Function at 0x4b54b0
Capabilities:
Check http status code
Get file size
Inspect section memory permissions
Parse pe header
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x167c]
mov eax, 0x167c
call fcn.005e00d0
push 0xfffffffffffffffe
push 0x671cb8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1678], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x1684]
mov dword [ebp - 0x15c], edi
mov ecx, dword [ebp + 0x1688]
mov edx, dword [ebp + 0x1690]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x1694]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x169c]
mov dword [ebp - 0x34], eax
xor esi, esi
mov dword [ebp - 0x24], esi
wait
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x8c], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x4c], esi
mov byte [ebp + 0x1658], 0
xor eax, eax
mov dword [ebp + 0x1659], eax
mov dword [ebp + 0x165d], eax
mov dword [ebp + 0x1661], eax
mov word [ebp + 0x1665], ax
mov byte [ebp + 0x1667], al
mov byte [ebp + 0x1648], al
mov dword [ebp + 0x1649], eax
mov dword [ebp + 0x164d], eax
mov dword [ebp + 0x1651], eax
mov word [ebp + 0x1655], ax
mov byte [ebp + 0x1657], al
mov byte [ebp + 0x1668], al
mov dword [ebp + 0x1669], eax
mov dword [ebp + 0x166d], eax
mov dword [ebp + 0x1671], eax
mov word [ebp + 0x1675], ax
mov byte [ebp + 0x1677], al
mov byte [ebp + 0x1638], al
mov dword [ebp + 0x1639], eax
mov dword [ebp + 0x163d], eax
mov dword [ebp + 0x1641], eax
mov word [ebp + 0x1645], ax
mov byte [ebp + 0x1647], al
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x64], esi
cmp edx, esi
je 0x4b5616
mov dword [edx], esi
cmp ecx, 1
jne 0x4b5623
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x4b562c
mov dword [eax], esi
cmp edi, esi
je 0x4b5673
cmp byte [edi], 0
je 0x4b5673
push 0x2e
push edi
call fcn.005e0a00
add esp, 8
mov esi, eax
test esi, esi
je 0x4b5671
push 0x641470
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4b566a
push str..xlt
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b5671
mov dword [ebp - 0x58], 1
xor esi, esi
push ebx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x4b56e0
push 1
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x114], eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x8c], eax
cmp eax, esi
je 0x4b575f
lea esi, [eax + 0x401]
push esi
call fcn.005e20e4
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4b575f
push esi
push 0
push edi
call fcn.005dfd60
add esp, 0xc
push 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
push edi
push ebx
jmp 0x4b5745
push esi
push 0x80
push 3
push esi
push 1
push connect
push edi
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x4b575f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x8c], ebx
cmp ebx, esi
je 0x4b575f
lea esi, [ebx + 0x401]
push esi
call fcn.005e20e4
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4b575f
push esi
push 0
push edi
call fcn.005dfd60
add esp, 0xc
push 0
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b575f
push edi
call fcn.005e0865
mov dword [ebp - 0x20], 0
add esp, 4
mov eax, dword [ebp - 0x38]
cmp eax, 0x80
jbe 0x4b8bfe
cmp dword [ebp - 0x20], 0
je 0x4b8bfe
mov ecx, dword [ebp - 0x20]
mov ebx, ecx
mov edi, eax
mov esi, 1
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x150], ebx
mov al, byte [ebx]
test al, al
je 0x4b57ab
cmp al, 0x20
je 0x4b57a5
cmp al, 0xa
je 0x4b57a5
cmp al, 0xd
je 0x4b57a5
cmp al, 9
jne 0x4b57ab
add ebx, esi
sub edi, esi
jmp 0x4b5783
cmp byte [ecx], 0
je 0x4b57f5
push 4
push 0x6402c4
mov edx, dword [ebp - 0x20]
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b57cf
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
mov ecx, dword [ebp - 0x20]
cmp byte [ecx], 0
je 0x4b57f5
push 4
push str.MSCF
mov eax, ecx
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b57f5
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
push 2
push 0x634a04
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004dd670
add esp, 0xc
mov edx, dword [ebp - 0x20]
test eax, eax
jne 0x4b5823
cmp byte [edx + 2], 0xbc
jne 0x4b5823
cmp byte [edx + 3], 0xaf
jne 0x4b5823
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
cmp byte [edx], 0xfd
jne 0x4b5854
push 4
push str.7zXZ
mov edx, dword [ebp - 0x20]
inc edx
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b5851
mov eax, dword [ebp - 0x20]
cmp byte [eax + 5], 0
jne 0x4b5851
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
mov edx, dword [ebp - 0x20]
lea eax, [edx + 7]
cmp byte [eax], 0
je 0x4b587b
push 7
push str.ACE
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b5878
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
mov edx, dword [ebp - 0x20]
mov cl, byte [edx]
cmp cl, 0x1f
jne 0x4b5890
cmp byte [edx + 1], 0x8b
jne 0x4b5890
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
cmp byte [edx + 2], 0x2d
jne 0x4b58cf
cmp byte [edx + 6], 0x2d
jne 0x4b58cf
mov al, byte [edx + 3]
cmp al, 0x6c
jne 0x4b58a9
cmp byte [edx + 4], 0x68
je 0x4b58c7
cmp al, 0x70
jne 0x4b58bd
cmp byte [edx + 4], 0x63
je 0x4b58c7
cmp al, al
jne 0x4b58bd
cmp byte [edx + 4], 0x6d
je 0x4b58c7
cmp al, 0x6c
jne 0x4b58cf
cmp byte [edx + 4], 0x7a
jne 0x4b58cf
mov dword [ebp - 0x4c], esi
jmp 0x4b737f
test cl, cl
je 0x4b695a
push 2
push 0x63eddc
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b695a
mov edx, dword [ebp - 0x20]
cmp byte [edx + 2], 3
jne 0x4b695a
mov eax, edx
cmp byte [eax + 3], 4
jne 0x4b695a
xor esi, esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0xb0], esi
cmp dword [ebp + 0x1698], esi
je 0x4b594e
lea ecx, [ebp - 0xb0]
push ecx
push esi
push esi
lea edx, [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x38]
dec eax
push eax
push esi
push str.media_image1.eps
push str.embeddings_oleobject
push str.word_vbaProject.bin
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004ab880
mov ebx, dword [ebp - 0x58]
jmp 0x4b59a9
mov ebx, dword [ebp - 0x58]
cmp ebx, esi
je 0x4b597e
lea edx, [ebp - 0xb0]
push edx
push 1
push esi
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x38]
dec ecx
push ecx
push esi
push str.media_image1.eps
push str.embeddings_oleobject1.bin
push str.xl_vbaProject.bin
mov edx, dword [ebp - 0x20]
push edx
jmp 0x4b59a4
lea eax, [ebp - 0xb0]
push eax
push esi
push esi
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x38]
dec edx
push edx
push esi
push str.media_image1.eps
push str.embeddings_oleobject1.bin
push str.word_vbaProject.bin
mov eax, dword [ebp - 0x20]
push eax
call fcn.004ab880
add esp, 0x28
cmp eax, 0xffffffff
je 0x4b63d5
mov edi, dword [ebp - 0x7c]
cmp edi, 2
jb 0x4b648d
cmp dword [ebp + 0x1698], esi
je 0x4b59d0
mov dword [ebp - 0x24], 1
mov ebx, dword [ebp - 0x1c]
cmp ebx, esi
je 0x4b63d8
mov byte [ebp + 0x1228], 0
push 0x207
xor ebx, ebx
push ebx
lea ecx, [ebp + 0x1229]
push ecx
call fcn.005dfd60
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xe8], ebx
mov byte [ebp + 0xc10], bl
push 0x207
push ebx
lea edx, [ebp + 0xc11]
push edx
call fcn.005dfd60
mov dword [ebp - 0xa0], ebx
mov esi, dword [ebp - 0x54]
push esi
call fcn.004d90d0
add esp, 0x1c
push ebx
push ebx
push ebx
test eax, eax
je 0x4b5a64
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xa0]
lea ecx, [ebp + 0xc10]
lea edx, [ebp + 0x1228]
push eax
push ecx
push edx
cmp edi, 4
jne 0x4b5a5c
push str.media_image1.eps
push esi
jmp 0x4b5ab1
push str.embeddings_oleobject1.bin
push esi
jmp 0x4b5ab1
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, 4
jne 0x4b5a93
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp + 0xc10]
push edx
lea eax, [ebp + 0x1228]
push eax
push str.media_image1.eps
mov ecx, dword [ebp - 0x30]
push ecx
jmp 0x4b5ab1
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp + 0xc10]
push eax
lea ecx, [ebp + 0x1228]
push ecx
push str.embeddings_oleobject1.bin
mov edx, dword [ebp - 0x30]
push edx
push 0
push 0
call fcn.004ab410
add esp, 0x1c
cmp byte [ebp + 0xc10], bl
je 0x4b5bb6
push 0x2f
lea eax, [ebp + 0xc10]
push eax
call fcn.005e0a00
add esp, 8
mov esi, eax
test esi, esi
je 0x4b5bc7
mov byte [esi], bl
push 0x2f
lea ecx, [ebp + 0xc10]
push ecx
call fcn.005e0a00
add esp, 8
mov edi, eax
mov byte [esi], 0x2f
test edi, edi
je 0x4b5b4b
inc edi
push 0xa
push str.EmBeDdings
push edi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
jne 0x4b5b4b
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0xa
push edi
call fcn.004abf90
add esp, 0x10
cmp dword [ebp - 0x2c], 1
jbe 0x4b5b4b
cmp dword [ebp - 0x28], 1
jbe 0x4b5b4b
mov ebx, 1
mov dword [ebp - 0xe8], ebx
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004aaf70
add esp, 4
inc esi
push str.OlEObJecT1.bin
push esi
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x4b5bc7
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2c]
push eax
push 3
push esi
call fcn.004abf90
add esp, 0x10
mov edi, 1
cmp dword [ebp - 0x2c], edi
jbe 0x4b5b80
cmp dword [ebp - 0x28], edi
ja 0x4b5ba0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2c]
push eax
push 6
add esi, 3
push esi
call fcn.004abf90
add esp, 0x10
cmp dword [ebp - 0x2c], edi
jbe 0x4b5bc7
cmp dword [ebp - 0x28], edi
jbe 0x4b5bc7
mov ebx, edi
mov dword [ebp - 0xe8], ebx
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004aaf70
add esp, 4
jmp 0x4b5bc7
cmp dword [ebp - 0xa0], ebx
je 0x4b5bc7
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0x3e5
cmp byte [ebp + 0x1228], 0
je 0x4b63d3
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp + 0x1228]
push ecx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x4b63d3
cmp ebx, edi
jne 0x4b63c4
lea eax, [ebp + 0x1228]
cmp dword [ebp - 0x7c], 4
jne 0x4b5c86
mov dword [ebp - 0x9c], edi
lea edx, [ebp - 0x9c]
push edx
push eax
call fcn.004f1610
mov ecx, dword [ebp - 0x9c]
cmp ecx, edi
je 0x4b63c4
cmp eax, 0x80
jbe 0x4b5c78
xor edx, edx
mov bl, 0x35
mov dword [ebp - 0x154], edx
lea esi, [eax - 9]
cmp edx, esi
jae 0x4b5c78
cmp byte [edx + ecx], 0x34
jne 0x4b5c83
cmp byte [edx + ecx + 1], 0x64
jne 0x4b5c83
cmp byte [edx + ecx + 2], bl
jne 0x4b5c83
cmp byte [edx + ecx + 3], 0x61
jne 0x4b5c83
cmp byte [edx + ecx + 6], 0x30
jne 0x4b5c83
cmp byte [edx + ecx + 7], 0x30
jne 0x4b5c83
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004aaf70
add esp, 4
push ecx
call fcn.005e0865
jmp 0x4b63c1
inc edx
jmp 0x4b5c37
push edi
push edi
push edi
push edi
push edi
push eax
call fcn.00508b00
cmp eax, 1
je 0x4b63b8
cmp eax, 8
je 0x4b63b8
cmp eax, 9
je 0x4b63b8
cmp eax, 0xb
je 0x4b63b8
cmp eax, 0xd
je 0x4b63b8
cmp eax, edi
jne 0x4b63c4
mov dword [ebp - 0x60], edi
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp + 0x1228]
push edx
call fcn.004f1610
mov dword [ebp - 0x9c], eax
mov edx, dword [ebp - 0x60]
cmp edx, edi
je 0x4b63c4
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x110], edi
cmp eax, 0xb
jbe 0x4b5e97
cmp byte [edx], 0xd0
jne 0x4b5d20
cmp byte [edx + 1], 0xcf
jne 0x4b5d20
cmp byte [edx + 2], 0x11
jne 0x4b5d20
cmp byte [edx + 3], 0xe0
jne 0x4b5d20
mov dword [ebp - 0x140], 1
cmp eax, 0xb
jbe 0x4b5e97
mov dword [ebp - 0xf8], edi
mov dword [ebp - 0xd8], edi
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x164], edi
add eax, 0xfffffff6
cmp edi, eax
jae 0x4b5e97
lea esi, [edi + edx]
cmp dword [ebp - 0x140], 0
jne 0x4b5e51
cmp byte [esi], 0x2e
jne 0x4b5e51
mov cl, byte [esi + 1]
test cl, cl
je 0x4b63a9
cmp cl, 0x4a
jne 0x4b5d7c
cmp byte [esi + 2], 0x53
je 0x4b5e8e
cmp cl, 0x6a
jne 0x4b5d8b
cmp byte [esi + 2], 0x73
je 0x4b5e8e
cmp cl, 0x4a
je 0x4b5d95
cmp cl, 0x6a
jne 0x4b5db3
mov al, byte [esi + 2]
cmp al, 0x41
je 0x4b5da0
cmp al, 0x61
jne 0x4b5db3
mov al, byte [esi + 3]
cmp al, 0x52
je 0x4b5e8e
cmp al, 0x72
je 0x4b5e8e
cmp cl, 0x56
je 0x4b5dbd
cmp cl, 0x76
jne 0x4b5ddb
mov al, byte [esi + 2]
cmp al, 0x42
je 0x4b5dc8
cmp al, 0x62
jne 0x4b5ddb
mov al, byte [esi + 3]
cmp al, 0x45
je 0x4b5e8e
cmp al, 0x65
je 0x4b5e8e
cmp cl, 0x56
je 0x4b5de5
cmp cl, 0x76
jne 0x4b5e03
mov al, byte [esi + 2]
cmp al, 0x42
je 0x4b5df0
cmp al, 0x62
jne 0x4b5e03
mov al, byte [esi + 3]
cmp al, 0x53
je 0x4b5e8e
cmp al, 0x73
je 0x4b5e8e
cmp cl, 0x57
je 0x4b5e0d
cmp cl, 0x77
jne 0x4b5e23
mov al, byte [esi + 2]
cmp al, 0x53
je 0x4b5e18
cmp al, 0x73
jne 0x4b5e23
mov al, byte [esi + 3]
cmp al, 0x46
je 0x4b5e8e
cmp al, 0x66
je 0x4b5e8e
cmp cl, 0x4c
je 0x4b5e31
cmp cl, 0x6c
jne 0x4b63a9
mov al, byte [esi + 2]
cmp al, 0x4e
je 0x4b5e40
cmp al, 0x6e
jne 0x4b63a9
mov al, byte [esi + 3]
cmp al, 0x4b
je 0x4b5e8e
cmp al, 0x6b
jne 0x4b63a9
jmp 0x4b5e8e
mov cl, byte [esi]
cmp cl, 0x2e
jne 0x4b5eac
mov al, byte [esi + 1]
cmp al, 0x4a
jne 0x4b5e65
cmp byte [esi + 2], 0x53
je 0x4b5e77
cmp al, 0x6a
jne 0x4b63a9
cmp byte [esi + 2], 0x73
jne 0x4b63a9
mov dword [ebp - 0xd8], 1
cmp dword [ebp - 0xf8], 0
je 0x4b63a9
push ebx
call fcn.004aaf70
add esp, 4
mov edx, dword [ebp - 0x60]
push edx
call fcn.005e0865
mov dword [ebp - 0x60], 0
jmp 0x4b63c1
cmp cl, 0x43
je 0x4b5eb6
cmp cl, 0x63
jne 0x4b5ee2
mov al, byte [esi + 1]
cmp al, 0x41
je 0x4b5ec1
cmp al, 0x61
jne 0x4b5ee2
mov al, byte [esi + 2]
cmp al, 0x54
je 0x4b5ecc
cmp al, 0x74
jne 0x4b5ee2
mov al, byte [esi + 3]
cmp al, 0x43
je 0x4b5ed7
cmp al, 0x63
jne 0x4b5ee2
mov al, byte [esi + 4]
cmp al, 0x48
je 0x4b5efe
cmp al, 0x68
je 0x4b5efe
cmp cl, 0x5c
jne 0x4b5f14
mov al, byte [esi + 1]
cmp al, 0x55
je 0x4b5ef2
cmp al, 0x75
jne 0x4b5f14
cmp byte [esi + 2], 0x30
jne 0x4b5f14
cmp byte [esi + 3], 0x30
jne 0x4b5f14
mov dword [ebp - 0xf8], 1
cmp dword [ebp - 0xd8], 0
jmp 0x4b5e88
cmp cl, 0x50
je 0x4b5f1e
cmp cl, 0x70
jne 0x4b5f7e
mov al, byte [esi + 1]
cmp al, 0x4f
je 0x4b5f29
cmp al, 0x6f
jne 0x4b5f7e
mov al, byte [esi + 2]
cmp al, 0x57
je 0x4b5f34
cmp al, 0x77
jne 0x4b5f7e
mov al, byte [esi + 3]
cmp al, 0x45
je 0x4b5f3f
cmp al, 0x65
jne 0x4b5f7e
mov al, byte [esi + 4]
cmp al, 0x52
je 0x4b5f4a
cmp al, 0x72
jne 0x4b5f7e
mov al, byte [esi + 5]
cmp al, 0x53
je 0x4b5f55
cmp al, 0x73
jne 0x4b5f7e
mov al, byte [esi + 6]
cmp al, 0x48
je 0x4b5f60
cmp al, 0x68
jne 0x4b5f7e
mov al, byte [esi + 7]
cmp al, 0x45
je 0x4b5f6b
cmp al, 0x65
jne 0x4b5f7e
mov al, byte [esi + 8]
cmp al, 0x4c
je 0x4b5e8e
cmp al, 0x6c
je 0x4b5e8e
cmp cl, 0x4d
jne 0x4b5fc7
cmp byte [esi + 1], 0x5a
jne 0x4b5fc7
mov al, byte [esi + 2]
cmp al, 0x90
je 0x4b5fa8
cmp al, 0xa
je 0x4b5fa8
cmp al, 0x50
je 0x4b5fa8
cmp al, 0x40
je 0x4b5fa8
test al, al
je 0x4b5fa8
cmp al, 0x80
je 0x4b5fa8
cmp al, 0xf
jne 0x4b5fc7
cmp byte [esi + 3], 0
jne 0x4b5fc7
mov eax, dword [ebp - 0x9c]
push eax
push edi
push edx
call fcn.004ac0b0
add esp, 0xc
test eax, eax
jne 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x65
je 0x4b5fda
cmp ax, 0x45
jne 0x4b6068
push 8
push str.Equation
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b6068
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x74]
push edx
push 8
push esi
call fcn.004abf30
add esp, 0x10
mov ecx, dword [ebp - 0x74]
cmp ecx, 1
jne 0x4b6023
movzx eax, word [esi]
cmp ax, 0x61
jb 0x4b6023
cmp ax, 0x7a
ja 0x4b6023
mov dword [ebp - 0x74], 2
mov edx, ecx
jmp 0x4b602c
mov edx, 1
cmp ecx, edx
jbe 0x4b6035
cmp dword [ebp - 0x44], edx
jae 0x4b5e8e
mov eax, dword [ebp - 0xe0]
cmp eax, 0x1000
je 0x4b6056
cmp eax, 0x1200
je 0x4b6056
cmp eax, 0xe00
je 0x4b6056
mov dword [ebx], 0x230
mov dword [ebp - 0x64], edx
inc edi
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x60]
jmp 0x4b5d38
movzx eax, word [esi]
cmp ax, 0x6e
je 0x4b6077
cmp ax, 0x4e
jne 0x4b609a
push 6
push str.NAtIve
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b609a
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x74]
push ecx
push 6
jmp 0x4b5ff8
movzx eax, word [esi]
cmp ax, 0x4f
je 0x4b60a9
cmp ax, 0x6f
jne 0x4b60d6
push 3
push 0x6413a8
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b60d6
mov dword [ebp - 0x110], 1
inc edi
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x60]
jmp 0x4b5d38
cmp dword [ebp - 0x110], 0
je 0x4b63a9
movzx eax, word [esi]
cmp ax, 0x42
je 0x4b60f2
cmp ax, 0x62
jne 0x4b6122
push 7
push str.bit.ly_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 7
push str.bit.do_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x54
je 0x4b6131
cmp ax, 0x74
jne 0x4b61a9
push 0xc
push str.tinyurl.com_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 8
push str.tiny.cc_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 5
push str.t.co_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 5
push str.t.cn_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 5
push str.t.me_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x4f
je 0x4b61b8
cmp ax, 0x6f
jne 0x4b61e8
push 6
push str.ow.ly_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 7
push str.oal.lu_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x47
je 0x4b61f7
cmp ax, 0x67
jne 0x4b6223
push 7
push str.goo.gl_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b6223
push eax
push str._maps_
push esi
call fcn.004f59a0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x44
je 0x4b6232
cmp ax, 0x64
jne 0x4b624a
push 6
push str.db.gl_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x49
je 0x4b6259
cmp ax, 0x69
jne 0x4b6271
push 5
push str.i.ua_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x52
je 0x4b6280
cmp ax, 0x72
jne 0x4b6298
push 5
push str.rb.gy_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x4d
je 0x4b62a7
cmp ax, 0x6d
jne 0x4b62d7
push 9
push str.migre.me_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 9
push str.maj.to_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x58
je 0x4b62e6
cmp ax, 0x78
jne 0x4b6316
push 5
push str.x.co_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
push 8
push str.xurl.es_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x43
je 0x4b6325
cmp ax, 0x63
jne 0x4b633d
push 8
push str.cutt.ly_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x55
je 0x4b634c
cmp ax, 0x75
jne 0x4b6364
push 8
push str.urlz.fr_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
movzx eax, word [esi]
cmp ax, 0x56
je 0x4b6373
cmp ax, 0x76
jne 0x4b638b
push 8
push str.v.ht_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
cmp word [esi], 0x36
jne 0x4b63a9
push 8
push str.6url.ru_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b5e8e
inc edi
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x60]
jmp 0x4b5d38
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004aaf70
add esp, 4
lea ecx, [ebp + 0x1228]
push ecx
call fcn.004e0670
add esp, 4
xor esi, esi
mov ebx, dword [ebp - 0x1c]
mov eax, 1
cmp dword [ebp - 0xb0], eax
jne 0x4b737f
cmp dword [ebp - 0x24], eax
je 0x4b737f
cmp ebx, esi
je 0x4b737f
cmp dword [ebx], esi
jne 0x4b737f
cmp ebx, esi
je 0x4b737f
mov byte [ebp + 0x400], 0
push 0x3ff
push esi
lea eax, [ebp + 0x401]
push eax
call fcn.005dfd60
mov byte [ebp + 0x1430], 0
push 0x103
push esi
lea ecx, [ebp + 0x1431]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x138], esi
xor edi, edi
mov dword [ebp - 0x128], edi
mov edx, dword [ebp - 0x54]
push edx
call fcn.004d90d0
add esp, 0x1c
push esi
push esi
push esi
test eax, eax
je 0x4b66e3
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x40]
push edx
push str..xml.rels
mov eax, dword [ebp - 0x54]
push eax
jmp 0x4b6701
mov byte [ebp + 0xe18], 0
push 0x207
push esi
lea edx, [ebp + 0xe19]
push edx
call fcn.005dfd60
mov byte [ebp + 0x800], 0
push 0x207
push esi
lea eax, [ebp + 0x801]
push eax
call fcn.005dfd60
mov dword [ebp - 0x44], esi
mov edi, dword [ebp - 0x54]
push edi
call fcn.004d90d0
add esp, 0x1c
push esi
push esi
push esi
test eax, eax
je 0x4b6502
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x44]
lea edx, [ebp + 0x800]
lea eax, [ebp + 0xe18]
push ecx
push edx
push eax
cmp ebx, esi
jne 0x4b64fa
push str.word_vbaProject.bin
push edi
jmp 0x4b6548
push str.xl_vbaProject.bin
push edi
jmp 0x4b6548
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp ebx, esi
jne 0x4b652d
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp + 0x800]
push eax
lea ecx, [ebp + 0xe18]
push ecx
push str.word_vbaProject.bin
mov edx, dword [ebp - 0x30]
push edx
jmp 0x4b6548
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 0x800]
push ecx
lea edx, [ebp + 0xe18]
push edx
push str.xl_vbaProject.bin
mov eax, dword [ebp - 0x30]
push eax
push esi
push esi
call fcn.004ab410
add esp, 0x1c
cmp byte [ebp + 0xe18], 0
je 0x4b63d5
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp + 0xe18]
push edx
call fcn.004f1610
cmp eax, 0x80
jbe 0x4b66bd
mov ecx, dword [ebp - 0x48]
cmp ecx, esi
je 0x4b66cf
mov dword [ebp - 0x2c], esi
lea edi, [eax - 1]
push 0
lea edx, [ebp - 0x2c]
cmp ebx, esi
jne 0x4b661b
mov dword [ebp - 0x120], esi
push 0
lea eax, [ebp - 0x120]
push eax
push edx
push edi
push str.rundll
push str.GetObject_
push str.Object_
push str._OPEN
push ecx
call fcn.004ab880
add esp, 0x28
mov esi, eax
mov dword [ebp - 0xac], esi
cmp esi, 0xffffffff
je 0x4b66bd
cmp dword [ebp - 0x2c], 1
jne 0x4b66a2
cmp dword [ebp - 0x120], 0
jne 0x4b66a2
push edi
push 0x641204
mov eax, dword [ebp - 0x48]
push eax
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b66a2
mov dword [ebp - 0xac], 0xffffffff
jmp 0x4b66bd
mov ebx, dword [ebp - 0x58]
push ebx
push 0
push edx
push edi
push str.rundll
push 0
push 0
push str.WORKBOOK_OPEN
push ecx
call fcn.004ab880
add esp, 0x28
mov esi, eax
mov dword [ebp - 0xac], esi
cmp esi, 0xffffffff
je 0x4b66bd
mov eax, dword [ebp - 0x2c]
cmp eax, 7
je 0x4b66a2
push 0
push ebx
push 0
cmp eax, 1
je 0x4b6675
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push str.ALLUSERS
push str.AUTOOPEN
push str.DECRYPTBYTE
mov ecx, dword [ebp - 0x48]
push ecx
jmp 0x4b6692
lea edx, [ebp - 0x2c]
push edx
push edi
push str.rundll
push str.ALLUSERS
push str.AUTOOPEN
push str.DECRYPTBYTE
mov eax, dword [ebp - 0x48]
push eax
call fcn.004ab880
mov esi, eax
mov dword [ebp - 0xac], esi
add esp, 0x28
cmp esi, 0xffffffff
je 0x4b66bd
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x1c], 0
je 0x4b66bd
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0x22d
mov ecx, dword [ebp - 0x48]
xor esi, esi
cmp ecx, esi
je 0x4b66cf
push ecx
call fcn.005e0865
add esp, 4
lea edx, [ebp + 0xe18]
push edx
call fcn.004e0670
add esp, 4
jmp 0x4b63d5
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x40]
push eax
push str..xml.rels
mov ecx, dword [ebp - 0x30]
push ecx
push esi
push esi
call fcn.004aaf80
add esp, 0x18
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x4b737f
cmp byte [eax], 0
je 0x4b690b
mov dword [ebp - 0x28], esi
mov byte [ebp + 0x1534], 0
push 1
push esi
push 0x2c
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp + 0x1534]
push ecx
push eax
call fcn.004e1380
add esp, 0x18
or edi, 0xffffffff
cmp dword [ebp - 0x28], edi
je 0x4b68ad
mov dword [ebp - 0xd4], esi
mov byte [ebp], 0
push 0x3ff
push esi
lea edx, [ebp + 1]
push edx
call fcn.005dfd60
add esp, 0xc
mov ecx, dword [ebp - 0x34]
cmp ecx, esi
je 0x4b678a
cmp byte [ecx], 0
je 0x4b678a
lea edx, [ebp]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4b6780
mov byte [ebp + 0x1430], 0
mov byte [ebp + 0x400], 0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp + 0x1430]
push eax
lea ecx, [ebp + 0x400]
push ecx
mov edi, dword [ebp - 0x58]
push edi
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp + 0x1534]
push eax
call fcn.004b4df0
add esp, 0x20
mov esi, eax
cmp byte [ebp + 0x400], 0
je 0x4b686d
test edi, edi
je 0x4b6827
test esi, esi
je 0x4b686d
lea ecx, [ebp]
push ecx
cmp byte [ebp + 0x1430], 0
je 0x4b6819
lea edx, [ebp + 0x1430]
push edx
lea eax, [ebp + 0x400]
push eax
push str._EXT__XLS__INF___s__RN:_s___s_
push 0
call fcn.004f0f30
add esp, 0x14
jmp 0x4b686d
lea edx, [ebp + 0x400]
push edx
push str._EXT__XLS__INF___s___s_
jmp 0x4b6863
test esi, esi
je 0x4b686d
lea eax, [ebp]
push eax
cmp byte [ebp + 0x1430], 0
je 0x4b6857
lea ecx, [ebp + 0x1430]
push ecx
lea edx, [ebp + 0x400]
push edx
push str._EXT__DOC__INF___s__RN:_s___s_
push 0
call fcn.004f0f30
add esp, 0x14
jmp 0x4b686d
lea ecx, [ebp + 0x400]
push ecx
push str._EXT__DOC__INF___s___s_
push 0
call fcn.004f0f30
add esp, 0x10
cmp esi, 1
je 0x4b687b
cmp dword [ebp - 0xd4], 0
je 0x4b6889
mov dword [ebp - 0x24], esi
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov dword [edx], eax
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp + 0x1534]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.004e1380
xor esi, esi
mov ebx, dword [ebp - 0x1c]
jmp 0x4b673f
mov dword [ebp - 0x28], esi
mov byte [ebp + 0x1534], 0
push 1
push esi
push 0x2c
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp + 0x1534]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x28], edi
je 0x4b6902
lea ecx, [ebp + 0x1534]
push ecx
call fcn.004e0670
push 1
push esi
push 0x2c
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp + 0x1534]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004e1380
add esp, 0x1c
jmp 0x4b68d3
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x128]
cmp dword [ebp - 0x24], 1
je 0x4b6936
cmp ebx, esi
je 0x4b6919
cmp dword [ebx], esi
jne 0x4b6936
cmp edi, 1
jne 0x4b694c
cmp ebx, esi
je 0x4b694c
mov dword [ebx], 0x230
push eax
call fcn.005e0865
mov dword [ebp - 0x40], esi
jmp 0x4b737c
cmp dword [ebp - 0x138], esi
jne 0x4b694c
cmp edi, 1
je 0x4b694c
mov dword [ebp - 0x24], esi
cmp ebx, esi
je 0x4b694c
mov dword [ebx], esi
push eax
call fcn.005e0865
mov dword [ebp - 0x40], esi
jmp 0x4b737c
cmp byte [ebx], 0
je 0x4b6a33
push str.__xml_version
push ebx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b69ed
lea eax, [ebx + 1]
push 0x3c
push eax
call fcn.005e0940
add esp, 8
mov esi, eax
test esi, esi
je 0x4b737f
push str.__mso_application
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b737f
push eax
push str..macroEnabled.
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4b69d0
push 0
push str.:macrosPresent_yes_
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b737f
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b737f
mov dword [eax], 0x30a
jmp 0x4b737f
cmp byte [ebx], 0
je 0x4b6a33
push str.MIME_Version:
push ebx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b6a33
push eax
push str._x_mso
push ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b6a33
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x1c], 0
je 0x4b737f
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0x309
jmp 0x4b737f
cmp dword [ebp + 0x1698], 0
je 0x4b6a76
cmp byte [ebx], 0x7b
jne 0x4b6bdc
cmp byte [ebx + 1], 0x5c
jne 0x4b6a76
cmp byte [ebx + 2], 0x72
jne 0x4b6a76
cmp byte [ebx + 3], 0x74
jne 0x4b6a76
cmp byte [ebx + 4], 0xc8
jne 0x4b6a76
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b737f
mov dword [eax], 0x378
jmp 0x4b737f
cmp byte [ebx], 0x7b
jne 0x4b6bdc
push 0x6410f8
lea eax, [ebx + 1]
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b6bdc
mov ecx, dword [ebp - 0x8c]
fild dword [ebp - 0x8c]
test ecx, ecx
jge 0x4b6aae
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x4b6b4c
lea esi, [ebx + 5]
push 0
push str.datastore_
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b6b02
push 0
push str.d0cf11e
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b6b02
mov dword [ebp - 0x24], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4b6b4c
mov dword [edi], 0x378
jmp 0x4b6b4f
add edi, 0xfffffff0
push edi
push str.objupdate
push esi
call fcn.004f5ad0
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
je 0x4b6b4c
mov byte [edi + esi], 0
push 0x5c
push esi
call fcn.005e0a00
add esp, 8
mov byte [edi + esi], 0x5c
test eax, eax
je 0x4b6b4c
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x1c], 0
je 0x4b6b4c
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0x379
mov edi, edx
jmp 0x4b6b4f
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 0
jne 0x4b737f
lea esi, [ebx + 6]
push str.typiso
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4b6bc2
push str._rtv0
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4b6bc2
mov al, byte [esi]
mov cl, 0xff
cmp al, cl
jne 0x4b737f
cmp byte [ebx + 7], 0xd8
jne 0x4b6b9d
cmp byte [ebx + 8], cl
jne 0x4b6b9d
cmp byte [ebx + 9], 0xe0
je 0x4b6bc2
cmp al, cl
jne 0x4b737f
cmp byte [ebx + 7], 0xd8
jne 0x4b737f
cmp byte [ebx + 8], cl
jne 0x4b737f
cmp byte [ebx + 9], 0xe1
jne 0x4b737f
mov dword [ebp - 0x24], 1
test edi, edi
je 0x4b737f
mov dword [edi], 0x378
jmp 0x4b737f
mov ebx, dword [0x748868]
test bl, 1
jne 0x4b6c0f
or ebx, esi
mov dword [0x748868], ebx
mov eax, str.Macros
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6bf7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [0x748864], eax
test bl, 2
jne 0x4b6c33
or ebx, 2
mov dword [0x748868], ebx
mov eax, str.Kernel32
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b6c25
sub eax, edx
mov dword [0x748860], eax
test bl, 4
jne 0x4b6c5e
or ebx, 4
mov dword [0x748868], ebx
mov eax, str.OLE_Package
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b6c50
sub eax, edx
mov dword [0x74885c], eax
test bl, 8
jne 0x4b6c82
or ebx, 8
mov dword [0x748868], ebx
mov eax, str.CreateProcess
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b6c74
sub eax, edx
mov dword [0x748858], eax
test bl, 0x10
jne 0x4b6cb8
or ebx, 0x10
mov dword [0x748868], ebx
mov eax, str.EncryptedPackage
lea edx, [eax + 2]
jmp 0x4b6ca0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6ca0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov dword [0x748854], ecx
test bl, 0x20
jne 0x4b6ce8
or ebx, 0x20
mov dword [0x748868], ebx
mov eax, str.Container.EncryptionTransform
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6cd0
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov dword [0x748850], edx
test bl, 0x40
jne 0x4b6d18
or ebx, 0x40
mov dword [0x748868], ebx
mov eax, 0x68ae0c
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6d00
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [0x74884c], eax
test bl, bl
js 0x4b6d48
or ebx, 0x80
mov dword [0x748868], ebx
mov eax, str._VBA_
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6d30
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov dword [0x748848], ecx
xor edi, edi
mov ebx, dword [ebp - 0x12c]
mov dword [ebp - 0xc4], edi
cmp edi, dword [ebp - 0x38]
jae 0x4b737f
cmp dword [ebp - 0x24], 0
jne 0x4b72a7
mov edx, dword [ebp - 0x20]
lea esi, [edi + edx]
mov al, byte [esi]
cmp al, 0x4d
jne 0x4b6dfb
mov eax, dword [0x748864]
mov ecx, str.Macros
cmp eax, 4
jb 0x4b6d9d
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b728d
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b6d83
test eax, eax
je 0x4b6dcd
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b728d
cmp eax, 1
jbe 0x4b6dcd
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b728d
cmp eax, 2
jbe 0x4b6dcd
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4b728d
mov eax, dword [0x74884c]
mov ecx, 0x68ae0c
mov edx, dword [ebp - 0x20]
lea esi, [edi + edx + 0x80]
cmp eax, 4
jb 0x4b6e2a
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b728d
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b6de1
cmp al, 0x4f
jne 0x4b6e66
mov eax, dword [0x74885c]
mov ecx, str.OLE_Package
lea esp, [esp]
cmp eax, 4
jb 0x4b6e2a
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b728d
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b6e10
test eax, eax
je 0x4b6e5a
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b728d
cmp eax, 1
jbe 0x4b6e5a
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b728d
cmp eax, 2
jbe 0x4b6e5a
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4b728d
mov dword [ebp - 0x24], 1
jmp 0x4b728d
cmp al, 0x58
jne 0x4b6f1c
mov eax, dword [0x748864]
mov ecx, str.Xacros
cmp eax, 4
jb 0x4b6e8e
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b6eb2
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b6e78
test eax, eax
je 0x4b6ef6
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b6eb2
cmp eax, 1
jbe 0x4b6ef6
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b6eb2
cmp eax, 2
jbe 0x4b6ef6
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4b6ef6
mov ecx, dword [ebp - 0x20]
lea eax, [edi + ecx]
cmp dword [eax], 0x560058
jne 0x4b728d
add eax, 4
cmp byte [eax], 0x42
jne 0x4b728d
call fcn.004dcdb0
test eax, eax
je 0x4b737f
push str.DISINFECTED_DOCUMENT_D__n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0x24], 1
jmp 0x4b7389
call fcn.004dcdb0
test eax, eax
je 0x4b737f
push str.DISINFECTED_DOCUMENT_A__n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0x24], 1
jmp 0x4b7389
cmp al, 0x4b
je 0x4b726a
cmp al, 0x6b
je 0x4b726a
cmp al, 0x43
jne 0x4b700f
mov edx, dword [0x748858]
push edx
push str.CreateProcess
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
je 0x4b7283
cmp dword [ebp - 0x108], 0
je 0x4b728d
mov eax, dword [0x748850]
mov ecx, str.Container.EncryptionTransform
cmp eax, 4
jb 0x4b6f82
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b728d
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b6f68
test eax, eax
je 0x4b6fb2
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b728d
cmp eax, 1
jbe 0x4b6fb2
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b728d
cmp eax, 2
jbe 0x4b6fb2
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4b728d
lea ecx, [edi + 0x4c]
cmp ecx, dword [ebp - 0x38]
jae 0x4b7003
mov eax, dword [ebp - 0x20]
cmp dword [edi + eax + 0x4c], 0x20534541
jne 0x4b6ff2
cmp byte [edi + eax + 0x50], 0x31
jne 0x4b6ff2
cmp byte [edi + eax + 0x51], 0x32
jne 0x4b6ff2
cmp byte [edi + eax + 0x52], 0x38
jne 0x4b6ff2
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x24], 1
jmp 0x4b7389
cmp byte [edi + eax + 0x4c], 0
jne 0x4b7003
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x24], 1
jmp 0x4b7389
cmp al, 0x5f
jne 0x4b7100
mov eax, dword [0x748848]
mov ecx, str._VBA_
cmp eax, 4
jb 0x4b7037
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b706b
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b7021
test eax, eax
je 0x4b70f0
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b706b
cmp eax, 1
jbe 0x4b70f0
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b706b
cmp eax, 2
jbe 0x4b70f0
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4b70f0
mov eax, dword [0x748848]
mov ecx, str._XBA_
mov edx, dword [ebp - 0x20]
lea esi, [edi + edx]
jmp 0x4b7080
cmp eax, 4
jb 0x4b709a
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b728d
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b7080
test eax, eax
je 0x4b70ca
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b728d
cmp eax, 1
jbe 0x4b70ca
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b728d
cmp eax, 2
jbe 0x4b70ca
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4b728d
call fcn.004dcdb0
test eax, eax
je 0x4b737f
push str.DISINFECTED_DOCUMENT_B__n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0x24], 1
jmp 0x4b7389
mov eax, 1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x24], eax
jmp 0x4b728d
cmp al, 0x45
je 0x4b710c
cmp al, 0x65
jne 0x4b728d
mov eax, dword [0x748854]
mov ecx, str.EncryptedPackage
cmp eax, 4
jb 0x4b712c
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4b7150
sub eax, 4
add ecx, 4
add esi, 4
jmp 0x4b7116
test eax, eax
je 0x4b7186
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4b7150
cmp eax, 1
jbe 0x4b7186
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4b7150
cmp eax, 2
jbe 0x4b7186
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4b7186
mov ecx, dword [0x748854]
push ecx
push str.EncryptedPackage
mov edx, dword [ebp - 0x20]
lea eax, [edi + edx]
push eax
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b728d
mov eax, 1
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x24], eax
jmp 0x4b7389
lea ecx, [edi + 0x1020]
cmp ecx, dword [ebp - 0x38]
jae 0x4b725e
mov eax, dword [ebp - 0x20]
mov edx, dword [edi + eax + 0x1000]
mov dword [ebp + 0x1668], edx
mov ecx, dword [edi + eax + 0x1004]
mov dword [ebp + 0x166c], ecx
mov edx, dword [edi + eax + 0x1008]
mov dword [ebp + 0x1670], edx
mov ecx, dword [edi + eax + 0x100c]
mov dword [ebp + 0x1674], ecx
mov edx, dword [edi + eax + 0x1010]
mov dword [ebp + 0x1638], edx
mov ecx, dword [edi + eax + 0x1014]
mov dword [ebp + 0x163c], ecx
mov edx, dword [edi + eax + 0x1018]
mov dword [ebp + 0x1640], edx
mov ecx, dword [edi + eax + 0x101c]
mov dword [ebp + 0x1644], ecx
mov edx, dword [edi + eax + 0xe00]
mov dword [ebp + 0x1658], edx
mov ecx, dword [edi + eax + 0xe04]
mov dword [ebp + 0x165c], ecx
mov edx, dword [edi + eax + 0xe08]
mov dword [ebp + 0x1660], edx
mov ecx, dword [edi + eax + 0xe0c]
mov dword [ebp + 0x1664], ecx
lea eax, [edi + eax + 0xe10]
mov edx, dword [eax]
mov dword [ebp + 0x1648], edx
mov ecx, dword [eax + 4]
mov dword [ebp + 0x164c], ecx
mov edx, dword [eax + 8]
mov dword [ebp + 0x1650], edx
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x1654], eax
mov dword [ebp - 0x108], 1
jmp 0x4b728d
mov ecx, dword [0x748860]
push ecx
push str.Kernel32
push esi
call fcn.005f0a9e
add esp, 0xc
test eax, eax
jne 0x4b728d
mov dword [ebp - 0x10c], 1
mov esi, 1
cmp dword [ebp + 0x168c], 0
jne 0x4b75ab
add edi, 0x10
jmp 0x4b6d50
cmp dword [ebp - 0x1c], 0
je 0x4b737f
test ebx, ebx
jne 0x4b72dd
push 0x64104c
mov edx, dword [ebp - 0x20]
lea eax, [edi + edx]
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b72d5
mov ebx, esi
mov dword [ebp - 0x12c], ebx
add edi, 0x10
jmp 0x4b6d50
mov ecx, dword [ebp - 0x20]
lea esi, [edi + ecx]
push str.ThisDocument
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b7510
add esi, 0xd
mov byte [ebp + 0x1020], al
push 0x103
push eax
lea edx, [ebp + 0x1021]
push edx
call fcn.005dfd60
mov dword [ebp - 0x148], 0
push 0x20
push esi
lea eax, [ebp + 0xa08]
push eax
call fcn.005e1e30
mov byte [ebp + 0xa28], 0
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp + 0x1020]
push edx
lea eax, [ebp + 0xa08]
push eax
call fcn.004e1380
add esp, 0x30
cmp byte [ebp + 0x1020], 0x2d
jne 0x4b736b
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0
jmp 0x4b737f
lea edx, [ebp + 0x1020]
push edx
call fcn.005e0909
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
add esp, 4
cmp dword [ebp - 0x24], 1
jne 0x4b74db
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b74db
cmp dword [ebp - 0x108], 0
jne 0x4b899a
cmp dword [ebp - 0xb4], 0
jne 0x4b899a
mov eax, dword [eax]
test eax, eax
je 0x4b75b1
cmp eax, 0x16
je 0x4b75b1
cmp eax, 0x42
je 0x4b75b1
cmp eax, 0x84
je 0x4b75b1
cmp eax, 0x4b
je 0x4b75b1
cmp eax, 0x6e
je 0x4b75b1
cmp eax, 0x9a
je 0x4b75b1
cmp eax, 0x63
je 0x4b75b1
cmp eax, 0x19
je 0x4b75b1
cmp eax, 0x13
je 0x4b75b1
cmp eax, 0x64
je 0x4b75b1
cmp eax, 0x4e
je 0x4b75b1
cmp eax, 0x20
je 0x4b75b1
cmp eax, 0x17
je 0x4b75b1
cmp eax, 0x1b
je 0x4b75b1
cmp eax, 0x1a
je 0x4b75b1
cmp eax, 0x2c
je 0x4b75b1
cmp eax, 0x2e
je 0x4b75b1
cmp eax, 0x1d
je 0x4b75b1
cmp eax, 0x1e
je 0x4b75b1
cmp eax, 0x1c
je 0x4b75b1
cmp eax, 0x7d
je 0x4b75b1
cmp eax, 0x34
je 0x4b75b1
cmp eax, 0x82
je 0x4b75b1
cmp eax, 0x73
je 0x4b75b1
cmp eax, 0x32
je 0x4b75b1
cmp eax, 0x96
je 0x4b75b1
cmp eax, 0xb0
je 0x4b75b1
cmp eax, 0x145
je 0x4b75b1
cmp eax, 0x78
je 0x4b75b1
cmp eax, 0x58
je 0x4b75b1
mov edx, dword [ebp - 0x3c]
mov dword [edx], 1
mov edi, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0
jne 0x4b8bf1
cmp dword [ebp - 0x10c], 0
je 0x4b8bcd
mov dword [ebp - 0x24], 1
mov dword [edi], 1
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0xe0
jmp 0x4b8bfe
push str.Main
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4b75a6
add esi, 5
mov byte [ebp + 0x1124], al
push 0x103
push eax
lea edx, [ebp + 0x1125]
push edx
call fcn.005dfd60
mov dword [ebp - 0x118], 0
push 0x20
push esi
lea eax, [ebp + 0xb0c]
push eax
call fcn.005e1e30
mov byte [ebp + 0xb2c], 0
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp + 0x1124]
push edx
lea eax, [ebp + 0xb0c]
push eax
call fcn.004e1380
add esp, 0x30
cmp byte [ebp + 0x1124], 0x2d
jne 0x4b759b
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0
jmp 0x4b737f
lea edx, [ebp + 0x1124]
jmp 0x4b7371
mov esi, 1
inc edi
jmp 0x4b6d50
mov dword [ebp - 0x68], 0
mov esi, dword [0x748868]
test esi, 0x100
jne 0x4b75f4
or esi, 0x100
mov dword [0x748868], esi
mov eax, str.Enable_Macro
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b75e0
sub eax, edx
sar eax, 1
mov dword [0x748844], eax
test esi, 0x200
jne 0x4b761e
or esi, 0x200
mov dword [0x748868], esi
mov eax, 0x68add4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7610
sub eax, edx
mov dword [0x748840], eax
test esi, 0x400
jne 0x4b7654
or esi, 0x400
mov dword [0x748868], esi
mov eax, str..AutoOpen
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7640
sub eax, edx
sar eax, 1
mov dword [0x74883c], eax
test esi, 0x800
jne 0x4b767e
or esi, 0x800
mov dword [0x748868], esi
mov eax, str.Ent_Open
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7670
sub eax, edx
mov dword [0x748838], eax
test esi, 0x1000
jne 0x4b76b4
or esi, 0x1000
mov dword [0x748868], esi
mov eax, str.ThisDocument.
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b76a0
sub eax, edx
sar eax, 1
mov dword [0x748834], eax
test esi, 0x2000
jne 0x4b76de
or esi, 0x2000
mov dword [0x748868], esi
mov eax, str.MSForms
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b76d0
sub eax, edx
mov dword [0x748830], eax
test esi, 0x4000
jne 0x4b770e
or esi, 0x4000
mov dword [0x748868], esi
mov eax, str.WScript
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7700
sub eax, edx
mov dword [0x74882c], eax
test esi, 0x8000
jne 0x4b7744
or esi, 0x8000
mov dword [0x748868], esi
mov eax, 0x68ad78
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7730
sub eax, edx
sar eax, 1
mov dword [0x748828], eax
test esi, 0x10000
jne 0x4b776e
or esi, 0x10000
mov dword [0x748868], esi
mov eax, str.MergeForm
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7760
sub eax, edx
mov dword [0x748824], eax
test esi, 0x20000
jne 0x4b779e
or esi, 0x20000
mov dword [0x748868], esi
mov eax, str.btnSave
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7790
sub eax, edx
mov dword [0x748820], eax
test esi, 0x40000
jne 0x4b77ce
or esi, 0x40000
mov dword [0x748868], esi
mov eax, str.bookmarks
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b77c0
sub eax, edx
mov dword [0x74881c], eax
test esi, 0x80000
jne 0x4b77fe
or esi, 0x80000
mov dword [0x748868], esi
mov eax, str.Options
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b77f0
sub eax, edx
mov dword [0x748818], eax
test esi, 0x100000
jne 0x4b782e
or esi, 0x100000
mov dword [0x748868], esi
mov eax, str.ShowMess
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7820
sub eax, edx
mov dword [0x748814], eax
test esi, 0x200000
jne 0x4b7864
or esi, 0x200000
mov dword [0x748868], esi
mov eax, 0x68ad30
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7850
sub eax, edx
sar eax, 1
mov dword [0x748810], eax
test esi, 0x400000
jne 0x4b788e
or esi, 0x400000
mov dword [0x748868], esi
mov eax, str.WinExec
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7880
sub eax, edx
mov dword [0x74880c], eax
test esi, 0x800000
jne 0x4b78c4
or esi, 0x800000
mov dword [0x748868], esi
mov eax, 0x68ad18
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b78b0
sub eax, edx
sar eax, 1
mov dword [0x748808], eax
test esi, 0x1000000
jne 0x4b78ee
or esi, 0x1000000
mov dword [0x748868], esi
mov eax, 0x68ad08
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b78e0
sub eax, edx
mov dword [0x748804], eax
test esi, 0x2000000
jne 0x4b7924
or esi, 0x2000000
mov dword [0x748868], esi
mov eax, 0x68acec
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7910
sub eax, edx
sar eax, 1
mov dword [0x748800], eax
test esi, 0x4000000
jne 0x4b794e
or esi, 0x4000000
mov dword [0x748868], esi
mov eax, str.UrlDownloadTo
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7940
sub eax, edx
mov dword [0x7487fc], eax
test esi, 0x8000000
jne 0x4b7984
or esi, 0x8000000
mov dword [0x748868], esi
mov eax, 0x68acc0
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7970
sub eax, edx
sar eax, 1
mov dword [0x7487f8], eax
test esi, 0x10000000
jne 0x4b79ae
or esi, 0x10000000
mov dword [0x748868], esi
mov eax, str.winmgmts
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b79a0
sub eax, edx
mov dword [0x7487f4], eax
test esi, 0x20000000
jne 0x4b79e4
or esi, 0x20000000
mov dword [0x748868], esi
mov eax, 0x68aca0
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b79d0
sub eax, edx
sar eax, 1
mov dword [0x7487f0], eax
test esi, 0x40000000
jne 0x4b7a0e
or esi, 0x40000000
mov dword [0x748868], esi
mov eax, str.Win32_Process
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7a00
sub eax, edx
mov dword [0x7487ec], eax
test esi, esi
js 0x4b7a3a
or esi, 0x80000000
mov dword [0x748868], esi
mov eax, 0x68ac74
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7a26
sub eax, edx
sar eax, 1
mov dword [0x7487e8], eax
mov ecx, dword [0x7487e4]
test cl, 1
jne 0x4b7a64
or ecx, 1
mov dword [0x7487e4], ecx
mov eax, str.gmts:Win
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7a56
sub eax, esi
mov dword [0x7487e0], eax
test cl, 2
jne 0x4b7a94
or ecx, 2
mov dword [0x7487e4], ecx
mov eax, 0x68ac54
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4b7a80
sub eax, esi
sar eax, 1
mov dword [0x7487dc], eax
test cl, 4
jne 0x4b7abe
or ecx, 4
mov dword [0x7487e4], ecx
mov eax, 0x68ac48
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7ab0
sub eax, esi
mov dword [0x7487d8], eax
test cl, 8
jne 0x4b7ae2
or ecx, 8
mov dword [0x7487e4], ecx
mov eax, str.Control_ms
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7ad4
sub eax, esi
mov dword [0x7487d4], eax
test cl, 0x10
jne 0x4b7b14
or ecx, 0x10
mov dword [0x7487e4], ecx
mov eax, 0x68ac24
lea esi, [eax + 2]
jmp 0x4b7b00
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4b7b00
sub eax, esi
sar eax, 1
mov dword [0x7487d0], eax
test cl, 0x20
jne 0x4b7b3e
or ecx, 0x20
mov dword [0x7487e4], ecx
mov eax, str.CreateObject
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7b30
sub eax, esi
mov dword [0x7487cc], eax
test cl, 0x40
jne 0x4b7b62
or ecx, 0x40
mov dword [0x7487e4], ecx
mov eax, str.Shell
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7b54
sub eax, esi
mov dword [0x7487c8], eax
test cl, cl
js 0x4b7b8e
or ecx, 0x80
mov dword [0x7487e4], ecx
mov eax, str.fixed
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7b80
sub eax, esi
mov dword [0x7487c4], eax
test ecx, 0x100
jne 0x4b7bbe
or ecx, 0x100
mov dword [0x7487e4], ecx
mov eax, str.Atos
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7bb0
sub eax, esi
mov dword [0x7487c0], eax
test ecx, 0x200
jne 0x4b7bee
or ecx, 0x200
mov dword [0x7487e4], ecx
mov eax, str.DisplayAlert
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7be0
sub eax, esi
mov dword [0x7487bc], eax
test ecx, 0x400
jne 0x4b7c1e
or ecx, 0x400
mov dword [0x7487e4], ecx
mov eax, str.Duplex
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7c10
sub eax, esi
mov dword [0x7487b8], eax
test ecx, 0x800
jne 0x4b7c54
or ecx, 0x800
mov dword [0x7487e4], ecx
mov eax, str._DELETED_
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4b7c40
sub eax, esi
sar eax, 1
mov dword [0x7487b4], eax
test ecx, 0x1000
jne 0x4b7c7e
or ecx, 0x1000
mov dword [0x7487e4], ecx
mov eax, str.DOS_mode.
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b7c70
sub eax, esi
mov dword [0x7487b0], eax
test ecx, 0x2000
jne 0x4b7cae
or ecx, 0x2000
mov dword [0x7487e4], ecx
mov eax, str.ShellV
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b7ca0
sub eax, edx
mov dword [0x7487ac], eax
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0xdc], edx
xor edi, edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xec], edx
xor ebx, ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xf0], edx
lea ecx, [ecx]
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff5
mov esi, dword [ebp - 0x68]
cmp esi, eax
jae 0x4b7e14
mov ecx, dword [ebp - 0x20]
add esi, ecx
mov al, byte [esi]
test al, al
je 0x4b87c7
cmp al, 0x65
je 0x4b8752
cmp al, 0x45
je 0x4b8752
cmp dword [ebp - 0xf0], 0
jne 0x4b7dd6
cmp al, 0x27
jne 0x4b7dd6
mov edx, dword [0x7487c4]
push edx
push str.fixed
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b7dd6
call fcn.004dcdb0
test eax, eax
je 0x4b7dbc
push str.DISINFECTED_DOCUMENT_C__n
call fcn.005e0e7f
add esp, 4
mov dword [ebp - 0xf0], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0xbc], 0
jne 0x4b7f37
cmp byte [esi], 0x41
jne 0x4b7f37
mov eax, dword [0x7487c0]
push eax
push str.Atos
push esi
call fcn.005e21ae
add esp, 0xc
test eax, eax
jne 0x4b7f37
mov dword [ebp - 0xbc], 1
xor edx, edx
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], edx
jne 0x4b74db
cmp dword [ebp - 0xbc], edx
jne 0x4b74db
cmp dword [ebp - 0xcc], edx
jne 0x4b74db
cmp edi, edx
jne 0x4b88a7
cmp dword [ebp - 0xdc], edx
jne 0x4b88a7
cmp dword [ebp - 0xe4], edx
jne 0x4b88a7
cmp dword [ebp - 0xec], edx
jne 0x4b88a7
xor eax, eax
cmp eax, edx
jne 0x4b8817
cmp dword [ebp - 0x13c], edx
jne 0x4b8817
cmp dword [ebp - 0x124], edx
je 0x4b87d7
cmp dword [ebp - 0x94], edx
jne 0x4b8817
cmp dword [ebp - 0x88], edx
jne 0x4b8817
cmp dword [ebp - 0xc0], edx
jne 0x4b8817
cmp dword [ebp - 0xa4], edx
jne 0x4b8817
cmp dword [ebp - 0x90], edx
jne 0x4b8817
cmp dword [ebp - 0xb8], edx
jne 0x4b8817
cmp dword [ebp - 0x84], edx
jne 0x4b8817
cmp dword [ebp - 0xc8], edx
jne 0x4b8817
cmp ebx, edx
jne 0x4b8817
cmp dword [ebp - 0x6c], edx
jne 0x4b8817
cmp dword [ebp - 0x78], edx
jne 0x4b8817
cmp dword [ebp - 0x70], edx
jne 0x4b8817
cmp dword [ebp - 0x98], edx
jne 0x4b8817
cmp dword [ebp - 0x5c], edx
jne 0x4b8817
cmp dword [ebp - 0xa8], edx
jne 0x4b8817
cmp dword [ebp - 0x80], edx
je 0x4b8948
jmp 0x4b8817
cmp dword [ebp - 0xcc], 0
jne 0x4b7f6d
cmp byte [esi], 0x44
jne 0x4b7f6d
mov ecx, dword [0x7487b8]
push ecx
push str.Duplex
push esi
call fcn.005e21ae
add esp, 0xc
test eax, eax
jne 0x4b7f6d
mov dword [ebp - 0xcc], 1
jmp 0x4b7e12
cmp dword [ebp - 0x104], 0
jne 0x4b7fa8
mov al, byte [esi]
cmp al, 0x44
je 0x4b7f80
cmp al, 0x64
jne 0x4b7fa8
mov edx, dword [0x7487bc]
push edx
push str.DisplayAlert
push esi
call fcn.005e21ae
add esp, 0xc
test eax, eax
jne 0x4b7fa8
mov dword [ebp - 0x104], 1
jmp 0x4b7e12
cmp dword [ebp - 0x78], 0
jne 0x4b7fe2
cmp byte [esi], 0x44
jne 0x4b7fe2
mov eax, dword [0x7487b0]
push eax
push str.DOS_mode.
push esi
call fcn.005e21ae
add esp, 0xc
test eax, eax
jne 0x4b7fe2
mov dword [ebp - 0x78], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp byte [esi], 0x2e
jne 0x4b801a
mov ecx, dword [0x74883c]
push ecx
push str..AutoOpen
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b801a
mov dword [ebp - 0x124], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov al, byte [esi]
cmp al, 0x42
je 0x4b86e2
cmp al, 0x62
je 0x4b86e2
cmp al, 0x4f
je 0x4b8034
cmp al, 0x6f
jne 0x4b8073
cmp byte [esi - 1], 0
jne 0x4b8073
cmp dword [ebp - 0xec], 0
jne 0x4b87c7
mov edx, dword [0x748818]
push edx
push str.Options
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0xec], 1
jmp 0x4b7e12
cmp al, 0x53
jne 0x4b816a
cmp dword [ebp - 0xdc], 0
jne 0x4b80a6
mov eax, dword [0x748814]
push eax
push str.ShowMess
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b80a6
mov dword [ebp - 0xdc], 1
cmp dword [ebp - 0xc8], 0
jne 0x4b80f7
mov ecx, dword [0x7487c8]
push ecx
push str.Shell
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b80f7
mov edx, dword [0x7487c8]
mov eax, dword [ebp - 0x68]
lea ecx, [eax + edx]
xor eax, eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x158], eax
cmp eax, 4
jge 0x4b80f7
lea esi, [eax + ecx]
cmp byte [esi + edx], 0x28
jne 0x4b8164
mov dword [ebp - 0xc8], 1
cmp dword [ebp - 0x70], 0
jne 0x4b87c7
cmp dword [ebp - 0xf0], 0
jne 0x4b87c7
cmp dword [ebp - 0xbc], 0
jne 0x4b87c7
cmp dword [ebp - 0xcc], 0
jne 0x4b87c7
mov ecx, dword [0x7487ac]
push ecx
push str.ShellV
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
add edx, eax
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0x70], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
inc eax
jmp 0x4b80d9
cmp al, 0x55
jne 0x4b81c7
test ebx, ebx
jne 0x4b87c7
mov ecx, dword [0x7487fc]
push ecx
push str.UrlDownloadTo
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b81ac
mov edx, dword [0x7487f8]
push edx
push 0x68acc0
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov ebx, 1
mov dword [ebp - 0x100], ebx
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp al, 0x4e
je 0x4b86a4
cmp al, 0x6e
je 0x4b86a4
cmp al, 0x4d
jne 0x4b8250
cmp dword [ebp - 0xf4], 0
jne 0x4b87c7
mov eax, dword [0x748830]
push eax
push str.MSForms
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b8236
mov ecx, dword [0x748824]
push ecx
push str.MergeForm
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b8236
mov edx, dword [0x748810]
push edx
push 0x68ad30
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0xf4], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp al, 0x5f
jne 0x4b8289
cmp dword [ebp - 0x80], 0
jne 0x4b8289
mov eax, dword [0x7487b4]
push eax
push str._DELETED_
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b8289
mov dword [ebp - 0x80], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0x94], 0
jne 0x4b8424
cmp dword [ebp - 0xb8], 0
jne 0x4b8424
cmp dword [ebp - 0x84], 0
jne 0x4b8424
cmp dword [ebp - 0xa4], 0
jne 0x4b8424
mov al, byte [esi]
cmp al, 0x63
je 0x4b82cb
cmp al, 0x43
jne 0x4b8424
push 3
push str.cmd
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b82ea
mov al, byte [esi + 3]
cmp al, 0x20
je 0x4b8309
cmp al, 0x2e
je 0x4b8309
push 3
push 0x68aba4
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b8323
mov al, byte [esi + 3]
cmp al, 0x20
je 0x4b8309
cmp al, 0x2e
jne 0x4b8323
mov dword [ebp - 0x94], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
lea edi, [esi - 1]
push 9
push str._COMSPEC_
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b8309
push 9
push 0x68ab84
push edi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b8309
mov ecx, dword [0x748804]
push ecx
push 0x68ad08
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b840a
mov edx, dword [0x748800]
push edx
push 0x68acec
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b840a
mov eax, dword [0x7487d4]
push eax
push str.Control_ms
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b83f0
mov ecx, dword [0x7487d0]
push ecx
push 0x68ac24
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b83f0
mov edx, dword [0x7487cc]
push edx
push str.CreateObject
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0x84], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov dword [ebp - 0xb8], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov dword [ebp - 0xa4], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0xa8], 0
jne 0x4b8486
mov al, byte [esi]
cmp al, 0x67
je 0x4b8437
cmp al, 0x47
jne 0x4b8486
mov eax, dword [0x7487e0]
push eax
push str.gmts:Win
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b846c
mov ecx, dword [0x7487dc]
push ecx
push 0x68ac54
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0xa8], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0x88], 0
jne 0x4b8603
cmp dword [ebp - 0xc0], 0
jne 0x4b8603
cmp dword [ebp - 0x98], 0
jne 0x4b8603
cmp dword [ebp - 0x5c], 0
jne 0x4b8603
mov al, byte [esi]
cmp al, 0x77
je 0x4b84c5
cmp al, 0x57
jne 0x4b8603
mov edx, dword [0x74882c]
push edx
push str.WScript
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b85e9
mov eax, dword [0x748828]
push eax
push 0x68ad78
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b85e9
mov ecx, dword [0x74880c]
push ecx
push str.WinExec
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b85cf
mov edx, dword [0x748808]
push edx
push 0x68ad18
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b85cf
mov eax, dword [0x7487f4]
push eax
push str.winmgmts
push esi
call fcn.004aaec0
add esp, 0xc
test eax, eax
je 0x4b85b5
mov ecx, dword [0x7487f0]
push ecx
push 0x68aca0
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
je 0x4b85b5
mov edx, dword [0x7487ec]
push edx
push str.Win32_Process
push esi
call fcn.004aaec0
add esp, 0xc
test eax, eax
je 0x4b859e
mov eax, dword [0x7487e8]
push eax
push 0x68ac74
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0x5c], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov dword [ebp - 0x98], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov dword [ebp - 0xc0], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
mov dword [ebp - 0x88], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0x90], 0
jne 0x4b865c
mov al, byte [esi]
cmp al, 0x70
je 0x4b8616
cmp al, 0x50
jne 0x4b865c
push 0xa
push str.Powershell
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b8642
push 0xa
push 0x68ab60
push esi
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0x90], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0xfc], 0
jne 0x4b87c7
cmp byte [esi], 0x5f
jne 0x4b87c7
push 9
push str._Evaluate
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0xfc], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp dword [ebp - 0x6c], 0
jne 0x4b87c7
mov ecx, dword [0x7487d8]
push ecx
push 0x68ac48
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0x6c], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
test edi, edi
jne 0x4b870f
mov edx, dword [0x748820]
push edx
push str.btnSave
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b870f
mov edi, 1
mov dword [ebp - 0x11c], edi
jmp 0x4b7e12
cmp dword [ebp - 0xe4], 0
jne 0x4b87c7
mov eax, dword [0x74881c]
push eax
push str.bookmarks
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4b87c1
mov dword [ebp - 0xe4], 1
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
or edi, 0xffffffff
mov dword [ebp - 0x160], edi
mov ecx, dword [0x748844]
push ecx
push str.Enable_Macro
push esi
call fcn.005e38e0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4b87b7
mov edx, dword [0x748838]
push edx
push str.Ent_Open
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4b87af
mov eax, dword [0x748840]
push eax
push 0x68add4
push esi
call fcn.004dd670
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x160], edi
test edi, edi
jne 0x4b87c1
test ebx, ebx
je 0x4b87b7
test edi, edi
jne 0x4b87c1
mov dword [ebp - 0x13c], 1
mov ebx, dword [ebp - 0x100]
inc dword [ebp - 0x68]
mov edi, dword [ebp - 0x11c]
xor edx, edx
jmp 0x4b7d50
cmp ebx, edx
je 0x4b87e7
cmp dword [ebp - 0xf4], edx
je 0x4b8882
cmp dword [ebp - 0x6c], edx
jne 0x4b8882
cmp dword [ebp - 0x70], edx
jne 0x4b8882
cmp dword [ebp - 0xa4], edx
jne 0x4b8882
cmp dword [ebp - 0x78], edx
jne 0x4b8882
cmp dword [ebp - 0x80], edx
jne 0x4b8882
cmp dword [ebp - 0xb8], edx
je 0x4b883c
mov dword [ecx], 1
mov eax, dword [ebp - 0x50]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xffffff22
add esi, 0x29a
mov edi, dword [ebp - 0x1c]
mov dword [edi], esi
jmp 0x4b894b
cmp dword [ebp - 0x84], edx
je 0x4b8948
cmp dword [ebp - 0xfc], edx
je 0x4b8948
cmp dword [ebp - 0x104], edx
jne 0x4b8948
mov dword [ecx], 1
mov eax, dword [ebp - 0x50]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xffffff97
add esi, 0x299
mov edi, dword [ebp - 0x1c]
mov dword [edi], esi
jmp 0x4b894b
mov dword [ecx], 1
mov eax, dword [ebp - 0x50]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xffffff22
add esi, 0x29b
mov edi, dword [ebp - 0x1c]
mov dword [edi], esi
jmp 0x4b894b
cmp dword [ebp - 0x94], edx
jne 0x4b8817
cmp dword [ebp - 0x88], edx
jne 0x4b8817
cmp dword [ebp - 0xc0], edx
jne 0x4b8817
cmp dword [ebp - 0x84], edx
jne 0x4b8817
cmp dword [ebp - 0xa4], edx
jne 0x4b8817
cmp dword [ebp - 0x90], edx
jne 0x4b8817
cmp dword [ebp - 0xc8], edx
jne 0x4b8817
cmp ebx, edx
jne 0x4b8817
cmp dword [ebp - 0x6c], edx
jne 0x4b8817
cmp dword [ebp - 0x70], edx
jne 0x4b8817
cmp dword [ebp - 0x98], edx
jne 0x4b8817
cmp dword [ebp - 0x5c], edx
jne 0x4b8817
cmp dword [ebp - 0xa8], edx
jne 0x4b8817
cmp dword [ebp - 0x78], edx
jne 0x4b8817
cmp dword [ebp - 0x80], edx
jne 0x4b8817
mov eax, dword [ebp - 0x50]
cmp dword [ecx], edx
jne 0x4b74db
cmp dword [ebp - 0x88], edx
jne 0x4b897c
cmp dword [ebp - 0x90], edx
jne 0x4b897c
cmp dword [ebp - 0x98], edx
jne 0x4b897c
cmp dword [ebp - 0x5c], edx
jne 0x4b897c
cmp dword [ebp - 0xa8], edx
je 0x4b74db
mov dword [ecx], 1
neg eax
sbb eax, eax
and eax, 0xffffff24
add eax, 0x29c
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x4b74db
mov edi, 1
mov ebx, edi
xor eax, eax
mov dword [ebp - 0x144], eax
cmp eax, 0x10
jae 0x4b89c3
mov dl, byte [ebp + 0x1668]
cmp byte [ebp + eax + 0x1668], dl
je 0x4b8a42
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14c], eax
cmp eax, 0x10
jae 0x4b89e1
mov cl, byte [ebp + 0x1658]
cmp byte [ebp + eax + 0x1658], cl
je 0x4b8a48
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x134], esi
cmp dword [ebp - 0xd0], 1
jne 0x4b8b0b
cmp dword [ebp - 0x34], esi
je 0x4b8a61
mov edx, dword [ebp - 0x34]
cmp byte [edx], 0
je 0x4b8a61
push 2
push esi
push esi
mov eax, edx
push eax
call fcn.0049fdb0
add esp, 0x10
test eax, eax
je 0x4b8a2d
push esi
push str.ISOB
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b8a56
push 0x5c
mov edx, dword [ebp - 0x34]
push edx
call fcn.005e0a00
add esp, 8
test eax, eax
je 0x4b8a4e
inc eax
jmp 0x4b8a51
inc eax
jmp 0x4b89a3
inc eax
jmp 0x4b89c5
mov eax, dword [ebp - 0x34]
cmp byte [eax], 0x23
jne 0x4b8a61
mov esi, 1
mov dword [ebp - 0x134], esi
cmp dword [ebp - 0xd0], 1
jne 0x4b8b0b
test edi, edi
jne 0x4b8ab9
mov eax, 0x10
lea ecx, [ebp + 0x1638]
lea edx, [ebp + 0x1668]
cmp eax, 4
jb 0x4b8a99
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x4b8ab9
sub eax, 4
add ecx, 4
add edx, 4
jmp 0x4b8a83
mov eax, dword [ebp - 0x3c]
mov dword [eax], 1
neg esi
sbb esi, esi
and esi, 0xfffffeaf
add esi, 0x230
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], esi
jmp 0x4b8b0b
cmp dword [ebp - 0xd0], 1
jne 0x4b8b0b
test ebx, ebx
jne 0x4b8b0b
mov eax, 0x10
lea ecx, [ebp + 0x1648]
lea edx, [ebp + 0x1658]
cmp eax, 4
jb 0x4b8aed
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x4b8b0b
sub eax, 4
add ecx, 4
add edx, 4
jmp 0x4b8ad7
mov edx, dword [ebp - 0x3c]
mov dword [edx], 1
neg esi
sbb esi, esi
and esi, 0xfffffeaf
add esi, 0x230
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov edi, dword [ebp - 0x3c]
cmp dword [ebp - 0xb4], 0
je 0x4b8b26
mov dword [edi], 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0xdf
cmp dword [edi], 0
jne 0x4b74db
cmp dword [ebp - 0x8c], 0x32000
jae 0x4b8bc1
xor esi, esi
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0x34]
push edx
push str.BlockEncryptedDocsEx
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4b8ba0
mov eax, dword [ebp - 0x34]
push eax
push str.BlockEncryptedDocsEx
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.BlockEncryptedDocs
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
push str.BlockEncryptedDocsA
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
cmp dword [ebp - 0x34], esi
je 0x4b8bb9
mov dword [edi], 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0xde
jmp 0x4b74db
mov dword [ebp - 0x24], esi
jmp 0x4b74e8
mov dword [ebp - 0x24], 0
jmp 0x4b74e8
cmp dword [ebp - 0x24], 0
jne 0x4b8bf1
cmp dword [ebp - 0x4c], 0
je 0x4b8bf1
mov dword [ebp - 0x24], 1
mov dword [edi], 1
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xe1
jmp 0x4b8bfe
cmp dword [ebp - 0x64], 0
je 0x4b8bfe
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4b8c0e
push eax
call fcn.005e0865
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
call fcn.004dca10
mov esi, dword [ebp - 0x54]
push esi
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x4b8c39
push 0
push 0
mov edx, dword [ebp - 0x114]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
wait
jmp 0x4b8c75
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1678]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x167c
mov esp, ebp
pop ebp
ret