Function at 0x478f30
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb78b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1968
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x1078]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x6d8]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x479101
push edx
lea ecx, [ebp - 0x6d8]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6d8]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6d8]
push 0x520bd4
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479123
mov dword [ebp - 0x134], 1
mov al, byte [ebp - 0x6d8]
xor ecx, ecx
cmp al, 0x25
jne 0x479134
mov ecx, 1
lea edx, [ebx - 2]
test edx, edx
jle 0x47915e
mov al, byte [ebp + edx - 0x6d8]
cmp al, 0x3a
jne 0x479150
cmp byte [ebp + edx - 0x6d7], 0x5c
je 0x47915e
cmp ecx, 1
jne 0x479159
cmp al, 0x5c
je 0x479163
dec edx
test edx, edx
jg 0x47913b
cmp ecx, 1
jne 0x4791c1
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x47918b
mov ecx, ebx
lea esi, [ebp + edx - 0x6d7]
mov edx, ecx
lea edi, [ebp - 0xff8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xff8], 0
lea edi, [ebp - 0xff8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x6d8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47926f
test edx, edx
je 0x47926f
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x1278]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x479209
cmp byte [ebp + ebx - 0x6d8], 0x2e
je 0x479209
dec ebx
test ebx, ebx
jg 0x4791fa
sub ebx, edx
mov byte [ebp - 0x6d8], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x479234
lea esi, [ebp + edx - 0x1279]
mov edx, ecx
lea edi, [ebp - 0x6d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x6d3], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x47925f
cmp byte [ebp + ecx - 0x6d8], 0x2e
je 0x47925f
dec ecx
test ecx, ecx
jg 0x479250
test ecx, ecx
mov byte [ebp + ecx - 0x6d4], 0
jne 0x479335
lea eax, [ebp - 0x2d8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x10f8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x958]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x958]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x479313
lea edx, [ebp - 0x958]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x479313
lea eax, [ebp - 0x958]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x479313
lea ecx, [ebp - 0x958]
lea edx, [ebp - 0x2d8]
push ecx
jmp 0x479320
lea ecx, [ebp - 0x958]
lea edx, [ebp - 0x10f8]
push ecx
push edx
lea eax, [ebp - 0x6d8]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x479358
cmp byte [ebp + ecx - 0x6d8], 0x2e
je 0x479358
dec ecx
test ecx, ecx
jg 0x479349
mov byte [ebp + ecx - 0x6d4], 0
lea ecx, [ebp - 0x6d8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x47937e
push 0x515844
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push edx
call fcn.004ab3c0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x6d8]
mov ebx, 1
push ecx
push edx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x64], 0
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x6d8]
push str.DOCUME1_
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4793d8
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x6d8]
push str.LOCALS1Temp_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4793f3
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x1578]
lea eax, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x6d8]
push eax
push ecx
call fcn.004d9d40
movsx edi, ax
lea edx, [ebp - 0xef8]
lea eax, [ebp - 0x6d8]
push edx
push eax
mov dword [ebp - 0x48], edi
call fcn.004da170
add esp, 0x14
cmp esi, 0xc8000
jle 0x479479
cmp edi, ebx
jle 0x479441
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x1278]
push edx
push 0x515e38
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1278]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xef8]
push edx
push str.PowerWord
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47949c
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x258]
push str.Maxthon_International
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4794c0
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x258]
push str.MoreQuick
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4794e4
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x258]
push str.Opera_Software
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479507
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x6d8]
push str.Microsoft.NETFramework_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47952b
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x6d8]
push str.jre_binjre
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47954f
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x258]
push str.Beijing_Rising
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47958f
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4795cf
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47960f
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47964f
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47968f
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4796cf
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47970f
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47974f
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47978f
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4797cf
mov edi, 0x5156ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x258]
push str.F_Secure_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4797f1
push 0x515dec
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push 0x5156a4
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479814
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x6d8]
push str.java
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479838
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x6d8]
push str.Microsoft.NETFramework_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47985c
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push str.microsoft.net_framework_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47987f
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x258]
push str.Microsoft
push ecx
mov dword [ebp - 0x44], 0
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4798e9
lea edx, [ebp - 0x1578]
push str.Microsoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4798bb
mov dword [ebp - 0x44], ebx
jmp 0x4798e9
mov edi, 0x515e60
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x8c], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d8]
push str.CCManager
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47990b
push 0x5147b4
jmp 0x47c881
lea edx, [ebp - 0x858]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xb38]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x858]
lea edx, [ebp - 0xa58]
push ecx
push str._swinlogon.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x6d8]
lea ecx, [ebp - 0xa58]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47996d
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0xa58]
push eax
push str._scsrss.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6d8]
lea eax, [ebp - 0xa58]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4799ab
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x858]
lea eax, [ebp - 0xa58]
push edx
push str._s_services.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x6d8]
lea edx, [ebp - 0xa58]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4799e8
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x858]
lea edx, [ebp - 0xa58]
push ecx
push str._slsass.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x6d8]
lea ecx, [ebp - 0xa58]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479a26
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0xa58]
push eax
push str._s_svchost.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6d8]
lea eax, [ebp - 0xa58]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479a64
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0x858]
lea eax, [ebp - 0xa58]
push edx
push str._suserinit.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x6d8]
lea edx, [ebp - 0xa58]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479aa1
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x858]
lea edx, [ebp - 0xa58]
push ecx
push str._s_taskmgr.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x6d8]
lea ecx, [ebp - 0xa58]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479adf
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0xa58]
push eax
push str._s_spoolsv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6d8]
lea eax, [ebp - 0xa58]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479b1d
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0xb38]
lea eax, [ebp - 0xa58]
push edx
push str._sexplorer.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x6d8]
lea edx, [ebp - 0xa58]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479b5a
lea eax, [ebp - 0x258]
jmp 0x47c880
lea ecx, [ebp - 0x6d8]
push ecx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479b7e
lea edx, [ebp - 0x258]
push edx
jmp 0x47c881
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0xa58]
push eax
push str._sctfmon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6d8]
lea eax, [ebp - 0xa58]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479bbc
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edx, [ebp - 0xb38]
lea eax, [ebp - 0xa58]
push edx
push str._s_anotherlockfile.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x6d8]
lea edx, [ebp - 0xa58]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x479bf8
push 0x5147b4
jmp 0x47c881
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x24], edx
cmp ecx, edx
jle 0x479c30
lea esi, [ebp + ecx - 0x6d8]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xd58], al
jne 0x479c2a
cmp edx, 2
jge 0x479c30
inc edx
dec esi
cmp edx, ecx
jl 0x479c18
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x479c57
mov ebx, ecx
lea esi, [ebp - 0x6d8]
lea edi, [ebp - 0x1478]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x1478], 0
test edx, edx
jle 0x479ca1
mov edi, dword [ebp - 0xf8]
lea esi, [ebp + eax - 0x6d7]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x479c80
mov byte [ebp + ecx - 0xd58], al
cmp al, 0x2e
jne 0x479c85
inc edi
cmp al, 0x20
jne 0x479c8a
inc edi
cmp al, 0x5c
jne 0x479c96
mov byte [ebp + ecx - 0xd58], 0
inc ecx
cmp ecx, edx
jl 0x479c72
mov dword [ebp - 0xf8], edi
mov al, byte [ebp - 0x1476]
mov byte [ebp + edx - 0xd58], 0
cmp al, 0x5c
je 0x479cc1
mov byte [ebp - 0x1476], 0x5c
mov byte [ebp - 0x1475], 0
lea edi, [ebp - 0xd58]
or ecx, 0xffffffff
xor eax, eax
push 0x516860
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0xd58]
dec ecx
push eax
mov dword [ebp - 0x14c], ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x479d07
lea ecx, [ebp - 0xd58]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479d0d
mov dword [ebp - 0x140], ebx
lea edx, [ebp - 0x1478]
lea eax, [ebp - 0x1078]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479d2a
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x6d8]
push 0x100
lea edx, [ebp - 0x7d8]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0xd58]
push 0x40
lea ecx, [ebp - 0xab8]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x6d8]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x479d81
push 0x5144fc
jmp 0x47c881
lea eax, [ebp - 0x6d8]
push 0x80
lea ecx, [ebp - 0xdf8]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x6d8]
push 0x80
lea eax, [ebp - 0xe78]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xb38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x858]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xdf8], al
lea edx, [ebp - 0xdf8]
mov byte [ebp + ecx - 0xe78], al
lea ecx, [ebp - 0xb38]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x479e14
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479e11
push esi
jmp 0x47c881
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0xe78]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479e49
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479e49
push esi
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push str.System
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479ea2
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479e7c
push esi
jmp 0x47c881
lea eax, [ebp - 0x6d8]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x479ea2
push edi
jmp 0x47c881
lea ecx, [ebp - 0x6d8]
push str._system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479efb
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479ed5
push esi
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x479efb
push edi
jmp 0x47c881
lea eax, [ebp - 0x6d8]
push str.SYSTEM
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479f54
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x479f2e
push esi
jmp 0x47c881
lea ecx, [ebp - 0x6d8]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x479f54
push esi
jmp 0x47c881
lea edx, [ebp - 0x6d8]
push 0x515d14
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479f6f
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x6d8]
push str.Microsoft_SharedMSINFO
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479f8a
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x6d8]
push str.Microsoft_SharedMSInfo
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x479fa5
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0xd58]
push str.smss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea eax, [ebp - 0xd58]
push str.winlogon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea ecx, [ebp - 0xd58]
push str.csrss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea edx, [ebp - 0xd58]
push str.services.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea eax, [ebp - 0xd58]
push str.lsass.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea ecx, [ebp - 0xd58]
push str.svchost.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea edx, [ebp - 0xd58]
push str.taskmgr.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea eax, [ebp - 0xd58]
push str.spoolsv.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea ecx, [ebp - 0xd58]
push str.explorer.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea edx, [ebp - 0xd58]
push str.userinit.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea eax, [ebp - 0xd58]
push str.ctfmon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea ecx, [ebp - 0xd58]
push str.cmd.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea edx, [ebp - 0xd58]
push str.logo1_.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea eax, [ebp - 0xd58]
push str.net.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47c78d
lea ecx, [ebp - 0xd58]
push str.iexplore.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47a22d
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x47a22d
lea edx, [ebp - 0x7d8]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47a17b
lea eax, [ebp - 0x7d8]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x7d8]
push ecx
call esi
lea edx, [ebp - 0x7d8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x47a1e8
lea eax, [ebp - 0x7d8]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x7d8]
push ecx
call esi
test eax, eax
jne 0x47a1e8
lea edx, [ebp - 0x7d8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x47a1e8
lea eax, [ebp - 0x7d8]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4d8]
mov edi, 0x5209ec
jmp 0x47a1f3
lea edx, [ebp - 0x4d8]
mov edi, 0x520998
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c98]
mov dword [0xe56d20], eax
inc edi
mov dword [0xe56c98], edi
jmp 0x47c854
cmp dword [ebp - 0x48], 3
jle 0x47a24d
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x47a24d
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x47a24d
lea ecx, [ebp - 0x258]
push ecx
jmp 0x47c881
lea edi, [ebp - 0xd58]
or ecx, 0xffffffff
xor eax, eax
mov esi, 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
xor ebx, ebx
push 0xd8a430
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x6d8]
push 0xd8a430
push edx
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x47a2e2
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x6d8]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 1
jmp 0x47abcf
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 3
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x144], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0x110], eax
test eax, eax
jne 0x47a372
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], esi
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x11c], esi
jne 0x47aa87
mov dword [ebp + 8], 6
jmp 0x47abbc
mov dword [ebp - 0x108], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47a33a
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd8a438]
mov eax, dword [ebp - 0x144]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x28], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x148], eax
call fcn.004f61e0
add esp, 0x10
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x11c], eax
cmp esi, 0x69
jge 0x47a47d
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47a477
cmp esi, 0xf
jle 0x47a40f
cmp esi, 0x12
jge 0x47a40f
mov dword [ebp - 0xa0], ebx
cmp esi, 0x1d
je 0x47a41e
cmp esi, 0x1e
je 0x47a41e
cmp esi, 0x39
jne 0x47a421
mov dword [ebp - 0x80], ebx
cmp esi, 0x1f
je 0x47a42b
cmp esi, 0x20
jne 0x47a42e
mov dword [ebp - 0x78], ebx
cmp esi, 0x21
je 0x47a438
cmp esi, 0x22
jne 0x47a43e
mov dword [ebp - 0x88], ebx
cmp esi, 0x23
je 0x47a448
cmp esi, 0x24
jne 0x47a44e
mov dword [ebp - 0x98], ebx
cmp esi, 0x2c
jne 0x47a45c
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x47a3dc
cmp esi, 0x2d
je 0x47a474
cmp esi, 0x2e
jne 0x47a46f
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x47a3dc
cmp esi, 0x3d
jne 0x47a477
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x47a3dc
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x100], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd8a438]
mov dword [ebp - 0x154], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0x108]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x47a4c5
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x74], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x47a33a
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x47a9cb
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x47a556
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd78]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xd78]
jmp 0x47a5da
mov edx, dword [0xd8a438]
push eax
mov eax, dword [ebp - 0x154]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47a595
xor ecx, ecx
lea edx, [ebp - 0xa78]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x120], esi
jmp 0x47a5e5
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xb58]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0x120], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x47a974
mov eax, dword [ebp - 0x120]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47a96e
cmp esi, 0x45
jne 0x47a6b7
lea ecx, [ebp - 0x10f8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x10f8]
lea eax, [ebp - 0x2d8]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x47a691
lea edx, [ebp - 0x258]
lea eax, [ebp - 0xff8]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xff8]
jmp 0x47c880
lea ecx, [ebp - 0x258]
lea edx, [ebp - 0xff8]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xff8]
jmp 0x47c880
test esi, esi
jne 0x47a6c4
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x47a5e7
cmp esi, edi
jne 0x47a6d1
mov dword [ebp - 0x58], edi
inc esi
jmp 0x47a5e7
cmp esi, 2
je 0x47a96e
cmp esi, 4
jne 0x47a6eb
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x47a5e7
cmp esi, 5
jne 0x47a6fc
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x47a5e7
cmp esi, 6
jne 0x47a70d
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x47a5e7
cmp esi, 7
jne 0x47a71e
mov dword [ebp - 0x114], edi
inc esi
jmp 0x47a5e7
cmp esi, 8
jne 0x47a72f
mov dword [ebp - 0x124], edi
inc esi
jmp 0x47a5e7
cmp esi, 9
jne 0x47a740
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x47a5e7
cmp esi, 0xa
jne 0x47a74e
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x47a5e7
cmp esi, 0xb
jne 0x47a75f
mov dword [ebp - 0x130], edi
inc esi
jmp 0x47a5e7
jle 0x47a76c
cmp esi, 0xf
jge 0x47a76f
mov dword [ebp - 0x84], edi
cmp esi, 0xf
jne 0x47a77d
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x47a5e7
jle 0x47a78a
cmp esi, 0x12
jge 0x47a78a
mov dword [ebp - 0xa0], edi
cmp esi, 0x1b
jne 0x47a79b
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x1c
jne 0x47a7a9
mov dword [ebp - 0x60], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x1d
je 0x47a7b8
cmp esi, 0x1e
je 0x47a7b8
cmp esi, 0x39
jne 0x47a7bb
mov dword [ebp - 0x80], edi
cmp esi, 0x1f
je 0x47a7c5
cmp esi, 0x20
jne 0x47a7c8
mov dword [ebp - 0x78], edi
cmp esi, 0x21
je 0x47a7d2
cmp esi, 0x22
jne 0x47a7d8
mov dword [ebp - 0x88], edi
cmp esi, 0x23
je 0x47a7e2
cmp esi, 0x24
jne 0x47a7e8
mov dword [ebp - 0x98], edi
cmp esi, 0x25
je 0x47a7f2
cmp esi, 0x26
jne 0x47a7f8
mov dword [ebp - 0xe4], edi
cmp esi, 0x27
jne 0x47a809
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x28
jne 0x47a81a
mov dword [ebp - 0xec], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x29
jne 0x47a82b
mov dword [ebp - 0x128], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x2c
jne 0x47a83c
mov dword [ebp - 0x90], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x2d
jne 0x47a84a
mov dword [ebp - 0x34], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x2e
jne 0x47a858
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x2f
jne 0x47a869
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x30
jne 0x47a87a
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x31
jne 0x47a88b
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x32
jne 0x47a89c
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x34
jne 0x47a8aa
mov dword [ebp - 0x54], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x35
jne 0x47a8b8
mov dword [ebp - 0x70], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x36
jne 0x47a8c9
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x37
jne 0x47a8de
mov dword [ebp - 0xe0], 0
inc esi
jmp 0x47a5e7
cmp esi, 0x38
jne 0x47a8ef
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x3a
je 0x47a8fe
cmp esi, 0x3b
je 0x47a8fe
cmp esi, 0x3c
jne 0x47a901
mov dword [ebp - 0x50], edi
cmp esi, 0x3d
jne 0x47a90f
mov dword [ebp - 0x34], edi
inc esi
jmp 0x47a5e7
cmp esi, 0x3e
jne 0x47a91d
inc esi
jmp 0x47a5e7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x148]
inc ecx
cmp eax, edi
mov dword [ebp - 0x1c], ecx
jne 0x47a98b
inc dword [ebp - 0x94]
cmp dword [ebp - 0x11c], edi
jne 0x47a999
inc dword [ebp - 0xc4]
cmp dword [ebp - 0x1c], 0x2710
jg 0x47a9cb
mov esi, dword [ebp - 0x100]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x20], ecx
mov eax, ecx
jmp 0x47a4ef
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x110]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x110], eax
jmp 0x47a37c
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x74], ebx
cmp bx, word [esi + 2]
jae 0x47abbc
xor ecx, ecx
push str..asp
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 0xac], cl
mov edx, dword [edi]
mov dword [ebp - 0xb4], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb0], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x47aae9
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xb4]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ab04
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xb4]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ab1f
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xb4]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ab3a
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xb4]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ab55
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xb4]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ab70
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x74]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x74], eax
jg 0x47abbc
mov esi, dword [ebp - 0x11c]
add edi, 0x28
inc ebx
jmp 0x47aa9a
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x94]
mov dword [ebp - 4], 2
mov ecx, dword [0xd8a438]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x47ac0b
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp esi, 1
jne 0x47ac27
push 0x515b6c
jmp 0x47c881
test esi, esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
je 0x47b41c
cmp edi, 1
jge 0x47b41c
lea edx, [ebp - 0x1478]
xor esi, esi
push edx
mov dword [ebp - 0x28], esi
call fcn.004f2beb
jmp 0x47ac61
lea eax, [ebp - 0xd58]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xff8]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x47ac92
push 1
lea ecx, [ebp - 0x2a0]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, 1
jne 0x47acbe
lea edx, [ebp - 0xff8]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x47acd2
lea eax, [ebp - 0x7d8]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp + 8], esi
push ecx
push 1
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x2a0]
call fcn.004f0727
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x29c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x47ad26
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
jmp 0x47aeef
mov ebx, dword [ebp - 0x158]
mov esi, 1
mov edi, dword [ebp - 0x29c]
push 0xa
lea ecx, [ebp - 0x958]
push 0x100
inc edi
push ecx
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x29c], edi
call fcn.004f0ae9
lea edi, [ebp - 0x958]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x47b37c
lea edx, [ebp - 0x958]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47ad8e
mov dword [ebp - 0x13c], esi
lea eax, [ebp - 0x958]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47adb0
push 0x5147b4
jmp 0x47aeef
lea ecx, [ebp - 0x958]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47b37c
lea edx, [ebp - 0x958]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47b37c
lea eax, [ebp - 0x958]
push str.Dump_of_file
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47b37c
cmp dword [ebp - 0x6c], esi
jne 0x47ae0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x38], esi
jne 0x47ae14
inc dword [ebp - 0x20]
cmp ebx, esi
jne 0x47ae1e
inc dword [ebp - 0xa4]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x47b370
lea ecx, [esi + esi*2]
lea edx, [ebp - 0x958]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47b36a
mov ecx, dword [ebp - 0x104]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x104], ecx
jne 0x47af26
lea eax, [ebp - 0x10f8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x10f8]
lea edx, [ebp - 0x1178]
push ecx
push str._sMicrosoft.NETFramework
push edx
call fcn.004f175f
lea eax, [ebp - 0x1178]
push eax
call fcn.004f2beb
xor ecx, ecx
push str.c:endpcache
test eax, eax
sete cl
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x47aecd
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x1278]
push edx
push 0x5153f4
push eax
jmp 0x47aee0
lea ecx, [ebp - 0x258]
lea edx, [ebp - 0x1278]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1278]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x28c]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x28c]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x47af91
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x28], edx
jle 0x47af46
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x958]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x958]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x958]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47affe
test ebx, ebx
jne 0x47affe
test eax, eax
mov dword [ebp - 0x38], ebx
je 0x47b005
jmp 0x47affe
cmp esi, 0x1a
jne 0x47b063
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x28], edx
jle 0x47afb5
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x958]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x958]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x958]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47affe
test ebx, ebx
jne 0x47affe
test eax, eax
mov dword [ebp - 0x38], ebx
je 0x47b005
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 0x958]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x958]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x958]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47b056
test ebx, ebx
jne 0x47b056
test eax, eax
jne 0x47b056
mov edi, 1
inc esi
jmp 0x47ae25
mov ebx, 1
inc esi
mov edi, ebx
jmp 0x47ae25
cmp esi, 0x2a
jne 0x47b07c
xor ebx, ebx
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x47ae25
cmp esi, 0x2b
jne 0x47b095
xor ebx, ebx
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x47ae25
test esi, esi
jne 0x47b0a2
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x47ae25
cmp esi, edi
jne 0x47b0af
mov dword [ebp - 0x58], edi
inc esi
jmp 0x47ae25
cmp esi, 2
je 0x47b36a
cmp esi, 4
jne 0x47b0c9
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x47ae25
cmp esi, 5
jne 0x47b0da
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x47ae25
cmp esi, 6
jne 0x47b0eb
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x47ae25
cmp esi, 7
jne 0x47b0fc
mov dword [ebp - 0x114], edi
inc esi
jmp 0x47ae25
cmp esi, 8
jne 0x47b10d
mov dword [ebp - 0x124], edi
inc esi
jmp 0x47ae25
cmp esi, 9
jne 0x47b11e
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x47ae25
cmp esi, 0xa
jne 0x47b12c
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x47ae25
cmp esi, 0xb
jne 0x47b13d
mov dword [ebp - 0x130], edi
inc esi
jmp 0x47ae25
jle 0x47b14a
cmp esi, 0xf
jge 0x47b14d
mov dword [ebp - 0x84], edi
cmp esi, 0xf
jne 0x47b15b
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x47ae25
jle 0x47b168
cmp esi, 0x12
jge 0x47b168
mov dword [ebp - 0xa0], edi
cmp esi, 0x11
jle 0x47b175
cmp esi, 0x19
jge 0x47b175
mov dword [ebp - 0x30], edi
cmp esi, 0x1b
jne 0x47b186
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x47ae25
cmp esi, 0x1c
jne 0x47b194
mov dword [ebp - 0x60], edi
inc esi
jmp 0x47ae25
cmp esi, 0x1d
je 0x47b1a3
cmp esi, 0x1e
je 0x47b1a3
cmp esi, 0x39
jne 0x47b1a6
mov dword [ebp - 0x80], edi
cmp esi, 0x1f
je 0x47b1b0
cmp esi, 0x20
jne 0x47b1b3
mov dword [ebp - 0x78], edi
cmp esi, 0x21
je 0x47b1bd
cmp esi, 0x22
jne 0x47b1c3
mov dword [ebp - 0x88], edi
cmp esi, 0x23
je 0x47b1cd
cmp esi, 0x24
jne 0x47b1d3
mov dword [ebp - 0x98], edi
cmp esi, 0x25
je 0x47b1dd
inc esi
jmp 0x47ae25
mov eax, dword [ebp + 8]
mov esi, 1
inc eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x298], 1
je 0x47ad31
lea ecx, [ebp - 0x2a0]
call fcn.004f076e
mov eax, dword [ebp - 0x20]
mov ecx, 5
cmp eax, ecx
jle 0x47b3af
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x47b3bb
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
jne 0x47b3d0
cmp eax, 6
jle 0x47b3d0
sub eax, 6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x28c]
call fcn.004f05fb
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0xa4]
mov ebx, dword [ebp - 0x94]
mov edx, 1
cmp dword [ebp - 0x130], edx
jne 0x47b42c
mov eax, 0x51536c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x68]
mov edx, 1
jmp 0x47b3fe
cmp eax, 5
jle 0x47b434
sub eax, 5
cmp eax, 3
jle 0x47b448
cmp dword [ebp - 0x24], edx
je 0x47b448
push 0x515350
jmp 0x47c881
cmp ecx, 0x32000
jle 0x47b4cd
mov eax, dword [ebp - 0xc4]
cmp eax, 0x64
jle 0x47b460
cmp ebx, 0x64
jmp 0x47b493
cmp ebx, 0x64
jle 0x47b4cd
cmp eax, 0x50
jle 0x47b480
cmp ecx, 0x37000
jle 0x47b480
lea eax, [ebp - 0x258]
push eax
push 0x516ad4
jmp 0x47b4a1
cmp ecx, 0x3e800
jle 0x47b48d
cmp dword [ebp - 0x48], edx
jg 0x47b495
cmp ecx, 0x70800
jle 0x47b4cd
lea eax, [ebp - 0x258]
push eax
push 0x515a74
lea ecx, [ebp - 0x4d8]
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4d8]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0x4d8], 0
cmp eax, edx
mov dword [ebp + 8], 0
jle 0x47b514
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcc], edx
jne 0x47b54c
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x8c], edx
jne 0x47b58e
mov edi, 0x5208b8
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], edx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x6d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x47b5e0
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
mov ebx, 1
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x18], ebx
jmp 0x47b5e5
mov ebx, 1
mov al, byte [ebp - 0xd58]
mov dword [ebp - 0x68], 0
cmp al, 0x30
je 0x47b61a
cmp al, 0x31
je 0x47b61a
cmp al, 0x32
je 0x47b61a
cmp al, 0x33
je 0x47b61a
cmp al, 0x34
je 0x47b61a
cmp al, 0x35
je 0x47b61a
cmp al, 0x36
je 0x47b61a
cmp al, 0x37
je 0x47b61a
cmp al, 0x38
je 0x47b61a
cmp al, 0x39
jne 0x47b698
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x68], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x150]
cmp ecx, 7
jge 0x47b690
mov al, byte [ebp - 0xd57]
cmp al, 0x30
je 0x47b68d
cmp al, 0x31
je 0x47b68d
cmp al, 0x32
je 0x47b68d
cmp al, 0x33
je 0x47b68d
cmp al, 0x34
je 0x47b68d
cmp al, 0x35
je 0x47b68d
cmp al, 0x36
je 0x47b68d
cmp al, 0x37
je 0x47b68d
cmp al, 0x38
je 0x47b68d
cmp al, 0x39
jne 0x47b690
mov dword [ebp - 0x18], ebx
cmp ecx, 4
jne 0x47b698
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x134], ebx
jne 0x47b6da
mov edi, 0x5208ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x124], ebx
jne 0x47b712
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x58], ebx
jne 0x47b74e
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd4], ebx
jne 0x47b78d
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10c], ebx
je 0x47b79d
cmp dword [ebp - 0xdc], ebx
jne 0x47b7cd
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x118], ebx
jne 0x47b80c
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe4], ebx
jne 0x47b844
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x114], ebx
jne 0x47b87c
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3c], ebx
jne 0x47b8b8
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xec], ebx
jne 0x47b8fa
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xb8], ebx
jne 0x47b939
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf4], ebx
jne 0x47b978
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x128], ebx
jne 0x47b9b7
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x84], ebx
jne 0x47ba56
cmp dword [ebp - 0xfc], ebx
je 0x47b9e0
cmp dword [ebp - 0xbc], ebx
je 0x47b9e0
lea edx, [ebp - 0x4d8]
mov edi, 0x515278
jmp 0x47ba2a
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc0]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x4d8]
mov edi, 0x515258
je 0x47ba2a
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc8], ebx
jne 0x47ba95
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd0], ebx
jne 0x47bad4
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa0], ebx
jne 0x47bb13
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x30], ebx
jne 0x47bb8e
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x44]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jne 0x47bb91
mov edi, 0x515200
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x4d8]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
jmp 0x47bb91
mov edx, dword [ebp - 0x44]
cmp dword [ebp - 0x60], ebx
jne 0x47bc09
cmp dword [ebp - 0x54], ebx
jne 0x47bc09
cmp dword [ebp - 0x70], ebx
jne 0x47bc09
cmp dword [ebp - 0xa8], ebx
jne 0x47bc09
mov eax, dword [ebp - 0x9c]
mov edi, 0x5151ec
cmp eax, ebx
lea ebx, [ebp - 0x4d8]
je 0x47bbc2
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x47bc09
cmp dword [ebp - 0x138], ebx
jne 0x47bc09
test edx, edx
jne 0x47bc09
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xd8], ebx
jne 0x47bca9
cmp dword [ebp - 0x60], ebx
jne 0x47bc66
cmp dword [ebp - 0x54], ebx
jne 0x47bc66
cmp dword [ebp - 0x70], ebx
jne 0x47bc66
cmp dword [ebp - 0xa8], ebx
jne 0x47bc66
mov edi, 0x5160c0
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp - 0x18], ebx
rep movsb byte es:[edi], byte [esi]
jmp 0x47bc9b
mov edi, 0x5160b4
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jne 0x47bca9
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x140], ebx
jne 0x47bcc1
cmp dword [ebp - 0x24], ebx
jne 0x47bcb9
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x4c], ebx
jne 0x47bcc1
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x60], ebx
jne 0x47bd1e
cmp dword [ebp - 0x54], ebx
jne 0x47bd1e
cmp dword [ebp - 0x70], ebx
jne 0x47bd1e
cmp dword [ebp - 0xe0], ebx
jne 0x47bd1e
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x4d8]
cmp eax, ebx
mov edi, 0x5151c4
je 0x47bcf2
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe8], ebx
jne 0x47bd56
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x80], ebx
jne 0x47bd92
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf0], ebx
jne 0x47bdd1
mov edi, 0x5160a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x78], ebx
jne 0x47be0d
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x88], ebx
jne 0x47be4c
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x98], ebx
jne 0x47be8b
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x47bed8
mov eax, dword [ebp - 0x13c]
test eax, eax
jne 0x47bed8
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xf8], ebx
jle 0x47bf1c
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x90], ebx
jne 0x47bf60
lea ecx, [ebp - 0x7d8]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47c7b4
lea edx, [ebp - 0x7d8]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7d8]
push eax
call esi
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x47c821
lea edx, [ebp - 0x7d8]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x7d8]
push eax
call esi
test eax, eax
jne 0x47c821
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x47c821
lea edx, [ebp - 0x7d8]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4d8]
mov edi, 0x5158dc
jmp 0x47c82c
lea edx, [ebp - 0x4d8]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x7d8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4d8]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret