024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_enter_
push str.stealth_manager
mov dword [ebp - 0xb4], edi
call fcn.00401b30
push 0x4183c4
lea edx, [edi + 0x58]
lea ecx, [ebp - 0x2c]
call fcn.00405e30
push 0x421cc0
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00407190
push 0x4183c4
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00403e30
add esp, 0x18
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x40ecfb
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40ed23
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
push str.libs_
lea edx, [ebp - 0x74]
mov dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 0x10
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40fe24
test al, 0x10
je 0x40fe24
push 0x41cadc
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xad], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00405e30
add esp, 4
push str.PocoCrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40ee68
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb8], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40edf3
mov eax, dword [ecx]
jmp 0x40edf5
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40ee34
mov eax, dword [ecx]
jmp 0x40ee36
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 8
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40ee96
push str.Update_poco_crypto_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x10
push 0
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xad]
jmp 0x40eea3
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0xad], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40eeb5
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40eed9
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40ef3f
push 0x41cb30
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa6], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.00405e30
add esp, 4
push str.PocoFoundation.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f032
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40efbd
mov eax, dword [ecx]
jmp 0x40efbf
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40effe
mov eax, dword [ecx]
jmp 0x40f000
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0xe
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f05a
push str.Update_poco_foundation_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa6]
jmp 0x40f061
mov byte [ebp - 0xa6], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f073
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f097
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f0fd
push 0x41cb94
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa7], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x12
call fcn.00405e30
add esp, 4
push str.PocoJSON.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f1f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40f17b
mov eax, dword [ecx]
jmp 0x40f17d
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f1bc
mov eax, dword [ecx]
jmp 0x40f1be
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x14
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f218
push str.Update_poco_json_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa7]
jmp 0x40f21f
mov byte [ebp - 0xa7], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f231
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f255
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f2bb
push 0x41cbe8
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa8], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
call fcn.00405e30
add esp, 4
push str.PocoNet.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f3ae
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40f339
mov eax, dword [ecx]
jmp 0x40f33b
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f37a
mov eax, dword [ecx]
jmp 0x40f37c
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x1a
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f3d6
push str.Update_poco_net_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa8]
jmp 0x40f3dd
mov byte [ebp - 0xa8], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f3ef
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f413
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f479
push 0x41cc34
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa9], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.00405e30
add esp, 4
push str.PocoNetSSL.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f56c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40f4f7
mov eax, dword [ecx]
jmp 0x40f4f9
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f538
mov eax, dword [ecx]
jmp 0x40f53a
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x20
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f594
push str.Update_poco_netssl_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xa9]
jmp 0x40f59b
mov byte [ebp - 0xa9], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f5ad
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f5d1
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f637
push 0x41cc88
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xaa], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x24
call fcn.00405e30
add esp, 4
push str.PocoUtil.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f72a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40f6b5
mov eax, dword [ecx]
jmp 0x40f6b7
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f6f6
mov eax, dword [ecx]
jmp 0x40f6f8
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x26
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f752
push str.Update_poco_util_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xaa]
jmp 0x40f759
mov byte [ebp - 0xaa], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f76b
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f78f
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f7f5
push 0x41ccdc
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xab], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x2a
call fcn.00405e30
add esp, 4
push str.PocoXML.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40f8e8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40f873
mov eax, dword [ecx]
jmp 0x40f875
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f8b4
mov eax, dword [ecx]
jmp 0x40f8b6
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x2c
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40f910
push str.Update_poco_xml_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xab]
jmp 0x40f917
mov byte [ebp - 0xab], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40f929
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40f94d
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40f9b3
push 0x41cd28
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xac], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x30
call fcn.00405e30
add esp, 4
push str.libcrypto.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40faa6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x40fa31
mov eax, dword [ecx]
jmp 0x40fa33
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x33
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fa72
mov eax, dword [ecx]
jmp 0x40fa74
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x32
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40face
push str.Update_libcrypto_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete byte [ebp - 0xac]
jmp 0x40fad5
mov byte [ebp - 0xac], 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x40fae7
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40fb0b
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
mov dword [ebp - 4], 5
jmp 0x40fb71
push 0x41cd7c
lea edx, [ebp - 0x5c]
mov byte [ebp - 0xa5], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x36
call fcn.00405e30
add esp, 4
push str.libssl.dll
lea edx, [edi + 0x40]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2c]
call fcn.00405e30
add esp, 4
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
add esp, 8
test eax, eax
je 0x40fbed
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 1
sete bl
jmp 0x40fc9a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fc1e
mov eax, dword [ecx]
jmp 0x40fc20
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.00403180
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fc5f
mov eax, dword [ecx]
jmp 0x40fc61
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00403180
mov byte [ebp - 4], 0x38
call fcn.0040dbf0
add esp, 0x30
test al, al
jne 0x40fc98
push str.Update_libssl_dll
push str.stealth_manager
call fcn.00401b30
add esp, 8
jmp 0x40fbc6
mov bl, 1
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0xa5], bl
cmp eax, 0x10
jb 0x40fcb2
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403580
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp eax, 0x10
jb 0x40fd28
inc eax
push eax
push dword [ebp - 0x44]
call fcn.00403580
jmp 0x40fd28
mov bh, byte [ebp - 0xac]
movzx eax, bl
push eax
mov bl, byte [ebp - 0xad]
movzx eax, bh
push eax
movzx eax, byte [ebp - 0xab]
push eax
movzx eax, byte [ebp - 0xaa]
push eax
movzx eax, byte [ebp - 0xa9]
push eax
movzx eax, byte [ebp - 0xa8]
push eax
movzx eax, byte [ebp - 0xa7]
push eax
movzx eax, byte [ebp - 0xa6]
push eax
movzx eax, bl
push eax
push str.__d___d___d___d___d___d___d___d___d_
push str.stealth_manager
mov dword [ebp - 4], 5
call fcn.00401b30
push str.CStealthManager::checkAndUpdatePocoLibrary
push str._s_exit_
push str.stealth_manager
call fcn.00401b30
add esp, 0x38
test bl, bl
je 0x40fde8
cmp byte [ebp - 0xa6], 0
je 0x40fde8
cmp byte [ebp - 0xa7], 0
je 0x40fde8
cmp byte [ebp - 0xa8], 0
je 0x40fde8
cmp byte [ebp - 0xa9], 0
je 0x40fde8
cmp byte [ebp - 0xaa], 0
je 0x40fde8
cmp byte [ebp - 0xab], 0
je 0x40fde8
test bh, bh
je 0x40fde8
cmp byte [ebp - 0xa5], 0
je 0x40fde8
mov bl, 1
jmp 0x40fdea
xor bl, bl
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x40fdfc
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.00403580
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp ecx, 0x10
jb 0x40fe20
inc ecx
push ecx
push dword [ebp - 0x74]
call fcn.00403580
mov al, bl
jmp 0x40fe5c
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x40fe36
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.00403580
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp eax, 0x10
jb 0x40fe5a
inc eax
push eax
push dword [ebp - 0x74]
call fcn.00403580
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414132
mov esp, ebp
pop ebp
ret