Function at 0x911400
Capabilities:
Check os version
Get file size
Parse pe header
Read file on windows
Read file via mapping
Resolve function by parsing pe exports
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa9c094
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x671c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x6718], eax
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x6730]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xb4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x9c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0xd8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0xf0], edx
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0xe8], ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x70], edx
mov edx, dword [ebp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0xd0], ecx
mov ecx, dword [ebp + 0x34]
mov dword [esp + 0x90], edx
mov edx, dword [ebp + 0x38]
mov dword [esp + 0xf4], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x94], ecx
mov ecx, dword [ebp + 0x40]
mov dword [esp + 0xec], edx
mov edx, dword [ebp + 0x44]
xor ebx, ebx
push 0xfff
mov dword [esp + 0x64], eax
mov dword [esp + 0xc4], ecx
mov ecx, dword [ebp + 0x4c]
mov dword [esp + 0xcc], edx
mov edx, dword [ebp + 0x50]
lea eax, [esp + 0x221]
push ebx
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0x74], ebx
mov dword [esp + 0xe0], ebx
mov byte [esp + 0x228], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x119]
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x120], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [esp + 0x1329]
push ebx
push edx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x1330], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [esp + 0x40], ebx
mov dword [esp + 0xdc], ebx
or esi, 0xffffffff
mov dword [esp + 0x5c], esi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0xac], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0xa8], ebx
cmp dword [0xbf6cac], ebx
jne 0x91162b
mov edi, 0xbf6cac
call fcn.0091cbd0
mov edi, 1
cmp dword [0xbf6cb0], ebx
jne 0x91166a
push 0x100
push ebx
push 0xc11938
mov dword [0xbf6cb0], edi
call fcn.00a7ffb0
add esp, 0xc
push 0xbf6cb4
push str.CloudScanExtA
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [esp + 0x2c]
mov dword [eax], edi
cmp dword [0xbd71c8], ebx
jne 0x911d77
push 0x2710
push 0xb5268c
mov dword [0xbd71c8], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x9116a1
push 0xb5268c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x58
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], ebx
cmp eax, ebx
je 0x9116e3
cmp byte [str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___], 0
mov ecx, str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___
je 0x9116cf
add ecx, edi
cmp byte [ecx], 0
jne 0x9116c8
sub ecx, str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___
push ecx
push eax
mov ecx, str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___
call fcn.00a6e730
jmp 0x9116e5
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52680], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], edi
cmp eax, ebx
je 0x91171c
mov ecx, dword [0xb52680]
push ecx
push eax
call fcn.00a6dad0
jmp 0x91171e
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb524dc], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 2
cmp eax, ebx
je 0x911770
cmp byte [str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__], 0
mov ecx, str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__
je 0x91175c
add ecx, edi
cmp byte [ecx], 0
jne 0x911755
sub ecx, str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__
push ecx
push eax
mov ecx, str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__
call fcn.00a6e730
jmp 0x911772
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52668], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 3
cmp eax, ebx
je 0x9117ad
mov edx, dword [0xb52668]
push edx
push eax
call fcn.00a6dad0
jmp 0x9117af
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52618], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 4
cmp eax, ebx
je 0x911801
cmp byte [str.____ffff__OR__FileAttach___], 0
mov ecx, str.____ffff__OR__FileAttach___
je 0x9117ed
add ecx, edi
cmp byte [ecx], 0
jne 0x9117e6
sub ecx, str.____ffff__OR__FileAttach___
push ecx
push eax
mov ecx, str.____ffff__OR__FileAttach___
call fcn.00a6e730
jmp 0x911803
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb5263c], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 5
cmp eax, ebx
je 0x91183e
mov ecx, dword [0xb5263c]
push ecx
push eax
call fcn.00a6dad0
jmp 0x911840
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52628], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 6
cmp eax, ebx
je 0x911892
cmp byte [str.___Android__OR__.classPK__OR__classes.dex__OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____], 0
mov ecx, str.___Android__OR__.classPK__OR__classes.dex__OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____
je 0x91187e
add ecx, edi
cmp byte [ecx], 0
jne 0x911877
sub ecx, str.___Android__OR__.classPK__OR__classes.dex__OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____
push ecx
push eax
mov ecx, str.___Android__OR__.classPK__OR__classes.dex__OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____
call fcn.00a6e730
jmp 0x911894
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52620], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 7
cmp eax, ebx
je 0x9118cf
mov edx, dword [0xb52620]
push edx
push eax
call fcn.00a6dad0
jmp 0x9118d1
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52640], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 8
cmp eax, ebx
je 0x911923
cmp byte [str.___AndroidManifest.xml___], 0
mov ecx, str.___AndroidManifest.xml___
je 0x91190f
add ecx, edi
cmp byte [ecx], 0
jne 0x911908
sub ecx, str.___AndroidManifest.xml___
push ecx
push eax
mov ecx, str.___AndroidManifest.xml___
call fcn.00a6e730
jmp 0x911925
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb5262c], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 9
cmp eax, ebx
je 0x911960
mov ecx, dword [0xb5262c]
push ecx
push eax
call fcn.00a6dad0
jmp 0x911962
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb526a4], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xa
cmp eax, ebx
je 0x9119bb
cmp byte [str.___content_PK__OR__locale___OR__content___OR__browser_PK___], 0
mov ecx, str.___content_PK__OR__locale___OR__content___OR__browser_PK___
je 0x9119a7
lea esp, [esp]
add ecx, edi
cmp byte [ecx], 0
jne 0x9119a0
sub ecx, str.___content_PK__OR__locale___OR__content___OR__browser_PK___
push ecx
push eax
mov ecx, str.___content_PK__OR__locale___OR__content___OR__browser_PK___
call fcn.00a6e730
jmp 0x9119bd
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52684], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xb
cmp eax, ebx
je 0x9119f8
mov edx, dword [0xb52684]
push edx
push eax
call fcn.00a6dad0
jmp 0x9119fa
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52664], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xc
cmp eax, ebx
je 0x911a4c
cmp byte [str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___], 0
mov ecx, str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___
je 0x911a38
add ecx, edi
cmp byte [ecx], 0
jne 0x911a31
sub ecx, str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___
push ecx
push eax
mov ecx, str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___
call fcn.00a6e730
jmp 0x911a4e
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52634], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xd
cmp eax, ebx
je 0x911a89
mov ecx, dword [0xb52634]
push ecx
push eax
call fcn.00a6dad0
jmp 0x911a8b
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52624], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xe
cmp eax, ebx
je 0x911add
cmp byte [str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___], 0
mov ecx, str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___
je 0x911ac9
add ecx, edi
cmp byte [ecx], 0
jne 0x911ac2
sub ecx, str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___
push ecx
push eax
mov ecx, str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___
call fcn.00a6e730
jmp 0x911adf
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52670], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0xf
cmp eax, ebx
je 0x911b1a
mov edx, dword [0xb52670]
push edx
push eax
call fcn.00a6dad0
jmp 0x911b1c
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52638], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x10
cmp eax, ebx
je 0x911b6e
cmp byte [str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___], 0
mov ecx, str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___
je 0x911b5a
add ecx, edi
cmp byte [ecx], 0
jne 0x911b53
sub ecx, str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___
push ecx
push eax
mov ecx, str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___
call fcn.00a6e730
jmp 0x911b70
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52688], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x11
cmp eax, ebx
je 0x911bab
mov ecx, dword [0xb52688]
push ecx
push eax
call fcn.00a6dad0
jmp 0x911bad
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb52678], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x12
cmp eax, ebx
je 0x911bff
cmp byte [str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___], 0
mov ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___
je 0x911beb
add ecx, edi
cmp byte [ecx], 0
jne 0x911be4
sub ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___
push ecx
push eax
mov ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___
call fcn.00a6e730
jmp 0x911c01
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb52660], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x13
cmp eax, ebx
je 0x911c3c
mov edx, dword [0xb52660]
push edx
push eax
call fcn.00a6dad0
jmp 0x911c3e
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x58
mov dword [0xb5261c], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x14
cmp eax, ebx
je 0x911c90
cmp byte [str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____], 0
mov ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____
je 0x911c7c
add ecx, edi
cmp byte [ecx], 0
jne 0x911c75
sub ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____
push ecx
push eax
mov ecx, str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR_Invoke_Expression_OR_New_Object_OR_StreamReader_OR_DeflateStream_OR_MemoryStream_OR_FromBase64String_OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____
call fcn.00a6e730
jmp 0x911c92
xor eax, eax
mov dword [esp + 0x6738], esi
push 0x80
mov dword [0xb5265c], eax
call fcn.00a7ab3a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x6738], 0x15
cmp eax, ebx
je 0x911ccd
mov ecx, dword [0xb5265c]
push ecx
push eax
call fcn.00a6dad0
jmp 0x911ccf
xor eax, eax
push 0xb48efc
mov dword [esp + 0x673c], esi
push str.MaxSizeForOverlayCheck
mov ecx, 0xab6f1c
mov edx, 0x80000000
mov dword [0xb5266c], eax
call fcn.0094c0d0
test al, al
je 0x911d12
mov eax, dword [0xb48efc]
cmp eax, 0x100000
je 0x911d12
cmp eax, 0x13d620
je 0x911d12
cmp eax, 0x30d400
jne 0x911d35
mov eax, 0x1000000
mov esi, str.MaxSizeForOverlayCheck
mov ebx, 0xab6f1c
mov ecx, 0x80000000
mov dword [0xb48efc], eax
call fcn.0094be90
xor ebx, ebx
or esi, 0xffffffff
push 0xbf6cb8
push str.CheckCABSfx
mov ecx, 0xab6f1c
mov edx, 0x80000000
call fcn.0094c0d0
test al, al
jne 0x911d77
xor eax, eax
mov esi, str.CheckCABSfx
mov ebx, 0xab6f1c
mov ecx, 0x80000000
mov dword [0xbf6cb8], 0
call fcn.0094be90
xor ebx, ebx
or esi, 0xffffffff
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x9c]
mov dword [edx], 2
cmp ecx, ebx
jne 0x911da3
cmp eax, ebx
je 0x9120e7
cmp eax, esi
je 0x9120e7
mov dword [esp + 0x38], eax
mov dword [edx], 3
cmp ecx, ebx
je 0x911dd1
cmp byte [ecx], 0
je 0x911dd1
push 0x400
lea ebx, [esp + 0x1328]
mov esi, ecx
call fcn.00957fa0
add esp, 4
xor ebx, ebx
or esi, 0xffffffff
mov eax, dword [esp + 0xf4]
cmp eax, ebx
je 0x911ddf
mov byte [eax], 0
mov eax, dword [esp + 0xb0]
cmp eax, ebx
je 0x911dec
mov dword [eax], ebx
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x911df9
mov dword [eax], ebx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x911e03
mov dword [eax], ebx
mov eax, dword [esp + 0x60]
cmp eax, ebx
je 0x911e0d
mov dword [eax], ebx
mov eax, dword [esp + 0xec]
cmp eax, ebx
je 0x911e1a
mov dword [eax], ebx
mov eax, dword [esp + 0x94]
cmp eax, ebx
je 0x911e27
mov dword [eax], ebx
mov eax, dword [esp + 0xf0]
cmp eax, ebx
je 0x911e34
mov dword [eax], ebx
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x911e3e
mov dword [eax], ebx
mov eax, dword [esp + 0x7c]
cmp eax, ebx
je 0x911e48
mov dword [eax], ebx
mov eax, dword [esp + 0xe8]
cmp eax, ebx
je 0x911e55
mov dword [eax], ebx
mov eax, dword [esp + 0xd0]
cmp eax, ebx
je 0x911e62
mov dword [eax], ebx
mov eax, dword [esp + 0x90]
cmp eax, ebx
je 0x911e6f
mov dword [eax], ebx
mov eax, dword [esp + 0xd8]
cmp eax, ebx
je 0x911e7d
mov byte [eax], 0
mov eax, dword [esp + 0xc8]
cmp eax, ebx
je 0x911e8a
mov dword [eax], ebx
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x911e94
mov dword [eax], ebx
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x911e9e
mov dword [eax], ebx
mov eax, dword [esp + 0x84]
cmp eax, ebx
je 0x911eab
mov dword [eax], ebx
push 0x1000
lea edx, [esp + 0x220]
push 0xff
push edx
call fcn.00a7ffb0
mov eax, dword [esp + 0x38]
add esp, 0xc
cmp byte [esp + 0x1324], 0
mov byte [esp + 0x121b], 0
mov byte [esp + 0x121a], 0
mov dword [eax], 5
je 0x91203e
lea ecx, [esp + 0x1324]
push 0x5c
push ecx
call fcn.00a7aa50
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x911f14
lea edx, [esp + 0x1324]
mov dword [esp + 0x44], edx
mov edi, edx
jmp 0x911f19
inc edi
mov dword [esp + 0x44], edi
mov eax, str.scflist.txt
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x9120e7
mov eax, str.hash.dat
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x9120e7
push ebx
push str.autorun
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x911f5f
mov dword [esp + 0xa4], 1
lea eax, [esp + 0x1324]
push 0x5c
push eax
call fcn.00a7bbc7
add esp, 8
cmp eax, ebx
je 0x911f78
inc eax
jmp 0x911f7f
lea eax, [esp + 0x1324]
push 0x2e
push eax
call fcn.00a7bbc7
add esp, 8
mov dword [esp + 0x30], eax
cmp eax, ebx
je 0x91203b
mov esi, eax
inc esi
cmp byte [esi], 0
je 0x91203b
mov edi, dword [esp + 0x30]
mov eax, str..VIR
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x911fc3
mov dword [esp + 0x88], 1
jmp 0x912032
mov eax, str..EML
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x911fdd
mov dword [esp + 0x4c], 1
jmp 0x912032
push esi
call fcn.00904c10
add esp, 4
test eax, eax
jne 0x912032
mov eax, str..cpp
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x91202a
mov eax, 0xadef78
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x91202a
mov eax, 0xadef7c
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x91202a
mov eax, 0xadef88
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x912032
mov dword [esp + 0x64], 1
push esi
call fcn.009183f0
add esp, 4
or esi, 0xffffffff
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 6
cmp dword [esp + 0x9c], ebx
jne 0x9120ee
push 0x80
push 3
push 3
push 0x80000000
lea edi, [esp + 0x1334]
call fcn.0094db00
add esp, 0x10
mov dword [esp + 0x38], eax
cmp eax, esi
jne 0x9120ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [esp + 0x20], eax
call fcn.00966a70
test eax, eax
je 0x9120dc
xor ecx, ecx
call fcn.009790d0
test eax, eax
je 0x9120dc
push ebx
push ebx
push ebx
xor edx, edx
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x9120dc
push 0x80
push 3
push 3
push 0x80000000
mov dword [esp + 0xc8], 1
call fcn.0094db00
add esp, 0x10
mov dword [esp + 0x38], eax
cmp eax, 0xffffffff
jne 0x9120ee
call fcn.00987380
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x91506a
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push ebx
mov dword [esi], 7
call edi
cmp dword [esp + 0x70], 0
mov dword [esp + 0x34], eax
mov dword [esi], 8
je 0x91220f
mov esi, dword [esp + 0x30]
test esi, esi
je 0x91220f
cmp byte [esi + 1], 0
je 0x91220f
mov eax, str..HTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x912166
mov eax, str..HTM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x912166
mov eax, str..ASPX
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x91220f
push 0
push ebx
call edi
mov dword [esp + 0x48], eax
test eax, eax
je 0x91220f
add eax, 0x11
push 1
push eax
call fcn.00a7b9f8
mov edi, eax
add esp, 8
test edi, edi
je 0x91220f
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ebx
call esi
push 0
push 0
push 0
push ebx
mov dword [esp + 0x30], eax
call esi
mov ecx, dword [esp + 0x48]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x20]
push 0
push 0
push edx
push ebx
call esi
cmp dword [esp + 0x10], 0
jbe 0x912200
cmp byte [edi], 0
je 0x912200
call fcn.00909820
cmp eax, 0xffffffff
jne 0x9121f6
push 0
push str._iframe
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x912200
mov eax, dword [esp + 0x70]
mov dword [eax], 1
push edi
call fcn.00a78fec
mov ebx, dword [esp + 0x3c]
add esp, 4
jmp 0x912215
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ebx
mov dword [ecx], 9
call esi
push 0
push 0
push 0
push ebx
mov dword [esp + 0x30], eax
call esi
push 0
lea edx, [esp + 0x14]
push edx
push 0xffe
lea eax, [esp + 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0x34]
cmp edi, 0x400
jbe 0x9123ac
cmp edi, dword [0xb48efc]
ja 0x9123ac
test ebx, ebx
je 0x9123ac
cmp ebx, 0xffffffff
je 0x9123ac
movzx ecx, byte [esp + 0x21c]
push ecx
call fcn.00a7c649
add esp, 4
cmp eax, 0x4d
jne 0x9123ac
movzx edx, byte [esp + 0x21d]
push edx
call fcn.00a7c649
add esp, 4
cmp eax, 0x5a
jne 0x9123ac
mov eax, dword [esp + 0x258]
lea ecx, [edi - 4]
cmp eax, ecx
ja 0x9123ac
cmp dword [esp + eax + 0x21c], 0x4550
lea eax, [esp + eax + 0x21c]
jne 0x9123ac
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x100], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x104], ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [esp + 0x108], edx
mov dword [esp + 0x10c], ecx
test eax, 0x2000
jne 0x9123ac
test al, 2
je 0x9123ac
push 1
push 0
push 0
push ebx
call esi
push 0
push 0
push 0
push ebx
mov dword [esp + 0x80], eax
call esi
push 0
push edi
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0x48], eax
test eax, eax
je 0x9123a0
mov edx, edi
push edx
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x912392
mov edx, dword [esp + 0x34]
push 0
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0xe8]
push ecx
push edx
mov ecx, edi
call fcn.00910ee0
add esp, 0x10
push edi
mov dword [esp + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [esp + 0x48]
push eax
call fcn.00985290
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x70]
push 0
push 0
push ecx
push ebx
call esi
cmp dword [esp + 0x60], 0
mov edx, dword [esp + 0x2c]
mov dword [edx], 0xa
je 0x912543
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x912543
mov bl, byte [esp + 0x21c]
cmp eax, 5
jb 0x912411
cmp byte [esp + 0x21d], bl
jne 0x912543
mov cl, bl
cmp byte [esp + 0x21e], cl
jne 0x912543
mov dl, bl
cmp byte [esp + 0x21f], dl
jne 0x912543
cmp byte [esp + 0x220], cl
jne 0x912543
cmp eax, edi
jne 0x91246a
push eax
call fcn.00a7a155
mov edi, eax
add esp, 4
test edi, edi
je 0x912510
mov edx, dword [esp + 0x10]
movzx eax, bl
push edx
push eax
push edi
call fcn.00a7ffb0
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x21c]
mov esi, edi
cmp eax, 4
jb 0x9124d9
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x912507
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x912450
jmp 0x9124d9
cmp byte [esp + 0x1324], 0x5c
jne 0x912510
cmp byte [esp + 0x1325], 0x5c
jne 0x912510
cmp byte [esp + 0x21c], 0
jne 0x912510
push eax
call fcn.00a7a155
mov edi, eax
add esp, 4
test edi, edi
je 0x912510
mov edx, dword [esp + 0x10]
push edx
push 0
push edi
call fcn.00a7ffb0
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x21c]
mov esi, edi
cmp eax, 4
jb 0x9124d9
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x912507
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x9124c5
test eax, eax
je 0x9124fd
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x912507
cmp eax, 1
jbe 0x9124fd
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x912507
cmp eax, 2
jbe 0x9124fd
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x912507
mov ecx, dword [esp + 0x60]
mov dword [ecx], 1
push edi
call fcn.00a78fec
add esp, 4
mov edx, dword [esp + 0x60]
cmp dword [edx], 1
jne 0x912543
cmp dword [esp + 0x9c], 0
jne 0x91252d
lea eax, [esp + 0x38]
push eax
call fcn.00985290
cmp dword [esp + 0xb8], 1
jne 0x91253c
call fcn.00987380
xor eax, eax
jmp 0x91506a
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 0xb
test esi, esi
jbe 0x91270d
mov byte [esp + esi + 0x21c], 0
mov byte [esp + esi + 0x21d], 0
mov al, byte [esp + 0x21c]
mov dl, byte [esp + 0x21e]
mov cl, byte [esp + 0x21d]
xor edi, edi
cmp al, 0xef
jne 0x9125bb
cmp cl, 0xbb
jne 0x9126b5
cmp dl, 0xbf
jne 0x9126b5
lea edx, [esp + 0x21f]
dec esi
push esi
mov eax, edx
push eax
lea ecx, [esp + 0x224]
push ecx
mov dword [esp + 0x28], edx
call fcn.00a7be50
add esp, 0xc
jmp 0x9126c0
cmp al, 0xff
jne 0x912649
cmp cl, 0xfe
jne 0x9126b5
cmp byte [esp + 0x21f], 0
jne 0x9126b5
lea edx, [esp + 0x21e]
push edx
lea ebx, [esp + 0x4c]
mov dword [esp + 0x4c], 0
call fcn.00970520
add esp, 4
test eax, eax
je 0x9126c0
mov esi, dword [esp + 0x48]
test esi, esi
je 0x9126c0
mov ebx, 1
lea edx, [esp + 0x21c]
mov dword [esp + 0xac], ebx
mov dword [esp + 0xbc], ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x912628
push esi
call fcn.00a78fec
lea eax, [esp + 0x220]
add esp, 4
mov dword [esp + 0x1c], eax
jmp 0x9126c0
cmp al, 0xfe
jne 0x9126b5
cmp cl, 0xff
jne 0x9126b5
test dl, dl
jne 0x9126b5
push 1
add esi, 0x12
push esi
call fcn.00a7b9f8
add esp, 8
test eax, eax
je 0x9126c0
lea ecx, [esp + 0x21e]
mov dword [esp + 0xac], 2
mov dword [esp + 0xbc], 1
call fcn.00906b00
lea esi, [esp + 0x21c]
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x912695
push eax
call fcn.00a78fec
lea ecx, [esp + 0x220]
add esp, 4
mov dword [esp + 0x1c], ecx
jmp 0x9126c0
lea edx, [esp + 0x21c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
test edx, edx
jbe 0x9126ec
lea esp, [esp]
mov al, byte [ecx]
inc edi
cmp al, 0x20
je 0x9126e3
cmp al, 9
je 0x9126e3
cmp al, 0xd
je 0x9126e3
cmp al, 0xa
jne 0x9126e8
inc ecx
cmp edi, edx
jb 0x9126d0
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x912705
cmp byte [ecx], 0
mov eax, ecx
je 0x9126fd
inc eax
cmp byte [eax], 0
jne 0x9126f7
sub eax, ecx
mov dword [esp + 0x3c], eax
jmp 0x91270d
mov dword [esp + 0x3c], 0
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], 0xc
test edi, edi
je 0x912763
cmp byte [edi + 1], 0
lea ecx, [edi + 1]
je 0x912763
lea eax, [esp + 0x80]
push eax
call fcn.00918290
add esp, 4
test eax, eax
je 0x912763
cmp byte [esp + 0x21c], 0x4d
jne 0x912763
cmp byte [esp + 0x21d], 0x5a
jne 0x912763
push str.MZ_EXE_DLL_File
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x10], 0x40
mov dword [esi], 0xe
jbe 0x912942
cmp byte [esp + 0x21c], 0x4d
jne 0x912942
cmp byte [esp + 0x21d], 0x5a
jne 0x912942
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x50]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xd0]
lea eax, [esp + 0x20]
push ebx
push eax
lea eax, [esp + 0x234]
call fcn.0090aaf0
add esp, 0x18
cmp dword [esp + 0xc4], 0
je 0x912815
mov eax, dword [esp + 0xe0]
cmp eax, 7
je 0x9127fd
cmp eax, 0xa
je 0x9127fd
cmp eax, 0xb
je 0x9127fd
cmp eax, 2
jne 0x912815
cmp dword [esp + 0x34], 0x300000
ja 0x912815
mov eax, 0xaaab94
mov ecx, ebx
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x912946
cmp dword [0xbf6cb8], 0
je 0x912840
cmp dword [esp + 0xfc], 1
jne 0x912840
mov eax, 0xaaab94
mov ecx, ebx
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x912946
test edi, edi
je 0x912872
cmp byte [edi + 1], 0
lea eax, [edi + 1]
je 0x912894
push eax
call fcn.00915090
add esp, 4
test eax, eax
je 0x912894
mov eax, 0xaaab94
mov ecx, ebx
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x912946
cmp dword [esp + 0x34], 0xb00000
jae 0x912894
mov eax, 0xaaab94
mov ecx, ebx
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x912946
mov esi, dword [esp + 0x44]
test esi, esi
je 0x912946
cmp byte [esi], 0
je 0x912946
test edi, edi
je 0x9128c8
cmp byte [edi + 1], 0
lea ecx, [edi + 1]
je 0x9128c8
mov eax, 0xae0c08
call fcn.0094c330
test eax, eax
je 0x912946
call fcn.00905840
test eax, eax
je 0x912921
push 0
push str.shark
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x912946
push 0
lea ecx, [esp + 0x1328]
push str.WindowsApp
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x912946
cmp dword [esp + 0x34], 0x30d400
ja 0x912946
mov eax, 0xaaab94
mov ecx, ebx
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x912946
test edi, edi
je 0x91292b
cmp byte [edi + 1], 0
jne 0x912946
mov dword [esp + 0x114], 0x455845
test ebx, ebx
je 0x912946
mov dword [ebx], 1
jmp 0x912946
mov ebx, dword [esp + 0x18]
cmp dword [esp + 0x10], 0
mov esi, dword [esp + 0x2c]
mov dword [esi], 0xf
jbe 0x9129ae
cmp byte [esp + 0x21c], 0x4c
jne 0x9129ae
cmp byte [esp + 0x21d], 0
jne 0x9129ae
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
lea edx, [esp + 0x1324]
push edx
mov edx, dword [esp + 0x88]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
mov edx, ebx
lea ecx, [esp + 0x130]
call fcn.0090b890
add esp, 0x1c
cmp dword [esp + 0x10], 0
mov dword [esi], 0x10
jbe 0x912aec
test edi, edi
je 0x912a7f
cmp byte [edi + 1], 0
je 0x912a7f
push 4
mov eax, str..PST
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x912cc8
push 4
mov eax, str..OST
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x912cc8
push 5
mov eax, str..MBOX
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x912cc8
push 4
mov eax, str..MSF
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x912cc8
push 4
mov eax, str..IMM
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x912cc8
mov al, byte [esp + 0x21c]
cmp al, 0x21
jne 0x912c97
cmp byte [esp + 0x21d], 0x42
jne 0x912a7f
cmp byte [esp + 0x21e], 0x44
jne 0x912a7f
cmp byte [esp + 0x21f], 0x4e
je 0x912cc8
cmp dword [esp + 0x10], 0
jbe 0x912aec
cmp dword [esp + 0x1c], 0
je 0x912aec
mov edi, str.PE1BSUw
inc edi
cmp byte [edi], 0
jne 0x912a92
mov ecx, dword [esp + 0x1c]
sub edi, str.PE1BSUw
mov eax, str.PE1BSUw
call fcn.00904d50
test eax, eax
jne 0x912aec
mov eax, dword [esp + 0x18]
mov dword [esp + 0x114], 0x4c4355
test eax, eax
je 0x912ace
cmp dword [eax], 0
jne 0x912ace
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x912ae4
mov dword [eax], 1
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0x4c
mov ecx, esi
mov dword [ecx], 0x11
jbe 0x912d67
cmp byte [esp + 0x21c], 0
je 0x912d67
cmp dword [esp + 0x88], 0
jne 0x912d67
mov eax, str.regedit
lea ecx, [esp + 0x21c]
call fcn.0094c3e0
test eax, eax
je 0x912d67
mov eax, str.Windows_Registry
lea ecx, [esp + 0x21c]
call fcn.0094c3e0
test eax, eax
je 0x912d67
lea esi, [esp + 0x21c]
call fcn.00904e20
test eax, eax
jne 0x912d67
mov edx, dword [esp + 0x10]
inc edx
push edx
call fcn.00a7a155
mov esi, eax
add esp, 4
mov dword [esp + 0x84], esi
test esi, esi
je 0x912d67
mov eax, dword [esp + 0x10]
inc eax
push eax
push 0
push esi
call fcn.00a7ffb0
add esp, 0xc
push 0x4000
lea ecx, [esp + 0x2728]
push 0
push ecx
call fcn.00a7ffb0
mov edi, dword [esp + 0x1c]
add esp, 0xc
push edi
lea edx, [esp + 0x220]
push edx
push esi
call fcn.00a7a620
add esp, 0xc
test edi, edi
jbe 0x912bcd
cmp byte [edi + esi - 1], 0
je 0x912bcd
mov byte [edi + esi], 0
mov esi, dword [esp + 0x84]
xor eax, eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x5f]
push ecx
lea edx, [esp + 0x50]
push edx
lea ebx, [esp + 0x88]
lea edi, [esp + 0x94]
call fcn.00951ad0
mov ebx, eax
test ebx, ebx
je 0x912d25
mov esi, dword [esp + 0x88]
lea esp, [esp]
cmp byte [ebx], 0
mov edi, ebx
je 0x912c2d
inc edi
cmp byte [edi], 0
jne 0x912c27
push ebx
call fcn.0095ad70
add esp, 4
test eax, eax
je 0x912c5b
cmp byte [ebx], 0
je 0x912c5b
mov eax, edi
mov edi, dword [esp + 0x70]
sub eax, ebx
lea edi, [esp + edi + 0x2724]
push ebx
call fcn.0096ad40
add esp, 4
add dword [esp + 0x70], eax
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x912c69
mov cl, byte [esp + 0x5b]
mov byte [eax], cl
mov eax, dword [esp + 0x48]
test eax, eax
je 0x912c77
mov dl, byte [esp + 0x60]
mov byte [eax], dl
test esi, esi
je 0x912d25
push 0xa
push esi
mov ebx, esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x912cfb
xor esi, esi
jmp 0x912d1d
cmp al, 0xff
jne 0x912a7f
cmp byte [esp + 0x21d], al
jne 0x912a7f
cmp byte [esp + 0x21e], 1
jne 0x912a7f
cmp byte [esp + 0x21f], 0
jne 0x912a7f
push 0xabe830
lea eax, [esp + 0x118]
push eax
mov dword [esp + 0x94], 1
mov dword [esp + 0x2c], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x78], 1
jmp 0x912ae4
mov cl, byte [eax]
mov dword [esp + 0x7c], eax
mov byte [eax], 0
lea esi, [eax + 1]
dec eax
cmp byte [eax], 0xd
mov byte [esp + 0x5b], cl
jne 0x912d1d
mov dword [esp + 0x48], eax
mov byte [esp + 0x60], 0xd
mov byte [eax], 0
test ebx, ebx
jne 0x912c20
cmp byte [esp + 0x2724], 0
je 0x912d57
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x2728]
push eax
lea ecx, [esp + 0x224]
push ecx
mov dword [esp + 0xe0], 1
call fcn.00a828e0
add esp, 0xc
mov edx, dword [esp + 0x84]
push edx
call fcn.00a78fec
add esp, 4
cmp dword [esp + 0x10], 0
mov esi, dword [esp + 0x2c]
mov dword [esi], 0x12
jbe 0x912dc3
cmp byte [esp + 0x21c], 0
je 0x912dc3
cmp dword [esp + 0x8c], 0
jne 0x912dc3
mov ecx, dword [0xb524dc]
lea eax, [esp + 0x21c]
push eax
call fcn.009051f0
add esp, 4
cmp eax, 0xffffffff
je 0x912dc3
cmp dword [esp + 0x34], 0x100000
jb 0x912dc3
cmp dword [esp + 0x4c], 0
jne 0x912dc3
mov dword [esp + 0x8c], 1
cmp dword [esp + 0x8c], 0
mov dword [esi], 0x13
jne 0x912dfc
cmp byte [esp + 0x21c], 0
je 0x912e27
mov eax, str.From
lea ecx, [esp + 0x21c]
call fcn.0094c3e0
test eax, eax
jne 0x912e27
cmp dword [esp + 0x34], 0x100000
jb 0x912e27
push 0xabe830
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x2c], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0
mov dword [esp + 0x78], 1
mov eax, dword [esp + 0x10]
mov dword [esi], 0x14
test eax, eax
jbe 0x913693
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
push eax
push edx
lea esi, [esp + 0x224]
call fcn.00911320
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x91308e
movzx ebx, word [esp + esi + 0x236]
push 0x104
lea eax, [esp + 0x1220]
push 0
push eax
call fcn.00a7ffb0
mov ecx, 0x103
add esp, 0xc
cmp bx, cx
jae 0x913077
movzx edx, bx
push edx
lea eax, [esp + esi + 0x23e]
push eax
lea ecx, [esp + 0x1224]
push ecx
call fcn.00a828e0
add esp, 0xc
lea edx, [esp + 0x121c]
push 0x5c
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x913077
lea eax, [esp + 0x121c]
push 0x2f
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x913077
lea ecx, [esp + 0x121c]
push 0x2e
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x913077
mov eax, str..SCR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..PIF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..COM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..CPL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..HTA
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..CMD
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..URL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..CHM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..SHTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913016
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913016
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913066
mov eax, 0xace5d4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..JAR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, str..LNK
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913066
mov eax, 0xace5f4
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913077
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x913077
mov dword [eax], 1
mov eax, 1
mov dword [esp + 0xcc], eax
mov dword [esp + 0x6c], eax
mov ebx, eax
jmp 0x913698
xor ebx, ebx
cmp byte [esp + 0x21c], bl
je 0x9130f0
push 4
mov eax, 0xae03a8
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x9130c0
mov dword [esp + 0x6c], 1
jmp 0x913693
cmp byte [esp + 0x21c], bl
je 0x9130f0
push 4
mov eax, str.MSCF
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x9130f0
mov dword [esp + 0x6c], 1
jmp 0x913693
push 2
mov eax, 0xad00ac
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x91312b
cmp byte [esp + 0x21e], 0xbc
jne 0x91312b
cmp byte [esp + 0x21f], 0xaf
jne 0x91312b
mov dword [esp + 0x6c], 1
jmp 0x913693
cmp byte [esp + 0x21c], 0xfd
jne 0x913165
push 4
mov eax, str.7zXZ
lea ecx, [esp + 0x221]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x913165
cmp byte [esp + 0x221], bl
jne 0x913165
mov dword [esp + 0x6c], 1
jmp 0x913693
cmp byte [esp + 0x223], bl
je 0x9133d6
push 7
mov eax, str.ACE
lea ecx, [esp + 0x227]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x9133d6
mov dl, byte [esp + 0x272]
mov al, byte [esp + 0x273]
push 0x104
lea ecx, [esp + 0x1220]
push ebx
mov dword [esp + 0x50], ebx
push ecx
mov dword [esp + 0x78], 1
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], al
call fcn.00a7ffb0
mov eax, dword [esp + 0x54]
add esp, 0xc
cmp eax, ebx
je 0x913693
cmp eax, 0x103
jae 0x913693
push eax
lea edx, [esp + 0x278]
push edx
lea eax, [esp + 0x1224]
push eax
call fcn.00a828e0
add esp, 0xc
lea ecx, [esp + 0x121c]
push 0x5c
push ecx
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x913693
lea edx, [esp + 0x121c]
push 0x2f
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x913693
lea eax, [esp + 0x121c]
push 0x2e
push eax
call fcn.00a7aa50
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x913693
mov eax, str..SCR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..PIF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..COM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..CPL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..HTA
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..CMD
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..URL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..CHM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..SHTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913368
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913368
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x9133bc
mov eax, 0xace5d4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..JAR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, str..LNK
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9133bc
mov eax, 0xace5f4
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913693
mov eax, dword [esp + 0xb0]
cmp eax, ebx
je 0x913693
mov dword [eax], 1
jmp 0x913693
cmp byte [esp + 0x21c], 0x1f
jne 0x9133f7
cmp byte [esp + 0x21d], 0x8b
jne 0x9133f7
mov dword [esp + 0x6c], 1
jmp 0x913693
cmp byte [esp + 0x21e], 0x2d
mov al, byte [esp + 0x220]
jne 0x913440
cmp byte [esp + 0x222], 0x2d
jne 0x913440
mov cl, byte [esp + 0x21f]
cmp cl, 0x6c
jne 0x913433
cmp al, 0x68
je 0x913426
cmp al, 0x7a
jne 0x913440
mov dword [esp + 0x6c], 1
jmp 0x913693
cmp cl, 0x70
jne 0x913440
cmp al, 0x63
je 0x913426
cmp al, 0x6d
je 0x913426
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
je 0x913487
cmp byte [ecx + 1], bl
je 0x913487
mov eax, str..LOG
call fcn.0094c3e0
test eax, eax
jne 0x913487
push 0xaade0c
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x2c], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x78], 1
jmp 0x913693
mov eax, dword [esp + 0x10]
cmp eax, ebx
jbe 0x913693
cmp dword [esp + 0x78], 0
jne 0x9134dc
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x90]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x23c]
push ecx
call fcn.00909860
mov eax, dword [esp + 0x34]
add esp, 0x24
test eax, eax
jbe 0x913693
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
push ecx
lea edx, [esp + 0x98]
push edx
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
lea eax, [esp + 0x234]
xor edi, edi
push eax
mov dword [esp + 0xac], edi
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x913693
mov al, byte [esp + 0x21c]
mov bl, byte [esp + 0x21e]
mov cl, byte [esp + 0x21d]
cmp al, 0x47
jne 0x913564
cmp cl, 0x49
jne 0x913564
cmp bl, 0x46
jne 0x913564
mov ecx, dword [esp + 0x18]
mov eax, 0xadf5b0
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x913667
mov esi, dword [esp + 0x90]
cmp esi, edi
jbe 0x9135c5
lea ecx, [esp + esi + 0x21c]
mov eax, str..rsrc
call fcn.0094c3e0
test eax, eax
jne 0x9135b0
mov eax, esi
lea edx, [esp + 0x21c]
call fcn.00904f10
test eax, eax
je 0x9135b0
mov ecx, dword [esp + 0x18]
mov eax, 0xaaab94
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x913667
mov bl, byte [esp + 0x21e]
mov al, byte [esp + 0x21c]
mov cl, byte [esp + 0x21d]
mov dl, byte [esp + 0x21f]
cmp al, 0xca
jne 0x9135e1
cmp cl, 0xfe
jne 0x9135f8
cmp bl, 0xba
jne 0x9135f8
cmp dl, 0xbe
jne 0x9135f8
jmp 0x91363f
cmp al, 0xce
je 0x9135e9
cmp al, 0xcf
jne 0x9135f8
cmp cl, 0xfa
jne 0x9135f8
cmp bl, 0xed
jne 0x9135f8
cmp dl, 0xfe
je 0x91363f
cmp dword [esp + 0x10], 0x200
jbe 0x913612
lea esi, [esp + 0x21c]
call fcn.00906fd0
cmp eax, edi
jne 0x91363f
mov al, byte [esp + 0x21f]
cmp al, 0xce
je 0x913621
cmp al, 0xcf
jne 0x913667
cmp byte [esp + 0x21e], 0xfa
jne 0x913667
cmp byte [esp + 0x21d], 0xed
jne 0x913667
cmp byte [esp + 0x21c], 0xfe
jne 0x913667
mov ax, word [0xadeff0]
mov edx, dword [0xadefec]
mov ecx, dword [str.MacBinary]
mov word [esp + 0x11c], ax
mov dword [esp + 0x118], edx
mov dword [esp + 0x114], ecx
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x913679
cmp dword [eax], edi
jne 0x913679
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
cmp eax, edi
je 0x91368f
mov dword [eax], 1
mov dword [esp + 0x10], edi
mov ebx, 1
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov dword [ecx], 0x15
jbe 0x9136d8
cmp dword [esp + 0x6c], 0
jne 0x9136d8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
lea esi, [esp + 0x230]
call fcn.009079d0
add esp, 0x14
cmp dword [esp + 0x10], 0
mov eax, dword [esp + 0x2c]
mov dword [eax], 0x16
jbe 0x91372e
cmp dword [esp + 0x6c], 0
jne 0x91372e
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
push esi
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
push edi
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x240]
push edx
call fcn.009070a0
add esp, 0x28
jmp 0x913732
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
mov dword [eax], 0x17
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x913a44
lea ecx, [esp + 0x21c]
push 0
push ecx
lea edx, [esp + 0x64]
lea ecx, [esp + 0x11c]
mov dword [esp + 0x100], eax
call fcn.00904050
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
jne 0x913997
mov edx, dword [esp + 0x1c]
push ebx
push edx
lea edx, [esp + 0x64]
lea ecx, [esp + 0x11c]
call fcn.00904050
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
jne 0x913997
push 2
mov eax, 0xadfde8
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x9137cb
cmp byte [esp + 0x21e], 3
jne 0x9137cb
cmp byte [esp + 0x21f], 4
je 0x9137d5
cmp dword [esp + 0xcc], 0
je 0x9137e3
mov dword [esp + 0x5c], ebx
push 0xac5f5c
jmp 0x913a32
cmp byte [esp + 0x21c], 0
je 0x913857
push 4
mov eax, 0xae03a8
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x91381d
push 0xad24f8
lea ecx, [esp + 0x118]
mov dword [esp + 0x60], ebx
push ecx
jmp 0x913a3a
cmp byte [esp + 0x21c], 0
je 0x913857
push 4
mov eax, str.MSCF
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x913857
push 0xad21c4
lea edx, [esp + 0x118]
mov dword [esp + 0x60], ebx
push edx
jmp 0x913a3a
push 2
mov eax, 0xad00ac
lea ecx, [esp + 0x220]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x913893
cmp byte [esp + 0x21e], 0xbc
jne 0x913893
cmp byte [esp + 0x21f], 0xaf
jne 0x913893
mov dword [esp + 0x5c], ebx
push 0xad00ac
jmp 0x913a32
cmp byte [esp + 0x21c], 0xfd
jne 0x9138d6
push 4
mov eax, str.7zXZ
lea ecx, [esp + 0x221]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x9138d6
cmp byte [esp + 0x221], al
jne 0x9138d6
push 0xae0c70
lea ecx, [esp + 0x118]
mov dword [esp + 0x60], ebx
push ecx
jmp 0x913a3a
cmp byte [esp + 0x223], 0
je 0x913910
push 7
mov eax, str.ACE
lea ecx, [esp + 0x227]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x913910
push 0xad279c
lea edx, [esp + 0x118]
mov dword [esp + 0x60], ebx
push edx
jmp 0x913a3a
cmp byte [esp + 0x21c], 0x1f
jne 0x913932
cmp byte [esp + 0x21d], 0x8b
jne 0x913932
mov dword [esp + 0x5c], ebx
push 0xad330c
jmp 0x913a32
cmp byte [esp + 0x21e], 0x2d
jne 0x9139f1
cmp byte [esp + 0x222], 0x2d
jne 0x9139f1
mov al, byte [esp + 0x21f]
cmp al, 0x6c
jne 0x913982
mov al, byte [esp + 0x220]
cmp al, 0x68
je 0x91396c
cmp al, 0x7a
jne 0x9139f1
push 0xad28a0
lea ecx, [esp + 0x118]
mov dword [esp + 0x60], ebx
push ecx
jmp 0x913a3a
cmp al, 0x70
jne 0x9139f1
mov al, byte [esp + 0x220]
cmp al, 0x63
je 0x91396c
cmp al, 0x6d
je 0x91396c
jmp 0x9139f1
mov eax, 0xaaabac
lea ecx, [esp + 0x114]
call fcn.0094c330
test eax, eax
jne 0x9139f1
test esi, esi
je 0x9139f1
push esi
call fcn.00919d60
add esp, 4
test eax, eax
je 0x9139f1
mov eax, 0xaaabac
mov ecx, edi
lea edx, [esp + 0x114]
call fcn.00907060
test edi, edi
je 0x9139db
cmp dword [edi], 0
jne 0x9139db
mov dword [edi], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
test eax, eax
je 0x9139e9
mov dword [eax], ebx
mov dword [esp + 0x10], 0
cmp dword [esp + 0x40], 0
jne 0x913a44
mov edx, dword [esp + 0x1c]
cmp byte [edx], 0x7b
jne 0x913a44
mov edi, 0xae0c74
add edi, ebx
cmp byte [edi], 0
jne 0x913a06
mov ecx, dword [esp + 0x1c]
sub edi, 0xae0c74
inc ecx
mov eax, 0xae0c74
call fcn.00904d50
test eax, eax
jne 0x913a44
mov dword [esp + 0xdc], ebx
push 0xad6c3c
lea eax, [esp + 0x118]
push eax
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 0x18
je 0x913b0f
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x74]
push edx
push eax
mov eax, dword [esp + 0x6c]
push ecx
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xbc]
push ecx
push edx
mov edx, dword [esp + 0x104]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0xf8]
push edx
push eax
mov eax, dword [esp + 0x118]
push ecx
mov edi, dword [esp + 0x48]
lea edx, [esp + 0x1354]
push edx
mov edx, dword [esp + 0x88]
push eax
lea ecx, [esp + 0xd8]
push ecx
mov ecx, dword [esp + 0xd0]
push edx
lea eax, [esp + 0x11c]
push eax
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x8c]
push eax
push ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x278]
push ecx
mov edx, edi
lea ecx, [esp + 0x70]
call fcn.00909b70
add esp, 0x60
jmp 0x913b99
cmp dword [esp + 0x4c], 0
mov edi, dword [esp + 0x18]
je 0x913b99
cmp dword [edi], 0
jne 0x913b99
mov esi, dword [esp + 0x94]
test esi, esi
je 0x913b99
cmp dword [esi], 0
jne 0x913b99
cmp dword [esp + 0x1c], 0
je 0x913b99
mov edx, dword [esp + 0x1c]
cmp byte [edx], 0
je 0x913b99
mov eax, str.HELO_btamail.net.cn
mov ecx, edx
call fcn.0094c3e0
test eax, eax
jne 0x913b99
push eax
mov eax, dword [esp + 0x20]
push str.is_comming
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x913b99
mov dword [esi], 2
cmp dword [edi], 0
mov dword [esp + 0x114], 0x4c4d45
jne 0x913b83
mov dword [edi], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
test eax, eax
je 0x913b91
mov dword [eax], ebx
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 0x19
jbe 0x914148
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x9c]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x34]
push ecx
lea eax, [esp + 0x244]
call fcn.00908840
add esp, 0x28
cmp dword [esp + 0x24], 0
jne 0x914148
mov esi, dword [esp + 0x10]
cmp esi, 0x100
jbe 0x913c64
cmp dword [esp + 0xa8], 0
jne 0x913c64
mov eax, esi
lea edx, [esp + 0x21c]
call fcn.00904f10
mov dword [esp + 0xa8], ebx
cmp eax, ebx
jne 0x913c64
mov edx, dword [str.Mangled_EXE]
mov eax, dword [0xadf5b8]
mov ecx, dword [0xadf5bc]
mov dword [esp + 0x114], edx
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], ecx
test edi, edi
je 0x913fc4
mov dword [edi], 2
jmp 0x913fc4
cmp byte [esp + 0x220], 0x20
jne 0x913d11
cmp byte [esp + 0x221], 0
jne 0x913d11
cmp byte [esp + 0x222], 0
jne 0x913d11
cmp byte [esp + 0x223], 0
jne 0x913d11
cmp byte [esp + 0x224], 0xff
jne 0x913d11
cmp byte [esp + 0x225], 0xff
jne 0x913d11
cmp byte [esp + 0x226], 0
jne 0x913d11
cmp byte [esp + 0x227], 0
jne 0x913d11
push 0
push 0
push esi
lea edx, [esp + 0x228]
push str..rsrc
push edx
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
je 0x913cf7
test edi, edi
je 0x913fc4
cmp dword [edi], 0
jne 0x913fc4
mov dword [edi], ebx
jmp 0x913fc4
push 0xadf904
lea eax, [esp + 0x118]
mov dword [esp + 0x28], 0x8f
push eax
jmp 0x914142
mov edi, str.Standard_Jet
add edi, ebx
cmp byte [edi], 0
jne 0x913d16
sub edi, str.Standard_Jet
mov eax, str.Standard_Jet
lea ecx, [esp + 0x220]
call fcn.00904d50
test eax, eax
je 0x914106
mov edi, str.Jet_DB
add edi, ebx
cmp byte [edi], 0
jne 0x913d41
sub edi, str.Jet_DB
mov eax, str.Jet_DB
lea ecx, [esp + 0x225]
call fcn.00904d50
test eax, eax
je 0x914106
cmp dword [esp + 0x1c], 0
je 0x913f15
mov ecx, dword [esp + 0x1c]
push 0x23
push ecx
call fcn.00a7a2c0
mov esi, eax
add esp, 8
test esi, esi
je 0x913f15
push 8
mov eax, str.include
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x913de3
push 3
mov eax, 0xae0cc4
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x913de3
push 7
mov eax, str.define
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x913de3
push 7
mov eax, str.pragma
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x913f15
cmp dword [esp + 0x68], 0
jne 0x913e43
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x44]
push 0
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x60]
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x913e43
mov eax, dword [esp + 0x18]
test eax, eax
je 0x91411f
cmp dword [eax], 0
jne 0x91411f
mov dword [esp + 0x14], ebx
mov dword [eax], ebx
mov dword [esp + 0x10], 0
jmp 0x914148
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x10]
mov edi, 0x1000
cmp eax, 0x1000
ja 0x913e59
mov edi, eax
cmp eax, 0x30
jbe 0x913ef0
mov esi, dword [esp + 0x38]
push 1
push 0
push 0
push esi
mov dword [esp + 0x60], 0
mov dword [esp + 0xb0], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
mov edx, edi
neg edx
push edx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x54]
push eax
push edi
lea ecx, [esp + 0x1730]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x54]
push eax
push 0
push 0
push ecx
mov ecx, dword [esp + 0x58]
push edx
lea eax, [esp + 0x173c]
push eax
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x9140ac
push 0xae0cd8
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x2c], 0x5a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
jmp 0x914148
mov edi, dword [esp + 0x1c]
cmp byte [edi], 0x2f
jne 0x914148
mov al, byte [edi + 1]
cmp al, 0x2a
je 0x913f31
cmp al, 0x2f
jne 0x914148
mov esi, dword [esp + 0x30]
test esi, esi
je 0x913f81
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x913f6d
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x913f6d
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x914148
mov eax, str..CSS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x914148
cmp dword [esp + 0x68], 0
jne 0x913fdf
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x44]
push 0
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
push edi
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x913fdf
mov eax, dword [esp + 0x18]
test eax, eax
je 0x913fc4
cmp dword [eax], 0
jne 0x913fc4
mov dword [eax], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
test eax, eax
je 0x913fd2
mov dword [eax], ebx
mov dword [esp + 0x10], 0
jmp 0x914148
mov ecx, dword [esp + 0x3c]
push ecx
push str._
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x914003
mov dword [esp + 0xe4], ebx
jmp 0x914148
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x10]
mov edi, 0x1000
cmp eax, 0x1000
ja 0x914019
mov edi, eax
cmp eax, 0x30
jbe 0x9140e4
mov esi, dword [esp + 0x38]
push 1
push 0
push 0
push esi
mov dword [esp + 0x60], 0
mov dword [esp + 0xb0], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
mov edx, edi
neg edx
push edx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x54]
push eax
push edi
lea ecx, [esp + 0x1730]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x54]
push eax
push 0
push 0
push ecx
mov ecx, dword [esp + 0x58]
push edx
lea eax, [esp + 0x173c]
push eax
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x9140e4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x9140bf
cmp dword [eax], 0
jne 0x9140bf
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x9140d5
mov dword [eax], 1
mov dword [esp + 0x10], 0
mov ebx, 1
jmp 0x914148
push str.Source_File
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x2c], 0x5a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
jmp 0x914148
cmp byte [esp + 0x230], 0
jne 0x91412d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x91411f
cmp dword [eax], 0
jne 0x91411f
mov dword [eax], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
jmp 0x914148
push str.JET_DB
lea edx, [esp + 0x118]
mov dword [esp + 0x28], 0x4c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp byte [esp + 0x21c], 0x4d
jne 0x914160
cmp byte [esp + 0x21d], 0x5a
jne 0x914160
mov eax, ebx
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 0x1a
jbe 0x914409
cmp dword [esp + 0x24], 0
jne 0x914409
test eax, eax
jne 0x914409
lea edx, [esp + 0x50]
mov dword [esp + 0x50], eax
push edx
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x224]
call fcn.00907f60
mov eax, dword [esp + 0x58]
add esp, 8
test eax, eax
jne 0x9143ea
cmp dword [esp + 0x78], eax
jne 0x914319
cmp dword [esp + 0xe4], eax
jne 0x914262
mov ecx, dword [esp + 0x1c]
push 4
mov eax, str._
call fcn.0094c380
add esp, 4
test eax, eax
je 0x914262
mov ecx, dword [esp + 0x1c]
mov eax, str.REGEDIT
call fcn.0094c3e0
test eax, eax
je 0x914262
mov ecx, dword [esp + 0x1c]
mov eax, str.Windows_Registry
call fcn.0094c3e0
test eax, eax
je 0x914262
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
push ecx
call fcn.00906e30
add esp, 4
cmp eax, 0x20
jge 0x914262
cmp dword [esp + 0x68], 0
jne 0x914319
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x44]
push 0
lea ecx, [esp + 0x74]
push ecx
push edx
push eax
mov ecx, ebx
push ecx
mov ecx, dword [esp + 0x60]
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x914319
mov eax, dword [esp + 0x10]
mov dword [esp + 0x114], 0x45534a
cmp eax, 0x100
jbe 0x9142ac
cmp dword [esp + 0xa8], 0
jne 0x9142ac
lea edx, [esp + 0x21c]
call fcn.00904f10
cmp eax, 1
jne 0x9142ac
mov esi, dword [esp + 0x18]
mov eax, 0xae0d00
mov ecx, esi
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x9142f1
mov esi, dword [esp + 0x30]
test esi, esi
je 0x9142ed
mov eax, 0xace5f4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9142d4
mov eax, str..CMD
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x9142ed
mov esi, dword [esp + 0x18]
mov eax, 0xac8844
mov ecx, esi
lea edx, [esp + 0x114]
call fcn.00907060
jmp 0x9142f1
mov esi, dword [esp + 0x18]
test esi, esi
je 0x914300
cmp dword [esi], 0
jne 0x914300
mov dword [esi], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x914409
jmp 0x914403
mov eax, str.etQhsockTS
mov edi, edi
inc eax
cmp byte [eax], 0
jne 0x914320
sub eax, str.etQhsockTS
add eax, 0xf6
cmp dword [esp + 0x10], eax
jbe 0x914409
xor esi, esi
mov bl, 0x51
mov edi, edi
cmp byte [esp + esi + 0x21c], 0x65
lea ecx, [esp + esi + 0x21c]
jne 0x91437e
cmp byte [ecx + 1], 0x74
jne 0x91437e
cmp byte [ecx + 2], bl
jne 0x91437e
mov eax, str.etQhsockTS
inc eax
cmp byte [eax], 0
jne 0x914361
sub eax, str.etQhsockTS
push eax
mov eax, str.etQhsockTS
call fcn.0094c380
add esp, 4
test eax, eax
je 0x91438c
inc esi
cmp esi, 0xf6
jl 0x914340
jmp 0x914409
mov eax, dword [0xae0d14]
mov edx, dword [str.Witty_Packet]
mov ecx, dword [0xae0d18]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x114], edx
mov dl, byte [0xae0d1c]
mov dword [esp + 0x11c], ecx
mov byte [esp + 0x120], dl
test eax, eax
je 0x9143d2
cmp dword [eax], 0
jne 0x9143d2
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x9143ef
mov dword [eax], 1
jmp 0x9143ef
cmp eax, 1
jne 0x914409
mov eax, dword [esp + 0x54]
mov dword [esp + 0x10], 0
test eax, eax
je 0x9144ac
mov dword [eax], 1
cmp dword [esp + 0x54], 0
je 0x9144ac
mov eax, dword [esp + 0x54]
cmp dword [eax], 1
jne 0x9144ac
cmp dword [esp + 0x14], 0
jne 0x9144ac
cmp dword [esp + 0x30], 0
je 0x9144ac
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 1], 0
je 0x9144ac
mov eax, str..PART
mov esi, ecx
call fcn.0094c330
test eax, eax
je 0x914471
mov eax, str..TMP
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x914471
mov eax, str..crdownload
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x9144ac
cmp dword [esp + 0x34], 0x80
jae 0x9144ac
mov eax, dword [esp + 0x18]
test eax, eax
je 0x91448e
cmp dword [eax], 0
jne 0x91448e
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x9144a4
mov dword [eax], 1
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
xor edi, edi
mov dword [edx], 0x1b
cmp eax, edi
jbe 0x914500
cmp dword [esp + 0x24], edi
jne 0x914500
cmp dword [esp + 0x14], edi
jne 0x914500
cmp eax, 0x14
jbe 0x914500
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x230]
call fcn.00907730
add esp, 0x14
xor edi, edi
jmp 0x914508
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov al, byte [esp + 0x21d]
mov dl, byte [esp + 0x21c]
mov dword [ecx], 0x1c
cmp dword [esp + 0x10], edi
jbe 0x91467c
cmp dword [esp + 0x24], edi
jne 0x91467c
cmp dword [esp + 0x14], edi
jne 0x91467c
cmp dword [esp + 0x78], edi
jne 0x91467c
cmp dl, 0x82
jne 0x914551
test al, al
jmp 0x914587
cmp dl, 0x88
jne 0x91455a
test al, al
jmp 0x914587
cmp dl, 0x81
jne 0x914577
cmp al, 0xc6
jne 0x9145a1
cmp byte [esp + 0x21e], 7
jne 0x9145a1
cmp byte [esp + 0x21f], 1
jmp 0x91459b
cmp dl, 0x5c
jne 0x914580
cmp al, 0xe
jmp 0x914587
cmp dl, 0xac
jne 0x9145a1
cmp al, 0xe9
jne 0x9145a1
cmp byte [esp + 0x21e], 0
jne 0x9145a1
cmp byte [esp + 0x21f], 0
je 0x914658
cmp byte [esp + 0x220], 0xe9
jne 0x9145cd
cmp byte [esp + 0x221], 0xc6
jne 0x9145cd
cmp byte [esp + 0x222], 1
jne 0x9145cd
cmp byte [esp + 0x223], 0x9c
je 0x914658
cmp dl, 0xbd
jne 0x9145ea
cmp al, 0x11
jne 0x9145f7
cmp byte [esp + 0x21e], 0xa5
jne 0x914618
cmp byte [esp + 0x21f], 0x55
jmp 0x914616
cmp dl, 0x8b
jne 0x914844
cmp al, 0x29
je 0x914658
cmp al, 0x45
jne 0x91460f
cmp byte [esp + 0x21e], 0x4c
jne 0x91460f
cmp byte [esp + 0x21f], 0x46
je 0x914658
cmp dl, 0xf8
jne 0x914618
cmp al, 0x94
je 0x914658
cmp dword [esp + 0x68], edi
jne 0x91467c
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x74]
push ecx
push edx
push eax
lea ecx, [esp + 0x234]
push ecx
mov ecx, dword [esp + 0x60]
call fcn.00906770
mov dl, byte [esp + 0x238]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x91467c
cmp esi, edi
je 0x914666
cmp dword [esi], edi
jne 0x914666
mov dword [esi], 1
mov dword [esp + 0x14], 1
cmp ebx, edi
je 0x914678
mov dword [ebx], 1
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x2c]
mov dword [eax], 0x1d
cmp dword [esp + 0x10], edi
jbe 0x9146cb
cmp dword [esp + 0xa4], edi
je 0x9146cb
cmp dword [esp + 0x24], edi
jne 0x9146cb
cmp dword [esp + 0x14], edi
jne 0x9146cb
cmp dword [esp + 0x78], edi
jne 0x9146cb
cmp esi, edi
je 0x9146b5
cmp dword [esi], edi
jne 0x9146b5
mov dword [esi], 1
mov dword [esp + 0x14], 1
cmp ebx, edi
je 0x9146c7
mov dword [ebx], 1
mov dword [esp + 0x10], edi
mov dword [eax], 0x1e
mov eax, dword [esp + 0xf8]
lea ecx, [eax - 1]
cmp ecx, 0x7fe
ja 0x91473d
cmp dword [esp + 0x14], edi
jne 0x91473d
push eax
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x224]
push eax
mov byte [esp + 0x6c], 0xeb
mov byte [esp + 0x6d], 0x72
call fcn.0095d3f0
add esp, 0xc
cmp eax, 0xffffffff
je 0x914736
cmp esi, edi
je 0x91471c
cmp dword [esi], edi
jne 0x91471c
mov dword [esi], 1
mov dword [esp + 0x14], 1
cmp ebx, edi
je 0x91472e
mov dword [ebx], 1
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], edi
mov dl, byte [esp + 0x21c]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 0x1f
cmp dword [esp + 0x10], edi
jbe 0x9149b5
cmp dword [esp + 0x14], edi
jne 0x9149ae
cmp dword [esp + 0xa0], 0
jne 0x9149ae
cmp dword [esp + 0x78], 0
jne 0x9149ae
cmp dword [esp + 0x64], 0
jne 0x9149ae
cmp dword [esp + 0x98], 0
jne 0x9149ae
mov edi, dword [esp + 0x34]
sub edi, dword [esp + 0x10]
cmp edi, 0x30
jbe 0x9149ae
mov dword [esp + 0x3c], 0
cmp edi, 0xc00
jbe 0x9147b3
mov edi, 0xc00
mov ebx, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ebx
call esi
push 2
push 0
mov edx, edi
neg edx
push edx
push ebx
mov dword [esp + 0x90], eax
call esi
push 0
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x1730]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x80]
push 0
push 0
push edx
push ebx
call esi
cmp dword [esp + 0xbc], 1
jne 0x914954
mov edx, dword [esp + 0x3c]
xor esi, esi
mov byte [esp + edx + 0x1723], 0
mov byte [esp + edx + 0x1722], 0
test edx, edx
jbe 0x914958
jmp 0x914830
cmp byte [esp + esi + 0x1724], 0
jne 0x914877
inc esi
cmp esi, edx
jb 0x914830
jmp 0x914958
cmp dl, 0x83
jne 0x914850
cmp al, 0xec
jmp 0x9145f5
cmp dl, 0xe9
je 0x914658
cmp dl, 0x45
jne 0x9145f7
cmp al, 0x4c
jne 0x9145f7
cmp byte [esp + 0x21e], 0x46
jmp 0x914616
cmp esi, edx
jae 0x914958
cmp dword [esp + 0xac], 2
jne 0x9148ed
test esi, esi
jne 0x914894
mov esi, 1
jmp 0x914895
dec esi
add edx, 0x12
push 1
push edx
call fcn.00a7b9f8
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x914954
lea ecx, [esp + esi + 0x1724]
call fcn.00906b00
mov eax, dword [esp + 0x3c]
dec eax
push eax
lea ecx, [esp + 0x1728]
push 0
push ecx
call fcn.00a7ffb0
lea edx, [esp + 0x1730]
add esp, 0xc
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x9148e0
push ebx
jmp 0x91494c
lea edx, [esp + esi + 0x1724]
push edx
lea ebx, [esp + 0x9c]
mov dword [esp + 0x9c], 0
call fcn.00970520
add esp, 4
test eax, eax
je 0x914954
mov esi, dword [esp + 0x98]
test esi, esi
je 0x914954
mov eax, dword [esp + 0x3c]
dec eax
push eax
lea ecx, [esp + 0x1728]
push 0
push ecx
call fcn.00a7ffb0
lea edx, [esp + 0x1730]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x914941
push esi
call fcn.00a78fec
add esp, 4
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x1724]
push eax
call fcn.00906900
add esp, 4
cmp eax, 0xffffffff
je 0x9149a7
mov eax, dword [esp + 0x18]
test eax, eax
je 0x914980
cmp dword [eax], 0
jne 0x914980
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x914996
mov dword [eax], 1
mov dl, byte [esp + 0x21c]
mov dword [esp + 0x10], 0
jmp 0x9149b5
mov dl, byte [esp + 0x21c]
cmp dword [esp + 0x10], 0
ja 0x9149c3
cmp byte [esp + 0x114], 0
jne 0x914a60
cmp dword [esp + 0x14], 0
jne 0x914a60
cmp dword [esp + 0x24], 0
jne 0x914a60
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x914a64
cmp byte [ebx + 1], 0
lea esi, [ebx + 1]
je 0x914a64
mov eax, 0xae0d28
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
jne 0x914a57
lea edx, [esp + 0x114]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x914a10
mov edi, dword [esp + 0x18]
test edi, edi
je 0x914a2d
cmp dword [edi], 0
jne 0x914a2d
mov dword [edi], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test eax, eax
je 0x914a43
mov dword [eax], 1
mov dl, byte [esp + 0x21c]
mov dword [esp + 0x10], 0
jmp 0x914b25
mov dl, byte [esp + 0x21c]
jmp 0x914a64
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x914b21
cmp dword [esp + 0x14], 0
jne 0x914b14
cmp dword [esp + 0x24], 0
jne 0x914b14
cmp eax, 0x400
jbe 0x914a92
mov eax, 0x400
xor ecx, ecx
add eax, 0xfffffffe
je 0x914b14
mov edi, dword [esp + 0x18]
mov bl, 0x78
mov edx, 0x4c4355
xor esi, esi
lea ebx, [ebx]
cmp byte [esp + ecx + 0x21c], bl
jne 0x914b02
cmp byte [esp + ecx + 0x21d], 0x9c
jne 0x914b02
mov dword [esp + 0x24], esi
cmp edi, esi
je 0x914ad1
mov dword [edi], 2
mov dword [esp + 0x114], edx
cmp edi, esi
je 0x914ae6
cmp dword [edi], esi
jne 0x914ae6
mov dword [edi], 1
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], 1
test esi, esi
je 0x914afc
mov dword [esi], 1
xor esi, esi
mov dword [esp + 0x10], esi
inc ecx
cmp ecx, eax
jb 0x914ab0
mov dl, byte [esp + 0x21c]
mov ebx, dword [esp + 0x30]
jmp 0x914b18
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x10], 0
ja 0x914b2f
jmp 0x914b25
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x114], 0
jne 0x914b86
cmp dword [esp + 0x24], 0
jne 0x914b86
cmp byte [esp + 0x21f], 0
jne 0x914b86
cmp byte [esp + 0x220], 0
jne 0x914b86
cmp byte [esp + 0x221], 0
jne 0x914b86
cmp byte [esp + 0x222], 0
jne 0x914b86
cmp byte [esp + 0x223], 0
jne 0x914b86
test dl, dl
jne 0x914c61
cmp byte [esp + 0x21d], dl
jne 0x914b86
cmp byte [esp + 0x21e], dl
je 0x914c86
mov esi, dword [esp + 0x54]
cmp dword [esp + 0x10], 0
ja 0x914b9b
cmp byte [esp + 0x114], 0
jne 0x914bdd
cmp dword [esp + 0x24], 0
jne 0x914bdd
test ebx, ebx
je 0x914bdd
cmp byte [ebx + 1], 0
je 0x914bdd
mov eax, str..TAR
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x914bdd
push 0xad2794
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x914bdd
mov dword [esi], 1
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
mov dword [edi], 0x20
test ebx, ebx
je 0x914f7b
cmp dword [ebx], 0
je 0x914f7b
cmp byte [esp + 0x21c], 0x4d
jne 0x914f7b
cmp byte [esp + 0x21d], 0x5a
jne 0x914f7b
mov eax, dword [esp + 0x94]
test eax, eax
je 0x914c29
mov dword [eax], 1
mov al, byte [esp + 0x22a]
cmp al, 0xf0
jne 0x914f4e
cmp byte [esp + 0x22b], 0xff
jne 0x914f7b
cmp byte [esp + 0x22c], 0xfe
jne 0x914f7b
cmp byte [esp + 0x22d], 0xff
jmp 0x914f6b
cmp dl, 0x44
jne 0x914b86
mov al, 0x41
cmp byte [esp + 0x21d], al
jne 0x914b86
cmp byte [esp + 0x21e], al
jne 0x914b86
cmp dword [esp + 0x14], 0
jne 0x914c95
mov dword [esp + 0x24], 0x3e8
cmp byte [esp + 0x114], 0
jne 0x914d00
test ebx, ebx
je 0x914ced
cmp byte [ebx + 1], 0
je 0x914ced
mov eax, str..PGP
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x914cc8
push 0xae0d34
lea ecx, [esp + 0x118]
push ecx
jmp 0x914cfa
cmp byte [ebx + 1], 0
je 0x914ced
mov eax, str..DMP
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x914ced
push 0xae0d40
lea edx, [esp + 0x118]
push edx
jmp 0x914cfa
push str.Generic_NullByte_Header
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x914dd2
cmp byte [ebx + 1], 0
lea esi, [ebx + 1]
je 0x914dd2
mov eax, str..ISO
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x914ec8
mov eax, str..IMG
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x914ec8
mov eax, str..ING
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x914ec8
mov eax, str..DAA
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x914ec8
mov al, byte [esi]
cmp al, 0x72
je 0x914d73
cmp al, 0x52
jne 0x914e75
mov al, byte [ebx + 2]
cmp al, 0x30
jl 0x914e75
cmp al, 0x32
jg 0x914e75
mov al, byte [ebx + 3]
cmp al, 0x30
jl 0x914e75
cmp al, 0x39
jg 0x914e75
xor esi, esi
mov eax, 0xad24f8
mov ecx, edi
lea edx, [esp + 0x114]
mov dword [esp + 0x24], esi
call fcn.00907060
cmp edi, esi
je 0x914dc0
cmp dword [edi], esi
jne 0x914dc0
mov dword [edi], 1
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x914dce
mov dword [eax], 1
mov dword [esp + 0x10], esi
cmp dword [esp + 0x34], 0x8010
jbe 0x914b86
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
push 1
xor ebx, ebx
push ebx
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x40]
push ebx
push eax
mov dword [esp + 0xb4], ebx
call esi
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push 0x8000
push ecx
mov edi, eax
call esi
mov ecx, dword [esp + 0x38]
push ebx
lea edx, [esp + 0xa8]
push edx
push 0x10
lea eax, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x38]
push ebx
push ebx
push edi
push edx
call esi
mov eax, dword [esp + 0x100]
cmp al, 1
jne 0x914ef6
cmp ah, 0x43
jne 0x914f41
cmp byte [esp + 0x102], 0x44
jmp 0x914f07
cmp dword [esp + 0x10], 0
jbe 0x914dd2
mov ecx, dword [esp + 0x34]
fild dword [esp + 0x34]
test ecx, ecx
jge 0x914e92
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x914dd2
push esi
call fcn.00915090
add esp, 4
test eax, eax
je 0x914dd2
mov esi, dword [esp + 0xb4]
call fcn.00905840
test eax, eax
je 0x914dd2
push 0xad289c
lea edx, [esp + 0x118]
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x54]
test esi, esi
je 0x914f45
mov dword [esi], 1
jmp 0x914b8a
test al, al
jne 0x914f41
cmp ah, 0x42
jne 0x914f41
cmp byte [esp + 0x102], 0x45
jne 0x914f41
cmp byte [esp + 0x106], 1
jne 0x914f41
push 0xad289c
lea eax, [esp + 0x118]
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x54]
cmp esi, ebx
je 0x914f45
mov ebx, dword [esp + 0x30]
mov dword [esi], 1
jmp 0x914b8a
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x30]
jmp 0x914b8a
test al, al
jne 0x914f7b
cmp byte [esp + 0x22b], al
jne 0x914f7b
cmp byte [esp + 0x22c], al
jne 0x914f7b
cmp byte [esp + 0x22d], al
jne 0x914f7b
mov eax, dword [esp + 0x28]
test eax, eax
je 0x914f7b
mov dword [eax], 1
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
push 0
push 0
push edx
push eax
mov dword [edi], 0x22
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0xc8]
mov dword [edi], 0x23
test esi, esi
je 0x914fc1
mov eax, str.MacBinary
lea ecx, [esp + 0x114]
call fcn.0094c330
test eax, eax
jne 0x914fc1
mov dword [esi], 1
mov esi, dword [esp + 0xd0]
test esi, esi
je 0x914fe7
mov eax, 0xad17e8
lea ecx, [esp + 0x114]
call fcn.0094c330
test eax, eax
jne 0x914fe7
mov dword [esi], 1
cmp dword [esp + 0x9c], 0
mov dword [edi], 0x25
jne 0x915001
lea ecx, [esp + 0x38]
push ecx
call fcn.00985290
cmp dword [esp + 0xb8], 1
jne 0x915010
call fcn.00987380
mov edx, dword [esp + 0xd8]
test edx, edx
je 0x915060
cmp dword [esp + 0x74], 0
je 0x915051
mov eax, dword [esp + 0x34]
fild dword [esp + 0x34]
test eax, eax
jge 0x915034
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x915051
lea eax, [esp + 0x114]
mov ecx, ebx
call fcn.00907060
jmp 0x915060
lea ecx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x24]
mov dword [edi], 0x26
mov ecx, dword [esp + 0x6730]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6718]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret