Function at 0x421ff0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa96b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1660
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc70]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x390]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x422186
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x390]
push ecx
push 0x515880
push edx
call fcn.004f175f
lea eax, [ebp - 0x390]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x390]
push 0x516b34
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4221ce
lea ecx, [ebp - 0x390]
push 0x516b34
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4221ce
lea ecx, [ebp - 0x390]
push str.._temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4221f7
lea edx, [ebp - 0x390]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5168b0
jmp 0x424abb
lea edx, [ebx - 2]
test edx, edx
jle 0x422219
cmp byte [ebp + edx - 0x390], 0x3a
jne 0x422212
cmp byte [ebp + edx - 0x38f], 0x5c
je 0x422217
dec edx
test edx, edx
jg 0x4221fe
test edx, edx
je 0x4222c5
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x1370]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x64], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x42225f
cmp byte [ebp + ebx - 0x390], 0x2e
je 0x42225f
dec ebx
test ebx, ebx
jg 0x422250
sub ebx, edx
mov byte [ebp - 0x390], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x42228a
lea esi, [ebp + edx - 0x1371]
mov edx, ecx
lea edi, [ebp - 0x390]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x38b], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4222b5
cmp byte [ebp + ecx - 0x390], 0x2e
je 0x4222b5
dec ecx
test ecx, ecx
jg 0x4222a6
test ecx, ecx
mov byte [ebp + ecx - 0x38c], 0
jne 0x4223f4
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0x390], 0
test ecx, ecx
jle 0x4222f4
mov dl, byte [esi + eax + 1]
cmp dl, 0x2e
mov byte [ebp + eax - 0x390], dl
je 0x4222f4
inc eax
cmp eax, ecx
jl 0x4222df
cmp eax, ecx
jne 0x422302
push 0x515844
jmp 0x424abb
mov ecx, dword [ebp + 8]
push 0x80
mov dl, byte [eax + ecx + 2]
mov byte [ebp + eax - 0x38f], dl
mov dl, byte [eax + ecx + 3]
mov cl, byte [eax + ecx + 4]
mov byte [ebp + eax - 0x38e], dl
lea edx, [ebp - 0x190]
mov byte [ebp + eax - 0x38d], cl
push edx
mov byte [ebp + eax - 0x38c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xbf0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x930]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x930]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4223d2
lea edx, [ebp - 0x930]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4223d2
lea eax, [ebp - 0x930]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4223d2
lea ecx, [ebp - 0x930]
lea edx, [ebp - 0x190]
push ecx
jmp 0x4223df
lea ecx, [ebp - 0x930]
lea edx, [ebp - 0xbf0]
push ecx
push edx
lea eax, [ebp - 0x390]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x422417
cmp byte [ebp + ecx - 0x390], 0x2e
je 0x422417
dec ecx
test ecx, ecx
jg 0x422408
mov byte [ebp + ecx - 0x38c], 0
lea ecx, [ebp - 0x9b0]
lea edx, [ebp - 0x390]
push ecx
push edx
call fcn.004d9590
movsx eax, ax
add esp, 8
cmp eax, 2
mov dword [ebp - 0x64], eax
jle 0x4224cc
lea eax, [ebp - 0x390]
push str.Network_Associates
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x422466
push 0x5147b4
jmp 0x424abb
lea ecx, [ebp - 0x390]
push str.kav.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x422488
push 0x5147b4
jmp 0x424abb
lea edx, [ebp - 0x390]
push str.Kav.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4224aa
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0x390]
push str.System32_smss.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4224cc
push 0x5147b4
jmp 0x424abb
lea ecx, [ebp - 0x9b0]
xor esi, esi
push str.Microsoft
push ecx
mov dword [ebp - 0xdc], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4224f6
mov dword [ebp - 0xdc], 1
lea edx, [ebp - 0x390]
push str.CCManager
push edx
mov ebx, 1
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x42251d
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0x610]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xa70]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x610]
lea eax, [ebp - 0x830]
push edx
push str._swinlogon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x390]
lea edx, [ebp - 0x830]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x42257d
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0x610]
lea ecx, [ebp - 0x830]
push eax
push str._scsrss.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x390]
lea eax, [ebp - 0x830]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4225b9
push 0x5147b4
jmp 0x424abb
lea ecx, [ebp - 0x610]
lea edx, [ebp - 0x830]
push ecx
push str._s_services.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x390]
lea ecx, [ebp - 0x830]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4225f5
push 0x5147b4
jmp 0x424abb
lea edx, [ebp - 0x610]
lea eax, [ebp - 0x830]
push edx
push str._slsass.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x390]
lea edx, [ebp - 0x830]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x422631
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0x610]
lea ecx, [ebp - 0x830]
push eax
push str._s_svchost.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x390]
lea eax, [ebp - 0x830]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x42266d
push 0x5147b4
jmp 0x424abb
lea ecx, [ebp - 0x610]
lea edx, [ebp - 0x830]
push ecx
push str._s_taskmgr.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x390]
lea ecx, [ebp - 0x830]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4226a9
push 0x5147b4
jmp 0x424abb
lea edx, [ebp - 0x610]
lea eax, [ebp - 0x830]
push edx
push str._s_spoolsv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x390]
lea edx, [ebp - 0x830]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4226e5
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0xa70]
lea ecx, [ebp - 0x830]
push eax
push str._sexplorer.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x390]
lea eax, [ebp - 0x830]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x422721
push 0x5147b4
jmp 0x424abb
lea ecx, [ebp - 0x390]
push ecx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x422743
push 0x5147b4
jmp 0x424abb
lea edx, [ebp - 0x610]
lea eax, [ebp - 0x830]
push edx
push str._sctfmon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x390]
lea edx, [ebp - 0x830]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x42277f
push 0x5147b4
jmp 0x424abb
lea eax, [ebp - 0x610]
lea ecx, [ebp - 0x830]
push eax
push str._smswsock.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x390]
lea eax, [ebp - 0x830]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4227bb
push 0x5147b4
jmp 0x424abb
lea edi, [ebp - 0x390]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x2c], esi
cmp ecx, esi
jle 0x4227f3
lea esi, [ebp + ecx - 0x390]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xef0], al
jne 0x4227ed
cmp edx, 2
jge 0x4227f3
inc edx
dec esi
cmp edx, ecx
jl 0x4227db
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x42281a
mov ebx, ecx
lea esi, [ebp - 0x390]
lea edi, [ebp - 0x11f0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x11f0], 0
test edx, edx
jle 0x422864
mov edi, dword [ebp - 0xc4]
lea esi, [ebp + eax - 0x38f]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x422843
mov byte [ebp + ecx - 0xef0], al
cmp al, 0x2e
jne 0x422848
inc edi
cmp al, 0x20
jne 0x42284d
inc edi
cmp al, 0x5c
jne 0x422859
mov byte [ebp + ecx - 0xef0], 0
inc ecx
cmp ecx, edx
jl 0x422835
mov dword [ebp - 0xc4], edi
mov al, byte [ebp - 0x11ee]
mov byte [ebp + edx - 0xef0], 0
cmp al, 0x5c
je 0x422884
mov byte [ebp - 0x11ee], 0x5c
mov byte [ebp - 0x11ed], 0
lea ecx, [ebp - 0x390]
push 0x100
lea edx, [ebp - 0x710]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0xef0]
push 0x80
lea ecx, [ebp - 0xcf0]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x390]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x4228de
push 0x5144fc
jmp 0x424abb
lea eax, [ebp - 0x390]
push 0x80
lea ecx, [ebp - 0xaf0]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x390]
push 0x80
lea eax, [ebp - 0xb70]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xa70]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x610]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xaf0], al
lea edx, [ebp - 0xaf0]
mov byte [ebp + ecx - 0xb70], al
lea ecx, [ebp - 0xa70]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x42296e
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42296e
push esi
jmp 0x424abb
lea eax, [ebp - 0x610]
lea ecx, [ebp - 0xb70]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4229a3
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4229a3
push esi
jmp 0x424abb
lea edx, [ebp - 0x390]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4229fc
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4229d6
push esi
jmp 0x424abb
lea eax, [ebp - 0x390]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4229fc
push edi
jmp 0x424abb
lea ecx, [ebp - 0x390]
push str.system32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x422a55
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x422a2f
push esi
jmp 0x424abb
lea edx, [ebp - 0x390]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x422a55
push edi
jmp 0x424abb
lea eax, [ebp - 0x390]
push str.system
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x422aae
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x422a88
push esi
jmp 0x424abb
lea ecx, [ebp - 0x390]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x422aae
push esi
jmp 0x424abb
lea edx, [ebp - 0xef0]
push str.smss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea eax, [ebp - 0xef0]
push str.winlogon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea ecx, [ebp - 0xef0]
push str.csrss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea edx, [ebp - 0xef0]
push str.services.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea eax, [ebp - 0xef0]
push str.lsass.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea ecx, [ebp - 0xef0]
push str.svchost.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea edx, [ebp - 0xef0]
push str.taskmgr.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea eax, [ebp - 0xef0]
push str.spoolsv.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
lea ecx, [ebp - 0xef0]
push str.explorer.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x424946
xor edi, edi
push 0xd8a430
mov dword [ebp - 4], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x390]
push 0xd8a430
push edx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x422c16
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x390]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x42345d
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x10c], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xf4], eax
jne 0x422ca5
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov eax, dword [0xd8a438]
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0xfc], esi
jne 0x423336
mov dword [ebp + 8], 6
jmp 0x42344b
mov dword [ebp - 0xe4], edi
cmp dword [eax + 0x10], edi
je 0x422c72
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd8a438]
mov eax, dword [ebp - 0x10c]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov ebx, eax
inc ecx
push 0x515c98
push ebx
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov edi, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x110], eax
cmp esi, 0x69
jge 0x422d88
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x422d82
cmp esi, 0xf
jle 0x422d23
cmp esi, 0x12
jge 0x422d23
mov dword [ebp - 0x40], edi
cmp esi, 0x1d
je 0x422d32
cmp esi, 0x1e
je 0x422d32
cmp esi, 0x39
jne 0x422d35
mov dword [ebp - 0x68], edi
cmp esi, 0x1f
je 0x422d3f
cmp esi, 0x20
jne 0x422d42
mov dword [ebp - 0x50], edi
cmp esi, 0x21
je 0x422d4c
cmp esi, 0x22
jne 0x422d4f
mov dword [ebp - 0x60], edi
cmp esi, 0x23
je 0x422d59
cmp esi, 0x24
jne 0x422d5c
mov dword [ebp - 0x58], edi
cmp esi, 0x2c
jne 0x422d67
mov dword [ebp - 0x44], edi
inc esi
jmp 0x422cf3
cmp esi, 0x2d
je 0x422d7f
cmp esi, 0x2e
jne 0x422d7a
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x422cf3
cmp esi, 0x3d
jne 0x422d82
mov dword [ebp - 0x28], edi
inc esi
jmp 0x422cf3
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0x8c], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd8a438]
mov dword [ebp - 0xfc], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0xe4]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x422dd0
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x24], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x422c72
mov ebx, 1
mov eax, dword [eax]
test eax, eax
je 0x423278
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x422e5f
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9d0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [ebp - 0x9d0]
jmp 0x422edf
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x422e96
xor edx, edx
lea eax, [ebp - 0x730]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [esi + 2]
jmp 0x422edf
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9f0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [ebp - 0x9f0]
xor esi, esi
cmp esi, 0x69
jge 0x42322c
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x423226
cmp esi, 0x45
jne 0x422fad
lea edx, [ebp - 0xbf0]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xbf0]
lea ecx, [ebp - 0x190]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x190]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x422f86
lea eax, [ebp - 0x9b0]
lea ecx, [ebp - 0xff0]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xff0]
push ecx
jmp 0x424abb
lea edx, [ebp - 0x9b0]
lea eax, [ebp - 0xff0]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xff0]
push ecx
jmp 0x424abb
test esi, esi
jne 0x422fba
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x422ee1
cmp esi, ebx
jne 0x422fc7
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x422ee1
cmp esi, 2
je 0x423226
cmp esi, 4
jne 0x422fe1
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x422ee1
cmp esi, 5
jne 0x422ff2
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x422ee1
cmp esi, 6
jne 0x423003
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x422ee1
cmp esi, 7
jne 0x423014
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x422ee1
cmp esi, 8
jne 0x423025
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x422ee1
cmp esi, 9
jne 0x423036
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x422ee1
cmp esi, 0xa
jne 0x423044
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x422ee1
cmp esi, 0xb
jle 0x423051
cmp esi, 0xf
jge 0x423054
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x42305f
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x422ee1
jle 0x423069
cmp esi, 0x12
jge 0x423069
mov dword [ebp - 0x40], ebx
cmp esi, 0x1b
jne 0x42307a
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x1c
jne 0x42308b
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x1d
je 0x42309a
cmp esi, 0x1e
je 0x42309a
cmp esi, 0x39
jne 0x42309d
mov dword [ebp - 0x68], ebx
cmp esi, 0x1f
je 0x4230a7
cmp esi, 0x20
jne 0x4230aa
mov dword [ebp - 0x50], ebx
cmp esi, 0x21
je 0x4230b4
cmp esi, 0x22
jne 0x4230b7
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x4230c1
cmp esi, 0x24
jne 0x4230c4
mov dword [ebp - 0x58], ebx
cmp esi, 0x25
je 0x4230ce
cmp esi, 0x26
jne 0x4230d4
mov dword [ebp - 0xa0], ebx
cmp esi, 0x27
jne 0x4230e5
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x28
jne 0x4230f6
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x29
jne 0x423107
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x2c
jne 0x423115
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x2d
jne 0x423123
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x2e
jne 0x423131
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x2f
jne 0x423142
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x30
jne 0x423153
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x31
jne 0x423164
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x32
jne 0x423172
mov dword [ebp - 0x7c], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x34
jne 0x423183
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x35
jne 0x423194
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x36
jne 0x4231a5
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x37
jne 0x4231ba
mov dword [ebp - 0xb4], 0
inc esi
jmp 0x422ee1
cmp esi, 0x38
jne 0x4231cb
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x3a
je 0x4231da
cmp esi, 0x3b
je 0x4231da
cmp esi, 0x3c
jne 0x4231e0
mov dword [ebp - 0xcc], ebx
cmp esi, 0x3d
jne 0x4231ee
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x3e
jne 0x4231ff
mov dword [ebp - 0xd4], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x3f
jne 0x42320d
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x40
jne 0x42321b
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x422ee1
cmp esi, 0x41
jne 0x423226
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x422ee1
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x110]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x5c], ecx
jne 0x423240
inc dword [ebp - 0x80]
cmp dword [ebp - 0x5c], 0xc350
jg 0x423278
mov esi, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x8c], esi
mov esi, dword [ebp - 0xfc]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x422df4
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov edx, dword [ebp - 0x8c]
mov ecx, eax
push edx
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xf4]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xf4], eax
xor edi, edi
jmp 0x422cab
mov ecx, dword [0xd8a438]
push ecx
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], ebx
cmp bx, word [esi + 2]
jae 0x42344b
xor edx, edx
push str..asp
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], edx
mov byte [ebp - 0x6c], dl
mov eax, dword [edi]
mov dword [ebp - 0x74], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x74]
mov dword [ebp - 0x70], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x423387
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x74]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42339f
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x74]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4233b7
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x74]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4233cf
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x74]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4233e7
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x74]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4233ff
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x24], eax
jg 0x42344b
mov esi, dword [ebp - 0xfc]
add edi, 0x28
inc ebx
jmp 0x42334a
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 4], 0
mov ebx, 1
mov edx, dword [0xd8a438]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x423499
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x4234b4
push 0x515b6c
jmp 0x424abb
mov eax, dword [ebp - 0x80]
mov dword [ebp + 8], edi
test esi, esi
mov dword [ebp - 0x18], eax
je 0x423bc5
cmp edi, ebx
jge 0x423bc5
lea ecx, [ebp - 0x11f0]
xor esi, esi
push ecx
mov dword [ebp - 0x1c], esi
call fcn.004f2beb
jmp 0x4234f0
lea edx, [ebp - 0xef0]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0xff0]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x423521
push ebx
lea ecx, [ebp - 0x158]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x42354b
lea ecx, [ebp - 0xff0]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x42355f
lea edx, [ebp - 0x710]
push str.c:endpcachemonitor_procPath5.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x158]
push eax
push ebx
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp - 0x24], esi
call fcn.004f0727
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x154]
cmp dword [eax + 0x30], 0xffffffff
jne 0x4235ab
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x423763
mov edi, dword [ebp - 0x154]
push 0xa
lea eax, [ebp - 0x930]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x154], edi
call fcn.004f0ae9
lea edi, [ebp - 0x930]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x423b57
lea ecx, [ebp - 0x930]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x423608
mov dword [ebp - 0x100], ebx
lea edx, [ebp - 0x930]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42362a
push 0x5147b4
jmp 0x42375b
lea eax, [ebp - 0x930]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x423b57
lea ecx, [ebp - 0x930]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x423b57
lea edx, [ebp - 0x930]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x423b57
cmp dword [ebp - 0x3c], ebx
jne 0x423686
inc dword [ebp + 8]
cmp dword [ebp - 0x14], ebx
jne 0x42368e
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x423b54
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x930]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x423b4e
mov ecx, dword [ebp - 0xc0]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xc0], ecx
jne 0x423792
lea edx, [ebp - 0xbf0]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xbf0]
lea ecx, [ebp - 0x1270]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1270]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x423739
lea edx, [ebp - 0x9b0]
lea eax, [ebp - 0x1370]
push edx
push 0x5153f4
push eax
jmp 0x42374c
lea ecx, [ebp - 0x9b0]
lea edx, [ebp - 0x1370]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1370]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x144]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x144]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x423812
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x4237b2
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x930]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x930]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x930]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x42388a
test ebx, ebx
jne 0x42388a
test eax, eax
jne 0x42388a
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x423692
cmp esi, 0x1a
jne 0x42389e
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x423836
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x930]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x930]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x930]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x42388a
test ebx, ebx
jne 0x42388a
test eax, eax
jne 0x42388a
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x423692
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x423692
cmp esi, 0x2a
jne 0x4238b5
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x423692
cmp esi, 0x2b
jne 0x4238cc
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x423692
cmp esi, edi
jne 0x4238d9
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x423692
cmp esi, ebx
jne 0x4238e6
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x423692
cmp esi, 2
je 0x423b4e
cmp esi, 4
jne 0x423900
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x423692
cmp esi, 5
jne 0x423911
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x423692
cmp esi, 6
jne 0x423922
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x423692
cmp esi, 7
jne 0x423933
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x423692
cmp esi, 8
jne 0x423944
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x423692
cmp esi, 9
jne 0x423955
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x423692
cmp esi, 0xa
jne 0x423963
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x423692
cmp esi, 0xb
jle 0x423970
cmp esi, 0xf
jge 0x423973
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x42397e
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x423692
jle 0x423988
cmp esi, 0x12
jge 0x423988
mov dword [ebp - 0x40], ebx
cmp esi, 0x11
jle 0x423995
cmp esi, 0x19
jge 0x423995
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x4239a6
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x423692
cmp esi, 0x1c
jne 0x4239b7
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x423692
cmp esi, 0x1d
je 0x4239c6
cmp esi, 0x1e
je 0x4239c6
cmp esi, 0x39
jne 0x4239c9
mov dword [ebp - 0x68], ebx
cmp esi, 0x1f
je 0x4239d3
cmp esi, 0x20
jne 0x4239d6
mov dword [ebp - 0x50], ebx
cmp esi, 0x21
je 0x4239e0
cmp esi, 0x22
jne 0x4239e3
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x4239ed
cmp esi, 0x24
jne 0x4239f0
mov dword [ebp - 0x58], ebx
cmp esi, 0x25
je 0x4239fa
cmp esi, 0x26
jne 0x423a00
mov dword [ebp - 0xa0], ebx
cmp esi, 0x27
jne 0x423a11
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x423692
cmp esi, 0x28
jne 0x423a22
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x423692
cmp esi, 0x29
jne 0x423a33
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x423692
cmp esi, 0x2c
jne 0x423a41
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x423692
cmp esi, 0x2d
jne 0x423a4f
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x423692
cmp esi, 0x2e
jne 0x423a5d
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x423692
cmp esi, 0x2f
jne 0x423a6e
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x423692
cmp esi, 0x30
jne 0x423a7f
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x423692
cmp esi, 0x31
jne 0x423a90
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x423692
cmp esi, 0x32
jne 0x423a9e
mov dword [ebp - 0x7c], ebx
inc esi
jmp 0x423692
cmp esi, 0x34
jne 0x423aaf
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x423692
cmp esi, 0x35
jne 0x423ac0
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x423692
cmp esi, 0x36
jne 0x423ad1
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x423692
cmp esi, 0x37
jne 0x423ae2
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x423692
cmp esi, 0x38
jne 0x423af3
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x423692
cmp esi, 0x3a
je 0x423b02
cmp esi, 0x3b
je 0x423b02
cmp esi, 0x3c
jne 0x423b08
mov dword [ebp - 0xcc], ebx
cmp esi, 0x3d
jne 0x423b16
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x423692
cmp esi, 0x3e
jne 0x423b27
mov dword [ebp - 0xd4], ebx
inc esi
jmp 0x423692
cmp esi, 0x3f
jne 0x423b35
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x423692
cmp esi, 0x40
jne 0x423b43
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x423692
cmp esi, 0x41
jne 0x423b4e
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x423692
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x150], 1
je 0x4235ab
lea ecx, [ebp - 0x158]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jle 0x423b8a
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
jle 0x423b96
sub eax, ecx
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xec]
test ecx, ecx
jne 0x423bab
cmp eax, 6
jle 0x423bab
sub eax, 6
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x144]
call fcn.004f05fb
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 0x590], 0
cmp eax, ebx
mov dword [ebp - 0x14], 0
jle 0x423c09
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
jmp 0x423c0f
mov ebx, dword [ebp - 0x104]
cmp dword [ebp - 0x88], 1
jne 0x423c48
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x423c91
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xe0]
mov eax, 1
cmp ecx, eax
jne 0x423cd5
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x423d10
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], eax
jne 0x423d4e
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], eax
je 0x423d5e
cmp dword [ebp - 0x98], eax
jne 0x423d93
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
jne 0x423dd1
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa0], eax
jne 0x423e0e
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], eax
jne 0x423e4c
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x423e87
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
jne 0x423ecc
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], eax
jne 0x423f0a
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x423f48
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x423f86
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x42401f
cmp dword [ebp - 0xb8], eax
je 0x423fac
cmp dword [ebp - 0xf8], eax
je 0x423fac
lea edx, [ebp - 0x590]
mov edi, 0x515278
jmp 0x423ff4
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x7c]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x590]
mov edi, 0x515258
je 0x423ff4
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x84], eax
jne 0x42405d
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x424098
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
jne 0x4240d3
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x424152
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xdc]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp eax, esi
jne 0x424157
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dword [ebp - 0x14], esi
jmp 0x424157
mov esi, 1
cmp dword [ebp - 0x94], esi
jne 0x42420f
cmp dword [ebp - 0x9c], esi
jne 0x42420f
cmp dword [ebp - 0xa4], esi
jne 0x42420f
cmp dword [ebp - 0xac], esi
jne 0x4241c5
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x590]
cmp eax, esi
mov edi, 0x5151ec
je 0x42419a
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xb4], esi
jne 0x42420f
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x590]
cmp eax, esi
mov edi, 0x5151c4
je 0x4241e4
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xbc], esi
jne 0x42424c
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x68], esi
jne 0x424287
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x50], esi
jne 0x4242c2
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x60], esi
jne 0x4242fd
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x424338
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x42437f
mov eax, dword [ebp - 0x100]
test eax, eax
jne 0x42437f
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xc4], esi
jle 0x4243bd
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x44], esi
jne 0x4243f8
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x28], esi
jne 0x424433
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x4c], esi
jne 0x42446d
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xcc], esi
jne 0x4244ab
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xd4], esi
jne 0x4244e8
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, dword [ebp - 0x1c]
mov ecx, 4
cmp eax, esi
je 0x4244fb
lea ecx, [eax*4]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
jl 0x424509
cmp edx, 7
jge 0x424550
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x590]
cmp eax, esi
mov edi, 0x5150f8
je 0x424520
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
jle 0x42459a
cmp dword [ebp - 0x1c], esi
jne 0x42459a
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, 1
mov dword [ebp - 0x14], esi
mov eax, esi
cmp dword [ebp - 0x54], esi
jne 0x4245df
cmp ecx, 5
jge 0x4245df
test ecx, ecx
jle 0x4245df
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x590]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0x64]
cmp ecx, 6
jle 0x424603
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x424603
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x424603
test eax, eax
jne 0x424603
push 0x5147b4
jmp 0x424abb
cmp ecx, 7
jge 0x4246d3
cmp dword [ebp - 0x2c], esi
jne 0x42468c
cmp ecx, esi
lea edx, [ebp - 0x590]
jge 0x424656
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x4246d2
mov dword [ebp - 0x14], 1
jmp 0x4246d2
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x4246d2
jmp 0x4246cf
cmp ecx, esi
lea edx, [ebp - 0x590]
mov edi, 0x515078
jl 0x4246a0
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x4246d2
mov dword [ebp - 0x14], eax
inc ebx
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x42479c
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x42479c
cmp dword [ebp - 0x64], 6
jle 0x42479c
cmp dword [ebp - 0xdc], 1
jne 0x4247b4
push 0xd9b940
push 0xd6d890
lea eax, [ebp - 0x390]
push 0xd56eac
push eax
call fcn.004b7fe0
add esp, 0x10
lea ecx, [ebp - 0x390]
movsx esi, ax
push 0xd4f1d0
push ecx
call fcn.004b83e0
add esp, 8
cmp esi, 6
jle 0x42479c
push 0xd56eac
push 0xd9b8c0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42479c
push 0xd6d890
push 0xe56a50
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42479c
push 0xd9b940
push 0xdb1c0c
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42479c
push 0xd4f1d0
push 0xd4f350
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42479c
push 0x515044
jmp 0x424abb
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x4247be
push 0x5147b4
jmp 0x424abb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x424812
mov ecx, dword [ebp - 0x30]
mov eax, 1
cmp ecx, eax
je 0x424812
cmp dword [ebp - 0x14], eax
je 0x424812
cmp ebx, eax
jle 0x4247b4
lea edx, [ebp - 0x590]
lea eax, [ebp - 0x1670]
push edx
push 0x515004
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1670]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x590]
lea eax, [ebp - 0x1470]
push edx
push 0x514fd8
push eax
call fcn.004f175f
lea ecx, [ebp - 0x710]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x424865
lea edx, [ebp - 0x710]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x424865
lea eax, [ebp - 0x710]
push eax
call fcn.004abcc0
add esp, 4
mov eax, dword [ebp - 0x108]
test eax, eax
jne 0x42487e
lea ecx, [ebp - 0xef0]
push ecx
call fcn.004ab130
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x710]
push edx
call esi
lea eax, [ebp - 0x710]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x424902
lea ecx, [ebp - 0x710]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x710]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x710]
push eax
call esi
test eax, eax
jne 0x424902
lea ecx, [ebp - 0x710]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x424902
lea edx, [ebp - 0x710]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x590]
mov edi, 0x515b34
jmp 0x424a66
lea edx, [ebp - 0x590]
mov edi, 0x5159c4
jmp 0x424a66
lea ecx, [ebp - 0x710]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42496d
lea edx, [ebp - 0x710]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x710]
push eax
call esi
lea ecx, [ebp - 0x710]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x424a3a
lea edx, [ebp - 0x710]
push edx
call fcn.004ab990
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 4
lea eax, [ebp - 0x710]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x710]
push ecx
call esi
test eax, eax
jne 0x4249f3
lea edx, [ebp - 0x710]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4249f3
lea eax, [ebp - 0x710]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x590]
mov edi, 0x5158dc
jmp 0x4249fe
lea edx, [ebp - 0x590]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x710]
push ecx
call ebx
lea edx, [ebp - 0x710]
push edx
call fcn.004f2cb8
add esp, 4
jmp 0x424a83
lea eax, [ebp - 0x710]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x710]
push ecx
call fcn.004f2cb8
add esp, 4
lea edx, [ebp - 0x590]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xe56d20]
lea edi, [ebp - 0x710]
inc eax
or ecx, 0xffffffff
mov dword [0xe56d20], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x590]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret