Function at 0x4a4b50
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Move file
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2994
call fcn.0053e900
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
push esi
push edi
push 0x5807c1
mov dword [ebp - 0x4c], 0
call fcn.004aeba0
sub esp, 0xc
mov dword [ebp - 0x4b4], 0x77554345
mov ecx, esp
mov dword [ebp - 0x4b0], 0x6b6b6a4d
mov dword [ebp - 0x4ac], 0x2b595447
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x4a8], 0x6c38694a
mov dword [ebp - 0x4a4], 0x6b39324b
mov dword [ebp - 0x4a0], 0x7234515a
mov dword [ebp - 0x49c], 0x2b41534e
mov dword [ebp - 0x498], 0x45494450
mov dword [ebp - 0x494], 0x6c345248
mov dword [ebp - 0x490], 0x5638334e
mov dword [ebp - 0x48c], 0x73394443
mov dword [ebp - 0x488], 0x4a557849
mov dword [ebp - 0x484], 0x7151784a
mov dword [ebp - 0x480], 0x69595245
mov dword [ebp - 0x47c], 0x4249674e
mov dword [ebp - 0x478], 0x73594750
mov dword [ebp - 0x474], 0x48415242
mov dword [ebp - 0x470], 0x61386d61
mov dword [ebp - 0x46c], 0x7a415763
mov dword [ebp - 0x468], 0x6d676a63
mov dword [ebp - 0x464], 0x65306a45
mov dword [ebp - 0x460], 0x57637a4e
mov dword [ebp - 0x45c], 0x59494349
mov dword [ebp - 0x458], 0x78304143
mov dword [ebp - 0x454], 0x78677a59
mov dword [ebp - 0x450], 0x51674464
mov dword [ebp - 0x44c], 0x4a497a4c
mov dword [ebp - 0x448], 0x4d6b7a4c
mov dword [ebp - 0x444], 0x366f534f
mov dword [ebp - 0x440], 0x76397a4a
mov dword [ebp - 0x43c], 0x39736844
mov dword [ebp - 0x438], 0x71387a47
mov dword [ebp - 0x434], 0x4a59434c
mov dword [ebp - 0x430], 0x71557945
mov dword [ebp - 0x42c], 0x4d6b6a4a
mov dword [ebp - 0x428], 0x4c774442
mov dword [ebp - 0x424], 0x6b554844
mov dword [ebp - 0x420], 0x674d7748
mov dword [ebp - 0x41c], 0x6b747742
mov dword [ebp - 0x418], 0x77467944
mov dword [ebp - 0x414], 0x68426842
mov dword [ebp - 0x410], 0x71515848
mov dword [ebp - 0x40c], 0x36397a4b
mov dword [ebp - 0x408], 0x6e343348
mov dword [ebp - 0x404], 0x3631674a
mov dword [ebp - 0x400], 0x42416742
mov dword [ebp - 0x3fc], 0x4849794e
mov dword [ebp - 0x3f8], 0x4f455261
mov dword [ebp - 0x3f4], 0x6d515449
mov dword [ebp - 0x3f0], 0x47635346
mov dword [ebp - 0x3ec], 0x32385444
mov dword [ebp - 0x3e8], 0x34415345
mov dword [ebp - 0x3e4], 0x41557944
mov dword [ebp - 0x3e0], 0x48434141
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push dword [ebp - 0x269c]
push eax
lea eax, [ebp - 0x4b4]
push eax
push dword [ecx]
call fcn.004660a0
lea eax, [ebp - 0x26c4]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
je 0x4ac6ba
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x34], eax
xor esi, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a4e08
sub ecx, edx
je 0x4a4e4d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a4e30
sub ecx, edx
cmp esi, ecx
jb 0x4a4e13
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4a4e4d
push eax
call fcn.0053c1e0
add esp, 4
mov eax, dword [ebp - 0x26c4]
test eax, eax
je 0x4a4e7e
push eax
call fcn.0053c1e0
add esp, 4
mov dword [ebp - 0x26c4], 0
mov dword [ebp - 0x26c0], 0
mov dword [ebp - 0x26bc], 0
mov dword [ebp - 0x44], 0
call fcn.00468bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x4ac6c1
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
mov ecx, 1
lea edx, [eax + 0x10]
mov dword [ebp - 0x44], edx
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4a4ece
push 0x104
lea ecx, [ebp - 0x44]
call fcn.00468e20
mov edx, dword [ebp - 0x44]
cmp dword [edx - 8], 0x104
jl 0x4ac6cb
mov dword [edx - 0xc], 0x104
xor ecx, ecx
mov eax, dword [ebp - 0x44]
push 0x104
push edx
push ecx
mov word [eax + 0x208], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, eax
test edx, edx
js 0x4ac6cb
mov ecx, dword [ebp - 0x44]
cmp edx, dword [ecx - 8]
jg 0x4ac6cb
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov word [eax + edx*2], cx
push dword [ebp - 0x44]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a52d0
sub esp, 0xc
mov dword [ebp - 0xf10], 0x77554345
mov ecx, esp
mov dword [ebp - 0xf0c], 0x6b6b6a4d
mov dword [ebp - 0xf08], 0x2b595447
mov dword [ebp - 0xf04], 0x6c38694a
mov dword [ebp - 0xf00], 0x6b39324b
mov dword [ebp - 0xefc], 0x6b67515a
mov dword [ebp - 0xef8], 0x3449324c
mov dword [ebp - 0xef4], 0x2f415465
mov dword [ebp - 0xef0], 0x79316a4a
mov dword [ebp - 0xeec], 0x79674462
mov dword [ebp - 0xee8], 0x6b555849
mov dword [ebp - 0xee4], 0x706b6a4d
mov dword [ebp - 0xee0], 0x4355424b
mov dword [ebp - 0xedc], 0x5645545a
mov dword [ebp - 0xed8], 0x77595850
mov dword [ebp - 0xed4], 0x38677845
mov dword [ebp - 0xed0], 0x35384263
mov dword [ebp - 0xecc], 0x30345245
mov dword [ebp - 0xec8], 0x4c516e47
mov dword [ebp - 0xec4], 0x5577674a
mov dword [ebp - 0xec0], 0x74397a45
mov dword [ebp - 0xebc], 0x716b425a
mov dword [ebp - 0xeb8], 0x66556d4c
mov dword [ebp - 0xeb4], 0x2b4a674b
mov dword [ebp - 0xeb0], 0x7749574b
mov dword [ebp - 0xeac], 0x56344361
mov dword [ebp - 0xea8], 0x6145524b
mov dword [ebp - 0xea4], 0x61345146
mov dword [ebp - 0xea0], 0x694e4263
mov dword [ebp - 0xe9c], 0x37683362
mov dword [ebp - 0xe98], 0x4d304445
mov dword [ebp - 0xe94], 0x6c636a4f
mov dword [ebp - 0xe90], 0x386b7749
mov dword [ebp - 0xe8c], 0x4638684b
mov dword [ebp - 0xe88], 0x73597a4f
mov dword [ebp - 0xe84], 0x73737a45
mov dword [ebp - 0xe80], 0x2b6c7747
mov dword [ebp - 0xe7c], 0x674e514b
mov dword [ebp - 0xe78], 0x36736a66
mov dword [ebp - 0xe74], 0x7349784d
mov dword [ebp - 0xe70], 0x32495744
mov dword [ebp - 0xe6c], 0x45515846
mov dword [ebp - 0xe68], 0x56635142
mov dword [ebp - 0xe64], 0x32685166
mov dword [ebp - 0xe60], 0x78787842
mov dword [ebp - 0xe5c], 0x3852674b
mov dword [ebp - 0xe58], 0x3668774f
mov dword [ebp - 0xe54], 0x6d4d5241
mov dword [ebp - 0xe50], 0x46494242
mov dword [ebp - 0xe4c], 0x4d344444
mov dword [ebp - 0xe48], 0x684d4249
mov dword [ebp - 0xe44], 0x4f416749
mov dword [ebp - 0xe40], 0x69734165
mov dword [ebp - 0xe3c], 0x67774348
mov dword [ebp - 0xe38], 0x376f674e
mov dword [ebp - 0xe34], 0x6738684d
mov dword [ebp - 0xe30], 0x6663524a
mov dword [ebp - 0xe2c], 0x67566d43
mov dword [ebp - 0xe28], 0x5a4d7a4b
mov dword [ebp - 0xe24], 0x31735864
mov dword [ebp - 0xe20], 0x36775148
mov dword [ebp - 0xe1c], 0x4877514e
mov dword [ebp - 0xe18], 0x426f444b
mov dword [ebp - 0xe14], 0x736b6846
mov dword [ebp - 0xe10], 0x6b4d4146
mov dword [ebp - 0xe0c], 0x6149524e
mov dword [ebp - 0xe08], 0x64413342
mov dword [ebp - 0xe04], 0x4373784e
mov dword [ebp - 0xe00], 0x38555245
mov dword [ebp - 0xdfc], 0x77396e47
mov dword [ebp - 0xdf8], 0x4f63434c
mov dword [ebp - 0xdf4], 0x4e555143
mov dword [ebp - 0xdf0], 0x41414141
mov word [ebp - 0xdec], 0x4174
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0xdea]
push dword [ebp - 0x269c]
push eax
lea eax, [ebp - 0xf10]
push eax
push dword [ecx]
call fcn.004660a0
lea eax, [ebp - 0x26d0]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
je 0x4ac6d5
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x34], eax
xor esi, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5270
sub ecx, edx
je 0x4a52bd
jmp 0x4a5280
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a52a0
sub ecx, edx
cmp esi, ecx
jb 0x4a5280
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4a52bd
push eax
call fcn.0053c1e0
add esp, 4
mov eax, dword [ebp - 0x26d0]
test eax, eax
je 0x4ac703
jmp 0x4ac6dc
mov dword [ebp - 0x1d90], 0x77554345
mov dword [ebp - 0x1d8c], 0x6b6b6a4d
mov dword [ebp - 0x1d88], 0x2b595447
mov dword [ebp - 0x1d84], 0x6c38694a
mov dword [ebp - 0x1d80], 0x6b39324b
mov dword [ebp - 0x1d7c], 0x3151515a
mov dword [ebp - 0x1d78], 0x6c73434a
mov dword [ebp - 0x1d74], 0x32467a4e
mov dword [ebp - 0x1d70], 0x67777a4f
mov dword [ebp - 0x1d6c], 0x6851434e
mov dword [ebp - 0x1d68], 0x35554849
mov dword [ebp - 0x1d64], 0x674d694d
mov dword [ebp - 0x1d60], 0x2b59544c
mov dword [ebp - 0x1d5c], 0x656f434e
mov dword [ebp - 0x1d58], 0x3459334f
mov dword [ebp - 0x1d54], 0x7251684c
mov dword [ebp - 0x1d50], 0x4238684d
mov dword [ebp - 0x1d4c], 0x6a635244
mov dword [ebp - 0x1d48], 0x33595143
mov dword [ebp - 0x1d44], 0x71386746
mov dword [ebp - 0x1d40], 0x4667444d
mov dword [ebp - 0x1d3c], 0x5a637a43
mov dword [ebp - 0x1d38], 0x3967524a
mov dword [ebp - 0x1d34], 0x74735145
mov dword [ebp - 0x1d30], 0x486f4850
mov dword [ebp - 0x1d2c], 0x6e49794e
mov dword [ebp - 0x1d28], 0x35596e4e
mov dword [ebp - 0x1d24], 0x796b6a44
mov dword [ebp - 0x1d20], 0x47677748
mov dword [ebp - 0x1d1c], 0x6e6b4445
mov dword [ebp - 0x1d18], 0x36594163
mov dword [ebp - 0x1d14], 0x67774442
mov dword [ebp - 0x1d10], 0x38466d63
mov dword [ebp - 0x1d0c], 0x6a4d434b
mov dword [ebp - 0x1d08], 0x6c45774e
mov dword [ebp - 0x1d04], 0x6f4e6845
mov dword [ebp - 0x1d00], 0x2f63444d
mov dword [ebp - 0x1cfc], 0x42737a50
mov dword [ebp - 0x1cf8], 0x2f517a4c
mov dword [ebp - 0x1cf4], 0x3078774e
mov dword [ebp - 0x1cf0], 0x486b4450
mov dword [ebp - 0x1cec], 0x79387959
mov dword [ebp - 0x1ce8], 0x4655794d
mov dword [ebp - 0x1ce4], 0x73415348
mov dword [ebp - 0x1ce0], 0x396c6966
mov dword [ebp - 0x1cdc], 0x6b596d4a
mov dword [ebp - 0x1cd8], 0x5438524d
mov dword [ebp - 0x1cd4], 0x3759324f
mov dword [ebp - 0x1cd0], 0x63777747
mov dword [ebp - 0x1ccc], 0x4f346e45
mov dword [ebp - 0x1cc8], 0x63775463
mov dword [ebp - 0x1cc4], 0x5a55514f
mov dword [ebp - 0x1cc0], 0x45556d41
mov dword [ebp - 0x1cbc], 0x5249674a
mov dword [ebp - 0x1cb8], 0x69456746
mov dword [ebp - 0x1cb4], 0x4b415350
mov dword [ebp - 0x1cb0], 0x6773514a
mov dword [ebp - 0x1cac], 0x4f595349
mov dword [ebp - 0x1ca8], 0x4e6b7747
mov dword [ebp - 0x1ca4], 0x6a38434c
mov dword [ebp - 0x1ca0], 0x674d4248
mov dword [ebp - 0x1c9c], 0x76674242
mov dword [ebp - 0x1c98], 0x4663534f
mov dword [ebp - 0x1c94], 0x7a4e784e
mov dword [ebp - 0x1c90], 0x4c386a49
mov dword [ebp - 0x1c8c], 0x50675463
mov dword [ebp - 0x1c88], 0x2f6b6744
mov dword [ebp - 0x1c84], 0x616b4148
mov dword [ebp - 0x1c80], 0x6e307942
mov dword [ebp - 0x1c7c], 0x4c777843
mov dword [ebp - 0x1c78], 0x734e7943
mov dword [ebp - 0x1c74], 0x716b6e4d
mov dword [ebp - 0x1c70], 0x74777a5a
mov dword [ebp - 0x1c6c], 0x53306950
mov dword [ebp - 0x1c68], 0x46675843
mov dword [ebp - 0x1c64], 0x32304848
mov dword [ebp - 0x1c60], 0x36465246
mov dword [ebp - 0x1c5c], 0x79344448
mov dword [ebp - 0x1c58], 0x626f4741
mov dword [ebp - 0x1c54], 0x6e77334d
mov dword [ebp - 0x1c50], 0x59416942
push 0
sub esp, 0xc
mov dword [ebp - 0x1c4c], 0x65776a48
mov ecx, esp
mov dword [ebp - 0x1c48], 0x35415749
mov dword [ebp - 0x1c44], 0x51517948
lea eax, [ebp - 0x1bf2]
mov dword [ebp - 0x1c40], 0x67307846
push eax
mov dword [ebp - 0x1c3c], 0x4e777a43
lea eax, [ebp - 0x1d90]
mov dword [ebp - 0x1c38], 0x63387845
mov dword [ebp - 0x1c34], 0x6856794c
mov dword [ebp - 0x1c30], 0x4c737766
mov dword [ebp - 0x1c2c], 0x4b386e46
mov dword [ebp - 0x1c28], 0x2b637a49
mov dword [ebp - 0x1c24], 0x706f7a43
mov dword [ebp - 0x1c20], 0x43345844
mov dword [ebp - 0x1c1c], 0x7a557841
mov dword [ebp - 0x1c18], 0x636f4143
mov dword [ebp - 0x1c14], 0x324d4266
mov dword [ebp - 0x1c10], 0x2f46514e
mov dword [ebp - 0x1c0c], 0x48517849
mov dword [ebp - 0x1c08], 0x47736d50
mov dword [ebp - 0x1c04], 0x6c41474e
mov dword [ebp - 0x1c00], 0x6b414145
mov dword [ebp - 0x1bfc], 0x54385146
mov dword [ebp - 0x1bf8], 0x42414141
mov word [ebp - 0x1bf4], 0x7743
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
lea eax, [ebp - 0x3c]
mov dword [ecx + 8], 0
push dword [ecx]
push eax
call fcn.00466ee0
lea eax, [ebp - 0x2824]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5744
sub ecx, edx
je 0x4a577d
nop
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5770
sub ecx, edx
cmp esi, ecx
jb 0x4a5750
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2824]
call fcn.00467ae0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x4a5a52
lea eax, [ebp - 0x65e]
mov dword [ebp - 0x728], 0x77554345
push eax
lea eax, [ebp - 0x728]
mov dword [ebp - 0x724], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x2914]
mov dword [ebp - 0x720], 0x2b595447
mov dword [ebp - 0x71c], 0x6c38694a
mov dword [ebp - 0x718], 0x6b39324b
mov dword [ebp - 0x714], 0x6b67515a
mov dword [ebp - 0x710], 0x3449324c
mov dword [ebp - 0x70c], 0x6d6b5465
mov dword [ebp - 0x708], 0x7964544c
mov dword [ebp - 0x704], 0x7767534d
mov dword [ebp - 0x700], 0x33777a4d
mov dword [ebp - 0x6fc], 0x73306d4e
mov dword [ebp - 0x6f8], 0x74307a4b
mov dword [ebp - 0x6f4], 0x304d794e
mov dword [ebp - 0x6f0], 0x2b684346
mov dword [ebp - 0x6ec], 0x7a63794a
mov dword [ebp - 0x6e8], 0x674d3344
mov dword [ebp - 0x6e4], 0x41416962
mov dword [ebp - 0x6e0], 0x6b346d66
mov dword [ebp - 0x6dc], 0x3268544e
mov dword [ebp - 0x6d8], 0x586f424a
mov dword [ebp - 0x6d4], 0x44417950
mov dword [ebp - 0x6d0], 0x2b415365
mov dword [ebp - 0x6cc], 0x66347848
mov dword [ebp - 0x6c8], 0x75775143
mov dword [ebp - 0x6c4], 0x33454143
mov dword [ebp - 0x6c0], 0x59416e4e
mov dword [ebp - 0x6bc], 0x4d4d7848
mov dword [ebp - 0x6b8], 0x666f4245
mov dword [ebp - 0x6b4], 0x36565464
mov dword [ebp - 0x6b0], 0x396f514b
mov dword [ebp - 0x6ac], 0x6a345147
mov dword [ebp - 0x6a8], 0x31564166
mov dword [ebp - 0x6a4], 0x436b795a
mov dword [ebp - 0x6a0], 0x2b68534b
mov dword [ebp - 0x69c], 0x54414346
mov dword [ebp - 0x698], 0x4263684e
mov dword [ebp - 0x694], 0x67707850
mov dword [ebp - 0x690], 0x33516e49
mov dword [ebp - 0x68c], 0x764e434f
mov dword [ebp - 0x688], 0x526f7764
mov dword [ebp - 0x684], 0x6e6f584a
mov dword [ebp - 0x680], 0x374a4441
mov dword [ebp - 0x67c], 0x3838694a
mov dword [ebp - 0x678], 0x2f74434f
mov dword [ebp - 0x674], 0x47385464
mov dword [ebp - 0x670], 0x55344349
mov dword [ebp - 0x66c], 0x306f5250
mov dword [ebp - 0x668], 0x68416a48
mov dword [ebp - 0x664], 0x41414141
mov word [ebp - 0x660], 0x5161
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2692]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x283c]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
xor esi, esi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5a10
sub ecx, edx
je 0x4ac73c
nop
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5a40
sub ecx, edx
cmp esi, ecx
jb 0x4a5a20
jmp 0x4ac73c
lea eax, [ebp - 0xf11]
mov dword [ebp - 0x1030], 0x77554345
push eax
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x102c], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x2924]
mov dword [ebp - 0x1028], 0x2b595447
mov dword [ebp - 0x1024], 0x6c38694a
mov dword [ebp - 0x1020], 0x6b39324b
mov dword [ebp - 0x101c], 0x3151515a
mov dword [ebp - 0x1018], 0x6c73434a
mov dword [ebp - 0x1014], 0x32467a4e
mov dword [ebp - 0x1010], 0x67777a4f
mov dword [ebp - 0x100c], 0x6851434e
mov dword [ebp - 0x1008], 0x62384349
mov dword [ebp - 0x1004], 0x306f7a49
mov dword [ebp - 0x1000], 0x5a63774d
mov dword [ebp - 0xffc], 0x78746d5a
mov dword [ebp - 0xff8], 0x52386e43
mov dword [ebp - 0xff4], 0x67417945
mov dword [ebp - 0xff0], 0x4551334b
mov dword [ebp - 0xfec], 0x62455146
mov dword [ebp - 0xfe8], 0x38775141
mov dword [ebp - 0xfe4], 0x47414141
mov dword [ebp - 0xfe0], 0x594d774a
mov dword [ebp - 0xfdc], 0x7059674f
mov dword [ebp - 0xfd8], 0x484d5749
mov dword [ebp - 0xfd4], 0x33706945
mov dword [ebp - 0xfd0], 0x2b555344
mov dword [ebp - 0xfcc], 0x61495363
mov dword [ebp - 0xfc8], 0x38315264
mov dword [ebp - 0xfc4], 0x66556862
mov dword [ebp - 0xfc0], 0x546f694b
mov dword [ebp - 0xfbc], 0x34456746
mov dword [ebp - 0xfb8], 0x3745784d
mov dword [ebp - 0xfb4], 0x31526a4d
mov dword [ebp - 0xfb0], 0x4373684d
mov dword [ebp - 0xfac], 0x734d544d
mov dword [ebp - 0xfa8], 0x37346741
mov dword [ebp - 0xfa4], 0x64457749
mov dword [ebp - 0xfa0], 0x3151484e
mov dword [ebp - 0xf9c], 0x734d6a46
mov dword [ebp - 0xf98], 0x5838794f
mov dword [ebp - 0xf94], 0x4251334d
mov dword [ebp - 0xf90], 0x59416749
mov dword [ebp - 0xf8c], 0x784a5359
mov dword [ebp - 0xf88], 0x74457942
mov dword [ebp - 0xf84], 0x71636748
mov dword [ebp - 0xf80], 0x38676947
mov dword [ebp - 0xf7c], 0x68595748
mov dword [ebp - 0xf78], 0x37425243
mov dword [ebp - 0xf74], 0x3849424c
mov dword [ebp - 0xf70], 0x37735145
mov dword [ebp - 0xf6c], 0x73635149
mov dword [ebp - 0xf68], 0x6a644764
mov dword [ebp - 0xf64], 0x53386750
mov dword [ebp - 0xf60], 0x6864794f
mov dword [ebp - 0xf5c], 0x7163674f
mov dword [ebp - 0xf58], 0x4b30434f
mov dword [ebp - 0xf54], 0x3878534b
mov dword [ebp - 0xf50], 0x76303345
mov dword [ebp - 0xf4c], 0x6d357a62
mov dword [ebp - 0xf48], 0x6e686750
mov dword [ebp - 0xf44], 0x32424146
mov dword [ebp - 0xf40], 0x46517942
mov dword [ebp - 0xf3c], 0x74517a4f
mov dword [ebp - 0xf38], 0x305a5741
mov dword [ebp - 0xf34], 0x784a5359
mov dword [ebp - 0xf30], 0x7441434b
mov dword [ebp - 0xf2c], 0x38305250
mov dword [ebp - 0xf28], 0x61416e4c
mov dword [ebp - 0xf24], 0x61416944
mov dword [ebp - 0xf20], 0x65304748
mov dword [ebp - 0xf1c], 0x4959434e
mov dword [ebp - 0xf18], 0x4141674e
mov word [ebp - 0xf14], 0x4c41
mov byte [ebp - 0xf12], 0x51
call fcn.004675e0
mov esi, eax
push 0
lea ecx, [ebp - 0x2685]
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2854]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5d91
sub ecx, edx
je 0x4a5dcd
lea esp, [esp]
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5dc0
sub ecx, edx
cmp esi, ecx
jb 0x4a5da0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2854]
call fcn.00467ae0
push 0xf01ff
mov ecx, ebx
call fcn.004b8320
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
jne 0x4a6242
mov dword [ebp - 0x15d8], 0x77554345
mov dword [ebp - 0x15d4], 0x6b6b6a4d
mov dword [ebp - 0x15d0], 0x2b595447
mov dword [ebp - 0x15cc], 0x6c38694a
mov dword [ebp - 0x15c8], 0x6b39324b
mov dword [ebp - 0x15c4], 0x6b30515a
mov dword [ebp - 0x15c0], 0x706b434b
mov dword [ebp - 0x15bc], 0x5a595850
mov dword [ebp - 0x15b8], 0x3877444f
mov dword [ebp - 0x15b4], 0x6c4d794b
mov dword [ebp - 0x15b0], 0x7859535a
mov dword [ebp - 0x15ac], 0x6f735449
mov dword [ebp - 0x15a8], 0x3259544b
mov dword [ebp - 0x15a4], 0x74516a4d
mov dword [ebp - 0x15a0], 0x54556947
mov dword [ebp - 0x159c], 0x70677849
mov dword [ebp - 0x1598], 0x72594347
mov dword [ebp - 0x1594], 0x5a4d7746
mov dword [ebp - 0x1590], 0x69524442
mov dword [ebp - 0x158c], 0x726b6843
mov dword [ebp - 0x1588], 0x7930444e
mov dword [ebp - 0x1584], 0x78675459
mov dword [ebp - 0x1580], 0x45555443
mov dword [ebp - 0x157c], 0x6538524b
mov dword [ebp - 0x1578], 0x54634346
mov dword [ebp - 0x1574], 0x51344342
mov dword [ebp - 0x1570], 0x67775147
mov dword [ebp - 0x156c], 0x4241534b
mov dword [ebp - 0x1568], 0x4b634250
mov dword [ebp - 0x1564], 0x7a4e6943
mov dword [ebp - 0x1560], 0x56634743
mov dword [ebp - 0x155c], 0x3055334b
mov dword [ebp - 0x1558], 0x65495465
mov dword [ebp - 0x1554], 0x30416846
mov dword [ebp - 0x1550], 0x46593347
mov dword [ebp - 0x154c], 0x49454245
mov dword [ebp - 0x1548], 0x4e515163
mov dword [ebp - 0x1544], 0x734d5349
mov dword [ebp - 0x1540], 0x3345424f
mov dword [ebp - 0x153c], 0x3367534d
mov dword [ebp - 0x1538], 0x4d674248
mov dword [ebp - 0x1534], 0x32566e42
mov dword [ebp - 0x1530], 0x316f524f
mov dword [ebp - 0x152c], 0x7a347a41
mov dword [ebp - 0x1528], 0x4845534b
mov dword [ebp - 0x1524], 0x6e6b7844
mov dword [ebp - 0x1520], 0x38646943
mov dword [ebp - 0x151c], 0x534d774e
mov dword [ebp - 0x1518], 0x446f7943
mov dword [ebp - 0x1514], 0x48734841
mov dword [ebp - 0x1510], 0x6b636744
mov dword [ebp - 0x150c], 0x3152694e
mov dword [ebp - 0x1508], 0x384a4750
mov dword [ebp - 0x1504], 0x6838524d
mov dword [ebp - 0x1500], 0x38636a4b
mov dword [ebp - 0x14fc], 0x2f6b7848
mov dword [ebp - 0x14f8], 0x4c30544c
mov dword [ebp - 0x14f4], 0x47515745
mov dword [ebp - 0x14f0], 0x2f6c6d50
mov dword [ebp - 0x14ec], 0x30744343
mov dword [ebp - 0x14e8], 0x75515349
mov dword [ebp - 0x14e4], 0x58517948
mov dword [ebp - 0x14e0], 0x70556944
mov dword [ebp - 0x14dc], 0x2b385146
mov dword [ebp - 0x14d8], 0x6a514342
mov dword [ebp - 0x14d4], 0x78514263
mov dword [ebp - 0x14d0], 0x5a414865
mov dword [ebp - 0x14cc], 0x6b52324c
mov dword [ebp - 0x14c8], 0x6a303247
mov dword [ebp - 0x14c4], 0x3638334b
mov dword [ebp - 0x14c0], 0x54517948
mov dword [ebp - 0x14bc], 0x774a5147
mov dword [ebp - 0x14b8], 0x7438424d
mov dword [ebp - 0x14b4], 0x79415445
mov dword [ebp - 0x14b0], 0x4d555350
mov dword [ebp - 0x14ac], 0x6f565148
mov dword [ebp - 0x14a8], 0x74516748
mov dword [ebp - 0x14a4], 0x6e517750
mov dword [ebp - 0x14a0], 0x6a41674f
mov dword [ebp - 0x149c], 0x78516763
mov dword [ebp - 0x1498], 0x466b7a4a
lea eax, [ebp - 0x146d]
mov dword [ebp - 0x1494], 0x34385245
push eax
lea eax, [ebp - 0x15d8]
mov dword [ebp - 0x1490], 0x395a5148
push eax
lea ecx, [ebp - 0x2994]
mov dword [ebp - 0x148c], 0x726f6750
mov dword [ebp - 0x1488], 0x38345441
mov dword [ebp - 0x1484], 0x496f414a
mov dword [ebp - 0x1480], 0x6c344344
mov dword [ebp - 0x147c], 0x516b444b
mov dword [ebp - 0x1478], 0x39676766
mov dword [ebp - 0x1474], 0x41414149
mov word [ebp - 0x1470], 0x4f41
mov byte [ebp - 0x146e], 0x59
call fcn.004675e0
push ebx
lea ecx, [ebp - 0x26a0]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27a0]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6200
sub ecx, edx
je 0x4ac771
nop
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6230
sub ecx, edx
cmp esi, ecx
jb 0x4a6210
jmp 0x4ac771
lea eax, [ebp - 0x156]
mov dword [ebp - 0x1e4], 0x77554345
push eax
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1e0], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x298c]
mov dword [ebp - 0x1dc], 0x2b595447
mov dword [ebp - 0x1d8], 0x6c38694a
mov dword [ebp - 0x1d4], 0x6b39324b
mov dword [ebp - 0x1d0], 0x776f525a
mov dword [ebp - 0x1cc], 0x3163444a
mov dword [ebp - 0x1c8], 0x7867444d
mov dword [ebp - 0x1c4], 0x336f4361
mov dword [ebp - 0x1c0], 0x7273444d
mov dword [ebp - 0x1bc], 0x30426a4a
mov dword [ebp - 0x1b8], 0x7649434d
mov dword [ebp - 0x1b4], 0x726f444c
mov dword [ebp - 0x1b0], 0x38385141
mov dword [ebp - 0x1ac], 0x6b777748
mov dword [ebp - 0x1a8], 0x526f3346
mov dword [ebp - 0x1a4], 0x6859584a
mov dword [ebp - 0x1a0], 0x6134524b
mov dword [ebp - 0x19c], 0x696b4342
mov dword [ebp - 0x198], 0x6155424a
mov dword [ebp - 0x194], 0x2f455763
mov dword [ebp - 0x190], 0x6c554245
mov dword [ebp - 0x18c], 0x624d414d
mov dword [ebp - 0x188], 0x6955484a
mov dword [ebp - 0x184], 0x68635842
mov dword [ebp - 0x180], 0x77464244
mov dword [ebp - 0x17c], 0x2b305865
mov dword [ebp - 0x178], 0x6d557848
mov dword [ebp - 0x174], 0x63517a4a
mov dword [ebp - 0x170], 0x7a6c5464
mov dword [ebp - 0x16c], 0x3259694c
mov dword [ebp - 0x168], 0x4838784e
mov dword [ebp - 0x164], 0x65414343
mov dword [ebp - 0x160], 0x2f51514b
mov dword [ebp - 0x15c], 0x41414141
mov word [ebp - 0x158], 0x7750
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a2]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27f4]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6412
sub ecx, edx
je 0x4a644d
lea ecx, [ecx]
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6440
sub ecx, edx
cmp esi, ecx
jb 0x4a6420
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27f4]
call fcn.00467ae0
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push ebx
call esi
push dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp - 0x48]
call esi
test eax, eax
jne 0x4a6902
mov dword [ebp - 0x18cc], 0x77554345
mov dword [ebp - 0x18c8], 0x6b6b6a4d
mov dword [ebp - 0x18c4], 0x2b595447
mov dword [ebp - 0x18c0], 0x6c38694a
mov dword [ebp - 0x18bc], 0x6b39324b
mov dword [ebp - 0x18b8], 0x6b30515a
mov dword [ebp - 0x18b4], 0x706b434b
mov dword [ebp - 0x18b0], 0x48595850
mov dword [ebp - 0x18ac], 0x67775450
mov dword [ebp - 0x18a8], 0x7351794f
mov dword [ebp - 0x18a4], 0x6e556e49
mov dword [ebp - 0x18a0], 0x33386a4e
mov dword [ebp - 0x189c], 0x70417a49
mov dword [ebp - 0x1898], 0x70554363
mov dword [ebp - 0x1894], 0x676b4349
mov dword [ebp - 0x1890], 0x2f596949
mov dword [ebp - 0x188c], 0x3159424f
mov dword [ebp - 0x1888], 0x65593247
mov dword [ebp - 0x1884], 0x55416748
mov dword [ebp - 0x1880], 0x706f784a
mov dword [ebp - 0x187c], 0x46635150
mov dword [ebp - 0x1878], 0x35686a45
mov dword [ebp - 0x1874], 0x41553247
mov dword [ebp - 0x1870], 0x7349514a
mov dword [ebp - 0x186c], 0x69596946
mov dword [ebp - 0x1868], 0x3268794e
mov dword [ebp - 0x1864], 0x3846674c
mov dword [ebp - 0x1860], 0x53306850
mov dword [ebp - 0x185c], 0x56454463
mov dword [ebp - 0x1858], 0x3749684e
mov dword [ebp - 0x1854], 0x5873544e
mov dword [ebp - 0x1850], 0x596f7842
mov dword [ebp - 0x184c], 0x344d6949
mov dword [ebp - 0x1848], 0x30735143
mov dword [ebp - 0x1844], 0x2f707846
mov dword [ebp - 0x1840], 0x6a6b6745
mov dword [ebp - 0x183c], 0x3151674a
mov dword [ebp - 0x1838], 0x78637762
mov dword [ebp - 0x1834], 0x52735248
mov dword [ebp - 0x1830], 0x7334524e
mov dword [ebp - 0x182c], 0x69496a46
mov dword [ebp - 0x1828], 0x31384259
mov dword [ebp - 0x1824], 0x4a55674c
mov dword [ebp - 0x1820], 0x75306949
mov dword [ebp - 0x181c], 0x61675465
mov dword [ebp - 0x1818], 0x5430684d
mov dword [ebp - 0x1814], 0x6277794b
mov dword [ebp - 0x1810], 0x45345145
mov dword [ebp - 0x180c], 0x58556a44
mov dword [ebp - 0x1808], 0x516f4444
mov dword [ebp - 0x1804], 0x6970414d
mov dword [ebp - 0x1800], 0x344d5346
mov dword [ebp - 0x17fc], 0x34647963
mov dword [ebp - 0x17f8], 0x52304347
mov dword [ebp - 0x17f4], 0x2f35794e
mov dword [ebp - 0x17f0], 0x77703343
mov dword [ebp - 0x17ec], 0x4f41514f
mov dword [ebp - 0x17e8], 0x4a517a4d
mov dword [ebp - 0x17e4], 0x61516847
mov dword [ebp - 0x17e0], 0x3773544d
mov dword [ebp - 0x17dc], 0x424d414e
mov dword [ebp - 0x17d8], 0x53777a4a
mov dword [ebp - 0x17d4], 0x4a306a4a
mov dword [ebp - 0x17d0], 0x6e385845
mov dword [ebp - 0x17cc], 0x596b5841
mov dword [ebp - 0x17c8], 0x38703363
mov dword [ebp - 0x17c4], 0x5a735344
mov dword [ebp - 0x17c0], 0x5867784e
mov dword [ebp - 0x17bc], 0x49737a4b
mov dword [ebp - 0x17b8], 0x31426d4a
mov dword [ebp - 0x17b4], 0x61386763
mov dword [ebp - 0x17b0], 0x30464349
mov dword [ebp - 0x17ac], 0x55596a4c
mov dword [ebp - 0x17a8], 0x4e735148
mov dword [ebp - 0x17a4], 0x34313346
mov dword [ebp - 0x17a0], 0x7377694d
mov dword [ebp - 0x179c], 0x76387764
mov dword [ebp - 0x1798], 0x65415746
mov dword [ebp - 0x1794], 0x6b4d4241
mov dword [ebp - 0x1790], 0x32787747
mov dword [ebp - 0x178c], 0x5259774e
lea eax, [ebp - 0x174a]
mov dword [ebp - 0x1788], 0x776c5443
push eax
lea eax, [ebp - 0x18cc]
mov dword [ebp - 0x1784], 0x6c636d4c
push eax
lea ecx, [ebp - 0x287c]
mov dword [ebp - 0x1780], 0x4238584b
mov dword [ebp - 0x177c], 0x52733343
mov dword [ebp - 0x1778], 0x30787849
mov dword [ebp - 0x1774], 0x75775265
mov dword [ebp - 0x1770], 0x6d774361
mov dword [ebp - 0x176c], 0x674e6965
mov dword [ebp - 0x1768], 0x7934484d
mov dword [ebp - 0x1764], 0x6a6b7a42
mov dword [ebp - 0x1760], 0x55345150
mov dword [ebp - 0x175c], 0x47515147
mov dword [ebp - 0x1758], 0x73775145
mov dword [ebp - 0x1754], 0x756b434b
mov dword [ebp - 0x1750], 0x41414141
mov word [ebp - 0x174c], 0x7737
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a7]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27dc]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a68c5
sub ecx, edx
je 0x4ac7af
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a68f0
sub ecx, edx
cmp esi, ecx
jb 0x4a68d4
jmp 0x4ac7af
push 4
lea ecx, [ebp - 0x40]
call fcn.005389f0
push dword [ebx + 0xc]
lea ecx, [ebp - 0x40]
call fcn.004aea30
lea ecx, [ebp - 0x40]
call fcn.004feb10
lea ecx, [ebp - 0x40]
call fcn.0051fe20
mov dword [ebp - 0x1314], 0x77554345
mov dword [ebp - 0x1310], 0x6b6b6a4d
mov dword [ebp - 0x130c], 0x2b595447
mov dword [ebp - 0x1308], 0x6c38694a
mov dword [ebp - 0x1304], 0x6b39324b
mov dword [ebp - 0x1300], 0x6767525a
mov dword [ebp - 0x12fc], 0x6c4d7a4d
mov dword [ebp - 0x12f8], 0x324e6a4f
mov dword [ebp - 0x12f4], 0x6d67444f
mov dword [ebp - 0x12f0], 0x72306d4b
mov dword [ebp - 0x12ec], 0x4d516d4e
mov dword [ebp - 0x12e8], 0x62634342
mov dword [ebp - 0x12e4], 0x676f6841
mov dword [ebp - 0x12e0], 0x724d4359
mov dword [ebp - 0x12dc], 0x4f414250
mov dword [ebp - 0x12d8], 0x4e385350
mov dword [ebp - 0x12d4], 0x36356748
mov dword [ebp - 0x12d0], 0x2b634344
mov dword [ebp - 0x12cc], 0x6441534d
mov dword [ebp - 0x12c8], 0x7852784a
mov dword [ebp - 0x12c4], 0x74396841
mov dword [ebp - 0x12c0], 0x556b4448
mov dword [ebp - 0x12bc], 0x37416a49
mov dword [ebp - 0x12b8], 0x74344349
mov dword [ebp - 0x12b4], 0x366f6e4a
mov dword [ebp - 0x12b0], 0x78454141
mov dword [ebp - 0x12ac], 0x59774865
mov dword [ebp - 0x12a8], 0x7949434d
mov dword [ebp - 0x12a4], 0x334d694a
mov dword [ebp - 0x12a0], 0x7255434a
mov dword [ebp - 0x129c], 0x69467741
mov dword [ebp - 0x1298], 0x52496750
mov dword [ebp - 0x1294], 0x594d3243
mov dword [ebp - 0x1290], 0x5a34514a
mov dword [ebp - 0x128c], 0x3978784c
mov dword [ebp - 0x1288], 0x314a5849
mov dword [ebp - 0x1284], 0x5055544a
mov dword [ebp - 0x1280], 0x64494262
mov dword [ebp - 0x127c], 0x6251424f
mov dword [ebp - 0x1278], 0x7755514a
mov dword [ebp - 0x1274], 0x77637748
mov dword [ebp - 0x1270], 0x31775850
mov dword [ebp - 0x126c], 0x6b41574b
mov dword [ebp - 0x1268], 0x30467746
mov dword [ebp - 0x1264], 0x6b345150
mov dword [ebp - 0x1260], 0x4d456a45
mov dword [ebp - 0x125c], 0x32415843
mov dword [ebp - 0x1258], 0x5a6f784d
mov dword [ebp - 0x1254], 0x786b674f
mov dword [ebp - 0x1250], 0x49736764
mov dword [ebp - 0x124c], 0x73466749
mov dword [ebp - 0x1248], 0x3355774e
mov dword [ebp - 0x1244], 0x49456763
mov dword [ebp - 0x1240], 0x6e636748
mov dword [ebp - 0x123c], 0x38305142
mov dword [ebp - 0x1238], 0x76304843
mov dword [ebp - 0x1234], 0x6549434a
mov dword [ebp - 0x1230], 0x7741424d
mov dword [ebp - 0x122c], 0x63734265
mov dword [ebp - 0x1228], 0x6863684a
mov dword [ebp - 0x1224], 0x486f674c
mov dword [ebp - 0x1220], 0x74635248
mov dword [ebp - 0x121c], 0x6e4d324a
mov dword [ebp - 0x1218], 0x52597859
mov dword [ebp - 0x1214], 0x6373674a
mov dword [ebp - 0x1210], 0x63674845
mov dword [ebp - 0x120c], 0x42496746
mov dword [ebp - 0x1208], 0x61413250
mov dword [ebp - 0x1204], 0x4451444f
mov dword [ebp - 0x1200], 0x4173484a
mov dword [ebp - 0x11fc], 0x694e6a42
lea eax, [ebp - 0x11a1]
mov dword [ebp - 0x11f8], 0x4473424d
push eax
lea eax, [ebp - 0x1314]
mov dword [ebp - 0x11f4], 0x71556a4a
push eax
lea ecx, [ebp - 0x28fc]
mov dword [ebp - 0x11f0], 0x53306746
mov dword [ebp - 0x11ec], 0x476b4244
mov dword [ebp - 0x11e8], 0x2f67584e
mov dword [ebp - 0x11e4], 0x67596a64
mov dword [ebp - 0x11e0], 0x6c4e694d
mov dword [ebp - 0x11dc], 0x77414750
mov dword [ebp - 0x11d8], 0x48414341
mov dword [ebp - 0x11d4], 0x33514164
mov dword [ebp - 0x11d0], 0x306c5145
mov dword [ebp - 0x11cc], 0x684e324a
mov dword [ebp - 0x11c8], 0x4a6f534b
mov dword [ebp - 0x11c4], 0x57347949
mov dword [ebp - 0x11c0], 0x6d454164
mov dword [ebp - 0x11bc], 0x3939774e
mov dword [ebp - 0x11b8], 0x506f4447
mov dword [ebp - 0x11b4], 0x43346d49
mov dword [ebp - 0x11b0], 0x52776a4c
mov dword [ebp - 0x11ac], 0x48494341
mov dword [ebp - 0x11a8], 0x41415148
mov word [ebp - 0x11a4], 0x5041
mov byte [ebp - 0x11a2], 0x4d
call fcn.004675e0
push 0
lea ecx, [ebp - 0x269e]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x280c]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6d38
sub ecx, edx
je 0x4a6d6d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6d60
sub ecx, edx
cmp esi, ecx
jb 0x4a6d43
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x280c]
call fcn.00467ae0
lea ecx, [ebp - 0x40]
call fcn.004b8310
push eax
lea ecx, [ebp - 0x269c]
mov dword [ebp - 0x58], eax
call fcn.004aec30
mov ecx, eax
call fcn.004680f0
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6dc0
sub ecx, edx
je 0x4a6dfd
jmp 0x4a6dd0
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6df0
sub ecx, edx
cmp esi, ecx
jb 0x4a6dd0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x269c]
call fcn.004679f0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x40]
call fcn.004c8380
test eax, eax
jne 0x4a7342
mov dword [ebp - 0x1bf0], 0x77554345
mov dword [ebp - 0x1bec], 0x6b6b6a4d
mov dword [ebp - 0x1be8], 0x2b595447
mov dword [ebp - 0x1be4], 0x6c38694a
mov dword [ebp - 0x1be0], 0x6b39324b
mov dword [ebp - 0x1bdc], 0x6767525a
mov dword [ebp - 0x1bd8], 0x6c4d7a4d
mov dword [ebp - 0x1bd4], 0x324e6a4f
mov dword [ebp - 0x1bd0], 0x2b416a4c
mov dword [ebp - 0x1bcc], 0x6d30324a
mov dword [ebp - 0x1bc8], 0x6e416a4b
mov dword [ebp - 0x1bc4], 0x316f5750
mov dword [ebp - 0x1bc0], 0x30596a61
mov dword [ebp - 0x1bbc], 0x7955544f
mov dword [ebp - 0x1bb8], 0x7831784e
mov dword [ebp - 0x1bb4], 0x6f70684c
mov dword [ebp - 0x1bb0], 0x684a7764
mov dword [ebp - 0x1bac], 0x44417861
mov dword [ebp - 0x1ba8], 0x71703241
mov dword [ebp - 0x1ba4], 0x486b7a47
mov dword [ebp - 0x1ba0], 0x44675464
mov dword [ebp - 0x1b9c], 0x4a346a42
mov dword [ebp - 0x1b98], 0x566f7863
mov dword [ebp - 0x1b94], 0x46416746
mov dword [ebp - 0x1b90], 0x63384848
mov dword [ebp - 0x1b8c], 0x486f4245
mov dword [ebp - 0x1b88], 0x4a4d6843
mov dword [ebp - 0x1b84], 0x7664474d
mov dword [ebp - 0x1b80], 0x4745684c
mov dword [ebp - 0x1b7c], 0x3068544c
mov dword [ebp - 0x1b78], 0x4d4d794c
mov dword [ebp - 0x1b74], 0x32776761
mov dword [ebp - 0x1b70], 0x746b4365
mov dword [ebp - 0x1b6c], 0x586b4143
mov dword [ebp - 0x1b68], 0x3564484c
mov dword [ebp - 0x1b64], 0x326c7a41
mov dword [ebp - 0x1b60], 0x3845424e
mov dword [ebp - 0x1b5c], 0x42557948
mov dword [ebp - 0x1b58], 0x55596865
mov dword [ebp - 0x1b54], 0x32647743
mov dword [ebp - 0x1b50], 0x58774764
mov dword [ebp - 0x1b4c], 0x536f6e43
mov dword [ebp - 0x1b48], 0x6e417849
mov dword [ebp - 0x1b44], 0x4f41794a
mov dword [ebp - 0x1b40], 0x74496d4e
mov dword [ebp - 0x1b3c], 0x786f4241
mov dword [ebp - 0x1b38], 0x3068794b
mov dword [ebp - 0x1b34], 0x636b4245
mov dword [ebp - 0x1b30], 0x52734266
mov dword [ebp - 0x1b2c], 0x36524363
mov dword [ebp - 0x1b28], 0x52497944
mov dword [ebp - 0x1b24], 0x35775241
mov dword [ebp - 0x1b20], 0x55497a45
mov dword [ebp - 0x1b1c], 0x67736743
mov dword [ebp - 0x1b18], 0x596b7949
mov dword [ebp - 0x1b14], 0x726b7745
mov dword [ebp - 0x1b10], 0x61734362
mov dword [ebp - 0x1b0c], 0x75417744
mov dword [ebp - 0x1b08], 0x6e424250
mov dword [ebp - 0x1b04], 0x4c38514b
mov dword [ebp - 0x1b00], 0x6663544c
mov dword [ebp - 0x1afc], 0x50344350
mov dword [ebp - 0x1af8], 0x3273784c
mov dword [ebp - 0x1af4], 0x7377414a
mov dword [ebp - 0x1af0], 0x4d676e42
mov dword [ebp - 0x1aec], 0x7974444a
mov dword [ebp - 0x1ae8], 0x2b316e42
mov dword [ebp - 0x1ae4], 0x366f4444
mov dword [ebp - 0x1ae0], 0x2b6f774a
mov dword [ebp - 0x1adc], 0x36357847
mov dword [ebp - 0x1ad8], 0x53677a48
mov dword [ebp - 0x1ad4], 0x30517841
mov dword [ebp - 0x1ad0], 0x3970424a
mov dword [ebp - 0x1acc], 0x6951444f
mov dword [ebp - 0x1ac8], 0x2b34674a
mov dword [ebp - 0x1ac4], 0x76416764
mov dword [ebp - 0x1ac0], 0x68397943
mov dword [ebp - 0x1abc], 0x6963424c
mov dword [ebp - 0x1ab8], 0x68305745
mov dword [ebp - 0x1ab4], 0x4f596945
mov dword [ebp - 0x1ab0], 0x6b774242
lea eax, [ebp - 0x1a2e]
mov dword [ebp - 0x1aac], 0x30687a49
push eax
lea eax, [ebp - 0x1bf0]
mov dword [ebp - 0x1aa8], 0x2f34524f
push eax
lea ecx, [ebp - 0x288c]
mov dword [ebp - 0x1aa4], 0x2f515846
mov dword [ebp - 0x1aa0], 0x48557947
mov dword [ebp - 0x1a9c], 0x48344145
mov dword [ebp - 0x1a98], 0x7534534c
mov dword [ebp - 0x1a94], 0x534d4148
mov dword [ebp - 0x1a90], 0x48554449
mov dword [ebp - 0x1a8c], 0x6f51434d
mov dword [ebp - 0x1a88], 0x63456a41
mov dword [ebp - 0x1a84], 0x334d4145
mov dword [ebp - 0x1a80], 0x4f386a4f
mov dword [ebp - 0x1a7c], 0x32426943
mov dword [ebp - 0x1a78], 0x784a6d48
mov dword [ebp - 0x1a74], 0x636f4248
mov dword [ebp - 0x1a70], 0x30567a4f
mov dword [ebp - 0x1a6c], 0x65497943
mov dword [ebp - 0x1a68], 0x6742534c
mov dword [ebp - 0x1a64], 0x75777a45
mov dword [ebp - 0x1a60], 0x35636744
mov dword [ebp - 0x1a5c], 0x6f346850
mov dword [ebp - 0x1a58], 0x31566a65
mov dword [ebp - 0x1a54], 0x42385861
mov dword [ebp - 0x1a50], 0x62637742
mov dword [ebp - 0x1a4c], 0x326f7a49
mov dword [ebp - 0x1a48], 0x49455846
mov dword [ebp - 0x1a44], 0x6777434c
mov dword [ebp - 0x1a40], 0x6d785145
mov dword [ebp - 0x1a3c], 0x7a316e4b
mov dword [ebp - 0x1a38], 0x64555350
mov dword [ebp - 0x1a34], 0x42414141
mov word [ebp - 0x1a30], 0x7749
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2686]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2800]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7300
sub ecx, edx
je 0x4ac7fb
nop
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7330
sub ecx, edx
cmp esi, ecx
jb 0x4a7310
jmp 0x4ac7fb
push 4
lea ecx, [ebp - 0x50]
call fcn.005389f0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.004aea00
lea ecx, [ebp - 0x26b8]
call fcn.004b23a0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x26b4], 5
push eax
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0x77554345
push eax
lea ecx, [ebp - 0x2944]
mov dword [ebp - 0x310], 0x6b6b6a4d
mov dword [ebp - 0x30c], 0x2b595447
mov dword [ebp - 0x308], 0x6c38694a
mov dword [ebp - 0x304], 0x6b39324b
mov dword [ebp - 0x300], 0x7167515a
mov dword [ebp - 0x2fc], 0x6c77544d
mov dword [ebp - 0x2f8], 0x32467a4e
mov dword [ebp - 0x2f4], 0x67777a4f
mov dword [ebp - 0x2f0], 0x6851434e
mov dword [ebp - 0x2ec], 0x6b554849
mov dword [ebp - 0x2e8], 0x706b6a4d
mov dword [ebp - 0x2e4], 0x6a636961
mov dword [ebp - 0x2e0], 0x6e514363
mov dword [ebp - 0x2dc], 0x3851534c
mov dword [ebp - 0x2d8], 0x3173574e
mov dword [ebp - 0x2d4], 0x6b454449
mov dword [ebp - 0x2d0], 0x4a733350
mov dword [ebp - 0x2cc], 0x48305749
mov dword [ebp - 0x2c8], 0x716f4163
mov dword [ebp - 0x2c4], 0x6a426745
mov dword [ebp - 0x2c0], 0x32595359
mov dword [ebp - 0x2bc], 0x69775166
mov dword [ebp - 0x2b8], 0x65346a4e
mov dword [ebp - 0x2b4], 0x50593366
mov dword [ebp - 0x2b0], 0x47514343
mov dword [ebp - 0x2ac], 0x56416a4d
mov dword [ebp - 0x2a8], 0x37426945
mov dword [ebp - 0x2a4], 0x62674263
mov dword [ebp - 0x2a0], 0x6d773363
mov dword [ebp - 0x29c], 0x77416847
mov dword [ebp - 0x298], 0x53635449
mov dword [ebp - 0x294], 0x6e596a47
mov dword [ebp - 0x290], 0x5445524f
mov dword [ebp - 0x28c], 0x7159334a
mov dword [ebp - 0x288], 0x4e494266
mov dword [ebp - 0x284], 0x2b316a48
mov dword [ebp - 0x280], 0x6846794b
mov dword [ebp - 0x27c], 0x4167514d
mov dword [ebp - 0x278], 0x42424141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2688]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2710]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7566
sub ecx, edx
je 0x4a759d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
jmp 0x4a7590
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7590
sub ecx, edx
cmp esi, ecx
jb 0x4a7571
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2710]
call fcn.00467ae0
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x8d0], 0x31637a61
push eax
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x8cc], 0x6b67424f
push eax
lea ecx, [ebp - 0x289c]
mov dword [ebp - 0x8c8], 0x72675246
mov dword [ebp - 0x8c4], 0x534d7a4a
mov dword [ebp - 0x8c0], 0x4673774e
mov dword [ebp - 0x8bc], 0x30685443
mov dword [ebp - 0x8b8], 0x30674364
mov dword [ebp - 0x8b4], 0x4f415448
mov dword [ebp - 0x8b0], 0x566f6866
mov dword [ebp - 0x8ac], 0x484d774c
mov dword [ebp - 0x8a8], 0x6b51694d
mov dword [ebp - 0x8a4], 0x536b6750
mov dword [ebp - 0x8a0], 0x316c684f
mov dword [ebp - 0x89c], 0x2f426950
mov dword [ebp - 0x898], 0x686f6e43
mov dword [ebp - 0x894], 0x54385344
mov dword [ebp - 0x890], 0x6c595446
mov dword [ebp - 0x88c], 0x2b38444f
mov dword [ebp - 0x888], 0x444d424c
mov dword [ebp - 0x884], 0x78516a4d
mov dword [ebp - 0x880], 0x2b6b524e
mov dword [ebp - 0x87c], 0x67516a49
mov dword [ebp - 0x878], 0x3578424c
mov dword [ebp - 0x874], 0x71554442
mov dword [ebp - 0x870], 0x34635845
mov dword [ebp - 0x86c], 0x73736e42
mov dword [ebp - 0x868], 0x6b30584c
mov dword [ebp - 0x864], 0x6b42414f
mov dword [ebp - 0x860], 0x466f5150
mov dword [ebp - 0x85c], 0x32564847
mov dword [ebp - 0x858], 0x474d6744
mov dword [ebp - 0x854], 0x586b784a
mov dword [ebp - 0x850], 0x5455784b
mov dword [ebp - 0x84c], 0x45417a44
mov dword [ebp - 0x848], 0x676b7a65
mov dword [ebp - 0x844], 0x51305243
mov dword [ebp - 0x840], 0x484d6a48
mov dword [ebp - 0x83c], 0x6c637961
mov dword [ebp - 0x838], 0x6e454741
mov dword [ebp - 0x834], 0x476b424e
mov dword [ebp - 0x830], 0x5845324d
mov dword [ebp - 0x82c], 0x33737961
mov dword [ebp - 0x828], 0x35456a4a
mov dword [ebp - 0x824], 0x44493345
mov dword [ebp - 0x820], 0x4f306e43
mov dword [ebp - 0x81c], 0x47454148
mov dword [ebp - 0x818], 0x4177774a
mov dword [ebp - 0x814], 0x4f736861
mov dword [ebp - 0x810], 0x4b457743
mov dword [ebp - 0x80c], 0x316b5145
mov dword [ebp - 0x808], 0x31773264
mov dword [ebp - 0x804], 0x5463794a
mov dword [ebp - 0x800], 0x644d4745
mov dword [ebp - 0x7fc], 0x41775345
mov dword [ebp - 0x7f8], 0x64434141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x268a]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27b8]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, eax
call fcn.0046bf80
push eax
lea ecx, [ebp - 0x50]
call fcn.005019c0
test eax, eax
lea ecx, [ebp - 0x27b8]
sete bl
call fcn.00467b80
test bl, bl
je 0x4a7b7a
lea eax, [ebp - 0x8d2]
mov dword [ebp - 0x9cc], 0x77554345
push eax
lea eax, [ebp - 0x9cc]
mov dword [ebp - 0x9c8], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x290c]
mov dword [ebp - 0x9c4], 0x2b595447
mov dword [ebp - 0x9c0], 0x6c38694a
mov dword [ebp - 0x9bc], 0x6b39324b
mov dword [ebp - 0x9b8], 0x6b30515a
mov dword [ebp - 0x9b4], 0x706b434b
mov dword [ebp - 0x9b0], 0x56595850
mov dword [ebp - 0x9ac], 0x38674449
mov dword [ebp - 0x9a8], 0x7351534a
mov dword [ebp - 0x9a4], 0x6e556e49
mov dword [ebp - 0x9a0], 0x33386a4e
mov dword [ebp - 0x99c], 0x70417a49
mov dword [ebp - 0x998], 0x6e594463
mov dword [ebp - 0x994], 0x7064694f
mov dword [ebp - 0x990], 0x6c52534d
mov dword [ebp - 0x98c], 0x76517949
mov dword [ebp - 0x988], 0x6d4d694d
mov dword [ebp - 0x984], 0x7a6b4361
mov dword [ebp - 0x980], 0x6e55694e
mov dword [ebp - 0x97c], 0x44737843
mov dword [ebp - 0x978], 0x79676941
mov dword [ebp - 0x974], 0x4c344866
mov dword [ebp - 0x970], 0x4f41534b
mov dword [ebp - 0x96c], 0x4e554247
mov dword [ebp - 0x968], 0x7555794a
mov dword [ebp - 0x964], 0x68387a4f
mov dword [ebp - 0x960], 0x52595362
mov dword [ebp - 0x95c], 0x2f70324c
mov dword [ebp - 0x958], 0x59384849
mov dword [ebp - 0x954], 0x6b4e6a49
mov dword [ebp - 0x950], 0x496f4150
mov dword [ebp - 0x94c], 0x7467544b
mov dword [ebp - 0x948], 0x6751584f
mov dword [ebp - 0x944], 0x4d777744
mov dword [ebp - 0x940], 0x78307846
mov dword [ebp - 0x93c], 0x2b6f5342
mov dword [ebp - 0x938], 0x53557747
mov dword [ebp - 0x934], 0x77634465
mov dword [ebp - 0x930], 0x62494145
mov dword [ebp - 0x92c], 0x4f38784a
mov dword [ebp - 0x928], 0x70736859
mov dword [ebp - 0x924], 0x6973694c
mov dword [ebp - 0x920], 0x33554847
mov dword [ebp - 0x91c], 0x39685147
mov dword [ebp - 0x918], 0x4e675344
mov dword [ebp - 0x914], 0x59416a48
mov dword [ebp - 0x910], 0x6c344362
mov dword [ebp - 0x90c], 0x464d6966
mov dword [ebp - 0x908], 0x4130544e
mov dword [ebp - 0x904], 0x4f6b7a4c
mov dword [ebp - 0x900], 0x354a6947
mov dword [ebp - 0x8fc], 0x6655574b
mov dword [ebp - 0x8f8], 0x76596848
mov dword [ebp - 0x8f4], 0x75635447
mov dword [ebp - 0x8f0], 0x386b6846
mov dword [ebp - 0x8ec], 0x2f59434d
mov dword [ebp - 0x8e8], 0x4f514341
mov dword [ebp - 0x8e4], 0x7245544a
mov dword [ebp - 0x8e0], 0x34494344
mov dword [ebp - 0x8dc], 0x5455414b
mov dword [ebp - 0x8d8], 0x41414141
mov word [ebp - 0x8d4], 0x4166
call fcn.004675e0
push 0
lea ecx, [ebp - 0x268c]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2728]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7b23
sub ecx, edx
je 0x4a7b5d
mov edi, edi
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7b50
sub ecx, edx
cmp esi, ecx
jb 0x4a7b30
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2728]
call fcn.00467ae0
mov edi, 0x1e
jmp 0x4ac650
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xbbc], 0x77554345
push eax
lea eax, [ebp - 0xbbc]
mov dword [ebp - 0xbb8], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28ac]
mov dword [ebp - 0xbb4], 0x2b595447
mov dword [ebp - 0xbb0], 0x6c38694a
mov dword [ebp - 0xbac], 0x6b39324b
mov dword [ebp - 0xba8], 0x7159515a
mov dword [ebp - 0xba4], 0x6977794e
mov dword [ebp - 0xba0], 0x6c596e50
mov dword [ebp - 0xb9c], 0x6b73534c
mov dword [ebp - 0xb98], 0x6e34794b
mov dword [ebp - 0xb94], 0x3745535a
mov dword [ebp - 0xb90], 0x67387963
mov dword [ebp - 0xb8c], 0x7368544b
mov dword [ebp - 0xb88], 0x6d5a544a
mov dword [ebp - 0xb84], 0x39346950
mov dword [ebp - 0xb80], 0x7877514c
mov dword [ebp - 0xb7c], 0x3764774d
mov dword [ebp - 0xb78], 0x304d474c
mov dword [ebp - 0xb74], 0x44775165
mov dword [ebp - 0xb70], 0x766c4145
mov dword [ebp - 0xb6c], 0x44347a43
mov dword [ebp - 0xb68], 0x77387741
mov dword [ebp - 0xb64], 0x2f704247
mov dword [ebp - 0xb60], 0x7634424b
mov dword [ebp - 0xb5c], 0x7863444f
mov dword [ebp - 0xb58], 0x764d4861
mov dword [ebp - 0xb54], 0x724d4464
mov dword [ebp - 0xb50], 0x30417943
mov dword [ebp - 0xb4c], 0x52675749
mov dword [ebp - 0xb48], 0x3441434d
mov dword [ebp - 0xb44], 0x6a4e534b
mov dword [ebp - 0xb40], 0x6c55444a
mov dword [ebp - 0xb3c], 0x72417845
mov dword [ebp - 0xb38], 0x56637a49
mov dword [ebp - 0xb34], 0x57304147
mov dword [ebp - 0xb30], 0x4d6f7944
mov dword [ebp - 0xb2c], 0x6230514d
mov dword [ebp - 0xb28], 0x504d7848
mov dword [ebp - 0xb24], 0x57675741
mov dword [ebp - 0xb20], 0x33735342
mov dword [ebp - 0xb1c], 0x66555145
mov dword [ebp - 0xb18], 0x57386a48
mov dword [ebp - 0xb14], 0x5045544f
mov dword [ebp - 0xb10], 0x6f4d784a
mov dword [ebp - 0xb0c], 0x39784143
mov dword [ebp - 0xb08], 0x6977334e
mov dword [ebp - 0xb04], 0x31305344
mov dword [ebp - 0xb00], 0x5a495146
mov dword [ebp - 0xafc], 0x426f7a4b
mov dword [ebp - 0xaf8], 0x304a4243
mov dword [ebp - 0xaf4], 0x79597841
mov dword [ebp - 0xaf0], 0x4b677749
mov dword [ebp - 0xaec], 0x59733265
mov dword [ebp - 0xae8], 0x454d5241
mov dword [ebp - 0xae4], 0x486b5849
mov dword [ebp - 0xae0], 0x38776e4c
mov dword [ebp - 0xadc], 0x7541414c
mov dword [ebp - 0xad8], 0x62777a4b
mov dword [ebp - 0xad4], 0x6d4e6a43
mov dword [ebp - 0xad0], 0x46303341
mov dword [ebp - 0xacc], 0x59557749
mov dword [ebp - 0xac8], 0x69417748
mov dword [ebp - 0xac4], 0x7573434a
mov dword [ebp - 0xac0], 0x7755434b
mov dword [ebp - 0xabc], 0x786b6e50
mov dword [ebp - 0xab8], 0x41455464
mov dword [ebp - 0xab4], 0x58434141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x268e]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2830]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7e81
sub ecx, edx
je 0x4a7ebd
lea esp, [esp]
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7eb0
sub ecx, edx
cmp esi, ecx
jb 0x4a7e90
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2830]
call fcn.00467ae0
lea ecx, [ebp - 0x50]
call fcn.004b8310
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 9
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x3c], eax
call ebx
test eax, eax
jne 0x4a81ca
lea eax, [ebp - 0x4b6]
mov dword [ebp - 0x58c], 0x77554345
push eax
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x588], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x2974]
mov dword [ebp - 0x584], 0x2b595447
mov dword [ebp - 0x580], 0x6c38694a
mov dword [ebp - 0x57c], 0x6b39324b
mov dword [ebp - 0x578], 0x6b30515a
mov dword [ebp - 0x574], 0x706b434b
mov dword [ebp - 0x570], 0x62595850
mov dword [ebp - 0x56c], 0x3738794a
mov dword [ebp - 0x568], 0x6970434c
mov dword [ebp - 0x564], 0x6d416a4e
mov dword [ebp - 0x560], 0x6951534a
mov dword [ebp - 0x55c], 0x344d334c
mov dword [ebp - 0x558], 0x6b593250
mov dword [ebp - 0x554], 0x6977794c
mov dword [ebp - 0x550], 0x3134545a
mov dword [ebp - 0x54c], 0x74555459
mov dword [ebp - 0x548], 0x6634544c
mov dword [ebp - 0x544], 0x6f4d7748
mov dword [ebp - 0x540], 0x73637947
mov dword [ebp - 0x53c], 0x3363444c
mov dword [ebp - 0x538], 0x4a51684a
mov dword [ebp - 0x534], 0x36494350
mov dword [ebp - 0x530], 0x78385247
mov dword [ebp - 0x52c], 0x61554342
mov dword [ebp - 0x528], 0x335a6742
mov dword [ebp - 0x524], 0x6e4d434d
mov dword [ebp - 0x520], 0x34637949
mov dword [ebp - 0x51c], 0x35595166
mov dword [ebp - 0x518], 0x706b5143
mov dword [ebp - 0x514], 0x7477684d
mov dword [ebp - 0x510], 0x526b584d
mov dword [ebp - 0x50c], 0x72417848
mov dword [ebp - 0x508], 0x46347845
mov dword [ebp - 0x504], 0x6634514f
mov dword [ebp - 0x500], 0x32744841
mov dword [ebp - 0x4fc], 0x38345165
mov dword [ebp - 0x4f8], 0x2b775444
mov dword [ebp - 0x4f4], 0x724a544b
mov dword [ebp - 0x4f0], 0x736b3341
mov dword [ebp - 0x4ec], 0x69425163
mov dword [ebp - 0x4e8], 0x59306e45
mov dword [ebp - 0x4e4], 0x3855524b
mov dword [ebp - 0x4e0], 0x69385866
mov dword [ebp - 0x4dc], 0x686b7744
mov dword [ebp - 0x4d8], 0x68674346
mov dword [ebp - 0x4d4], 0x4e454863
mov dword [ebp - 0x4d0], 0x43344259
mov dword [ebp - 0x4cc], 0x7139534b
mov dword [ebp - 0x4c8], 0x6d73694e
mov dword [ebp - 0x4c4], 0x69344266
mov dword [ebp - 0x4c0], 0x78783350
mov dword [ebp - 0x4bc], 0x41414141
mov word [ebp - 0x4b8], 0x775a
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2690]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2740]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8175
sub ecx, edx
je 0x4a81ad
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a81a0
sub ecx, edx
cmp esi, ecx
jb 0x4a8180
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2740]
call fcn.00467ae0
mov edi, 0x1f
jmp 0x4ac650
lea eax, [ebp - 0x316]
mov dword [ebp - 0x3dc], 0x77554345
push eax
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x3d8], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28bc]
mov dword [ebp - 0x3d4], 0x2b595447
mov dword [ebp - 0x3d0], 0x6c38694a
mov dword [ebp - 0x3cc], 0x6b39324b
mov dword [ebp - 0x3c8], 0x7159515a
mov dword [ebp - 0x3c4], 0x6977794e
mov dword [ebp - 0x3c0], 0x6a596e50
mov dword [ebp - 0x3bc], 0x7a30444f
mov dword [ebp - 0x3b8], 0x6968694e
mov dword [ebp - 0x3b4], 0x6751544e
mov dword [ebp - 0x3b0], 0x3130324f
mov dword [ebp - 0x3ac], 0x2f4d584a
mov dword [ebp - 0x3a8], 0x7751544e
mov dword [ebp - 0x3a4], 0x7377794a
mov dword [ebp - 0x3a0], 0x6b73545a
mov dword [ebp - 0x39c], 0x3031534e
mov dword [ebp - 0x398], 0x66345159
mov dword [ebp - 0x394], 0x46414442
mov dword [ebp - 0x390], 0x4c73444a
mov dword [ebp - 0x38c], 0x6c63474d
mov dword [ebp - 0x388], 0x30744144
mov dword [ebp - 0x384], 0x59597749
mov dword [ebp - 0x380], 0x6955514d
mov dword [ebp - 0x37c], 0x62345266
mov dword [ebp - 0x378], 0x395a514c
mov dword [ebp - 0x374], 0x3930514a
mov dword [ebp - 0x370], 0x6c567a44
mov dword [ebp - 0x36c], 0x3641674d
mov dword [ebp - 0x368], 0x34387841
mov dword [ebp - 0x364], 0x33516a4d
mov dword [ebp - 0x360], 0x34553341
mov dword [ebp - 0x35c], 0x56456844
mov dword [ebp - 0x358], 0x43384847
mov dword [ebp - 0x354], 0x63677741
mov dword [ebp - 0x350], 0x6649334a
mov dword [ebp - 0x34c], 0x3941674b
mov dword [ebp - 0x348], 0x4445424b
mov dword [ebp - 0x344], 0x726f5465
mov dword [ebp - 0x340], 0x7a346942
mov dword [ebp - 0x33c], 0x7a736a49
mov dword [ebp - 0x338], 0x6f55414f
mov dword [ebp - 0x334], 0x4e556763
mov dword [ebp - 0x330], 0x72354342
mov dword [ebp - 0x32c], 0x696b6766
mov dword [ebp - 0x328], 0x48676847
mov dword [ebp - 0x324], 0x72417744
mov dword [ebp - 0x320], 0x47417a4f
mov dword [ebp - 0x31c], 0x41414141
mov word [ebp - 0x318], 0x6758
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2694]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27d0]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8426
sub ecx, edx
je 0x4a845d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
jmp 0x4a8450
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8450
sub ecx, edx
cmp esi, ecx
jb 0x4a8431
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27d0]
call fcn.00467ae0
push 9
push dword [ebp - 0x58]
lea ecx, [ebp - 0x44]
call fcn.004b8310
push eax
call ebx
test eax, eax
jne 0x4a8954
lea eax, [ebp - 0xd5]
mov dword [ebp - 0x154], 0x77554345
push eax
lea eax, [ebp - 0x154]
mov dword [ebp - 0x150], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x291c]
mov dword [ebp - 0x14c], 0x2b595447
mov dword [ebp - 0x148], 0x6c38694a
mov dword [ebp - 0x144], 0x6b39324b
mov dword [ebp - 0x140], 0x6b30515a
mov dword [ebp - 0x13c], 0x706b434b
mov dword [ebp - 0x138], 0x62595850
mov dword [ebp - 0x134], 0x3738794a
mov dword [ebp - 0x130], 0x6970434c
mov dword [ebp - 0x12c], 0x7755434d
mov dword [ebp - 0x128], 0x6b6b6a4d
mov dword [ebp - 0x124], 0x744d6961
mov dword [ebp - 0x120], 0x6d35434a
mov dword [ebp - 0x11c], 0x7042694f
mov dword [ebp - 0x118], 0x3334694e
mov dword [ebp - 0x114], 0x7677794e
mov dword [ebp - 0x110], 0x6d594850
mov dword [ebp - 0x10c], 0x3630534b
mov dword [ebp - 0x108], 0x46595143
mov dword [ebp - 0x104], 0x68646763
mov dword [ebp - 0x100], 0x3030445a
mov dword [ebp - 0xfc], 0x364e574c
mov dword [ebp - 0xf8], 0x6c6f694a
mov dword [ebp - 0xf4], 0x5263424a
mov dword [ebp - 0xf0], 0x7a4e5266
mov dword [ebp - 0xec], 0x3830524a
mov dword [ebp - 0xe8], 0x344d5748
mov dword [ebp - 0xe4], 0x38555449
mov dword [ebp - 0xe0], 0x53346a63
mov dword [ebp - 0xdc], 0x41417748
mov word [ebp - 0xd8], 0x4341
mov byte [ebp - 0xd6], 0x49
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2696]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2758]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8637
sub ecx, edx
je 0x4a866d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8660
sub ecx, edx
cmp esi, ecx
jb 0x4a8642
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2758]
call fcn.00467ae0
lea eax, [ebp - 0x729]
mov dword [ebp - 0x7f4], 0x77554345
push eax
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x7f0], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28cc]
mov dword [ebp - 0x7ec], 0x2b595447
mov dword [ebp - 0x7e8], 0x6c38694a
mov dword [ebp - 0x7e4], 0x6b39324b
mov dword [ebp - 0x7e0], 0x7159515a
mov dword [ebp - 0x7dc], 0x6977794e
mov dword [ebp - 0x7d8], 0x30596e50
mov dword [ebp - 0x7d4], 0x356f544b
mov dword [ebp - 0x7d0], 0x69317a4e
mov dword [ebp - 0x7cc], 0x6751544e
mov dword [ebp - 0x7c8], 0x6a30324f
mov dword [ebp - 0x7c4], 0x6e417a4b
mov dword [ebp - 0x7c0], 0x70494463
mov dword [ebp - 0x7bc], 0x73776a62
mov dword [ebp - 0x7b8], 0x73307a4e
mov dword [ebp - 0x7b4], 0x73426949
mov dword [ebp - 0x7b0], 0x6963544b
mov dword [ebp - 0x7ac], 0x68384349
mov dword [ebp - 0x7a8], 0x67734363
mov dword [ebp - 0x7a4], 0x69516842
mov dword [ebp - 0x7a0], 0x46635459
mov dword [ebp - 0x79c], 0x326f4748
mov dword [ebp - 0x798], 0x73556a4d
mov dword [ebp - 0x794], 0x596b544b
mov dword [ebp - 0x790], 0x31746e4b
mov dword [ebp - 0x78c], 0x4a775346
mov dword [ebp - 0x788], 0x5977534b
mov dword [ebp - 0x784], 0x586f6749
mov dword [ebp - 0x780], 0x4f674841
mov dword [ebp - 0x77c], 0x56554750
mov dword [ebp - 0x778], 0x56734346
mov dword [ebp - 0x774], 0x384a774f
mov dword [ebp - 0x770], 0x4c51774e
mov dword [ebp - 0x76c], 0x78384243
mov dword [ebp - 0x768], 0x63734250
mov dword [ebp - 0x764], 0x3159784c
mov dword [ebp - 0x760], 0x78456a44
mov dword [ebp - 0x75c], 0x68455266
mov dword [ebp - 0x758], 0x5467674b
mov dword [ebp - 0x754], 0x6d68424d
mov dword [ebp - 0x750], 0x3173444d
mov dword [ebp - 0x74c], 0x4f55674f
mov dword [ebp - 0x748], 0x30637842
mov dword [ebp - 0x744], 0x4f676e43
mov dword [ebp - 0x740], 0x6a345841
mov dword [ebp - 0x73c], 0x6c677945
mov dword [ebp - 0x738], 0x44457848
mov dword [ebp - 0x734], 0x626b5747
mov dword [ebp - 0x730], 0x41415142
mov word [ebp - 0x72c], 0x4641
mov byte [ebp - 0x72a], 0x30
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a6]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2818]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
mov edi, eax
lea ecx, [ebp - 0x34]
push 0xc
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a88f0
sub ecx, edx
je 0x4a892d
jmp 0x4a8900
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8920
sub ecx, edx
cmp esi, ecx
jb 0x4a8900
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2818]
call fcn.00467ae0
push 9
push dword [ebp - 0x58]
push dword [ebp - 0x3c]
call ebx
mov edi, 0x20
jmp 0x4ac650
mov dword [ebp - 0x22cc], 0x77554345
mov dword [ebp - 0x22c8], 0x6b6b6a4d
mov dword [ebp - 0x22c4], 0x2b595447
mov dword [ebp - 0x22c0], 0x6c38694a
mov dword [ebp - 0x22bc], 0x6b39324b
mov dword [ebp - 0x22b8], 0x7467515a
mov dword [ebp - 0x22b4], 0x6e59434a
mov dword [ebp - 0x22b0], 0x7867444d
mov dword [ebp - 0x22ac], 0x336f4361
mov dword [ebp - 0x22a8], 0x7273444d
mov dword [ebp - 0x22a4], 0x30426a4a
mov dword [ebp - 0x22a0], 0x676b4449
mov dword [ebp - 0x229c], 0x2f596950
mov dword [ebp - 0x2298], 0x33427945
mov dword [ebp - 0x2294], 0x526b4248
mov dword [ebp - 0x2290], 0x56344866
mov dword [ebp - 0x228c], 0x31735147
mov dword [ebp - 0x2288], 0x6e59534c
mov dword [ebp - 0x2284], 0x78735765
mov dword [ebp - 0x2280], 0x4d677a4f
mov dword [ebp - 0x227c], 0x6d787944
mov dword [ebp - 0x2278], 0x34346741
mov dword [ebp - 0x2274], 0x4549784b
mov dword [ebp - 0x2270], 0x706f5366
mov dword [ebp - 0x226c], 0x2b744344
mov dword [ebp - 0x2268], 0x33776e63
mov dword [ebp - 0x2264], 0x42513364
mov dword [ebp - 0x2260], 0x47776843
mov dword [ebp - 0x225c], 0x6e785263
mov dword [ebp - 0x2258], 0x7678434f
mov dword [ebp - 0x2254], 0x39557748
mov dword [ebp - 0x2250], 0x58455342
mov dword [ebp - 0x224c], 0x42455150
mov dword [ebp - 0x2248], 0x4467514a
mov dword [ebp - 0x2244], 0x4b634146
mov dword [ebp - 0x2240], 0x6d77534e
mov dword [ebp - 0x223c], 0x30355346
mov dword [ebp - 0x2238], 0x474d4344
mov dword [ebp - 0x2234], 0x51416a66
mov dword [ebp - 0x2230], 0x626b7863
mov dword [ebp - 0x222c], 0x45453248
mov dword [ebp - 0x2228], 0x436b534b
mov dword [ebp - 0x2224], 0x31464747
mov dword [ebp - 0x2220], 0x56736d4e
mov dword [ebp - 0x221c], 0x51774366
mov dword [ebp - 0x2218], 0x7770414a
mov dword [ebp - 0x2214], 0x2b4d5244
mov dword [ebp - 0x2210], 0x7535444b
mov dword [ebp - 0x220c], 0x30773247
mov dword [ebp - 0x2208], 0x4d387847
mov dword [ebp - 0x2204], 0x675a4748
mov dword [ebp - 0x2200], 0x7968435a
mov dword [ebp - 0x21fc], 0x504d5166
mov dword [ebp - 0x21f8], 0x4a513344
mov dword [ebp - 0x21f4], 0x48343347
mov dword [ebp - 0x21f0], 0x51556945
mov dword [ebp - 0x21ec], 0x75774141
mov dword [ebp - 0x21e8], 0x39496d4f
mov dword [ebp - 0x21e4], 0x44677843
mov dword [ebp - 0x21e0], 0x6755414b
mov dword [ebp - 0x21dc], 0x63496a64
mov dword [ebp - 0x21d8], 0x6b45415a
mov dword [ebp - 0x21d4], 0x6b45324a
mov dword [ebp - 0x21d0], 0x72524142
mov dword [ebp - 0x21cc], 0x7477774c
mov dword [ebp - 0x21c8], 0x7770694b
mov dword [ebp - 0x21c4], 0x39464364
mov dword [ebp - 0x21c0], 0x38556750
mov dword [ebp - 0x21bc], 0x4c734744
mov dword [ebp - 0x21b8], 0x6c777a47
mov dword [ebp - 0x21b4], 0x4277444e
mov dword [ebp - 0x21b0], 0x6b6b4159
mov dword [ebp - 0x21ac], 0x4e596845
mov dword [ebp - 0x21a8], 0x54776849
mov dword [ebp - 0x21a4], 0x6455784b
mov dword [ebp - 0x21a0], 0x526b514c
mov dword [ebp - 0x219c], 0x2f416a64
mov dword [ebp - 0x2198], 0x42677a41
mov dword [ebp - 0x2194], 0x36306a45
mov dword [ebp - 0x2190], 0x32684249
mov dword [ebp - 0x218c], 0x65596d47
lea eax, [ebp - 0x2139]
mov dword [ebp - 0x2188], 0x46517850
push eax
lea eax, [ebp - 0x22cc]
mov dword [ebp - 0x2184], 0x6d346a63
push eax
lea ecx, [ebp - 0x295c]
mov dword [ebp - 0x2180], 0x7645514f
mov dword [ebp - 0x217c], 0x3451674a
mov dword [ebp - 0x2178], 0x6663434a
mov dword [ebp - 0x2174], 0x5938774c
mov dword [ebp - 0x2170], 0x444d784f
mov dword [ebp - 0x216c], 0x57347a65
mov dword [ebp - 0x2168], 0x51414147
mov dword [ebp - 0x2164], 0x54305448
mov dword [ebp - 0x2160], 0x7934684f
mov dword [ebp - 0x215c], 0x30514341
mov dword [ebp - 0x2158], 0x78396950
mov dword [ebp - 0x2154], 0x62554450
mov dword [ebp - 0x2150], 0x74516863
mov dword [ebp - 0x214c], 0x34496944
mov dword [ebp - 0x2148], 0x3555534b
mov dword [ebp - 0x2144], 0x6477784f
mov dword [ebp - 0x2140], 0x41417744
mov word [ebp - 0x213c], 0x5141
mov byte [ebp - 0x213a], 0x4d
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2687]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2770]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8db5
sub ecx, edx
je 0x4a8ded
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8de0
sub ecx, edx
cmp esi, ecx
jb 0x4a8dc0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2770]
call fcn.00467ae0
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4a91aa
lea eax, [ebp - 0xcc6]
mov dword [ebp - 0xde8], 0x77554345
push eax
lea eax, [ebp - 0xde8]
mov dword [ebp - 0xde4], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28dc]
mov dword [ebp - 0xde0], 0x2b595447
mov dword [ebp - 0xddc], 0x6c38694a
mov dword [ebp - 0xdd8], 0x6b39324b
mov dword [ebp - 0xdd4], 0x6b30515a
mov dword [ebp - 0xdd0], 0x706b434b
mov dword [ebp - 0xdcc], 0x78595850
mov dword [ebp - 0xdc8], 0x6d30534c
mov dword [ebp - 0xdc4], 0x6c4d794b
mov dword [ebp - 0xdc0], 0x7859535a
mov dword [ebp - 0xdbc], 0x6f735449
mov dword [ebp - 0xdb8], 0x735a544b
mov dword [ebp - 0xdb4], 0x6e497a49
mov dword [ebp - 0xdb0], 0x366f6a4f
mov dword [ebp - 0xdac], 0x66597745
mov dword [ebp - 0xda8], 0x6951514e
mov dword [ebp - 0xda4], 0x42346962
mov dword [ebp - 0xda0], 0x37734347
mov dword [ebp - 0xd9c], 0x36517a4f
mov dword [ebp - 0xd98], 0x5167444a
mov dword [ebp - 0xd94], 0x3577584d
mov dword [ebp - 0xd90], 0x30637a65
mov dword [ebp - 0xd8c], 0x776c434f
mov dword [ebp - 0xd88], 0x754d6964
mov dword [ebp - 0xd84], 0x4c41774b
mov dword [ebp - 0xd80], 0x41776764
mov dword [ebp - 0xd7c], 0x474d544e
mov dword [ebp - 0xd78], 0x586f4447
mov dword [ebp - 0xd74], 0x5630684b
mov dword [ebp - 0xd70], 0x6b4e514c
mov dword [ebp - 0xd6c], 0x6230784f
mov dword [ebp - 0xd68], 0x6d637865
mov dword [ebp - 0xd64], 0x4c45335a
mov dword [ebp - 0xd60], 0x4649514a
mov dword [ebp - 0xd5c], 0x67556743
mov dword [ebp - 0xd58], 0x32777a4b
mov dword [ebp - 0xd54], 0x68686a43
mov dword [ebp - 0xd50], 0x47457844
mov dword [ebp - 0xd4c], 0x6e6b7a4a
mov dword [ebp - 0xd48], 0x61387a64
mov dword [ebp - 0xd44], 0x4b494141
mov dword [ebp - 0xd40], 0x43345844
mov dword [ebp - 0xd3c], 0x416f6741
mov dword [ebp - 0xd38], 0x62556865
mov dword [ebp - 0xd34], 0x68494345
mov dword [ebp - 0xd30], 0x62776841
mov dword [ebp - 0xd2c], 0x6c73334d
mov dword [ebp - 0xd28], 0x68386d4f
mov dword [ebp - 0xd24], 0x6e6f7a4f
mov dword [ebp - 0xd20], 0x35454466
mov dword [ebp - 0xd1c], 0x72494244
mov dword [ebp - 0xd18], 0x5a456949
mov dword [ebp - 0xd14], 0x6a633345
mov dword [ebp - 0xd10], 0x5045794e
mov dword [ebp - 0xd0c], 0x32736844
mov dword [ebp - 0xd08], 0x2b6f534f
mov dword [ebp - 0xd04], 0x38384141
mov dword [ebp - 0xd00], 0x7138474d
mov dword [ebp - 0xcfc], 0x7a784344
mov dword [ebp - 0xcf8], 0x69786963
mov dword [ebp - 0xcf4], 0x76385348
mov dword [ebp - 0xcf0], 0x4830784f
mov dword [ebp - 0xcec], 0x43635459
mov dword [ebp - 0xce8], 0x386c5148
mov dword [ebp - 0xce4], 0x714d7943
mov dword [ebp - 0xce0], 0x31494263
mov dword [ebp - 0xcdc], 0x6b34534b
mov dword [ebp - 0xcd8], 0x686b474f
mov dword [ebp - 0xcd4], 0x7373534d
mov dword [ebp - 0xcd0], 0x646b5450
mov dword [ebp - 0xccc], 0x41414141
mov word [ebp - 0xcc8], 0x4171
call fcn.004675e0
mov esi, eax
push 0
lea ecx, [ebp - 0x26a1]
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27e8]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9158
sub ecx, edx
je 0x4a918d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9180
sub ecx, edx
cmp esi, ecx
jb 0x4a9163
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27e8]
call fcn.00467ae0
mov edi, 0x21
jmp 0x4ac650
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x4a9a3a
cmp eax, 3
je 0x4a9a3a
mov dword [ebp - 0x1f80], 0x77554345
mov dword [ebp - 0x1f7c], 0x6b6b6a4d
mov dword [ebp - 0x1f78], 0x2b595447
mov dword [ebp - 0x1f74], 0x6c38694a
mov dword [ebp - 0x1f70], 0x6b39324b
mov dword [ebp - 0x1f6c], 0x7867525a
mov dword [ebp - 0x1f68], 0x38556a4c
mov dword [ebp - 0x1f64], 0x7867444d
mov dword [ebp - 0x1f60], 0x336f4361
mov dword [ebp - 0x1f5c], 0x7273444d
mov dword [ebp - 0x1f58], 0x68416a4a
mov dword [ebp - 0x1f54], 0x314d7761
mov dword [ebp - 0x1f50], 0x68736863
mov dword [ebp - 0x1f4c], 0x4441424e
mov dword [ebp - 0x1f48], 0x676f7a64
mov dword [ebp - 0x1f44], 0x4b677944
mov dword [ebp - 0x1f40], 0x70635346
mov dword [ebp - 0x1f3c], 0x68515159
mov dword [ebp - 0x1f38], 0x55457749
mov dword [ebp - 0x1f34], 0x374a414e
mov dword [ebp - 0x1f30], 0x744e6d63
mov dword [ebp - 0x1f2c], 0x33645147
mov dword [ebp - 0x1f28], 0x48414466
mov dword [ebp - 0x1f24], 0x794d5443
mov dword [ebp - 0x1f20], 0x6d55674a
mov dword [ebp - 0x1f1c], 0x6d345448
mov dword [ebp - 0x1f18], 0x4c555465
mov dword [ebp - 0x1f14], 0x7559434d
mov dword [ebp - 0x1f10], 0x676b7966
mov dword [ebp - 0x1f0c], 0x346b5442
mov dword [ebp - 0x1f08], 0x7755474d
mov dword [ebp - 0x1f04], 0x30555841
mov dword [ebp - 0x1f00], 0x54637963
mov dword [ebp - 0x1efc], 0x5741684b
mov dword [ebp - 0x1ef8], 0x38565242
mov dword [ebp - 0x1ef4], 0x70455366
mov dword [ebp - 0x1ef0], 0x4e4d584f
mov dword [ebp - 0x1eec], 0x4f384149
mov dword [ebp - 0x1ee8], 0x7278575a
mov dword [ebp - 0x1ee4], 0x336b5342
mov dword [ebp - 0x1ee0], 0x694e324e
mov dword [ebp - 0x1edc], 0x4c673346
mov dword [ebp - 0x1ed8], 0x385a674f
mov dword [ebp - 0x1ed4], 0x74776849
mov dword [ebp - 0x1ed0], 0x345a5866
mov dword [ebp - 0x1ecc], 0x6b67444e
mov dword [ebp - 0x1ec8], 0x2b49444b
mov dword [ebp - 0x1ec4], 0x68456961
mov dword [ebp - 0x1ec0], 0x3538414d
mov dword [ebp - 0x1ebc], 0x784d4147
mov dword [ebp - 0x1eb8], 0x7a516a63
mov dword [ebp - 0x1eb4], 0x4e735345
mov dword [ebp - 0x1eb0], 0x34736741
mov dword [ebp - 0x1eac], 0x5351584d
mov dword [ebp - 0x1ea8], 0x4e555145
mov dword [ebp - 0x1ea4], 0x526f6e49
mov dword [ebp - 0x1ea0], 0x6a63794f
mov dword [ebp - 0x1e9c], 0x396f4450
mov dword [ebp - 0x1e98], 0x654d7a43
mov dword [ebp - 0x1e94], 0x3738694c
mov dword [ebp - 0x1e90], 0x7730774e
mov dword [ebp - 0x1e8c], 0x4b557759
mov dword [ebp - 0x1e88], 0x6c73574c
mov dword [ebp - 0x1e84], 0x4d4d684a
mov dword [ebp - 0x1e80], 0x39357a65
mov dword [ebp - 0x1e7c], 0x31594344
mov dword [ebp - 0x1e78], 0x75776864
mov dword [ebp - 0x1e74], 0x756f4445
mov dword [ebp - 0x1e70], 0x56343248
mov dword [ebp - 0x1e6c], 0x41636a4c
mov dword [ebp - 0x1e68], 0x6e5a6a4b
mov dword [ebp - 0x1e64], 0x306b6746
mov dword [ebp - 0x1e60], 0x5638544a
mov dword [ebp - 0x1e5c], 0x42413344
mov dword [ebp - 0x1e58], 0x47383346
mov dword [ebp - 0x1e54], 0x6f464164
mov dword [ebp - 0x1e50], 0x63456749
mov dword [ebp - 0x1e4c], 0x73595761
mov dword [ebp - 0x1e48], 0x72386749
mov dword [ebp - 0x1e44], 0x7238794f
mov dword [ebp - 0x1e40], 0x61774449
lea eax, [ebp - 0x1d92]
mov dword [ebp - 0x1e3c], 0x31343361
push eax
lea eax, [ebp - 0x1f80]
mov dword [ebp - 0x1e38], 0x4f45444a
push eax
lea ecx, [ebp - 0x292c]
mov dword [ebp - 0x1e34], 0x536f5150
mov dword [ebp - 0x1e30], 0x2f354146
mov dword [ebp - 0x1e2c], 0x61416942
mov dword [ebp - 0x1e28], 0x6b51584d
mov dword [ebp - 0x1e24], 0x79494345
mov dword [ebp - 0x1e20], 0x5a345242
mov dword [ebp - 0x1e1c], 0x42735145
mov dword [ebp - 0x1e18], 0x36556d4e
mov dword [ebp - 0x1e14], 0x33415347
mov dword [ebp - 0x1e10], 0x71734243
mov dword [ebp - 0x1e0c], 0x6f774143
mov dword [ebp - 0x1e08], 0x75554349
mov dword [ebp - 0x1e04], 0x6f51784c
mov dword [ebp - 0x1e00], 0x3152684d
mov dword [ebp - 0x1dfc], 0x73556947
mov dword [ebp - 0x1df8], 0x6735544d
mov dword [ebp - 0x1df4], 0x4d595164
mov dword [ebp - 0x1df0], 0x2f4d5743
mov dword [ebp - 0x1dec], 0x4b6f524e
mov dword [ebp - 0x1de8], 0x57555249
mov dword [ebp - 0x1de4], 0x7049784e
mov dword [ebp - 0x1de0], 0x4b593366
mov dword [ebp - 0x1ddc], 0x32744244
mov dword [ebp - 0x1dd8], 0x5a735346
mov dword [ebp - 0x1dd4], 0x47415162
mov dword [ebp - 0x1dd0], 0x77346a4c
mov dword [ebp - 0x1dcc], 0x3174684b
mov dword [ebp - 0x1dc8], 0x4d774144
mov dword [ebp - 0x1dc4], 0x53556e46
mov dword [ebp - 0x1dc0], 0x3030544c
mov dword [ebp - 0x1dbc], 0x77596a49
mov dword [ebp - 0x1db8], 0x786b4465
mov dword [ebp - 0x1db4], 0x78675344
mov dword [ebp - 0x1db0], 0x716f7949
mov dword [ebp - 0x1dac], 0x6e4a7762
mov dword [ebp - 0x1da8], 0x57384363
mov dword [ebp - 0x1da4], 0x32707863
mov dword [ebp - 0x1da0], 0x464d5366
mov dword [ebp - 0x1d9c], 0x79786a4d
mov dword [ebp - 0x1d98], 0x42414141
mov word [ebp - 0x1d94], 0x6754
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2689]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2788]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9700
sub ecx, edx
je 0x4a973d
jmp 0x4a9710
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9730
sub ecx, edx
cmp esi, ecx
jb 0x4a9710
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2788]
call fcn.00467ae0
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4a9a3a
lea eax, [ebp - 0x58d]
mov dword [ebp - 0x65c], 0x77554345
push eax
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x658], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28ec]
mov dword [ebp - 0x654], 0x2b595447
mov dword [ebp - 0x650], 0x6c38694a
mov dword [ebp - 0x64c], 0x6b39324b
mov dword [ebp - 0x648], 0x6b30515a
mov dword [ebp - 0x644], 0x706b434b
mov dword [ebp - 0x640], 0x46595850
mov dword [ebp - 0x63c], 0x69594450
mov dword [ebp - 0x638], 0x7351694d
mov dword [ebp - 0x634], 0x6e556e49
mov dword [ebp - 0x630], 0x33386a4e
mov dword [ebp - 0x62c], 0x70417a49
mov dword [ebp - 0x628], 0x46385147
mov dword [ebp - 0x624], 0x39497950
mov dword [ebp - 0x620], 0x6b6f4343
mov dword [ebp - 0x61c], 0x75635845
mov dword [ebp - 0x618], 0x4f494146
mov dword [ebp - 0x614], 0x2f55544d
mov dword [ebp - 0x610], 0x78315246
mov dword [ebp - 0x60c], 0x7930794c
mov dword [ebp - 0x608], 0x6f594149
mov dword [ebp - 0x604], 0x3135444a
mov dword [ebp - 0x600], 0x5a635146
mov dword [ebp - 0x5fc], 0x6c41694b
mov dword [ebp - 0x5f8], 0x6130534e
mov dword [ebp - 0x5f4], 0x32597a63
mov dword [ebp - 0x5f0], 0x54676a4d
mov dword [ebp - 0x5ec], 0x566b6d4c
mov dword [ebp - 0x5e8], 0x62736a65
mov dword [ebp - 0x5e4], 0x6c38694a
mov dword [ebp - 0x5e0], 0x4f515245
mov dword [ebp - 0x5dc], 0x306c6847
mov dword [ebp - 0x5d8], 0x44515241
mov dword [ebp - 0x5d4], 0x7a636a41
mov dword [ebp - 0x5d0], 0x4d776944
mov dword [ebp - 0x5cc], 0x30397863
mov dword [ebp - 0x5c8], 0x436b6748
mov dword [ebp - 0x5c4], 0x37416d43
mov dword [ebp - 0x5c0], 0x72387746
mov dword [ebp - 0x5bc], 0x78306845
mov dword [ebp - 0x5b8], 0x70304259
mov dword [ebp - 0x5b4], 0x31524166
mov dword [ebp - 0x5b0], 0x2f645849
mov dword [ebp - 0x5ac], 0x45306e4f
mov dword [ebp - 0x5a8], 0x31494461
mov dword [ebp - 0x5a4], 0x7441484c
mov dword [ebp - 0x5a0], 0x78637a4c
mov dword [ebp - 0x59c], 0x6e6c4148
mov dword [ebp - 0x598], 0x59495346
mov dword [ebp - 0x594], 0x41415146
mov word [ebp - 0x590], 0x4841
mov byte [ebp - 0x58e], 0x41
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2697]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2848]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a99e0
sub ecx, edx
je 0x4a9a1d
jmp 0x4a99f0
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9a10
sub ecx, edx
cmp esi, ecx
jb 0x4a99f0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2848]
call fcn.00467ae0
mov edi, 0x22
jmp 0x4ac650
xor edi, edi
mov dword [ebp - 0x146c], 0x77554345
mov dword [ebp - 0x1468], 0x6b6b6a4d
mov dword [ebp - 0x1464], 0x2b595447
mov dword [ebp - 0x1460], 0x6c38694a
mov dword [ebp - 0x145c], 0x6b39324b
mov dword [ebp - 0x1458], 0x6b77525a
mov dword [ebp - 0x1454], 0x6c45444b
mov dword [ebp - 0x1450], 0x32467a4e
mov dword [ebp - 0x144c], 0x67596a4c
mov dword [ebp - 0x1448], 0x6e346a59
mov dword [ebp - 0x1444], 0x394d794e
mov dword [ebp - 0x1440], 0x6868434d
mov dword [ebp - 0x143c], 0x73786a50
mov dword [ebp - 0x1438], 0x70497a49
mov dword [ebp - 0x1434], 0x7a346950
mov dword [ebp - 0x1430], 0x48304463
mov dword [ebp - 0x142c], 0x6f34794b
mov dword [ebp - 0x1428], 0x596b774f
mov dword [ebp - 0x1424], 0x7738545a
mov dword [ebp - 0x1420], 0x58776e65
mov dword [ebp - 0x141c], 0x47774341
mov dword [ebp - 0x1418], 0x5955525a
mov dword [ebp - 0x1414], 0x4745514c
mov dword [ebp - 0x1410], 0x55455148
mov dword [ebp - 0x140c], 0x626b6e4e
mov dword [ebp - 0x1408], 0x50496a64
mov dword [ebp - 0x1404], 0x6b73674d
mov dword [ebp - 0x1400], 0x524d4349
mov dword [ebp - 0x13fc], 0x4367515a
mov dword [ebp - 0x13f8], 0x6745694a
mov dword [ebp - 0x13f4], 0x6e674444
mov dword [ebp - 0x13f0], 0x65384449
mov dword [ebp - 0x13ec], 0x38427747
mov dword [ebp - 0x13e8], 0x386b4241
mov dword [ebp - 0x13e4], 0x2f5a6e4a
mov dword [ebp - 0x13e0], 0x67495163
mov dword [ebp - 0x13dc], 0x64455463
mov dword [ebp - 0x13d8], 0x6d35674b
mov dword [ebp - 0x13d4], 0x596b4766
mov dword [ebp - 0x13d0], 0x76686a43
mov dword [ebp - 0x13cc], 0x53636a45
mov dword [ebp - 0x13c8], 0x67676a4d
mov dword [ebp - 0x13c4], 0x4c4d7943
mov dword [ebp - 0x13c0], 0x75454448
mov dword [ebp - 0x13bc], 0x77674342
mov dword [ebp - 0x13b8], 0x51307945
mov dword [ebp - 0x13b4], 0x65515845
mov dword [ebp - 0x13b0], 0x4663414e
mov dword [ebp - 0x13ac], 0x71777866
mov dword [ebp - 0x13a8], 0x44734846
mov dword [ebp - 0x13a4], 0x6768484c
mov dword [ebp - 0x13a0], 0x37304448
mov dword [ebp - 0x139c], 0x426b4342
mov dword [ebp - 0x1398], 0x48415249
mov dword [ebp - 0x1394], 0x2f707a4b
mov dword [ebp - 0x1390], 0x33746e64
mov dword [ebp - 0x138c], 0x6c516945
mov dword [ebp - 0x1388], 0x6d6c4164
mov dword [ebp - 0x1384], 0x56385150
mov dword [ebp - 0x1380], 0x4267334e
mov dword [ebp - 0x137c], 0x6c734449
mov dword [ebp - 0x1378], 0x53777849
mov dword [ebp - 0x1374], 0x2b416947
mov dword [ebp - 0x1370], 0x786b6743
mov dword [ebp - 0x136c], 0x6a304841
mov dword [ebp - 0x1368], 0x71496e45
mov dword [ebp - 0x1364], 0x4e38794c
mov dword [ebp - 0x1360], 0x6d357a43
mov dword [ebp - 0x135c], 0x49305150
mov dword [ebp - 0x1358], 0x676b5449
mov dword [ebp - 0x1354], 0x7431784b
mov dword [ebp - 0x1350], 0x306b5350
mov dword [ebp - 0x134c], 0x31746747
mov dword [ebp - 0x1348], 0x51637744
mov dword [ebp - 0x1344], 0x516f534c
mov dword [ebp - 0x1340], 0x70674864
mov dword [ebp - 0x133c], 0x47775465
mov dword [ebp - 0x1338], 0x4d776861
mov dword [ebp - 0x1334], 0x2f517847
mov dword [ebp - 0x1330], 0x52387942
lea eax, [ebp - 0x1315]
mov dword [ebp - 0x132c], 0x36737a4a
push eax
lea eax, [ebp - 0x146c]
mov dword [ebp - 0x1328], 0x34684842
push eax
lea ecx, [ebp - 0x286c]
mov dword [ebp - 0x1324], 0x35495147
mov dword [ebp - 0x1320], 0x79386a48
mov dword [ebp - 0x131c], 0x4141774b
mov word [ebp - 0x1318], 0x4e41
mov byte [ebp - 0x1316], 0x49
call fcn.004675e0
push edi
lea ecx, [ebp - 0x268b]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x26ec]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov ebx, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9e06
sub ecx, edx
je 0x4a9e3d
mov al, byte [esi + ebx]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, ebx
inc esi
lea edx, [ecx + 1]
jmp 0x4a9e30
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9e30
sub ecx, edx
cmp esi, ecx
jb 0x4a9e11
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x26ec]
call fcn.00467ae0
cmp dword [ebp - 0x1c], 1
je 0x4a9ecb
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
inc edi
cmp eax, 0x258
jae 0x4a9e82
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x48]
call esi
test eax, eax
jne 0x4a9ec5
push 0
push ecx
mov ecx, esp
push 0x582738
call fcn.004672d0
push 0x1388
push ecx
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.004aea00
call fcn.004e9880
add esp, 0xc
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.004aea00
call fcn.004e8960
add esp, 4
test eax, eax
jne 0x4ab053
cmp dword [ebp - 0x1c], 1
jne 0x4a9e60
mov dword [ebp - 0x1748], 0x77554345
mov dword [ebp - 0x1744], 0x6b6b6a4d
mov dword [ebp - 0x1740], 0x2b595447
mov dword [ebp - 0x173c], 0x6c38694a
mov dword [ebp - 0x1738], 0x6b39324b
mov dword [ebp - 0x1734], 0x7867525a
mov dword [ebp - 0x1730], 0x34634449
mov dword [ebp - 0x172c], 0x7867444d
mov dword [ebp - 0x1728], 0x36304361
mov dword [ebp - 0x1724], 0x7830324a
mov dword [ebp - 0x1720], 0x69634349
mov dword [ebp - 0x171c], 0x6b34694f
mov dword [ebp - 0x1718], 0x66305249
mov dword [ebp - 0x1714], 0x6949674f
mov dword [ebp - 0x1710], 0x4655434c
mov dword [ebp - 0x170c], 0x5749424a
mov dword [ebp - 0x1708], 0x76455164
mov dword [ebp - 0x1704], 0x68646a4f
mov dword [ebp - 0x1700], 0x6b4d6842
mov dword [ebp - 0x16fc], 0x5877434c
mov dword [ebp - 0x16f8], 0x33595249
mov dword [ebp - 0x16f4], 0x55676842
mov dword [ebp - 0x16f0], 0x5a557a4b
mov dword [ebp - 0x16ec], 0x67454347
mov dword [ebp - 0x16e8], 0x4d347849
mov dword [ebp - 0x16e4], 0x66774364
mov dword [ebp - 0x16e0], 0x666b6746
mov dword [ebp - 0x16dc], 0x44516945
mov dword [ebp - 0x16d8], 0x57307a41
mov dword [ebp - 0x16d4], 0x79675263
mov dword [ebp - 0x16d0], 0x4149414e
mov dword [ebp - 0x16cc], 0x6c4d4141
mov dword [ebp - 0x16c8], 0x74515343
mov dword [ebp - 0x16c4], 0x2f4a6a59
mov dword [ebp - 0x16c0], 0x6e6b7750
mov dword [ebp - 0x16bc], 0x7a38444b
mov dword [ebp - 0x16b8], 0x74634262
mov dword [ebp - 0x16b4], 0x69426742
mov dword [ebp - 0x16b0], 0x6e304463
mov dword [ebp - 0x16ac], 0x764a514d
mov dword [ebp - 0x16a8], 0x67634166
mov dword [ebp - 0x16a4], 0x4d385447
mov dword [ebp - 0x16a0], 0x6c516844
mov dword [ebp - 0x169c], 0x2b4a5243
mov dword [ebp - 0x1698], 0x2b596942
mov dword [ebp - 0x1694], 0x61346a42
mov dword [ebp - 0x1690], 0x65454843
mov dword [ebp - 0x168c], 0x37556842
mov dword [ebp - 0x1688], 0x44734141
mov dword [ebp - 0x1684], 0x45556a46
mov dword [ebp - 0x1680], 0x4f6b5248
mov dword [ebp - 0x167c], 0x73774859
mov dword [ebp - 0x1678], 0x684d6748
mov dword [ebp - 0x1674], 0x764d3346
mov dword [ebp - 0x1670], 0x6b56674f
mov dword [ebp - 0x166c], 0x6834794b
mov dword [ebp - 0x1668], 0x456b5143
mov dword [ebp - 0x1664], 0x37347a4c
mov dword [ebp - 0x1660], 0x62385441
mov dword [ebp - 0x165c], 0x44553342
mov dword [ebp - 0x1658], 0x4e414242
mov dword [ebp - 0x1654], 0x5873534d
mov dword [ebp - 0x1650], 0x63416948
mov dword [ebp - 0x164c], 0x72516e45
mov dword [ebp - 0x1648], 0x4630444a
mov dword [ebp - 0x1644], 0x55494346
mov dword [ebp - 0x1640], 0x59454442
mov dword [ebp - 0x163c], 0x43415141
mov dword [ebp - 0x1638], 0x336b674a
mov dword [ebp - 0x1634], 0x6e41574b
mov dword [ebp - 0x1630], 0x4f49414e
mov dword [ebp - 0x162c], 0x3473784b
mov dword [ebp - 0x1628], 0x4a6b514f
mov dword [ebp - 0x1624], 0x42415159
mov dword [ebp - 0x1620], 0x48556964
mov dword [ebp - 0x161c], 0x32743349
mov dword [ebp - 0x1618], 0x6c77784e
mov dword [ebp - 0x1614], 0x6d4d6962
mov dword [ebp - 0x1610], 0x724e5250
mov dword [ebp - 0x160c], 0x53495241
mov dword [ebp - 0x1608], 0x45494463
lea eax, [ebp - 0x15d8]
mov dword [ebp - 0x1604], 0x7141514a
push eax
lea eax, [ebp - 0x1748]
mov dword [ebp - 0x1600], 0x626b6747
push eax
lea ecx, [ebp - 0x2884]
mov dword [ebp - 0x15fc], 0x4163424b
mov dword [ebp - 0x15f8], 0x2f6c7a59
mov dword [ebp - 0x15f4], 0x4734544e
mov dword [ebp - 0x15f0], 0x5763444f
mov dword [ebp - 0x15ec], 0x79595744
mov dword [ebp - 0x15e8], 0x6742784c
mov dword [ebp - 0x15e4], 0x36567a64
mov dword [ebp - 0x15e0], 0x41596d42
mov dword [ebp - 0x15dc], 0x73444141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x268d]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2704]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa2d0
sub ecx, edx
je 0x4aa30d
jmp 0x4aa2e0
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa300
sub ecx, edx
cmp esi, ecx
jb 0x4aa2e0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2704]
call fcn.00467ae0
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
push dword [ebp - 0x48]
call ebx
test eax, eax
jne 0x4ab57a
mov dword [ebp - 0x11a0], 0x77554345
mov dword [ebp - 0x119c], 0x6b6b6a4d
mov dword [ebp - 0x1198], 0x2b595447
mov dword [ebp - 0x1194], 0x6c38694a
mov dword [ebp - 0x1190], 0x6b39324b
mov dword [ebp - 0x118c], 0x6b30515a
mov dword [ebp - 0x1188], 0x706b434b
mov dword [ebp - 0x1184], 0x46595850
mov dword [ebp - 0x1180], 0x67674450
mov dword [ebp - 0x117c], 0x7351694e
mov dword [ebp - 0x1178], 0x67556e49
mov dword [ebp - 0x1174], 0x6868794f
mov dword [ebp - 0x1170], 0x2b59544f
mov dword [ebp - 0x116c], 0x6c38694a
mov dword [ebp - 0x1168], 0x2f45794b
mov dword [ebp - 0x1164], 0x6b417744
mov dword [ebp - 0x1160], 0x364a784b
mov dword [ebp - 0x115c], 0x67356947
mov dword [ebp - 0x1158], 0x4e30774c
mov dword [ebp - 0x1154], 0x3130444d
mov dword [ebp - 0x1150], 0x5a55474e
mov dword [ebp - 0x114c], 0x5149424a
mov dword [ebp - 0x1148], 0x45554366
mov dword [ebp - 0x1144], 0x33316959
mov dword [ebp - 0x1140], 0x36745848
mov dword [ebp - 0x113c], 0x6367584c
mov dword [ebp - 0x1138], 0x3563434c
mov dword [ebp - 0x1134], 0x4d636944
mov dword [ebp - 0x1130], 0x33453266
mov dword [ebp - 0x112c], 0x36347942
mov dword [ebp - 0x1128], 0x69527849
mov dword [ebp - 0x1124], 0x53514242
mov dword [ebp - 0x1120], 0x55677a66
mov dword [ebp - 0x111c], 0x51345359
mov dword [ebp - 0x1118], 0x37355848
mov dword [ebp - 0x1114], 0x32344850
mov dword [ebp - 0x1110], 0x7649414b
mov dword [ebp - 0x110c], 0x2f553250
mov dword [ebp - 0x1108], 0x3641544a
mov dword [ebp - 0x1104], 0x784e534a
mov dword [ebp - 0x1100], 0x6c643250
mov dword [ebp - 0x10fc], 0x72556847
mov dword [ebp - 0x10f8], 0x2b645750
mov dword [ebp - 0x10f4], 0x6e495145
mov dword [ebp - 0x10f0], 0x3930444f
mov dword [ebp - 0x10ec], 0x4d6b774a
mov dword [ebp - 0x10e8], 0x61515242
mov dword [ebp - 0x10e4], 0x5449434f
mov dword [ebp - 0x10e0], 0x7a596a66
mov dword [ebp - 0x10dc], 0x6a735164
mov dword [ebp - 0x10d8], 0x394d3242
mov dword [ebp - 0x10d4], 0x4a676961
mov dword [ebp - 0x10d0], 0x42636766
mov dword [ebp - 0x10cc], 0x774e795a
mov dword [ebp - 0x10c8], 0x46737a4a
mov dword [ebp - 0x10c4], 0x30316a41
mov dword [ebp - 0x10c0], 0x31675347
mov dword [ebp - 0x10bc], 0x2b416743
mov dword [ebp - 0x10b8], 0x4545534b
mov dword [ebp - 0x10b4], 0x31745363
mov dword [ebp - 0x10b0], 0x474d7746
mov dword [ebp - 0x10ac], 0x4a34444e
mov dword [ebp - 0x10a8], 0x2f785466
mov dword [ebp - 0x10a4], 0x464d4361
mov dword [ebp - 0x10a0], 0x64414242
mov dword [ebp - 0x109c], 0x48307748
mov dword [ebp - 0x1098], 0x3730684d
mov dword [ebp - 0x1094], 0x6b425346
mov dword [ebp - 0x1090], 0x7141544c
mov dword [ebp - 0x108c], 0x5341474c
mov dword [ebp - 0x1088], 0x77776d44
mov dword [ebp - 0x1084], 0x766f7a43
mov dword [ebp - 0x1080], 0x4545774a
mov dword [ebp - 0x107c], 0x4a634861
mov dword [ebp - 0x1078], 0x66556a46
mov dword [ebp - 0x1074], 0x6d555144
mov dword [ebp - 0x1070], 0x484d4345
mov dword [ebp - 0x106c], 0x56777a47
mov dword [ebp - 0x1068], 0x36677841
mov dword [ebp - 0x1064], 0x7567544a
mov dword [ebp - 0x1060], 0x78454449
lea eax, [ebp - 0x1031]
mov dword [ebp - 0x105c], 0x65554247
push eax
lea eax, [ebp - 0x11a0]
mov dword [ebp - 0x1058], 0x67733266
push eax
lea ecx, [ebp - 0x2894]
mov dword [ebp - 0x1054], 0x49595250
mov dword [ebp - 0x1050], 0x366b5344
mov dword [ebp - 0x104c], 0x6e305249
mov dword [ebp - 0x1048], 0x39416843
mov dword [ebp - 0x1044], 0x764a684d
mov dword [ebp - 0x1040], 0x39734449
mov dword [ebp - 0x103c], 0x45554249
mov dword [ebp - 0x1038], 0x4141674e
mov word [ebp - 0x1034], 0x4f41
mov byte [ebp - 0x1032], 0x51
call fcn.004675e0
push 0
lea ecx, [ebp - 0x269d]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x271c]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa740
sub ecx, edx
je 0x4aa77d
jmp 0x4aa750
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa770
sub ecx, edx
cmp esi, ecx
jb 0x4aa750
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x271c]
call fcn.00467ae0
mov dword [ebp - 0x2684], 0x77554345
mov dword [ebp - 0x2680], 0x6b6b6a4d
mov dword [ebp - 0x267c], 0x2b595447
mov dword [ebp - 0x2678], 0x6c38694a
mov dword [ebp - 0x2674], 0x6b39324b
mov dword [ebp - 0x2670], 0x676b525a
mov dword [ebp - 0x266c], 0x6a456a4d
mov dword [ebp - 0x2668], 0x34387a4b
mov dword [ebp - 0x2664], 0x6d6b334c
mov dword [ebp - 0x2660], 0x6968694b
mov dword [ebp - 0x265c], 0x7863534e
mov dword [ebp - 0x2658], 0x7551534a
mov dword [ebp - 0x2654], 0x73427950
mov dword [ebp - 0x2650], 0x304d694a
mov dword [ebp - 0x264c], 0x6d595350
mov dword [ebp - 0x2648], 0x4a4d784b
mov dword [ebp - 0x2644], 0x5a63694c
mov dword [ebp - 0x2640], 0x44384459
mov dword [ebp - 0x263c], 0x7234515a
mov dword [ebp - 0x2638], 0x36747a4c
mov dword [ebp - 0x2634], 0x5a736a4c
mov dword [ebp - 0x2630], 0x6c6b6e49
mov dword [ebp - 0x262c], 0x35306842
mov dword [ebp - 0x2628], 0x31636a5a
mov dword [ebp - 0x2624], 0x6b344148
mov dword [ebp - 0x2620], 0x326f524c
mov dword [ebp - 0x261c], 0x5a514442
mov dword [ebp - 0x2618], 0x534d7949
mov dword [ebp - 0x2614], 0x72557a42
mov dword [ebp - 0x2610], 0x54516945
mov dword [ebp - 0x260c], 0x67563241
mov dword [ebp - 0x2608], 0x6c6b6e4e
mov dword [ebp - 0x2604], 0x31676848
mov dword [ebp - 0x2600], 0x5a34435a
mov dword [ebp - 0x25fc], 0x61346748
mov dword [ebp - 0x25f8], 0x75677746
mov dword [ebp - 0x25f4], 0x65387a4d
mov dword [ebp - 0x25f0], 0x7a384343
mov dword [ebp - 0x25ec], 0x6a63784a
mov dword [ebp - 0x25e8], 0x46674345
mov dword [ebp - 0x25e4], 0x6c315763
mov dword [ebp - 0x25e0], 0x72346749
mov dword [ebp - 0x25dc], 0x54517844
mov dword [ebp - 0x25d8], 0x6b777a41
mov dword [ebp - 0x25d4], 0x686f444e
mov dword [ebp - 0x25d0], 0x58415341
mov dword [ebp - 0x25cc], 0x2b4e6941
mov dword [ebp - 0x25c8], 0x76565359
mov dword [ebp - 0x25c4], 0x46774350
mov dword [ebp - 0x25c0], 0x68457944
mov dword [ebp - 0x25bc], 0x52634450
mov dword [ebp - 0x25b8], 0x4b6b6a41
mov dword [ebp - 0x25b4], 0x2f597947
mov dword [ebp - 0x25b0], 0x5a346e45
mov dword [ebp - 0x25ac], 0x4d637748
mov dword [ebp - 0x25a8], 0x4567684b
mov dword [ebp - 0x25a4], 0x5777434f
mov dword [ebp - 0x25a0], 0x4345474b
mov dword [ebp - 0x259c], 0x55735244
mov dword [ebp - 0x2598], 0x50383362
mov dword [ebp - 0x2594], 0x6b785343
mov dword [ebp - 0x2590], 0x3074545a
mov dword [ebp - 0x258c], 0x646f7763
mov dword [ebp - 0x2588], 0x4e6b6942
mov dword [ebp - 0x2584], 0x72557759
mov dword [ebp - 0x2580], 0x4c347950
mov dword [ebp - 0x257c], 0x3051434a
mov dword [ebp - 0x2578], 0x6a46324b
mov dword [ebp - 0x2574], 0x6c394241
mov dword [ebp - 0x2570], 0x4277414e
mov dword [ebp - 0x256c], 0x2f496744
mov dword [ebp - 0x2568], 0x49637a43
mov dword [ebp - 0x2564], 0x436b4242
mov dword [ebp - 0x2560], 0x65735359
mov dword [ebp - 0x255c], 0x2f646a42
mov dword [ebp - 0x2558], 0x66775349
mov dword [ebp - 0x2554], 0x6f736949
lea eax, [ebp - 0x248d]
mov dword [ebp - 0x2550], 0x43344350
push eax
lea eax, [ebp - 0x2684]
mov dword [ebp - 0x254c], 0x5a675165
push eax
lea ecx, [ebp - 0x28a4]
mov dword [ebp - 0x2548], 0x6877694c
mov dword [ebp - 0x2544], 0x4667584c
mov dword [ebp - 0x2540], 0x4d677950
mov dword [ebp - 0x253c], 0x32596d41
mov dword [ebp - 0x2538], 0x7463334f
mov dword [ebp - 0x2534], 0x2f734447
mov dword [ebp - 0x2530], 0x2f384244
mov dword [ebp - 0x252c], 0x2b4a4443
mov dword [ebp - 0x2528], 0x76385445
mov dword [ebp - 0x2524], 0x7a774448
mov dword [ebp - 0x2520], 0x426b5148
mov dword [ebp - 0x251c], 0x2f636942
mov dword [ebp - 0x2518], 0x776f425a
mov dword [ebp - 0x2514], 0x62595465
mov dword [ebp - 0x2510], 0x71494243
mov dword [ebp - 0x250c], 0x3941414a
mov dword [ebp - 0x2508], 0x7935784c
mov dword [ebp - 0x2504], 0x4c347747
mov dword [ebp - 0x2500], 0x30557748
mov dword [ebp - 0x24fc], 0x3655684f
mov dword [ebp - 0x24f8], 0x6e386946
mov dword [ebp - 0x24f4], 0x61347864
mov dword [ebp - 0x24f0], 0x4b6b674e
mov dword [ebp - 0x24ec], 0x3251534f
mov dword [ebp - 0x24e8], 0x72787941
mov dword [ebp - 0x24e4], 0x49517965
mov dword [ebp - 0x24e0], 0x48775849
mov dword [ebp - 0x24dc], 0x66415242
mov dword [ebp - 0x24d8], 0x6a64694e
mov dword [ebp - 0x24d4], 0x77415144
mov dword [ebp - 0x24d0], 0x574d534c
mov dword [ebp - 0x24cc], 0x6a564164
mov dword [ebp - 0x24c8], 0x49775249
mov dword [ebp - 0x24c4], 0x48595141
mov dword [ebp - 0x24c0], 0x6b6f4347
mov dword [ebp - 0x24bc], 0x37637846
mov dword [ebp - 0x24b8], 0x31514341
mov dword [ebp - 0x24b4], 0x374a6842
mov dword [ebp - 0x24b0], 0x6a635741
mov dword [ebp - 0x24ac], 0x7135784c
mov dword [ebp - 0x24a8], 0x5877774c
mov dword [ebp - 0x24a4], 0x37303250
mov dword [ebp - 0x24a0], 0x4649694f
mov dword [ebp - 0x249c], 0x4c636d4a
mov dword [ebp - 0x2498], 0x3338684f
mov dword [ebp - 0x2494], 0x41415147
mov word [ebp - 0x2490], 0x5541
mov byte [ebp - 0x248e], 0x63
call fcn.004675e0
push 0
lea ecx, [ebp - 0x268f]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2734]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
jmp 0x4aacf0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aacf0
sub ecx, edx
je 0x4aad2d
jmp 0x4aad00
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aad20
sub ecx, edx
cmp esi, ecx
jb 0x4aad00
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2734]
call fcn.00467ae0
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 9
push dword [ebp - 0x58]
push dword [ebp - 0x3c]
call eax
lea eax, [ebp - 0x9ce]
mov dword [ebp - 0xab0], 0x77554345
push eax
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xaac], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28b4]
mov dword [ebp - 0xaa8], 0x2b595447
mov dword [ebp - 0xaa4], 0x6c38694a
mov dword [ebp - 0xaa0], 0x6b39324b
mov dword [ebp - 0xa9c], 0x7867525a
mov dword [ebp - 0xa98], 0x34634449
mov dword [ebp - 0xa94], 0x7867444d
mov dword [ebp - 0xa90], 0x36304361
mov dword [ebp - 0xa8c], 0x7930324a
mov dword [ebp - 0xa88], 0x69417a4e
mov dword [ebp - 0xa84], 0x3049694f
mov dword [ebp - 0xa80], 0x364d584f
mov dword [ebp - 0xa7c], 0x3151544e
mov dword [ebp - 0xa78], 0x6e41794a
mov dword [ebp - 0xa74], 0x3935684e
mov dword [ebp - 0xa70], 0x4277694e
mov dword [ebp - 0xa6c], 0x52514264
mov dword [ebp - 0xa68], 0x68557848
mov dword [ebp - 0xa64], 0x31357742
mov dword [ebp - 0xa60], 0x62496a4e
mov dword [ebp - 0xa5c], 0x31686a45
mov dword [ebp - 0xa58], 0x41494766
mov dword [ebp - 0xa54], 0x2f555145
mov dword [ebp - 0xa50], 0x6d45694f
mov dword [ebp - 0xa4c], 0x49557749
mov dword [ebp - 0xa48], 0x37416749
mov dword [ebp - 0xa44], 0x43413245
mov dword [ebp - 0xa40], 0x38413249
mov dword [ebp - 0xa3c], 0x44634341
mov dword [ebp - 0xa38], 0x74517963
mov dword [ebp - 0xa34], 0x4b6b7742
mov dword [ebp - 0xa30], 0x30594366
mov dword [ebp - 0xa2c], 0x48775150
mov dword [ebp - 0xa28], 0x78524166
mov dword [ebp - 0xa24], 0x33674348
mov dword [ebp - 0xa20], 0x644d7a63
mov dword [ebp - 0xa1c], 0x504d544c
mov dword [ebp - 0xa18], 0x4e494245
mov dword [ebp - 0xa14], 0x4d49524d
mov dword [ebp - 0xa10], 0x6d6b6843
mov dword [ebp - 0xa0c], 0x35516741
mov dword [ebp - 0xa08], 0x63596d41
mov dword [ebp - 0xa04], 0x336c414b
mov dword [ebp - 0xa00], 0x38346842
mov dword [ebp - 0x9fc], 0x4d4d514e
mov dword [ebp - 0x9f8], 0x434d6a42
mov dword [ebp - 0x9f4], 0x7655574d
mov dword [ebp - 0x9f0], 0x3863444a
mov dword [ebp - 0x9ec], 0x77555148
mov dword [ebp - 0x9e8], 0x7a455766
mov dword [ebp - 0x9e4], 0x43514245
mov dword [ebp - 0x9e0], 0x46494347
mov dword [ebp - 0x9dc], 0x70494250
mov dword [ebp - 0x9d8], 0x35516743
mov dword [ebp - 0x9d4], 0x41414141
mov word [ebp - 0x9d0], 0x4165
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a3]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x274c]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aaff1
sub ecx, edx
je 0x4ab02d
lea esp, [esp]
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ab020
sub ecx, edx
cmp esi, ecx
jb 0x4ab000
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x274c]
call fcn.00467ae0
push 0
push 0
push dword [ebp - 0x48]
call ebx
mov edi, 0x24
jmp 0x4ac650
mov dword [ebp - 0x248c], 0x77554345
mov dword [ebp - 0x2488], 0x6b6b6a4d
mov dword [ebp - 0x2484], 0x2b595447
mov dword [ebp - 0x2480], 0x6c38694a
mov dword [ebp - 0x247c], 0x6b39324b
mov dword [ebp - 0x2478], 0x6b30515a
mov dword [ebp - 0x2474], 0x706b434b
mov dword [ebp - 0x2470], 0x42595850
mov dword [ebp - 0x246c], 0x6d41544b
mov dword [ebp - 0x2468], 0x6c4d794b
mov dword [ebp - 0x2464], 0x374d545a
mov dword [ebp - 0x2460], 0x79305749
mov dword [ebp - 0x245c], 0x3645794c
mov dword [ebp - 0x2458], 0x6a55534f
mov dword [ebp - 0x2454], 0x6d736a62
mov dword [ebp - 0x2450], 0x7867545a
mov dword [ebp - 0x244c], 0x6d556a4c
mov dword [ebp - 0x2448], 0x6d776762
mov dword [ebp - 0x2444], 0x6e705465
mov dword [ebp - 0x2440], 0x6a6b7a4c
mov dword [ebp - 0x243c], 0x35646a42
mov dword [ebp - 0x2438], 0x79747a61
mov dword [ebp - 0x2434], 0x70387a65
mov dword [ebp - 0x2430], 0x314a4342
mov dword [ebp - 0x242c], 0x2f634842
mov dword [ebp - 0x2428], 0x7968584c
mov dword [ebp - 0x2424], 0x7238434c
mov dword [ebp - 0x2420], 0x76684445
mov dword [ebp - 0x241c], 0x33384348
mov dword [ebp - 0x2418], 0x6b737863
mov dword [ebp - 0x2414], 0x41595350
mov dword [ebp - 0x2410], 0x5355775a
mov dword [ebp - 0x240c], 0x2f423248
mov dword [ebp - 0x2408], 0x79564359
mov dword [ebp - 0x2404], 0x6f776864
mov dword [ebp - 0x2400], 0x7067774e
mov dword [ebp - 0x23fc], 0x3970414f
mov dword [ebp - 0x23f8], 0x6846474b
mov dword [ebp - 0x23f4], 0x36496865
mov dword [ebp - 0x23f0], 0x36416d4b
mov dword [ebp - 0x23ec], 0x75417749
mov dword [ebp - 0x23e8], 0x53516e42
mov dword [ebp - 0x23e4], 0x47777847
mov dword [ebp - 0x23e0], 0x6e514341
mov dword [ebp - 0x23dc], 0x46775149
mov dword [ebp - 0x23d8], 0x58517746
mov dword [ebp - 0x23d4], 0x3431484c
mov dword [ebp - 0x23d0], 0x66347744
mov dword [ebp - 0x23cc], 0x6f775249
mov dword [ebp - 0x23c8], 0x6e346e47
mov dword [ebp - 0x23c4], 0x796b6a47
mov dword [ebp - 0x23c0], 0x4e637a49
mov dword [ebp - 0x23bc], 0x43634748
mov dword [ebp - 0x23b8], 0x4555435a
mov dword [ebp - 0x23b4], 0x785a5350
mov dword [ebp - 0x23b0], 0x48734263
mov dword [ebp - 0x23ac], 0x50457741
mov dword [ebp - 0x23a8], 0x6d51524b
mov dword [ebp - 0x23a4], 0x49557848
mov dword [ebp - 0x23a0], 0x586f784f
mov dword [ebp - 0x239c], 0x63594164
mov dword [ebp - 0x2398], 0x4b775347
mov dword [ebp - 0x2394], 0x714d434c
mov dword [ebp - 0x2390], 0x63514149
mov dword [ebp - 0x238c], 0x2f746965
mov dword [ebp - 0x2388], 0x42557764
mov dword [ebp - 0x2384], 0x3178414d
mov dword [ebp - 0x2380], 0x6555524e
mov dword [ebp - 0x237c], 0x44674750
mov dword [ebp - 0x2378], 0x64674849
mov dword [ebp - 0x2374], 0x6c59784c
mov dword [ebp - 0x2370], 0x49676847
mov dword [ebp - 0x236c], 0x31557866
mov dword [ebp - 0x2368], 0x3830775a
mov dword [ebp - 0x2364], 0x5a30514b
mov dword [ebp - 0x2360], 0x676f7964
mov dword [ebp - 0x235c], 0x63304445
mov dword [ebp - 0x2358], 0x7738444c
mov dword [ebp - 0x2354], 0x42556a65
mov dword [ebp - 0x2350], 0x4667794c
mov dword [ebp - 0x234c], 0x45516d46
lea eax, [ebp - 0x22ce]
mov dword [ebp - 0x2348], 0x5245534e
push eax
lea eax, [ebp - 0x248c]
mov dword [ebp - 0x2344], 0x64454750
push eax
lea ecx, [ebp - 0x2874]
mov dword [ebp - 0x2340], 0x79566959
mov dword [ebp - 0x233c], 0x38556742
mov dword [ebp - 0x2338], 0x33644364
mov dword [ebp - 0x2334], 0x6941514e
mov dword [ebp - 0x2330], 0x41515259
mov dword [ebp - 0x232c], 0x72304741
mov dword [ebp - 0x2328], 0x46634363
mov dword [ebp - 0x2324], 0x6c307850
mov dword [ebp - 0x2320], 0x7a386942
mov dword [ebp - 0x231c], 0x4c737a50
mov dword [ebp - 0x2318], 0x724d5843
mov dword [ebp - 0x2314], 0x656b5365
mov dword [ebp - 0x2310], 0x314d6e47
mov dword [ebp - 0x230c], 0x5030534f
mov dword [ebp - 0x2308], 0x6b56324e
mov dword [ebp - 0x2304], 0x4b497a44
mov dword [ebp - 0x2300], 0x496f4342
mov dword [ebp - 0x22fc], 0x6d304141
mov dword [ebp - 0x22f8], 0x53306849
mov dword [ebp - 0x22f4], 0x66495165
mov dword [ebp - 0x22f0], 0x75415441
mov dword [ebp - 0x22ec], 0x71677a66
mov dword [ebp - 0x22e8], 0x39343341
mov dword [ebp - 0x22e4], 0x76386946
mov dword [ebp - 0x22e0], 0x2b6b7747
mov dword [ebp - 0x22dc], 0x6e685166
mov dword [ebp - 0x22d8], 0x646b4149
mov dword [ebp - 0x22d4], 0x42414141
mov word [ebp - 0x22d0], 0x4147
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a5]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x26f8]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
jmp 0x4ab520
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ab520
sub ecx, edx
je 0x4ab55d
jmp 0x4ab530
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ab550
sub ecx, edx
cmp esi, ecx
jb 0x4ab530
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x26f8]
call fcn.00467ae0
mov edi, 0x23
jmp 0x4ac650
xor edi, edi
mov dword [ebp - 0x1a2c], 0x77554345
mov dword [ebp - 0x1a28], 0x6b6b6a4d
mov dword [ebp - 0x1a24], 0x2b595447
mov dword [ebp - 0x1a20], 0x6c38694a
mov dword [ebp - 0x1a1c], 0x6b39324b
mov dword [ebp - 0x1a18], 0x6b77525a
mov dword [ebp - 0x1a14], 0x6c45444b
mov dword [ebp - 0x1a10], 0x32467a4e
mov dword [ebp - 0x1a0c], 0x67596a4c
mov dword [ebp - 0x1a08], 0x716b6a59
mov dword [ebp - 0x1a04], 0x6e554849
mov dword [ebp - 0x1a00], 0x33386a4e
mov dword [ebp - 0x19fc], 0x70417a49
mov dword [ebp - 0x19f8], 0x70494463
mov dword [ebp - 0x19f4], 0x39776a62
mov dword [ebp - 0x19f0], 0x786b444a
mov dword [ebp - 0x19ec], 0x35384464
mov dword [ebp - 0x19e8], 0x58343247
mov dword [ebp - 0x19e4], 0x6c35424f
mov dword [ebp - 0x19e0], 0x4438424e
mov dword [ebp - 0x19dc], 0x3663684a
mov dword [ebp - 0x19d8], 0x4f386849
mov dword [ebp - 0x19d4], 0x69777847
mov dword [ebp - 0x19d0], 0x31417859
mov dword [ebp - 0x19cc], 0x37347a46
mov dword [ebp - 0x19c8], 0x71554166
mov dword [ebp - 0x19c4], 0x364d774d
mov dword [ebp - 0x19c0], 0x62495241
mov dword [ebp - 0x19bc], 0x45635249
mov dword [ebp - 0x19b8], 0x316f674b
mov dword [ebp - 0x19b4], 0x33595763
mov dword [ebp - 0x19b0], 0x7459434a
mov dword [ebp - 0x19ac], 0x3164534f
mov dword [ebp - 0x19a8], 0x7a516746
mov dword [ebp - 0x19a4], 0x73554446
mov dword [ebp - 0x19a0], 0x5259324b
mov dword [ebp - 0x199c], 0x544d6844
mov dword [ebp - 0x1998], 0x584d5745
mov dword [ebp - 0x1994], 0x36346a49
mov dword [ebp - 0x1990], 0x6b34694a
mov dword [ebp - 0x198c], 0x6c5a3250
mov dword [ebp - 0x1988], 0x326c4144
mov dword [ebp - 0x1984], 0x38647941
mov dword [ebp - 0x1980], 0x7659485a
mov dword [ebp - 0x197c], 0x4d344244
mov dword [ebp - 0x1978], 0x45346744
mov dword [ebp - 0x1974], 0x345a4445
mov dword [ebp - 0x1970], 0x2b775443
mov dword [ebp - 0x196c], 0x6f344742
mov dword [ebp - 0x1968], 0x456f5842
mov dword [ebp - 0x1964], 0x3531514d
mov dword [ebp - 0x1960], 0x6f6f414f
mov dword [ebp - 0x195c], 0x414d5350
mov dword [ebp - 0x1958], 0x7945584e
mov dword [ebp - 0x1954], 0x4c677a4e
mov dword [ebp - 0x1950], 0x4a346744
mov dword [ebp - 0x194c], 0x6c777946
mov dword [ebp - 0x1948], 0x54455741
mov dword [ebp - 0x1944], 0x71785242
mov dword [ebp - 0x1940], 0x62736745
mov dword [ebp - 0x193c], 0x46595246
mov dword [ebp - 0x1938], 0x67636a4f
mov dword [ebp - 0x1934], 0x3570424b
mov dword [ebp - 0x1930], 0x79394446
mov dword [ebp - 0x192c], 0x41775142
mov dword [ebp - 0x1928], 0x6f637941
mov dword [ebp - 0x1924], 0x34457963
mov dword [ebp - 0x1920], 0x76394241
mov dword [ebp - 0x191c], 0x426b515a
mov dword [ebp - 0x1918], 0x75385848
mov dword [ebp - 0x1914], 0x6341524d
mov dword [ebp - 0x1910], 0x79304849
mov dword [ebp - 0x190c], 0x4963774d
mov dword [ebp - 0x1908], 0x2f674148
mov dword [ebp - 0x1904], 0x6e777765
mov dword [ebp - 0x1900], 0x32425146
mov dword [ebp - 0x18fc], 0x2f314342
mov dword [ebp - 0x18f8], 0x35344144
mov dword [ebp - 0x18f4], 0x47346a4c
mov dword [ebp - 0x18f0], 0x77316e63
lea eax, [ebp - 0x18ce]
mov dword [ebp - 0x18ec], 0x69425741
push eax
lea eax, [ebp - 0x1a2c]
mov dword [ebp - 0x18e8], 0x6f387850
push eax
lea ecx, [ebp - 0x28c4]
mov dword [ebp - 0x18e4], 0x6e635442
mov dword [ebp - 0x18e0], 0x714d5341
mov dword [ebp - 0x18dc], 0x50737844
mov dword [ebp - 0x18d8], 0x526f4150
mov dword [ebp - 0x18d4], 0x41414141
mov word [ebp - 0x18d0], 0x6730
call fcn.004675e0
push edi
lea ecx, [ebp - 0x2691]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2764]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov ebx, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ab953
sub ecx, edx
je 0x4ab98d
mov edi, edi
mov al, byte [esi + ebx]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, ebx
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ab980
sub ecx, edx
cmp esi, ecx
jb 0x4ab960
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2764]
call fcn.00467ae0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0x48]
lea esp, [esp]
push 0x1f4
call esi
mov eax, edi
inc edi
cmp eax, 0x258
jae 0x4abbbb
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4abbbb
cmp dword [ebp - 0x1c], 4
jne 0x4ab9b0
lea eax, [ebp - 0x59]
mov dword [ebp - 0xd4], 0x77554345
push eax
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd0], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28d4]
mov dword [ebp - 0xcc], 0x2b595447
mov dword [ebp - 0xc8], 0x6c38694a
mov dword [ebp - 0xc4], 0x6b39324b
mov dword [ebp - 0xc0], 0x7330515a
mov dword [ebp - 0xbc], 0x2f77794c
mov dword [ebp - 0xb8], 0x794d544d
mov dword [ebp - 0xb4], 0x69774361
mov dword [ebp - 0xb0], 0x3277694a
mov dword [ebp - 0xac], 0x6e554849
mov dword [ebp - 0xa8], 0x6934694a
mov dword [ebp - 0xa4], 0x2f41794c
mov dword [ebp - 0xa0], 0x714d6a4e
mov dword [ebp - 0x9c], 0x67596a49
mov dword [ebp - 0x98], 0x6851774e
mov dword [ebp - 0x94], 0x6e416945
mov dword [ebp - 0x90], 0x6d466d42
mov dword [ebp - 0x8c], 0x6c38694b
mov dword [ebp - 0x88], 0x6141794a
mov dword [ebp - 0x84], 0x4e384441
mov dword [ebp - 0x80], 0x6a345447
mov dword [ebp - 0x7c], 0x5a51414c
mov dword [ebp - 0x78], 0x66305341
mov dword [ebp - 0x74], 0x6641524a
mov dword [ebp - 0x70], 0x456f7841
mov dword [ebp - 0x6c], 0x30745364
mov dword [ebp - 0x68], 0x53494244
mov dword [ebp - 0x64], 0x5a777a4f
mov dword [ebp - 0x60], 0x4141414b
mov word [ebp - 0x5c], 0x4341
mov byte [ebp - 0x5a], 0x77
call fcn.004675e0
push 0
lea ecx, [ebp - 0x269f]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x277c]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4abb60
sub ecx, edx
je 0x4abb9d
jmp 0x4abb70
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4abb90
sub ecx, edx
cmp esi, ecx
jb 0x4abb70
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x277c]
call fcn.00467ae0
mov edi, dword [ebp - 0x26b0]
jmp 0x4ac656
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x274], 0x77554345
push eax
lea eax, [ebp - 0x274]
mov dword [ebp - 0x270], 0x6b6b6a4d
push eax
lea ecx, [ebp - 0x28e4]
mov dword [ebp - 0x26c], 0x2b595447
mov dword [ebp - 0x268], 0x6c38694a
mov dword [ebp - 0x264], 0x6b39324b
mov dword [ebp - 0x260], 0x6767525a
mov dword [ebp - 0x25c], 0x6c4d7a4d
mov dword [ebp - 0x258], 0x324e6a4f
mov dword [ebp - 0x254], 0x6b776a4a
mov dword [ebp - 0x250], 0x69397a4a
mov dword [ebp - 0x24c], 0x3145694e
mov dword [ebp - 0x248], 0x6b6b5449
mov dword [ebp - 0x244], 0x716f694c
mov dword [ebp - 0x240], 0x7759334e
mov dword [ebp - 0x23c], 0x3667794a
mov dword [ebp - 0x238], 0x4e514149
mov dword [ebp - 0x234], 0x34786949
mov dword [ebp - 0x230], 0x66416a4f
mov dword [ebp - 0x22c], 0x5773525a
mov dword [ebp - 0x228], 0x5634524a
mov dword [ebp - 0x224], 0x2f774246
mov dword [ebp - 0x220], 0x6b6f4245
mov dword [ebp - 0x21c], 0x3774324a
mov dword [ebp - 0x218], 0x65635843
mov dword [ebp - 0x214], 0x4e346746
mov dword [ebp - 0x210], 0x77354346
mov dword [ebp - 0x20c], 0x6e456a41
mov dword [ebp - 0x208], 0x7841684f
mov dword [ebp - 0x204], 0x72455166
mov dword [ebp - 0x200], 0x5877434e
mov dword [ebp - 0x1fc], 0x63556d44
mov dword [ebp - 0x1f8], 0x48675143
mov dword [ebp - 0x1f4], 0x5a345266
mov dword [ebp - 0x1f0], 0x6641694a
mov dword [ebp - 0x1ec], 0x41775848
mov dword [ebp - 0x1e8], 0x44424141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2693]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x2794]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4abd90
sub ecx, edx
je 0x4abdcd
jmp 0x4abda0
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4abdc0
sub ecx, edx
cmp esi, ecx
jb 0x4abda0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2794]
call fcn.00467ae0
mov dword [ebp - 0x2138], 0x77554345
mov dword [ebp - 0x2134], 0x6b6b6a4d
mov dword [ebp - 0x2130], 0x2b595447
mov dword [ebp - 0x212c], 0x6c38694a
mov dword [ebp - 0x2128], 0x6b39324b
mov dword [ebp - 0x2124], 0x676b525a
mov dword [ebp - 0x2120], 0x6a456a4d
mov dword [ebp - 0x211c], 0x34387a4b
mov dword [ebp - 0x2118], 0x696b334c
mov dword [ebp - 0x2114], 0x3067434d
mov dword [ebp - 0x2110], 0x686f444c
mov dword [ebp - 0x210c], 0x33304749
mov dword [ebp - 0x2108], 0x2f45794c
mov dword [ebp - 0x2104], 0x6f6b534f
mov dword [ebp - 0x2100], 0x37427766
mov dword [ebp - 0x20fc], 0x54676a4a
mov dword [ebp - 0x20f8], 0x494d6e46
mov dword [ebp - 0x20f4], 0x6a385446
mov dword [ebp - 0x20f0], 0x6e784765
mov dword [ebp - 0x20ec], 0x73676743
mov dword [ebp - 0x20e8], 0x3759414d
mov dword [ebp - 0x20e4], 0x6b306861
mov dword [ebp - 0x20e0], 0x6a4d414b
mov dword [ebp - 0x20dc], 0x72425146
mov dword [ebp - 0x20d8], 0x36643350
mov dword [ebp - 0x20d4], 0x5438444e
mov dword [ebp - 0x20d0], 0x43305245
mov dword [ebp - 0x20cc], 0x56386a4d
mov dword [ebp - 0x20c8], 0x6c685463
mov dword [ebp - 0x20c4], 0x376f6744
mov dword [ebp - 0x20c0], 0x2b4d6d63
mov dword [ebp - 0x20bc], 0x594d6742
mov dword [ebp - 0x20b8], 0x6f6f794d
mov dword [ebp - 0x20b4], 0x5159524d
mov dword [ebp - 0x20b0], 0x75557a64
mov dword [ebp - 0x20ac], 0x7467784e
mov dword [ebp - 0x20a8], 0x414d6841
mov dword [ebp - 0x20a4], 0x45495241
mov dword [ebp - 0x20a0], 0x51386a4f
mov dword [ebp - 0x209c], 0x6c49684e
mov dword [ebp - 0x2098], 0x324d514c
mov dword [ebp - 0x2094], 0x73396a4e
mov dword [ebp - 0x2090], 0x4f455266
mov dword [ebp - 0x208c], 0x6355544b
mov dword [ebp - 0x2088], 0x3677524f
mov dword [ebp - 0x2084], 0x4e6f5863
mov dword [ebp - 0x2080], 0x2f45684c
mov dword [ebp - 0x207c], 0x5141784d
mov dword [ebp - 0x2078], 0x64384245
mov dword [ebp - 0x2074], 0x4e63694b
mov dword [ebp - 0x2070], 0x41385145
mov dword [ebp - 0x206c], 0x49495342
mov dword [ebp - 0x2068], 0x69515449
mov dword [ebp - 0x2064], 0x714d5359
mov dword [ebp - 0x2060], 0x6d67414f
mov dword [ebp - 0x205c], 0x7577774a
mov dword [ebp - 0x2058], 0x7259514b
mov dword [ebp - 0x2054], 0x6c34574b
mov dword [ebp - 0x2050], 0x3973694f
mov dword [ebp - 0x204c], 0x76524163
mov dword [ebp - 0x2048], 0x6e784761
mov dword [ebp - 0x2044], 0x32675243
mov dword [ebp - 0x2040], 0x63675450
mov dword [ebp - 0x203c], 0x306c514e
mov dword [ebp - 0x2038], 0x41555341
mov dword [ebp - 0x2034], 0x4377794e
mov dword [ebp - 0x2030], 0x63596a4c
mov dword [ebp - 0x202c], 0x55557861
mov dword [ebp - 0x2028], 0x6e4e444f
mov dword [ebp - 0x2024], 0x62417764
mov dword [ebp - 0x2020], 0x5a30694e
mov dword [ebp - 0x201c], 0x54676749
mov dword [ebp - 0x2018], 0x346b4345
mov dword [ebp - 0x2014], 0x56346e59
mov dword [ebp - 0x2010], 0x4c595865
mov dword [ebp - 0x200c], 0x79315244
mov dword [ebp - 0x2008], 0x756f424d
lea eax, [ebp - 0x1f80]
mov dword [ebp - 0x2004], 0x3764794d
push eax
lea eax, [ebp - 0x2138]
mov dword [ebp - 0x2000], 0x37736a49
push eax
lea ecx, [ebp - 0x28f4]
mov dword [ebp - 0x1ffc], 0x79495364
mov dword [ebp - 0x1ff8], 0x58777a44
mov dword [ebp - 0x1ff4], 0x794e534a
mov dword [ebp - 0x1ff0], 0x364a5246
mov dword [ebp - 0x1fec], 0x48387942
mov dword [ebp - 0x1fe8], 0x694d4148
mov dword [ebp - 0x1fe4], 0x4e457843
mov dword [ebp - 0x1fe0], 0x7638534e
mov dword [ebp - 0x1fdc], 0x6c4e6a45
mov dword [ebp - 0x1fd8], 0x4467534c
mov dword [ebp - 0x1fd4], 0x4f515148
mov dword [ebp - 0x1fd0], 0x36495348
mov dword [ebp - 0x1fcc], 0x67385342
mov dword [ebp - 0x1fc8], 0x6d63794b
mov dword [ebp - 0x1fc4], 0x33776a41
mov dword [ebp - 0x1fc0], 0x37594849
mov dword [ebp - 0x1fbc], 0x69735844
mov dword [ebp - 0x1fb8], 0x4a49334b
mov dword [ebp - 0x1fb4], 0x6c595745
mov dword [ebp - 0x1fb0], 0x624d6943
mov dword [ebp - 0x1fac], 0x4641674e
mov dword [ebp - 0x1fa8], 0x526b4245
mov dword [ebp - 0x1fa4], 0x76774444
mov dword [ebp - 0x1fa0], 0x6d6b6844
mov dword [ebp - 0x1f9c], 0x6e635346
mov dword [ebp - 0x1f98], 0x2b59674e
mov dword [ebp - 0x1f94], 0x67305166
mov dword [ebp - 0x1f90], 0x32675746
mov dword [ebp - 0x1f8c], 0x36677861
mov dword [ebp - 0x1f88], 0x41595166
mov dword [ebp - 0x1f84], 0x63454141
call fcn.004675e0
push 0
lea ecx, [ebp - 0x26a4]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27ac]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ac295
sub ecx, edx
je 0x4ac2cd
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ac2c0
sub ecx, edx
cmp esi, ecx
jb 0x4ac2a0
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27ac]
call fcn.00467ae0
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 9
push dword [ebp - 0x58]
push dword [ebp - 0x3c]
call eax
lea eax, [ebp - 0xbbd]
mov dword [ebp - 0xcc4], 0x77554345
push eax
lea eax, [ebp - 0xcc4]
mov dword [ebp - 0xcc0], 0x6b6b6a4d
mov dword [ebp - 0xcbc], 0x2b595447
lea ecx, [ebp - 0x2904]
mov dword [ebp - 0xcb8], 0x6c38694a
mov dword [ebp - 0xcb4], 0x6b39324b
mov dword [ebp - 0xcb0], 0x7867525a
mov dword [ebp - 0xcac], 0x34634449
mov dword [ebp - 0xca8], 0x7867444d
mov dword [ebp - 0xca4], 0x676b4361
mov dword [ebp - 0xca0], 0x72737a4a
mov dword [ebp - 0xc9c], 0x6e41694b
mov dword [ebp - 0xc98], 0x6b737a63
mov dword [ebp - 0xc94], 0x6c41434f
mov dword [ebp - 0xc90], 0x56677950
mov dword [ebp - 0xc8c], 0x61555350
mov dword [ebp - 0xc88], 0x52344844
mov dword [ebp - 0xc84], 0x4e516741
mov dword [ebp - 0xc80], 0x336b4243
mov dword [ebp - 0xc7c], 0x68395741
mov dword [ebp - 0xc78], 0x41556746
mov dword [ebp - 0xc74], 0x51386741
mov dword [ebp - 0xc70], 0x6d6b7a4a
mov dword [ebp - 0xc6c], 0x4c387a43
mov dword [ebp - 0xc68], 0x334a5841
mov dword [ebp - 0xc64], 0x66347a50
mov dword [ebp - 0xc60], 0x53304242
mov dword [ebp - 0xc5c], 0x41634144
mov dword [ebp - 0xc58], 0x69464346
mov dword [ebp - 0xc54], 0x6c524463
mov dword [ebp - 0xc50], 0x32456764
mov dword [ebp - 0xc4c], 0x39386744
mov dword [ebp - 0xc48], 0x47737850
mov dword [ebp - 0xc44], 0x6f347849
mov dword [ebp - 0xc40], 0x3845674f
mov dword [ebp - 0xc3c], 0x4249574a
mov dword [ebp - 0xc38], 0x7441414d
mov dword [ebp - 0xc34], 0x7263434e
mov dword [ebp - 0xc30], 0x75565161
mov dword [ebp - 0xc2c], 0x44384465
mov dword [ebp - 0xc28], 0x5555794e
mov dword [ebp - 0xc24], 0x6d4e6942
mov dword [ebp - 0xc20], 0x6c636746
mov dword [ebp - 0xc1c], 0x6c677845
mov dword [ebp - 0xc18], 0x52385443
mov dword [ebp - 0xc14], 0x6d73684f
mov dword [ebp - 0xc10], 0x4e497849
mov dword [ebp - 0xc0c], 0x48384443
mov dword [ebp - 0xc08], 0x4a634344
mov dword [ebp - 0xc04], 0x344d6866
mov dword [ebp - 0xc00], 0x364a7762
mov dword [ebp - 0xbfc], 0x6d707850
mov dword [ebp - 0xbf8], 0x56774150
mov dword [ebp - 0xbf4], 0x6d415741
mov dword [ebp - 0xbf0], 0x6734694d
mov dword [ebp - 0xbec], 0x594d534f
mov dword [ebp - 0xbe8], 0x474d334c
mov dword [ebp - 0xbe4], 0x4a384443
mov dword [ebp - 0xbe0], 0x39344347
mov dword [ebp - 0xbdc], 0x6773424f
mov dword [ebp - 0xbd8], 0x45386764
mov dword [ebp - 0xbd4], 0x6e636844
mov dword [ebp - 0xbd0], 0x4677444a
mov dword [ebp - 0xbcc], 0x56415744
mov dword [ebp - 0xbc8], 0x6f30795a
mov dword [ebp - 0xbc4], 0x41417750
mov word [ebp - 0xbc0], 0x4a41
mov byte [ebp - 0xbbe], 0x67
push eax
call fcn.004675e0
push 0
lea ecx, [ebp - 0x2695]
mov esi, eax
call fcn.00467470
sub esp, 0xc
mov ecx, esp
push eax
push dword [esi + 4]
push dword [esi]
call fcn.004676d0
lea eax, [ebp - 0x27c4]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, eax
call fcn.0046bf20
push 0xc
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0046b880
lea ecx, [ebp - 0x34]
call fcn.00467710
mov ecx, edi
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ac5f2
sub ecx, edx
je 0x4ac62d
lea ecx, [ecx]
mov al, byte [esi + edi]
lea ecx, [ebp - 0x34]
xor al, 0x8b
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x25]
push eax
call fcn.0046daf0
mov ecx, edi
inc esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ac620
sub ecx, edx
cmp esi, ecx
jb 0x4ac600
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27c4]
call fcn.00467ae0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, 0x25
mov dword [ebp - 0x26b0], edi
push dword [ebp - 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x54]
call esi
lea ecx, [ebp - 0x50]
call fcn.004c8380
test eax, eax
je 0x4ac681
lea ecx, [ebp - 0x50]
call fcn.004b8310
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jne 0x4ac840
lea ecx, [ebp - 0x50]
call fcn.004b5930
lea ecx, [ebp - 0x40]
call fcn.004b5930
lea ecx, [ebp - 0x44]
call fcn.004b5930
lea ecx, [ebp - 0x4c]
call fcn.004679f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
mov ecx, eax
call fcn.0046b820
push 0x80004005
call fcn.00468960
push 0x80070057
call fcn.00468960
mov ecx, eax
call fcn.0046b820
push eax
call fcn.0053c1e0
add esp, 4
mov dword [ebp - 0x26d0], 0
mov dword [ebp - 0x26cc], 0
mov dword [ebp - 0x26c8], 0
push 0x59198c
lea eax, [ebp - 0x26e0]
mov dword [ebp - 0x26dc], 5
push eax
mov dword [ebp - 0x26d8], 0x1a
mov dword [ebp - 0x26d4], 0
mov dword [ebp - 0x26e0], 0x58284c
call fcn.0053d3af
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x283c]
call fcn.00467ae0
push 0
push 6
push 5
lea ecx, [ebp - 0x293c]
call fcn.004b2370
push 0x59198c
lea eax, [ebp - 0x293c]
push eax
call fcn.0053d3af
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27a0]
call fcn.00467ae0
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0x1b
push 5
lea ecx, [ebp - 0x2954]
call fcn.004b2370
push 0x59198c
lea eax, [ebp - 0x2954]
push eax
call fcn.0053d3af
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x27dc]
call fcn.00467ae0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x54]
call esi
push 0
push 0x1c
push 5
lea ecx, [ebp - 0x296c]
call fcn.004b2370
push 0x59198c
lea eax, [ebp - 0x296c]
push eax
call fcn.0053d3af
lea ecx, [ebp - 0x34]
call fcn.00467b10
lea ecx, [ebp - 0x2800]
call fcn.00467ae0
push dword [ebp - 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x54]
call esi
push 0
push 0x1d
push 5
lea ecx, [ebp - 0x2984]
call fcn.004b2370
push 0x59198c
lea eax, [ebp - 0x2984]
push eax
call fcn.0053d3af
lea eax, [ebp - 0x26b8]
push eax
lea ecx, [ebp - 0x2864]
call fcn.004b2340
push 0x59198c
lea eax, [ebp - 0x2864]
push eax
call fcn.0053d3af
int3