Function at 0x49c340
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbabb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x166c
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xcfc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x49c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x49c4dc
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x49c]
push ecx
push 0x515880
push edx
call fcn.004f175f
lea eax, [ebp - 0x49c]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x49c]
push 0x516b34
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49c524
lea ecx, [ebp - 0x49c]
push 0x516b34
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49c524
lea ecx, [ebp - 0x49c]
push str.._temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c54d
lea edx, [ebp - 0x49c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5168b0
jmp 0x49f159
lea edx, [ebx - 2]
test edx, edx
jle 0x49c56f
cmp byte [ebp + edx - 0x49c], 0x3a
jne 0x49c568
cmp byte [ebp + edx - 0x49b], 0x5c
je 0x49c56d
dec edx
test edx, edx
jg 0x49c554
test edx, edx
je 0x49c61b
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x137c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x80], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x49c5b5
cmp byte [ebp + ebx - 0x49c], 0x2e
je 0x49c5b5
dec ebx
test ebx, ebx
jg 0x49c5a6
sub ebx, edx
mov byte [ebp - 0x49c], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x49c5e0
lea esi, [ebp + edx - 0x137d]
mov edx, ecx
lea edi, [ebp - 0x49c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x497], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x49c60b
cmp byte [ebp + ecx - 0x49c], 0x2e
je 0x49c60b
dec ecx
test ecx, ecx
jg 0x49c5fc
test ecx, ecx
mov byte [ebp + ecx - 0x498], 0
jne 0x49c74a
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0x49c], 0
test ecx, ecx
jle 0x49c64a
mov dl, byte [esi + eax + 1]
cmp dl, 0x2e
mov byte [ebp + eax - 0x49c], dl
je 0x49c64a
inc eax
cmp eax, ecx
jl 0x49c635
cmp eax, ecx
jne 0x49c658
push 0x515844
jmp 0x49f159
mov ecx, dword [ebp + 8]
push 0x80
mov dl, byte [eax + ecx + 2]
mov byte [ebp + eax - 0x49b], dl
mov dl, byte [eax + ecx + 3]
mov cl, byte [eax + ecx + 4]
mov byte [ebp + eax - 0x49a], dl
lea edx, [ebp - 0x19c]
mov byte [ebp + eax - 0x499], cl
push edx
mov byte [ebp + eax - 0x498], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xbfc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x83c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x83c]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49c728
lea edx, [ebp - 0x83c]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49c728
lea eax, [ebp - 0x83c]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49c728
lea ecx, [ebp - 0x83c]
lea edx, [ebp - 0x19c]
push ecx
jmp 0x49c735
lea ecx, [ebp - 0x83c]
lea edx, [ebp - 0xbfc]
push ecx
push edx
lea eax, [ebp - 0x49c]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x49c76d
cmp byte [ebp + ecx - 0x49c], 0x2e
je 0x49c76d
dec ecx
test ecx, ecx
jg 0x49c75e
mov byte [ebp + ecx - 0x498], 0
lea ecx, [ebp - 0x49c]
push ecx
call fcn.004ab3c0
mov ebx, 1
add esp, 4
cmp eax, ebx
jge 0x49c797
push 0x515e70
jmp 0x49f159
mov dword [ebp - 0x10c], eax
lea edx, [ebp - 0x9bc]
lea eax, [ebp - 0x49c]
push edx
push eax
call fcn.004d9590
movsx eax, ax
add esp, 8
cmp eax, 2
mov dword [ebp - 0x80], eax
jle 0x49c84a
lea ecx, [ebp - 0x49c]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c7e4
push 0x5147b4
jmp 0x49f159
lea edx, [ebp - 0x49c]
push str.kav.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c806
push 0x5147b4
jmp 0x49f159
lea eax, [ebp - 0x49c]
push str.Kav.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c828
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0x49c]
push str.System32_smss.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c84a
push 0x5147b4
jmp 0x49f159
lea edx, [ebp - 0x9bc]
xor esi, esi
push str.Microsoft
push edx
mov dword [ebp - 0xe4], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49c870
mov dword [ebp - 0xe4], ebx
lea eax, [ebp - 0x49c]
push str.CCManager
push eax
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x49c892
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0x71c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xa7c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x71c]
lea ecx, [ebp - 0x93c]
push eax
push str._swinlogon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x49c]
lea eax, [ebp - 0x93c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49c8f2
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0x93c]
push ecx
push str._scsrss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x49c]
lea ecx, [ebp - 0x93c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49c92e
push 0x5147b4
jmp 0x49f159
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x93c]
push edx
push str._s_services.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x49c]
lea edx, [ebp - 0x93c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49c96a
push 0x5147b4
jmp 0x49f159
lea eax, [ebp - 0x71c]
lea ecx, [ebp - 0x93c]
push eax
push str._slsass.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x49c]
lea eax, [ebp - 0x93c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49c9a6
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0x93c]
push ecx
push str._s_svchost.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x49c]
lea ecx, [ebp - 0x93c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49c9e2
push 0x5147b4
jmp 0x49f159
lea edx, [ebp - 0x71c]
lea eax, [ebp - 0x93c]
push edx
push str._s_taskmgr.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x49c]
lea edx, [ebp - 0x93c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49ca1e
push 0x5147b4
jmp 0x49f159
lea eax, [ebp - 0x71c]
lea ecx, [ebp - 0x93c]
push eax
push str._s_spoolsv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x49c]
lea eax, [ebp - 0x93c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49ca5a
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0xa7c]
lea edx, [ebp - 0x93c]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x49c]
lea ecx, [ebp - 0x93c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49ca96
push 0x5147b4
jmp 0x49f159
lea edx, [ebp - 0x49c]
push edx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cab8
push 0x5147b4
jmp 0x49f159
lea eax, [ebp - 0x71c]
lea ecx, [ebp - 0x93c]
push eax
push str._sctfmon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x49c]
lea eax, [ebp - 0x93c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49caf4
push 0x5147b4
jmp 0x49f159
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0x93c]
push ecx
push str._smswsock.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x49c]
lea ecx, [ebp - 0x93c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49cb30
push 0x5147b4
jmp 0x49f159
lea edi, [ebp - 0x49c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x2c], esi
cmp ecx, esi
jle 0x49cb68
lea esi, [ebp + ecx - 0x49c]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xefc], al
jne 0x49cb62
cmp edx, 2
jge 0x49cb68
inc edx
dec esi
cmp edx, ecx
jl 0x49cb50
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x49cb8f
mov ebx, ecx
lea esi, [ebp - 0x49c]
lea edi, [ebp - 0x11fc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x11fc], 0
test edx, edx
jle 0x49cbd9
mov edi, dword [ebp - 0xcc]
lea esi, [ebp + eax - 0x49b]
mov al, byte [ecx + esi]
cmp al, 0x5c
je 0x49cbb8
mov byte [ebp + ecx - 0xefc], al
cmp al, 0x2e
jne 0x49cbbd
inc edi
cmp al, 0x20
jne 0x49cbc2
inc edi
cmp al, 0x5c
jne 0x49cbce
mov byte [ebp + ecx - 0xefc], 0
inc ecx
cmp ecx, edx
jl 0x49cbaa
mov dword [ebp - 0xcc], edi
mov al, byte [ebp - 0x11fa]
mov byte [ebp + edx - 0xefc], 0
cmp al, 0x5c
je 0x49cbf9
mov byte [ebp - 0x11fa], 0x5c
mov byte [ebp - 0x11f9], 0
lea edx, [ebp - 0x49c]
push 0x100
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xefc]
push 0x80
lea edx, [ebp - 0xc7c]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x49c]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x49cc53
push 0x5144fc
jmp 0x49f159
lea ecx, [ebp - 0x49c]
push 0x80
lea edx, [ebp - 0xb7c]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x49c]
push 0x80
lea ecx, [ebp - 0xafc]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0xa7c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x71c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xb7c], al
lea edx, [ebp - 0xa7c]
mov byte [ebp + ecx - 0xafc], al
lea eax, [ebp - 0xb7c]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x49cce3
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cce3
push esi
jmp 0x49f159
lea ecx, [ebp - 0x71c]
lea edx, [ebp - 0xafc]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cd18
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cd18
push esi
jmp 0x49f159
lea eax, [ebp - 0x49c]
push str.System32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49cd71
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cd4b
push esi
jmp 0x49f159
lea ecx, [ebp - 0x49c]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x49cd71
push edi
jmp 0x49f159
lea edx, [ebp - 0x49c]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49cdca
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cda4
push esi
jmp 0x49f159
lea eax, [ebp - 0x49c]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x49cdca
push edi
jmp 0x49f159
lea ecx, [ebp - 0x49c]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49ce23
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49cdfd
push esi
jmp 0x49f159
lea edx, [ebp - 0x49c]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x49ce23
push esi
jmp 0x49f159
lea eax, [ebp - 0xefc]
push str.smss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea ecx, [ebp - 0xefc]
push str.winlogon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea edx, [ebp - 0xefc]
push str.csrss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea eax, [ebp - 0xefc]
push str.services.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea ecx, [ebp - 0xefc]
push str.lsass.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea edx, [ebp - 0xefc]
push str.svchost.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea eax, [ebp - 0xefc]
push str.taskmgr.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea ecx, [ebp - 0xefc]
push str.spoolsv.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
lea edx, [ebp - 0xefc]
push str.explorer.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efe4
xor esi, esi
xor edi, edi
push 0xd8a430
mov dword [ebp - 4], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x54], esi
call fcn.004a6b50
add esp, 4
lea eax, [ebp - 0x49c]
push 0xd8a430
push eax
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x49cf97
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x49c]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x14], ebx
jmp 0x49d7fe
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x11c], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0xec], eax
test eax, eax
jne 0x49d026
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x14], 2
mov eax, dword [0xd8a438]
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x104], esi
jne 0x49d6b8
mov dword [ebp - 0x14], 6
jmp 0x49d7ec
mov dword [ebp - 0x8c], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x49cff3
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd8a438]
mov eax, dword [ebp - 0x11c]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov ebx, eax
inc ecx
push 0x515c98
push ebx
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov edi, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x118], eax
cmp esi, 0x69
jge 0x49d10f
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49d109
cmp esi, 0xf
jle 0x49d0aa
cmp esi, 0x12
jge 0x49d0aa
mov dword [ebp - 0x78], edi
cmp esi, 0x1d
je 0x49d0b9
cmp esi, 0x1e
je 0x49d0b9
cmp esi, 0x39
jne 0x49d0bc
mov dword [ebp - 0x7c], edi
cmp esi, 0x1f
je 0x49d0c6
cmp esi, 0x20
jne 0x49d0c9
mov dword [ebp - 0x64], edi
cmp esi, 0x21
je 0x49d0d3
cmp esi, 0x22
jne 0x49d0d6
mov dword [ebp - 0x74], edi
cmp esi, 0x23
je 0x49d0e0
cmp esi, 0x24
jne 0x49d0e3
mov dword [ebp - 0x6c], edi
cmp esi, 0x2c
jne 0x49d0ee
mov dword [ebp - 0x58], edi
inc esi
jmp 0x49d07a
cmp esi, 0x2d
je 0x49d106
cmp esi, 0x2e
jne 0x49d101
mov dword [ebp - 0x60], edi
inc esi
jmp 0x49d07a
cmp esi, 0x3d
jne 0x49d109
mov dword [ebp - 0x24], edi
inc esi
jmp 0x49d07a
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0x18], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd8a438]
mov dword [ebp - 0x104], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0x8c]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x49d154
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x40], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x49cff3
mov ebx, 1
mov eax, dword [eax]
test eax, eax
je 0x49d5ff
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x49d1e3
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x73c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9fc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [ebp - 0x9fc]
jmp 0x49d263
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x49d21a
xor edx, edx
lea eax, [ebp - 0x73c]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [esi + 2]
jmp 0x49d263
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x73c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9dc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [ebp - 0x9dc]
xor esi, esi
cmp esi, 0x69
jge 0x49d5b6
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49d5b0
cmp esi, 0x45
jne 0x49d331
lea edx, [ebp - 0xbfc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xbfc]
lea ecx, [ebp - 0x19c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x19c]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x49d30a
lea eax, [ebp - 0x9bc]
lea ecx, [ebp - 0xffc]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xffc]
push ecx
jmp 0x49f159
lea edx, [ebp - 0x9bc]
lea eax, [ebp - 0xffc]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xffc]
push ecx
jmp 0x49f159
test esi, esi
jne 0x49d33e
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x49d265
cmp esi, ebx
jne 0x49d34b
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x49d265
cmp esi, 2
je 0x49d5b0
cmp esi, 4
jne 0x49d365
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x49d265
cmp esi, 5
jne 0x49d376
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x49d265
cmp esi, 6
jne 0x49d387
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x49d265
cmp esi, 7
jne 0x49d398
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x49d265
cmp esi, 8
jne 0x49d3a9
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x49d265
cmp esi, 9
jne 0x49d3ba
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x49d265
cmp esi, 0xa
jne 0x49d3c8
mov dword [ebp - 0x68], ebx
inc esi
jmp 0x49d265
cmp esi, 0xb
jle 0x49d3d5
cmp esi, 0xf
jge 0x49d3d8
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x49d3e6
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x49d265
jle 0x49d3f0
cmp esi, 0x12
jge 0x49d3f0
mov dword [ebp - 0x78], ebx
cmp esi, 0x1b
jne 0x49d401
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x49d265
cmp esi, 0x1c
jne 0x49d412
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x49d265
cmp esi, 0x1d
je 0x49d421
cmp esi, 0x1e
je 0x49d421
cmp esi, 0x39
jne 0x49d424
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1f
je 0x49d42e
cmp esi, 0x20
jne 0x49d431
mov dword [ebp - 0x64], ebx
cmp esi, 0x21
je 0x49d43b
cmp esi, 0x22
jne 0x49d43e
mov dword [ebp - 0x74], ebx
cmp esi, 0x23
je 0x49d448
cmp esi, 0x24
jne 0x49d44b
mov dword [ebp - 0x6c], ebx
cmp esi, 0x25
je 0x49d455
cmp esi, 0x26
jne 0x49d45b
mov dword [ebp - 0xa8], ebx
cmp esi, 0x27
jne 0x49d46c
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x49d265
cmp esi, 0x28
jne 0x49d47d
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x49d265
cmp esi, 0x29
jne 0x49d48e
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x49d265
cmp esi, 0x2c
jne 0x49d49c
mov dword [ebp - 0x58], ebx
inc esi
jmp 0x49d265
cmp esi, 0x2d
jne 0x49d4aa
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x49d265
cmp esi, 0x2e
jne 0x49d4b8
mov dword [ebp - 0x60], ebx
inc esi
jmp 0x49d265
cmp esi, 0x2f
jne 0x49d4c9
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x49d265
cmp esi, 0x30
jne 0x49d4da
mov dword [ebp - 0xc0], ebx
inc esi
jmp 0x49d265
cmp esi, 0x31
jne 0x49d4eb
mov dword [ebp - 0x100], ebx
inc esi
jmp 0x49d265
cmp esi, 0x32
jne 0x49d4fc
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x49d265
cmp esi, 0x34
jne 0x49d50d
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x49d265
cmp esi, 0x35
jne 0x49d51e
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x49d265
cmp esi, 0x36
jne 0x49d52f
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x49d265
cmp esi, 0x37
jne 0x49d544
mov dword [ebp - 0xbc], 0
inc esi
jmp 0x49d265
cmp esi, 0x38
jne 0x49d555
mov dword [ebp - 0xc4], ebx
inc esi
jmp 0x49d265
cmp esi, 0x3a
je 0x49d564
cmp esi, 0x3b
je 0x49d564
cmp esi, 0x3c
jne 0x49d56a
mov dword [ebp - 0xd4], ebx
cmp esi, 0x3d
jne 0x49d578
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x49d265
cmp esi, 0x3e
jne 0x49d589
mov dword [ebp - 0xdc], ebx
inc esi
jmp 0x49d265
cmp esi, 0x3f
jne 0x49d597
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x49d265
cmp esi, 0x40
jne 0x49d5a5
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x49d265
cmp esi, 0x41
jne 0x49d5b0
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x49d265
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x118]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x3c], ecx
jne 0x49d5cd
inc dword [ebp - 0xfc]
cmp dword [ebp - 0x3c], 0xc350
jg 0x49d5ff
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x104]
mov dword [ebp - 0x40], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x49d178
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov edx, dword [ebp - 0x18]
mov ecx, eax
push edx
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0xec]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0xec], eax
jmp 0x49d030
mov ecx, dword [0xd8a438]
push ecx
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp + 8], ebx
cmp bx, word [esi + 2]
jae 0x49d7ec
xor edx, edx
push str..asp
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x48], dl
mov eax, dword [edi]
mov dword [ebp - 0x50], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x49d709
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x50]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49d721
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x50]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49d739
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x50]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49d751
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x50]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49d769
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x50]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49d781
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x50]
push 0x50dc3c
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49d799
inc dword [ebp - 0x54]
mov esi, dword [ebp - 0x70]
mov eax, dword [ebp + 8]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0x70], esi
mov dword [ebp + 8], eax
jg 0x49d7ec
mov esi, dword [ebp - 0x104]
add edi, 0x28
inc ebx
jmp 0x49d6cc
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x70]
mov dword [ebp - 4], 0
mov ebx, 1
mov eax, dword [0xd8a438]
push eax
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x49d83b
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x14], 3
push 0xd8a430
call fcn.004a6b50
mov eax, dword [ebp - 0x14]
add esp, 4
cmp eax, ebx
jne 0x49d859
push 0x515b6c
jmp 0x49f159
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + 8], esi
test edi, edi
mov dword [ebp - 0x18], ecx
jne 0x49e02f
cmp esi, ebx
jge 0x49e02f
lea edx, [ebp - 0x11fc]
xor esi, esi
push edx
mov dword [ebp - 0x1c], esi
call fcn.004f2beb
jmp 0x49d898
lea eax, [ebp - 0xefc]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xffc]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x49d8c9
push ebx
lea ecx, [ebp - 0x164]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x49d8f3
lea edx, [ebp - 0xffc]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x49d907
lea eax, [ebp - 0x29c]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp - 0x40], esi
push ecx
push ebx
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x164]
call fcn.004f0727
mov edx, dword [ebp - 0x164]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x160]
cmp dword [eax + 0x30], 0xffffffff
jne 0x49d954
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x49db0d
mov esi, dword [ebp - 0x160]
push 0xa
lea ecx, [ebp - 0x83c]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x160], esi
call fcn.004f0ae9
lea edi, [ebp - 0x83c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x49df07
lea edx, [ebp - 0x83c]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49d9b1
mov dword [ebp - 0x108], ebx
lea eax, [ebp - 0x83c]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49d9d3
push 0x5147b4
jmp 0x49db05
lea ecx, [ebp - 0x83c]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49df07
lea edx, [ebp - 0x83c]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49df07
lea eax, [ebp - 0x83c]
push str.Dump_of_file
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49df07
cmp dword [ebp - 0x44], ebx
jne 0x49da2f
inc dword [ebp + 8]
cmp dword [ebp - 0x28], ebx
jne 0x49da37
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x49df04
lea ecx, [esi + esi*2]
lea edx, [ebp - 0x83c]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x49defe
mov ecx, dword [ebp - 0xf4]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xf4], ecx
jne 0x49db3c
lea eax, [ebp - 0xbfc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0xbfc]
lea edx, [ebp - 0x127c]
push ecx
push str._sMicrosoft.NETFramework
push edx
call fcn.004f175f
lea eax, [ebp - 0x127c]
push eax
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x49dae3
lea edx, [ebp - 0x9bc]
lea eax, [ebp - 0x137c]
push edx
push 0x5153f4
push eax
jmp 0x49daf6
lea ecx, [ebp - 0x9bc]
lea edx, [ebp - 0x137c]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x137c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x150]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x150]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x49dbbc
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x49db5c
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x83c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x83c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x83c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x49dc34
test ebx, ebx
jne 0x49dc34
test eax, eax
jne 0x49dc34
mov dword [ebp - 0x28], eax
mov ebx, 1
inc esi
jmp 0x49da3b
cmp esi, 0x1a
jne 0x49dc48
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x49dbe0
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x83c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x83c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x83c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x49dc34
test ebx, ebx
jne 0x49dc34
test eax, eax
jne 0x49dc34
mov dword [ebp - 0x28], eax
mov ebx, 1
inc esi
jmp 0x49da3b
xor edi, edi
mov dword [ebp - 0x28], 1
mov ebx, 1
inc esi
jmp 0x49da3b
cmp esi, 0x2a
jne 0x49dc5f
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x28], edi
inc esi
jmp 0x49da3b
cmp esi, 0x2b
jne 0x49dc76
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x28], edi
inc esi
jmp 0x49da3b
cmp esi, edi
jne 0x49dc83
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x49da3b
cmp esi, ebx
jne 0x49dc90
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x49da3b
cmp esi, 2
je 0x49defe
cmp esi, 4
jne 0x49dcaa
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x49da3b
cmp esi, 5
jne 0x49dcbb
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x49da3b
cmp esi, 6
jne 0x49dccc
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x49da3b
cmp esi, 7
jne 0x49dcdd
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x49da3b
cmp esi, 8
jne 0x49dcee
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x49da3b
cmp esi, 9
jne 0x49dcff
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x49da3b
cmp esi, 0xa
jne 0x49dd0d
mov dword [ebp - 0x68], ebx
inc esi
jmp 0x49da3b
cmp esi, 0xb
jle 0x49dd1a
cmp esi, 0xf
jge 0x49dd1d
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x49dd2b
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x49da3b
jle 0x49dd35
cmp esi, 0x12
jge 0x49dd35
mov dword [ebp - 0x78], ebx
cmp esi, 0x11
jle 0x49dd42
cmp esi, 0x19
jge 0x49dd42
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x49dd53
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x1c
jne 0x49dd64
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x1d
je 0x49dd73
cmp esi, 0x1e
je 0x49dd73
cmp esi, 0x39
jne 0x49dd76
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1f
je 0x49dd80
cmp esi, 0x20
jne 0x49dd83
mov dword [ebp - 0x64], ebx
cmp esi, 0x21
je 0x49dd8d
cmp esi, 0x22
jne 0x49dd90
mov dword [ebp - 0x74], ebx
cmp esi, 0x23
je 0x49dd9a
cmp esi, 0x24
jne 0x49dd9d
mov dword [ebp - 0x6c], ebx
cmp esi, 0x25
je 0x49dda7
cmp esi, 0x26
jne 0x49ddad
mov dword [ebp - 0xa8], ebx
cmp esi, 0x27
jne 0x49ddbe
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x28
jne 0x49ddcf
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x29
jne 0x49dde0
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x2c
jne 0x49ddee
mov dword [ebp - 0x58], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x2d
jne 0x49ddfc
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x2e
jne 0x49de0a
mov dword [ebp - 0x60], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x2f
jne 0x49de1b
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x30
jne 0x49de2c
mov dword [ebp - 0xc0], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x31
jne 0x49de3d
mov dword [ebp - 0x100], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x32
jne 0x49de4e
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x34
jne 0x49de5f
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x35
jne 0x49de70
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x36
jne 0x49de81
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x37
jne 0x49de92
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x49da3b
cmp esi, 0x38
jne 0x49dea3
mov dword [ebp - 0xc4], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x3a
je 0x49deb2
cmp esi, 0x3b
je 0x49deb2
cmp esi, 0x3c
jne 0x49deb8
mov dword [ebp - 0xd4], ebx
cmp esi, 0x3d
jne 0x49dec6
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x3e
jne 0x49ded7
mov dword [ebp - 0xdc], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x3f
jne 0x49dee5
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x40
jne 0x49def3
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x49da3b
cmp esi, 0x41
jne 0x49defe
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x49da3b
inc dword [ebp - 0x40]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x15c], 1
je 0x49d954
lea ecx, [ebp - 0x164]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jle 0x49df3a
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
jle 0x49df46
sub eax, ecx
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc8]
test ecx, ecx
jne 0x49df5b
cmp eax, 6
jle 0x49df5b
sub eax, 6
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x150]
call fcn.004f05fb
mov esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
mov edi, dword [ebp - 0x70]
cmp dword [ebp - 0x14], 5
jne 0x49e037
test esi, esi
jne 0x49e039
test edi, edi
jle 0x49e144
mov eax, dword [ebp - 0x10c]
cmp eax, 0xc800
jge 0x49e144
cmp eax, 0x400
jle 0x49e144
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x29c]
push eax
call esi
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49e0f8
lea edx, [ebp - 0x29c]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x29c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x29c]
push ecx
call esi
test eax, eax
jne 0x49e0f8
lea edx, [ebp - 0x29c]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49e0f8
lea eax, [ebp - 0x29c]
push eax
jmp 0x49e0e3
mov ecx, dword [ebp - 0x54]
jmp 0x49df7e
test esi, esi
jle 0x49e144
cmp esi, 0xa
jge 0x49e144
test ecx, ecx
jle 0x49e144
lea eax, [edi - 1]
cmp ecx, eax
jg 0x49e05d
jne 0x49e144
mov eax, dword [ebp - 0x10c]
cmp eax, 0xa000
jge 0x49e144
cmp eax, 0x400
jle 0x49e144
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x29c]
push edx
call esi
lea eax, [ebp - 0x29c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49e0f8
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x29c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x29c]
push eax
call esi
test eax, eax
jne 0x49e0f8
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49e0f8
lea edx, [ebp - 0x29c]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x69c]
mov edi, 0x515b34
jmp 0x49e103
lea edx, [ebp - 0x69c]
mov edi, 0x5159c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56c98]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xe56d20]
inc ecx
inc eax
mov dword [0xe56d20], ecx
lea ecx, [ebp - 0x69c]
mov dword [0xe56c98], eax
push ecx
jmp 0x49f159
mov eax, dword [ebp - 0xf4]
mov byte [ebp - 0x69c], 0
cmp eax, ebx
mov dword [ebp - 0x14], 0
jle 0x49e188
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
jmp 0x49e18e
mov ebx, dword [ebp - 0x110]
cmp dword [ebp - 0x90], 1
jne 0x49e1c7
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x49e210
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xe8]
mov eax, 1
cmp ecx, eax
jne 0x49e254
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x49e28f
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], eax
jne 0x49e2cd
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], eax
je 0x49e2dd
cmp dword [ebp - 0xa0], eax
jne 0x49e312
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], eax
jne 0x49e350
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
jne 0x49e38d
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x49e3cb
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x49e406
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x49e44b
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
jne 0x49e489
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x49e4c7
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe0], eax
jne 0x49e505
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x49e5a1
cmp dword [ebp - 0xc0], eax
je 0x49e52b
cmp dword [ebp - 0x100], eax
je 0x49e52b
lea edx, [ebp - 0x69c]
mov edi, 0x515278
jmp 0x49e576
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x88]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x69c]
mov edi, 0x515258
je 0x49e576
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x84], eax
jne 0x49e5df
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x94], eax
jne 0x49e61d
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x49e658
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x49e6d7
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe4]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp eax, esi
jne 0x49e6dc
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dword [ebp - 0x14], esi
jmp 0x49e6dc
mov esi, 1
cmp dword [ebp - 0x9c], esi
jne 0x49e794
cmp dword [ebp - 0xa4], esi
jne 0x49e794
cmp dword [ebp - 0xac], esi
jne 0x49e794
cmp dword [ebp - 0xb4], esi
jne 0x49e74a
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x69c]
cmp eax, esi
mov edi, 0x5151ec
je 0x49e71f
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xbc], esi
jne 0x49e794
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x69c]
cmp eax, esi
mov edi, 0x5151c4
je 0x49e769
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xc4], esi
jne 0x49e7d1
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x7c], esi
jne 0x49e80c
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x64], esi
jne 0x49e847
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x74], esi
jne 0x49e882
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x6c], esi
jne 0x49e8bd
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x49e904
mov eax, dword [ebp - 0x108]
test eax, eax
jne 0x49e904
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xcc], esi
jle 0x49e942
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x49e97d
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x24], esi
jne 0x49e9b8
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x60], esi
jne 0x49e9f2
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xd4], esi
jne 0x49ea30
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x49ea6d
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, dword [ebp - 0x1c]
mov ecx, 4
cmp eax, esi
je 0x49ea80
lea ecx, [eax*4]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
jl 0x49ea8e
cmp edx, 7
jge 0x49ead5
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x69c]
cmp eax, esi
mov edi, 0x5150f8
je 0x49eaa5
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
jle 0x49eb1f
cmp dword [ebp - 0x1c], esi
jne 0x49eb1f
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, 1
mov dword [ebp - 0x14], esi
mov eax, esi
cmp dword [ebp - 0x68], esi
jne 0x49eb64
cmp ecx, 5
jge 0x49eb64
test ecx, ecx
jle 0x49eb64
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x69c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0x80]
cmp ecx, 6
jle 0x49eb88
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x49eb88
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x49eb88
test eax, eax
jne 0x49eb88
push 0x5147b4
jmp 0x49f159
cmp ecx, 7
jge 0x49ec58
cmp dword [ebp - 0x2c], esi
jne 0x49ec11
cmp ecx, esi
lea edx, [ebp - 0x69c]
jge 0x49ebdb
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x49ec57
mov dword [ebp - 0x14], 1
jmp 0x49ec57
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x49ec57
jmp 0x49ec54
cmp ecx, esi
lea edx, [ebp - 0x69c]
mov edi, 0x515078
jl 0x49ec25
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x49ec57
mov dword [ebp - 0x14], eax
inc ebx
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x49ed21
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x49ed21
cmp dword [ebp - 0x80], 6
jle 0x49ed21
cmp dword [ebp - 0xe4], 1
jne 0x49ed39
push 0xd9b940
push 0xd6d890
lea eax, [ebp - 0x49c]
push 0xd56eac
push eax
call fcn.004b7fe0
add esp, 0x10
lea ecx, [ebp - 0x49c]
movsx esi, ax
push 0xd4f1d0
push ecx
call fcn.004b83e0
add esp, 8
cmp esi, 6
jle 0x49ed21
push 0xd56eac
push 0xd9b8c0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49ed21
push 0xd6d890
push 0xe56a50
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49ed21
push 0xd9b940
push 0xdb1c0c
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49ed21
push 0xd4f1d0
push 0xd4f350
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49ed21
push 0x515044
jmp 0x49f159
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x49ed43
push 0x5147b4
jmp 0x49f159
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49ed97
mov ecx, dword [ebp - 0x30]
mov eax, 1
cmp ecx, eax
je 0x49ed97
cmp dword [ebp - 0x14], eax
je 0x49ed97
cmp ebx, eax
jle 0x49ed39
lea edx, [ebp - 0x69c]
lea eax, [ebp - 0x167c]
push edx
push 0x515004
push eax
call fcn.004f175f
lea ecx, [ebp - 0x167c]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x69c]
lea eax, [ebp - 0x147c]
push edx
push 0x514fd8
push eax
call fcn.004f175f
lea ecx, [ebp - 0x29c]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49edea
lea edx, [ebp - 0x29c]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x49edea
lea eax, [ebp - 0x29c]
push eax
call fcn.004abcc0
add esp, 4
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x49ee03
lea ecx, [ebp - 0xefc]
push ecx
call fcn.004ab130
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x29c]
push edx
call esi
lea eax, [ebp - 0x29c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x49ee84
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x29c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x29c]
push eax
call esi
test eax, eax
jne 0x49ee84
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x49ee84
lea edx, [ebp - 0x29c]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x69c]
mov edi, 0x515b34
jmp 0x49ee8f
lea edx, [ebp - 0x69c]
mov edi, 0x5159c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebx, ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x29c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [0xe56c50]
and ecx, 3
cmp edx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x49ef60
shl edx, 8
lea eax, [ebp - 0x49c]
lea ecx, [edx + 0xd70d90]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49efa4
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x49c]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49efa4
lea ecx, [ebp - 0x69c]
mov dword [0xe56c50], ebx
push ecx
jmp 0x49f159
mov esi, edx
lea edi, [ebp - 0x49c]
shl esi, 8
or ecx, 0xffffffff
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49efa4
mov dword [0xe56c50], ebx
lea ecx, [ebp - 0x69c]
push ecx
jmp 0x49f159
lea edx, [ebp - 0x29c]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49f00b
lea eax, [ebp - 0x29c]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x29c]
push ecx
call esi
lea edx, [ebp - 0x29c]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49f0d8
lea eax, [ebp - 0x29c]
push eax
call fcn.004ab990
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 4
lea ecx, [ebp - 0x29c]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x29c]
push edx
call esi
test eax, eax
jne 0x49f091
lea eax, [ebp - 0x29c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x49f091
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x69c]
mov edi, 0x5158dc
jmp 0x49f09c
lea edx, [ebp - 0x69c]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x29c]
push ecx
call ebx
lea edx, [ebp - 0x29c]
push edx
call fcn.004f2cb8
add esp, 4
jmp 0x49f121
lea eax, [ebp - 0x29c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004f2cb8
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x69c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xe56d20]
lea edi, [ebp - 0x29c]
inc eax
or ecx, 0xffffffff
mov dword [0xe56d20], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x69c]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret