Function at 0x410fd0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa8eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1c1c
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x132c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
lea ebx, [ebp - 0x41c]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x4111ec
push edx
lea ecx, [ebp - 0x41c]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x41c]
push str._ProgramFiles_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411292
xor eax, eax
test ebx, ebx
jle 0x41121d
cmp byte [ebp + eax - 0x41c], 0x5c
je 0x41121d
inc eax
cmp eax, ebx
jl 0x41120e
mov ecx, ebx
sub ecx, eax
test ecx, ecx
jle 0x411240
mov edx, ecx
lea esi, [ebp + eax - 0x41c]
lea edi, [ebp - 0x162c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x132c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x21c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x21c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x41c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x162c]
mov byte [ebp - 0x219], 0
push ecx
push edx
push str._sProgram_Files_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x41c], al
jle 0x411632
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0xa9c]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 0xa8e], 0
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4113a5
lea edx, [ebp - 0x21c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xbf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x21a], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbf4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x411374
lea eax, [ecx - 0xe]
lea esi, [ebp - 0xbe6]
mov ecx, eax
lea edi, [ebp - 0xe8c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xe8c], 0
lea eax, [ebp - 0xe8c]
lea ecx, [ebp - 0x21c]
push eax
push ecx
lea edx, [ebp - 0x41c]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x41c], 0
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0xa9c]
push str.Systemroot
push eax
mov byte [ebp - 0xa92], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x411481
lea ecx, [ebp - 0x21c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xbf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbf4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x411439
lea eax, [ecx - 0xa]
lea esi, [ebp - 0xbea]
mov ecx, eax
lea edi, [ebp - 0xe8c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xe8c], 0
lea eax, [ebp - 0xe8c]
lea ecx, [ebp - 0x21c]
push eax
push ecx
lea edx, [ebp - 0x41c]
push 0x50e0ec
push edx
mov byte [ebp - 0x41c], 0
call fcn.004f175f
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x41c], al
lea eax, [ebp - 0xa9c]
push str.system32
push eax
mov byte [ebp - 0xa94], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41155d
lea ecx, [ebp - 0x21c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xbf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbf4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x411515
lea eax, [ecx - 8]
lea esi, [ebp - 0xbec]
mov ecx, eax
lea edi, [ebp - 0xe8c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xe8c], 0
lea eax, [ebp - 0xe8c]
lea ecx, [ebp - 0x21c]
push eax
push ecx
lea edx, [ebp - 0x41c]
push 0x50e0ec
push edx
mov byte [ebp - 0x41c], 0
call fcn.004f175f
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x41c], al
lea eax, [ebp - 0xa9c]
push str._Windir_
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x411632
lea ecx, [ebp - 0x21c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xbf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbf4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x4115ea
lea eax, [ecx - 8]
lea esi, [ebp - 0xbec]
mov ecx, eax
lea edi, [ebp - 0xe8c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xe8c], 0
lea eax, [ebp - 0xe8c]
lea ecx, [ebp - 0x21c]
push eax
push ecx
lea edx, [ebp - 0x41c]
push 0x50e0ec
push edx
mov byte [ebp - 0x41c], 0
call fcn.004f175f
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x41c], al
cmp byte [ebp - 0x41c], 0x22
jne 0x411683
xor ecx, ecx
test ebx, ebx
jle 0x41165a
lea edx, [ebp - 0x162c]
mov al, byte [ebp + ecx - 0x41c]
cmp al, 0x22
je 0x411655
mov byte [edx], al
inc edx
inc ecx
cmp ecx, ebx
jl 0x411647
lea edi, [ebp - 0x162c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x41c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebp - 0x41c]
xor edx, edx
cmp al, 0x25
jne 0x411694
mov edx, 1
lea eax, [ebx - 2]
test eax, eax
mov dword [ebp + 8], eax
jle 0x4116c6
mov cl, byte [ebp + eax - 0x41c]
cmp cl, 0x3a
jne 0x4116b4
cmp byte [ebp + eax - 0x41b], 0x5c
je 0x4116c3
cmp edx, 1
jne 0x4116be
cmp cl, 0x5c
je 0x4116cd
dec eax
test eax, eax
jg 0x41169e
mov dword [ebp + 8], eax
cmp edx, 1
jne 0x411731
jmp 0x4116d0
mov dword [ebp + 8], eax
sub ebx, eax
xor ecx, ecx
dec ebx
test ebx, ebx
jle 0x4116fb
mov ecx, dword [ebp + 8]
lea edi, [ebp - 0xbf4]
lea esi, [ebp + ecx - 0x41b]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov byte [ebp + ecx - 0xbf4], 0
lea edi, [ebp - 0xbf4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x41c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41184a
test eax, eax
je 0x41184a
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x162c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x515e8c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x41c]
xor esi, esi
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411781
mov esi, 1
lea edx, [ebp - 0x41c]
push 0x515e88
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41179e
mov esi, 1
test ebx, ebx
jle 0x4117de
mov cl, 0x65
mov al, byte [ebp + ebx - 0x41c]
cmp esi, 1
jne 0x4117cb
cmp al, 0x2e
jne 0x4117d9
mov dl, byte [ebp + ebx - 0x41b]
cmp dl, cl
je 0x4117de
cmp al, al
jne 0x4117d9
mov al, dl
cmp al, 0x45
je 0x4117de
jmp 0x4117d9
cmp al, 0x2e
jne 0x4117d9
cmp byte [ebp + ebx - 0x41b], 0x2e
jne 0x4117de
dec ebx
test ebx, ebx
jg 0x4117a4
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x41c], 0
sub ebx, ecx
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x41180f
mov eax, dword [ebp + 8]
mov edx, ecx
lea edi, [ebp - 0x41c]
lea esi, [ebp + eax - 0x162d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x417], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41183a
cmp byte [ebp + ecx - 0x41c], 0x2e
je 0x41183a
dec ecx
test ecx, ecx
jg 0x41182b
test ecx, ecx
mov byte [ebp + ecx - 0x418], 0
jne 0x411910
lea eax, [ebp - 0x21c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x122c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa9c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa9c]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4118ee
lea edx, [ebp - 0xa9c]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4118ee
lea eax, [ebp - 0xa9c]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4118ee
lea ecx, [ebp - 0xa9c]
lea edx, [ebp - 0x21c]
push ecx
jmp 0x4118fb
lea ecx, [ebp - 0xa9c]
lea edx, [ebp - 0x122c]
push ecx
push edx
lea eax, [ebp - 0x41c]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x411933
cmp byte [ebp + ecx - 0x41c], 0x2e
je 0x411933
dec ecx
test ecx, ecx
jg 0x411924
mov byte [ebp + ecx - 0x418], 0
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004ab3c0
mov ebx, eax
add esp, 4
cmp ebx, 1
jge 0x41195b
push 0x515e70
jmp 0x415620
lea edx, [ebp - 0x182c]
lea eax, [ebp - 0x71c]
push edx
lea ecx, [ebp - 0x41c]
push eax
push ecx
mov dword [ebp - 0x7c], ebx
call fcn.004d9d40
movsx esi, ax
lea edx, [ebp - 0x71c]
push str.Microsoft
push edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4119f3
lea eax, [ebp - 0x182c]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4119be
mov dword [ebp - 0x28], 1
jmp 0x4119f3
mov edi, 0x515e60
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x120], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x20]
mov edi, 1
cmp esi, edi
jge 0x411a0e
cmp ebx, 0xc8000
jle 0x411a66
push 0x515e50
jmp 0x415620
cmp ebx, 0xc8000
jle 0x411a66
lea ecx, [ebp - 0x71c]
push str.Microsoft
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x411a66
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x162c]
push edx
push 0x515e38
push eax
call fcn.004f175f
lea ecx, [ebp - 0x162c]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x41c]
push str.Program_Files_
push edx
mov dword [ebp - 0x54], 0
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411a88
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x41c]
push str.program_files_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411aa3
mov dword [ebp - 0x54], edi
lea ecx, [ebp - 0xcac]
lea edx, [ebp - 0x12ac]
push ecx
lea eax, [ebp - 0x41c]
push edx
push eax
mov byte [ebp - 0xcac], 0
call fcn.004ca130
lea ecx, [ebp - 0x12ac]
push ecx
push str.PowerWord
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411ae6
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x71c]
push str.Maxthon_International
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411b08
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x71c]
push str.MoreQuick
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411b2a
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x71c]
push str.Opera_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411b4c
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x41c]
push 0x5156a4
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411b6e
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x41c]
push str.java
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411b90
push 0x5147b4
jmp 0x415620
cmp esi, 2
jle 0x411bb7
lea ecx, [ebp - 0x41c]
push str.System32_smss.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411bb7
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x71c]
push str.Beijing_Rising
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411bd9
push 0x5157e4
jmp 0x415620
lea eax, [ebp - 0x71c]
push str.Eset
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411c19
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x71c]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411c3b
push 0x515790
jmp 0x415620
lea edx, [ebp - 0x71c]
push str.Trend_Micro_Inc
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411c5d
push 0x5157c4
jmp 0x415620
lea eax, [ebp - 0x71c]
push str.Symantec_Corporation
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411c7f
push 0x515764
jmp 0x415620
lea ecx, [ebp - 0x71c]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411ca1
push 0x51570c
jmp 0x415620
lea edx, [ebp - 0x71c]
push str.Panda_Software
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411ce1
mov edi, 0x5156ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x71c]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411d03
push 0x5156c8
jmp 0x415620
lea edx, [ebp - 0x71c]
push 0x5156bc
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411d25
push 0x5156ac
jmp 0x415620
lea eax, [ebp - 0x71c]
push str.F_Secure_Corporation
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411d47
push 0x515dec
jmp 0x415620
lea ecx, [ebp - 0x71c]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411d69
push 0x515740
jmp 0x415620
lea edx, [ebp - 0x71c]
push str.McAfee_Inc
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411d8b
push 0x515740
jmp 0x415620
lea eax, [ebp - 0x71c]
push str.Avira_GmbH
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411dad
push 0x515dd0
jmp 0x415620
lea ecx, [ebp - 0x71c]
push 0x515dc8
push ecx
call fcn.004f2d80
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x411dd1
push 0x515dbc
jmp 0x415620
lea edx, [ebp - 0x41c]
push str.32A6Wizard_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x411df3
push 0x515dbc
jmp 0x415620
lea eax, [ebp - 0x89c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xd6c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._swinlogon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411e53
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._scsrss.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411e8f
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._s_services.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411ecb
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._slsass.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411f07
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._s_svchost.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411f43
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._suserinit.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411f7f
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._s_taskmgr.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411fbb
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._s_spoolsv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x411ff7
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0xd6c]
lea edx, [ebp - 0x99c]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412033
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x41c]
push edx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x412055
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._sctfmon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412091
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4120cd
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412109
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._swsock32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412145
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._sws2_32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412181
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4121bd
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0x89c]
lea ecx, [ebp - 0x99c]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4121f9
push 0x5147b4
jmp 0x415620
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x99c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412235
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0x89c]
lea eax, [ebp - 0x99c]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x41c]
lea edx, [ebp - 0x99c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x412271
push 0x5147b4
jmp 0x415620
lea eax, [ebp - 0xd6c]
lea ecx, [ebp - 0x99c]
push eax
push str._s_anotherlockfile.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x99c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4122ad
push 0x5147b4
jmp 0x415620
cmp dword [ebp - 0x28], 1
jne 0x41232b
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x99c]
push ecx
push str._sIMETINTLGNTTINTSETP.EXE
push edx
call fcn.004f175f
lea eax, [ebp - 0x99c]
lea ecx, [ebp - 0x41c]
push eax
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4122ef
push 0x5147b4
jmp 0x415620
lea edx, [ebp - 0xd6c]
lea eax, [ebp - 0x99c]
push edx
push str._sIMEimjp8_1IMJPMIG.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0x99c]
lea edx, [ebp - 0x41c]
push ecx
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x41232b
push 0x5147b4
jmp 0x415620
lea edi, [ebp - 0x41c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x34], ebx
test ecx, ecx
mov dword [ebp - 0x18], ebx
jle 0x412366
lea esi, [ebp + ecx - 0x41c]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0x10ac], al
jne 0x412360
cmp edx, 2
jge 0x412366
inc edx
dec esi
cmp edx, ecx
jl 0x41234e
sub ecx, edx
xor eax, eax
mov edi, ecx
test edi, edi
jle 0x41238f
mov esi, dword [ebp - 0x18]
mov cl, byte [ebp + eax - 0x41c]
cmp cl, 0x5c
mov byte [ebp + eax - 0x152c], cl
jne 0x412387
inc esi
inc eax
cmp eax, edi
jl 0x412373
mov dword [ebp - 0x18], esi
xor esi, esi
mov byte [ebp + edi - 0x152c], 0
test edx, edx
jle 0x4123d9
mov ecx, dword [ebp - 0x118]
lea edi, [ebp + edi - 0x41b]
mov al, byte [esi + edi]
cmp al, 0x5c
je 0x4123b8
mov byte [ebp + esi - 0x10ac], al
cmp al, 0x2e
jne 0x4123bd
inc ecx
cmp al, 0x20
jne 0x4123c2
inc ecx
cmp al, 0x5c
jne 0x4123ce
mov byte [ebp + esi - 0x10ac], 0
inc esi
cmp esi, edx
jl 0x4123aa
mov dword [ebp - 0x118], ecx
mov al, byte [ebp - 0x152a]
mov byte [ebp + edx - 0x10ac], 0
cmp al, 0x5c
je 0x4123f9
mov byte [ebp - 0x152a], 0x5c
mov byte [ebp - 0x1529], 0
lea eax, [ebp - 0x41c]
push 0x100
lea ecx, [ebp - 0x81c]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x10ac]
push 0x40
lea eax, [ebp - 0xcec]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x152c]
push ecx
call fcn.004cb750
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x194], eax
jne 0x4124da
lea edx, [ebp - 0x81c]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x81c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4124a6
lea edx, [ebp - 0x81c]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4124a6
lea eax, [ebp - 0x81c]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x61c]
mov edi, 0x515d4c
jmp 0x4124b1
lea edx, [ebp - 0x61c]
mov edi, 0x515d28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x61c]
push ecx
jmp 0x415620
mov edi, 1
cmp eax, edi
jne 0x4124e6
mov dword [ebp - 0x60], edi
lea edx, [ebp - 0x152c]
push edx
call fcn.004db090
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x412522
push 0x5144fc
jmp 0x415620
lea ecx, [ebp - 0x41c]
push 0x515d14
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41253d
mov dword [ebp - 0x60], edi
lea edx, [ebp - 0x41c]
push str.Microsoft_SharedMSINFO
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x412558
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x41c]
push str.Microsoft_SharedMSInfo
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x412573
mov dword [ebp - 0x60], edi
lea ecx, [ebp - 0x41c]
push 0x80
lea edx, [ebp - 0x11ac]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x41c]
push 0x80
lea ecx, [ebp - 0x112c]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0xd6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x89c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x11ac], al
lea edx, [ebp - 0xd6c]
mov byte [ebp + ecx - 0x112c], al
lea eax, [ebp - 0x11ac]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x41260a
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x412603
push esi
jmp 0x415620
mov dword [ebp - 0x70], 1
lea ecx, [ebp - 0x89c]
lea edx, [ebp - 0x112c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x412644
mov ebx, 1
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x412644
push esi
jmp 0x415620
lea eax, [ebp - 0x41c]
push str.System32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4126a2
mov ebx, 1
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41267c
push esi
jmp 0x415620
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4126a2
push edi
jmp 0x415620
lea edx, [ebp - 0x41c]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x412700
mov ebx, 1
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4126da
push esi
jmp 0x415620
lea eax, [ebp - 0x41c]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x412700
push edi
jmp 0x415620
lea ecx, [ebp - 0x41c]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41275e
mov ebx, 1
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x412738
push esi
jmp 0x415620
lea edx, [ebp - 0x41c]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41275e
push esi
jmp 0x415620
lea eax, [ebp - 0x10ac]
push str.smss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea ecx, [ebp - 0x10ac]
push str.winlogon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea edx, [ebp - 0x10ac]
push str.csrss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea eax, [ebp - 0x10ac]
push str.services.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea ecx, [ebp - 0x10ac]
push str.lsass.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea edx, [ebp - 0x10ac]
push str.svchost.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea eax, [ebp - 0x10ac]
push str.taskmgr.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea ecx, [ebp - 0x10ac]
push str.spoolsv.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea edx, [ebp - 0x10ac]
push str.explorer.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea eax, [ebp - 0x10ac]
push str.userinit.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea ecx, [ebp - 0x10ac]
push str.ctfmon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
lea edx, [ebp - 0x10ac]
push str.conime.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41552a
xor esi, esi
xor edi, edi
push 0xd8a430
mov dword [ebp - 4], esi
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x180], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x80], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x50], esi
call fcn.004a6b50
add esp, 4
lea eax, [ebp - 0x41c]
push 0xd8a430
push eax
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x412942
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 1
jmp 0x4133fd
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x188], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0xb4], eax
test eax, eax
jne 0x4129d2
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 0
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
add esp, 4
mov dword [ebp - 0x168], eax
test eax, eax
jne 0x41328e
mov dword [ebp + 8], 6
jmp 0x4133ed
mov dword [ebp - 0x138], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41299e
mov ecx, dword [ebp - 0xb4]
mov eax, dword [0xd8a438]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x188]
push edx
push eax
push ecx
call fcn.004a6c30
add esp, 0xc
mov edi, eax
mov eax, dword [ebp - 0x24]
inc eax
push 0x515c98
push edi
mov dword [ebp - 0x24], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x198], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push edi
mov dword [ebp - 0x19c], eax
call fcn.004f61e0
mov ecx, dword [ebp - 0xa0]
add esp, 0x18
neg eax
sbb eax, eax
inc eax
inc ecx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x194]
test eax, eax
mov dword [ebp - 0xa0], ecx
jne 0x412aa5
lea edx, [ebp - 0x152c]
push edi
push edx
lea eax, [ebp - 0x1664]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1664]
push ecx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x412aa5
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x58]
inc edx
add ecx, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x70], 1
jne 0x412ae6
test ebx, ebx
jne 0x412ae6
cmp dword [ebp - 0x18], 2
jle 0x412b2f
lea edx, [ebp - 0x152c]
push edi
push edx
lea eax, [ebp - 0xc2c]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x412b2f
jmp 0x412b20
cmp ebx, 1
jne 0x412b2f
cmp dword [ebp - 0x18], 3
jle 0x412b2f
lea edx, [ebp - 0x152c]
push edi
push edx
lea eax, [ebp - 0xad4]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0xad4]
push ecx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x412b2f
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x58]
inc edx
add ecx, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x58], ecx
xor esi, esi
mov ebx, 1
cmp esi, 0x69
jge 0x412be7
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x412be1
cmp esi, 0xf
jle 0x412b6d
cmp esi, 0x12
jge 0x412b6d
mov dword [ebp - 0xbc], ebx
cmp esi, 0x1d
je 0x412b7c
cmp esi, 0x1e
je 0x412b7c
cmp esi, 0x39
jne 0x412b82
mov dword [ebp - 0x90], ebx
cmp esi, 0x1f
je 0x412b8c
cmp esi, 0x20
jne 0x412b92
mov dword [ebp - 0xa4], ebx
cmp esi, 0x21
je 0x412b9c
cmp esi, 0x22
jne 0x412ba2
mov dword [ebp - 0xc4], ebx
cmp esi, 0x23
je 0x412bac
cmp esi, 0x24
jne 0x412bb2
mov dword [ebp - 0xac], ebx
cmp esi, 0x2c
jne 0x412bc3
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x412b36
cmp esi, 0x2d
je 0x412bde
cmp esi, 0x2e
jne 0x412bd9
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x412b36
cmp esi, 0x3d
jne 0x412be1
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x412b36
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x178], 0
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x168], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x138]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x412c30
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x38], eax
push eax
mov eax, dword [0xd8a438]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41299e
mov eax, dword [eax]
test eax, eax
je 0x413232
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x412cb9
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xaf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xeac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xeac]
jmp 0x412d39
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x412cf0
xor edx, edx
lea eax, [ebp - 0xaf4]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x412d39
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xaf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xd8c]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x413199
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x413193
cmp esi, 0x45
jne 0x412e0c
lea edx, [ebp - 0x122c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x122c]
lea ecx, [ebp - 0x21c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x21c]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x412de5
lea eax, [ebp - 0x71c]
lea ecx, [ebp - 0xbf4]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xbf4]
push ecx
jmp 0x415620
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0xbf4]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xbf4]
push ecx
jmp 0x415620
test esi, esi
jne 0x412e19
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x412d40
cmp esi, edi
jne 0x412e26
mov dword [ebp - 0x68], edi
inc esi
jmp 0x412d40
cmp esi, 2
je 0x413193
cmp esi, 4
jne 0x412e40
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x412d40
cmp esi, 5
jne 0x412e51
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x412d40
cmp esi, 6
jne 0x412e62
mov dword [ebp - 0x164], edi
inc esi
jmp 0x412d40
cmp esi, 7
jne 0x412e73
mov dword [ebp - 0x104], edi
inc esi
jmp 0x412d40
cmp esi, 8
jne 0x412e84
mov dword [ebp - 0xec], edi
inc esi
jmp 0x412d40
cmp esi, 9
jne 0x412e95
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x412d40
cmp esi, 0xa
jne 0x412ea6
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x412d40
cmp esi, 0xb
jne 0x412eb7
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x412d40
jle 0x412ec1
cmp esi, 0xf
jge 0x412ec4
mov dword [ebp - 0x6c], edi
cmp esi, 0xf
jne 0x412ed2
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x412d40
jle 0x412edf
cmp esi, 0x12
jge 0x412edf
mov dword [ebp - 0xbc], edi
cmp esi, 0x1b
jne 0x412ef0
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x412d40
cmp esi, 0x1c
jne 0x412f01
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x412d40
cmp esi, 0x1d
je 0x412f10
cmp esi, 0x1e
je 0x412f10
cmp esi, 0x39
jne 0x412f16
mov dword [ebp - 0x90], edi
cmp esi, 0x1f
je 0x412f20
cmp esi, 0x20
jne 0x412f26
mov dword [ebp - 0xa4], edi
cmp esi, 0x21
je 0x412f30
cmp esi, 0x22
jne 0x412f36
mov dword [ebp - 0xc4], edi
cmp esi, 0x23
je 0x412f40
cmp esi, 0x24
jne 0x412f46
mov dword [ebp - 0xac], edi
cmp esi, 0x25
je 0x412f50
cmp esi, 0x26
jne 0x412f56
mov dword [ebp - 0x134], edi
cmp esi, 0x27
jne 0x412f67
mov dword [ebp - 0x14c], edi
inc esi
jmp 0x412d40
cmp esi, 0x28
jne 0x412f78
mov dword [ebp - 0x15c], edi
inc esi
jmp 0x412d40
cmp esi, 0x29
jne 0x412f89
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x412d40
cmp esi, 0x2c
jne 0x412f9a
mov dword [ebp - 0x94], edi
inc esi
jmp 0x412d40
cmp esi, 0x2d
jne 0x412fa8
mov dword [ebp - 0x48], edi
inc esi
jmp 0x412d40
cmp esi, 0x2e
jne 0x412fb9
mov dword [ebp - 0x98], edi
inc esi
jmp 0x412d40
cmp esi, 0x2f
jne 0x412fca
inc esi
jmp 0x412d40
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x198]
inc ecx
cmp eax, edi
mov dword [ebp - 0x80], ecx
jne 0x4131ad
inc dword [ebp - 0x64]
cmp dword [ebp - 0x19c], edi
jne 0x4131bb
inc dword [ebp - 0x180]
cmp dword [ebp - 0x190], edi
jne 0x4131c9
inc dword [ebp - 0x174]
cmp dword [ebp - 0x80], 0x2710
jg 0x413232
mov esi, dword [ebp - 0x178]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x178], esi
mov esi, dword [ebp - 0x168]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x1c], ecx
mov eax, ecx
jmp 0x412c4e
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xb4]
mov ebx, dword [ebp - 0x34]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xb4], eax
jmp 0x4129dc
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x38], ebx
mov ecx, dword [ebp - 0x168]
cmp bx, word [ecx + 2]
jae 0x4133ed
xor edx, edx
push str..asp
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov byte [ebp - 0x84], dl
mov eax, dword [edi]
mov dword [ebp - 0x8c], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x8c]
mov dword [ebp - 0x88], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4132f8
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x8c]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x413313
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x8c]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41332e
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x8c]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x413349
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x8c]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x413364
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x8c]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41337f
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x8c]
push 0x50dc3c
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41339a
inc dword [ebp - 0x50]
mov esi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x38]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x38], eax
jg 0x4133ed
add edi, 0x28
inc ebx
jmp 0x4132a3
mov edi, dword [ebp - 0xc8]
mov esi, dword [ebp - 0x80]
mov dword [ebp - 4], 0
mov eax, dword [0xd8a438]
push eax
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x41343a
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 3
push 0xd8a430
call fcn.004a6b50
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 1
jne 0x413459
push 0x515b6c
jmp 0x415620
mov ecx, dword [ebp - 0x64]
mov ebx, esi
test edi, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
jne 0x413db2
cmp esi, 1
jge 0x413db2
lea edx, [ebp - 0x152c]
push edx
call fcn.004f2beb
jmp 0x413493
lea eax, [ebp - 0x10ac]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xbf4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x4134c4
push 1
lea ecx, [ebp - 0x1e4]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, 1
jne 0x4134f0
lea edx, [ebp - 0xbf4]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x413504
lea eax, [ebp - 0x81c]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp - 0x38], 0
push ecx
push 1
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x1e4]
call fcn.004f0727
mov edx, dword [ebp - 0x1e4]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x1e0]
cmp dword [eax + 0x30], 0xffffffff
jne 0x41355c
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
jmp 0x413754
mov esi, dword [ebp - 0x1e0]
push 0xa
lea ecx, [ebp - 0xa9c]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x1e0], esi
call fcn.004f0ae9
lea edi, [ebp - 0xa9c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x413d3e
lea edx, [ebp - 0xa9c]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
mov esi, 1
test eax, eax
je 0x4135be
mov dword [ebp - 0x170], esi
lea eax, [ebp - 0xa9c]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4135e0
push 0x5147b4
jmp 0x413754
lea ecx, [ebp - 0xa9c]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x413d3e
lea edx, [ebp - 0xa9c]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x413d3e
lea eax, [ebp - 0xa9c]
push str.Dump_of_file
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x413d3e
lea ecx, [ebp - 0xa9c]
push str.ws2_32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x413664
lea edx, [ebp - 0xa9c]
push str.Ws2_32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41366a
mov dword [ebp - 0x17c], esi
cmp dword [ebp - 0x78], esi
jne 0x413673
inc ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x44], esi
jne 0x41367b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x4c], esi
jne 0x413686
inc dword [ebp - 0x16c]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x413d3b
lea eax, [esi + esi*2]
lea ecx, [ebp - 0xa9c]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x413d32
mov ecx, dword [ebp - 0xe4]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xe4], ecx
jne 0x41378b
lea edx, [ebp - 0x122c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x122c]
lea ecx, [ebp - 0xe0c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0xe0c]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, 1
jne 0x413732
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x162c]
push edx
push 0x5153f4
push eax
jmp 0x413745
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0x162c]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x162c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1d0]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x1d0]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x4137f4
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x78], 1
inc ecx
cmp ebx, 5
mov dword [ebp - 0x24], ecx
jle 0x4137a9
sub ebx, 5
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xa9c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa9c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa9c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x41385f
test ebx, ebx
jne 0x41385f
test eax, eax
mov dword [ebp - 0x44], ebx
je 0x413866
jmp 0x41385f
cmp esi, 0x1a
jne 0x4138ca
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x78], 1
inc ecx
cmp ebx, 5
mov dword [ebp - 0x24], ecx
jle 0x413816
sub ebx, 5
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xa9c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa9c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa9c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x41385f
test ebx, ebx
jne 0x41385f
test eax, eax
mov dword [ebp - 0x44], ebx
je 0x413866
mov dword [ebp - 0x44], 1
lea ecx, [ebp - 0xa9c]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa9c]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa9c]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4138b8
test ebx, ebx
jne 0x4138b8
test eax, eax
jne 0x4138b8
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
inc esi
jmp 0x41368a
mov ebx, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0x4c], 1
inc esi
jmp 0x41368a
cmp esi, 0x2a
je 0x4138d4
cmp esi, 0x2b
jne 0x4138f0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x41368a
cmp esi, edi
jne 0x413904
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x5c], 1
inc esi
jmp 0x41368a
cmp esi, 1
jne 0x413915
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x68], esi
inc esi
jmp 0x41368a
cmp esi, 2
je 0x413d32
cmp esi, 4
jne 0x413936
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10c], 1
inc esi
jmp 0x41368a
cmp esi, 5
jne 0x41394e
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0xf4], 1
inc esi
jmp 0x41368a
cmp esi, 6
jne 0x413966
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x164], 1
inc esi
jmp 0x41368a
cmp esi, 7
jne 0x41397e
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x104], 1
inc esi
jmp 0x41368a
cmp esi, 8
jne 0x413996
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0xec], 1
inc esi
jmp 0x41368a
cmp esi, 9
jne 0x4139ae
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x13c], 1
inc esi
jmp 0x41368a
cmp esi, 0xa
jne 0x4139c6
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0xa8], 1
inc esi
jmp 0x41368a
cmp esi, 0xb
jne 0x4139de
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0xd0], 1
inc esi
jmp 0x41368a
jle 0x4139ef
cmp esi, 0xf
jge 0x4139ef
mov eax, 1
cmp esi, 0xf
jne 0x413a08
mov ebx, dword [ebp - 0x18]
inc esi
jmp 0x41368a
inc dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1e4]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x1dc], 1
je 0x41355c
lea ecx, [ebp - 0x1e4]
call fcn.004f076e
mov ecx, dword [ebp - 0x1c]
mov eax, 5
cmp ecx, eax
jle 0x413d71
sub ecx, eax
mov dword [ebp - 0x1c], ecx
cmp ebx, eax
jle 0x413d7a
sub ebx, eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x413d8f
cmp ebx, 6
jle 0x413d8f
sub ebx, 6
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x1d0]
call fcn.004f05fb
mov edi, dword [ebp - 0xc8]
mov esi, dword [ebp - 0x80]
cmp dword [ebp + 8], 5
jne 0x413e77
test esi, esi
jne 0x413e79
test edi, edi
jle 0x413f38
mov edx, dword [ebp - 0x7c]
cmp edx, 0xc800
jge 0x413f3b
cmp edx, 0x400
jle 0x413f3b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x81c]
push eax
call esi
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x414da0
lea edx, [ebp - 0x81c]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x81c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x81c]
push ecx
call esi
test eax, eax
jne 0x414da0
lea edx, [ebp - 0x81c]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x414da0
lea eax, [ebp - 0x81c]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x61c]
mov edi, 0x515b34
jmp 0x414dab
test esi, esi
jle 0x413f38
cmp esi, 0xa
jge 0x413f38
mov ecx, dword [ebp - 0x50]
test ecx, ecx
jle 0x413f38
lea eax, [edi - 1]
cmp ecx, eax
jg 0x413ea0
jne 0x413f38
mov edx, dword [ebp - 0x7c]
cmp edx, 0xa000
jge 0x413f3b
cmp edx, 0x400
jle 0x413f3b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x81c]
push edx
call esi
lea eax, [ebp - 0x81c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x414da0
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x81c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x81c]
push eax
call esi
test eax, eax
jne 0x414da0
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x414da0
lea edx, [ebp - 0x81c]
push edx
jmp 0x413e5f
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x50], 0
cmp eax, 1
jne 0x413fd3
mov edi, 0x515b20
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
cmp ecx, 1
jge 0x413f9b
cmp edx, 0x4b000
jle 0x413fe0
push 0x515b0c
jmp 0x415620
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x61c]
push edx
push 0x515af0
push eax
call fcn.004f175f
lea ecx, [ebp - 0x61c]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x64]
mov esi, 1
jmp 0x413fe8
mov edi, dword [ebp - 0x64]
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x41404b
cmp ecx, esi
jge 0x414006
cmp edx, 0x4b000
jle 0x41404b
push 0x515adc
jmp 0x415620
cmp dword [ebp - 0x28], esi
jne 0x41402b
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x61c]
push edx
push 0x515ac4
push eax
call fcn.004f175f
add esp, 0xc
jmp 0x415619
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0x61c]
push ecx
push 0x515aa8
push edx
call fcn.004f175f
add esp, 0xc
jmp 0x415619
cmp dword [ebp - 0xd4], esi
jne 0x4140a2
test ecx, ecx
jle 0x41408f
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a8c
lea edx, [ebp - 0x61c]
push edx
call fcn.004f175f
lea eax, [ebp - 0x61c]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x158], esi
jne 0x4140a2
cmp dword [ebp - 0x74], 2
jle 0x4140a2
cmp edi, 0x28
jg 0x414057
mov eax, dword [ebp - 0x40]
test eax, eax
jle 0x414116
cmp eax, esi
jle 0x4140bb
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a74
jmp 0x414063
mov eax, dword [ebp - 0x58]
cmp eax, 0x400
jbe 0x414116
add eax, edx
cmp eax, 0x64000
jle 0x4140dc
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a74
jmp 0x414063
cmp edi, 0x3c
jle 0x4140f9
cmp eax, 0x4b000
jle 0x4140f9
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a74
jmp 0x414063
cmp edi, 0x64
jle 0x414116
cmp eax, 0x32000
jle 0x414116
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a74
jmp 0x414063
cmp dword [ebp - 0xa0], 0x16
jle 0x414130
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a74
jmp 0x414063
cmp dword [ebp - 0x160], esi
jne 0x41415f
cmp ecx, esi
jge 0x41414e
cmp edx, 0x4b000
jle 0x41415f
push 0x515a5c
jmp 0x415620
lea ecx, [ebp - 0x71c]
push ecx
push 0x515a3c
jmp 0x414063
cmp dword [ebp - 0x124], esi
jne 0x414179
cmp edx, 0x57800
jle 0x414179
push 0x515a2c
jmp 0x415620
mov eax, dword [ebp - 0xe4]
mov byte [ebp - 0x61c], 0
cmp eax, esi
mov dword [ebp + 8], 0
jle 0x4141c5
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x164], esi
jne 0x414202
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x17c], esi
jne 0x41423f
mov edi, 0x515a20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x414293
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x2c], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xec], esi
jne 0x4142d0
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x68], esi
jne 0x414311
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x12c], esi
jne 0x414355
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xf4], esi
je 0x414365
cmp dword [ebp - 0x14c], esi
jne 0x41439a
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xfc], esi
jne 0x4143de
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x134], esi
jne 0x41441b
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x104], esi
jne 0x414458
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x5c], esi
jne 0x4144a6
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x70]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, 1
mov dword [ebp - 0x14], ecx
jne 0x41449f
mov dword [ebp - 0x2c], edx
mov ebx, 1
jmp 0x4144ae
mov edx, dword [ebp - 0x70]
mov ebx, 1
cmp dword [ebp - 0x15c], ebx
jne 0x4144f5
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
mov ebx, 1
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x10c], ebx
jne 0x414539
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x13c], ebx
jne 0x41457d
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xcc], ebx
jne 0x4145c1
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x6c], ebx
jne 0x414663
cmp dword [ebp - 0x154], ebx
je 0x4145e7
cmp dword [ebp - 0x11c], ebx
je 0x4145e7
lea ebx, [ebp - 0x61c]
mov edi, 0x515278
jmp 0x414632
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x144]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x61c]
mov edi, 0x515258
je 0x414632
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xd8], ebx
jne 0x4146a7
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xe0], ebx
jne 0x4146f2
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jne 0x4146f2
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0xbc], ebx
jne 0x41473d
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jne 0x41473d
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x30], ebx
jne 0x4147c7
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jne 0x414789
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x28], ebx
jne 0x4147c7
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x120], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], ebx
jne 0x414887
cmp dword [ebp - 0xf0], ebx
jne 0x414887
cmp dword [ebp - 0xf8], ebx
jne 0x414887
cmp dword [ebp - 0x100], ebx
jne 0x414839
cmp dword [ebp - 0x110], ebx
jne 0x4148bf
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], ebx
jne 0x4148fe
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa4], ebx
jne 0x41493d
lea edx, [ebp - 0x61c]
mov edi, 0x5159c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56c98]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xe56d20]
inc ecx
inc eax
mov dword [0xe56d20], ecx
lea ecx, [ebp - 0x61c]
mov dword [0xe56c98], eax
push ecx
jmp 0x415620
lea ecx, [ebp - 0x81c]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x415551
lea edx, [ebp - 0x81c]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x81c]
push eax
call esi
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4155c0
lea edx, [ebp - 0x81c]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x81c]
push eax
call esi
test eax, eax
jne 0x4155c0
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4155c0
lea edx, [ebp - 0x81c]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x61c]
mov edi, 0x5158dc
jmp 0x4155cb
lea edx, [ebp - 0x61c]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x81c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x61c]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret