Function at 0x4567d0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb22b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1840
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xc10]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x4b0]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x456986
push edx
lea ecx, [ebp - 0x4b0]
push 0x520bdc
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4b0]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx - 2]
test eax, eax
mov dword [ebp + 8], eax
jle 0x4569ae
cmp byte [ebp + eax - 0x4b0], 0x3a
jne 0x4569a4
cmp byte [ebp + eax - 0x4af], 0x5c
je 0x4569a9
dec eax
test eax, eax
jg 0x456990
mov dword [ebp + 8], eax
test eax, eax
je 0x456a8d
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1550]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x520bd8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4b0]
xor esi, esi
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4569fc
mov esi, 1
test ebx, ebx
mov eax, ebx
jle 0x456a24
mov cl, byte [ebp + eax - 0x4b0]
cmp cl, 0x4b
jne 0x456a15
mov esi, 1
jmp 0x456a1a
cmp esi, 1
jne 0x456a1f
cmp cl, 0x2e
je 0x456a24
dec eax
test eax, eax
jg 0x456a02
mov edx, dword [ebp + 8]
mov byte [ebp - 0x4b0], 0
sub eax, edx
lea ecx, [eax + 5]
test ecx, ecx
jle 0x456a52
lea esi, [ebp + edx - 0x1551]
mov edx, ecx
lea edi, [ebp - 0x4b0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x4ab], 0
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x456a7d
cmp byte [ebp + ecx - 0x4b0], 0x2e
je 0x456a7d
dec ecx
test ecx, ecx
jg 0x456a6e
test ecx, ecx
mov byte [ebp + ecx - 0x4ac], 0
jne 0x456b53
lea eax, [ebp - 0x2b0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xed0]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x830]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x830]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x456b31
lea edx, [ebp - 0x830]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x456b31
lea eax, [ebp - 0x830]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x456b31
lea ecx, [ebp - 0x830]
lea edx, [ebp - 0x2b0]
push ecx
jmp 0x456b3e
lea ecx, [ebp - 0x830]
lea edx, [ebp - 0xed0]
push ecx
push edx
lea eax, [ebp - 0x4b0]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx - 1]
test eax, eax
jle 0x456b79
cmp byte [ebp + eax - 0x4b0], 0x2e
je 0x456b79
dec eax
test eax, eax
jg 0x456b6a
mov byte [ebp + eax - 0x4ac], 0
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x4b0]
mov edx, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004abe70
mov ebx, 1
add esp, 4
cmp eax, ebx
je 0x456bda
lea ecx, [ebp - 0x4b0]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
je 0x456bda
push 0x515844
jmp 0x459c6e
lea edx, [ebp - 0x4b0]
push edx
call fcn.004ab3c0
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x4b0]
push eax
push ecx
call fcn.004d9950
movsx edx, ax
lea eax, [ebp - 0xe50]
lea ecx, [ebp - 0x4b0]
push eax
push ecx
mov dword [ebp - 0x48], edx
call fcn.004da170
lea edx, [ebp - 0xe50]
push edx
push str.PowerWord
call fcn.004f61e0
add esp, 0x1c
test eax, eax
jne 0x456c3b
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0x230]
push str.Maxthon_International
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456c5f
lea edx, [ebp - 0x230]
push edx
jmp 0x459c6e
lea eax, [ebp - 0x230]
push str.MoreQuick
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456c83
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x230]
push str.Opera_Software
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456ca6
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0x230]
push str.Beijing_Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456ce6
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456d26
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456d66
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456da6
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456de6
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456e26
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456e66
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456ea6
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456ee6
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x230]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456f26
mov edi, 0x5156ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4b0]
push 0x5156a4
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456f4a
lea edx, [ebp - 0x230]
push edx
jmp 0x459c6e
lea eax, [ebp - 0x4b0]
push str.java
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456f6e
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x230]
push str.Microsoft
push edx
mov dword [ebp - 0x6c], 0
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456f90
mov dword [ebp - 0x6c], ebx
lea eax, [ebp - 0x4b0]
push str.CCManager
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x456fb2
push 0x5147b4
jmp 0x459c6e
lea ecx, [ebp - 0x730]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xc90]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x730]
lea ecx, [ebp - 0x930]
push eax
push str._swinlogon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4b0]
lea eax, [ebp - 0x930]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457014
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x730]
lea eax, [ebp - 0x930]
push edx
push str._scsrss.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4b0]
lea edx, [ebp - 0x930]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457051
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0x730]
lea edx, [ebp - 0x930]
push ecx
push str._s_services.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0x930]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45708f
lea edx, [ebp - 0x230]
push edx
jmp 0x459c6e
lea eax, [ebp - 0x730]
lea ecx, [ebp - 0x930]
push eax
push str._slsass.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4b0]
lea eax, [ebp - 0x930]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4570cd
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x730]
lea eax, [ebp - 0x930]
push edx
push str._s_svchost.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4b0]
lea edx, [ebp - 0x930]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45710a
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0x730]
lea edx, [ebp - 0x930]
push ecx
push str._suserinit.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0x930]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457148
lea edx, [ebp - 0x230]
push edx
jmp 0x459c6e
lea eax, [ebp - 0x730]
lea ecx, [ebp - 0x930]
push eax
push str._s_taskmgr.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4b0]
lea eax, [ebp - 0x930]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457186
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x730]
lea eax, [ebp - 0x930]
push edx
push str._s_spoolsv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4b0]
lea edx, [ebp - 0x930]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4571c3
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0xc90]
lea edx, [ebp - 0x930]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0x930]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457201
lea edx, [ebp - 0x230]
push edx
jmp 0x459c6e
lea eax, [ebp - 0x4b0]
push eax
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x457225
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x730]
lea eax, [ebp - 0x930]
push edx
push str._sctfmon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4b0]
lea edx, [ebp - 0x930]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x457262
lea eax, [ebp - 0x230]
jmp 0x459c6d
lea ecx, [ebp - 0xc90]
lea edx, [ebp - 0x930]
push ecx
push str._s_anotherlockfile.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0x930]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45729e
push 0x5147b4
jmp 0x459c6e
lea edx, [ebp - 0x11d0]
lea eax, [ebp - 0x4b0]
push edx
push eax
call fcn.004c9790
add esp, 8
xor edi, edi
xor esi, esi
lea ecx, [esi + str.CMBPB]
lea edx, [ebp - 0x11d0]
push ecx
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45730b
lea eax, [esi + str.PersonalBankPortal.exe]
lea ecx, [ebp - 0xc10]
push eax
push ecx
lea edx, [ebp - 0xb50]
push str._s_system32_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0xb50]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x457365
add esi, 0x100
inc edi
cmp esi, 0x200
jl 0x4572b8
xor edi, edi
mov esi, str.watchclient.exe
lea ecx, [ebp - 0xc10]
push esi
push ecx
lea edx, [ebp - 0xb50]
push str._s_system32_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0xb50]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x4573a0
add esi, 0x100
inc edi
cmp esi, 0x50eba4
jl 0x457321
jmp 0x4573db
shl edi, 8
add edi, str.CMBPB
lea edx, [ebp - 0xb50]
push edi
push 0x520b90
push edx
call fcn.004f175f
lea eax, [ebp - 0xb50]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50eba4
lea edx, [ebp - 0xb50]
push edi
push 0x520b90
push edx
call fcn.004f175f
lea eax, [ebp - 0xb50]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0xe56be4], ebx
jne 0x4574fd
xor edi, edi
mov esi, str.olelink.exe
lea ecx, [ebp - 0xc10]
push esi
push ecx
lea edx, [ebp - 0xb50]
push str._s_system32_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0xb50]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x457487
add esi, 0x100
inc edi
cmp esi, 0x510124
jl 0x4573ee
cmp dword [0xe56bf0], ebx
jne 0x4574fd
xor edi, edi
mov esi, str.WBWA.exe
lea ecx, [ebp - 0xc10]
push esi
push ecx
lea edx, [ebp - 0xb50]
push str._s_system32_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x4b0]
lea ecx, [ebp - 0xb50]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x4574c2
add esi, 0x100
inc edi
cmp esi, 0x510724
jl 0x457443
jmp 0x4574fd
shl edi, 8
add edi, 0x510124
lea edx, [ebp - 0xb50]
push edi
push 0x520b90
push edx
call fcn.004f175f
lea eax, [ebp - 0xb50]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x510724
lea edx, [ebp - 0xb50]
push edi
push 0x520b90
push edx
call fcn.004f175f
lea eax, [ebp - 0xb50]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x4b0]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x2c], edx
cmp ecx, edx
jle 0x457535
lea esi, [ebp + ecx - 0x4b0]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0x10d0], al
jne 0x45752f
cmp edx, 2
jge 0x457535
inc edx
dec esi
cmp edx, ecx
jl 0x45751d
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x45755c
mov ebx, ecx
lea esi, [ebp - 0x4b0]
lea edi, [ebp - 0x13d0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x13d0], 0
test edx, edx
jle 0x4575a6
mov edi, dword [ebp - 0xec]
lea esi, [ebp + eax - 0x4af]
mov al, byte [ecx + esi]
cmp al, 0x5c
je 0x457585
mov byte [ebp + ecx - 0x10d0], al
cmp al, 0x2e
jne 0x45758a
inc edi
cmp al, 0x20
jne 0x45758f
inc edi
cmp al, 0x5c
jne 0x45759b
mov byte [ebp + ecx - 0x10d0], 0
inc ecx
cmp ecx, edx
jl 0x457577
mov dword [ebp - 0xec], edi
mov al, byte [ebp - 0x13ce]
mov byte [ebp + edx - 0x10d0], 0
cmp al, 0x5c
je 0x4575c6
mov byte [ebp - 0x13ce], 0x5c
mov byte [ebp - 0x13cd], 0
lea ecx, [ebp - 0x13d0]
lea edx, [ebp - 0xc10]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4575e3
mov dword [ebp - 0x40], ebx
lea eax, [ebp - 0x13d0]
push str.LOCALS1Temp
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4575fe
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x4b0]
push 0x100
lea edx, [ebp - 0xa30]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x10d0]
push 0x40
lea ecx, [ebp - 0xb90]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x4b0]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x457655
push 0x5144fc
jmp 0x459c6e
lea eax, [ebp - 0x4b0]
push 0x80
lea ecx, [ebp - 0xd50]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x4b0]
push 0x80
lea eax, [ebp - 0xdd0]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xc90]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x730]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xd50], al
lea edx, [ebp - 0xd50]
mov byte [ebp + ecx - 0xdd0], al
lea ecx, [ebp - 0xc90]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x4576e8
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4576e5
push esi
jmp 0x459c6e
mov dword [ebp - 0x40], ebx
lea eax, [ebp - 0x730]
lea ecx, [ebp - 0xdd0]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45771d
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45771d
push esi
jmp 0x459c6e
lea edx, [ebp - 0x4b0]
push str.System
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x457776
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x457750
push esi
jmp 0x459c6e
lea eax, [ebp - 0x4b0]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x457776
push edi
jmp 0x459c6e
lea ecx, [ebp - 0x4b0]
push str._system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4577cf
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4577a9
push esi
jmp 0x459c6e
lea edx, [ebp - 0x4b0]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4577cf
push edi
jmp 0x459c6e
lea eax, [ebp - 0x4b0]
push str.SYSTEM
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x457828
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x457802
push esi
jmp 0x459c6e
lea ecx, [ebp - 0x4b0]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x457828
push esi
jmp 0x459c6e
lea edx, [ebp - 0x4b0]
push 0x515d14
push edx
call fcn.004f2d80
add esp, 8
mov esi, ebx
test eax, eax
jne 0x457845
mov esi, dword [ebp - 0x74]
lea eax, [ebp - 0x4b0]
push str.Microsoft_SharedMSINFO
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45785f
mov esi, ebx
lea ecx, [ebp - 0x4b0]
push str.Microsoft_SharedMSInfo
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x457879
mov esi, ebx
lea edx, [ebp - 0x10d0]
push str.smss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea eax, [ebp - 0x10d0]
push str.winlogon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea ecx, [ebp - 0x10d0]
push str.csrss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea edx, [ebp - 0x10d0]
push str.services.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea eax, [ebp - 0x10d0]
push str.lsass.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea ecx, [ebp - 0x10d0]
push str.svchost.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea edx, [ebp - 0x10d0]
push str.taskmgr.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea eax, [ebp - 0x10d0]
push str.spoolsv.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea ecx, [ebp - 0x10d0]
push str.explorer.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea edx, [ebp - 0x10d0]
push str.userinit.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
lea eax, [ebp - 0x10d0]
push str.ctfmon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x459b6d
cmp dword [ebp - 0x48], 3
jle 0x4579ca
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x4579ca
test esi, esi
jne 0x4579ca
lea ecx, [ebp - 0x230]
push ecx
jmp 0x459c6e
xor edi, edi
push 0xd8a430
mov dword [ebp - 4], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x18], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x4b0]
push 0xd8a430
push edx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x457a3f
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x4b0]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x45819c
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x12c], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xfc], eax
jne 0x457aa0
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
jmp 0x458163
mov dword [ebp - 0xa4], edi
cmp dword [eax + 0x10], edi
je 0x458161
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd8a438]
mov eax, dword [ebp - 0x12c]
push ecx
push edx
push eax
call fcn.004a6c30
add esp, 0xc
mov edi, eax
mov eax, dword [ebp - 0x1c]
inc eax
push 0x515c98
push edi
mov dword [ebp - 0x1c], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x130], eax
call fcn.004f61e0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x124], eax
cmp esi, 0x69
jge 0x457b98
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x457b92
cmp esi, 0xf
jle 0x457b33
cmp esi, 0x12
jge 0x457b33
mov dword [ebp - 0x78], ebx
cmp esi, 0x1d
je 0x457b42
cmp esi, 0x1e
je 0x457b42
cmp esi, 0x39
jne 0x457b45
mov dword [ebp - 0x58], ebx
cmp esi, 0x1f
je 0x457b4f
cmp esi, 0x20
jne 0x457b52
mov dword [ebp - 0x70], ebx
cmp esi, 0x21
je 0x457b5c
cmp esi, 0x22
jne 0x457b5f
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x457b69
cmp esi, 0x24
jne 0x457b6c
mov dword [ebp - 0x4c], ebx
cmp esi, 0x2c
jne 0x457b77
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x457b03
cmp esi, 0x2d
je 0x457b8f
cmp esi, 0x2e
jne 0x457b8a
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x457b03
cmp esi, 0x3d
jne 0x457b92
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x457b03
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0x114], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd8a438]
mov dword [ebp - 0x10c], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0xa4]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x457be0
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x74], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp + 0xc], eax
test eax, eax
je 0x458161
mov eax, dword [eax]
test eax, eax
je 0x458101
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x457c6a
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa50]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xcd0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xcd0]
jmp 0x457cea
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x457ca1
xor edx, edx
lea eax, [ebp - 0xa50]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x457cea
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa50]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xcb0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xcb0]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x458073
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45806d
cmp esi, 0x45
jne 0x457dbd
lea edx, [ebp - 0xed0]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xed0]
lea ecx, [ebp - 0x2b0]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x2b0]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x457d96
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0xb50]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xb50]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x230]
lea eax, [ebp - 0xb50]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xb50]
push ecx
jmp 0x459c6e
test esi, esi
jne 0x457dca
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x457cf1
cmp esi, edi
jne 0x457dd7
mov dword [ebp - 0x20], edi
inc esi
jmp 0x457cf1
cmp esi, 2
je 0x45806d
cmp esi, 4
jne 0x457df1
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x457cf1
cmp esi, 5
jne 0x457e02
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x457cf1
cmp esi, 6
jne 0x457e13
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x457cf1
cmp esi, 7
jne 0x457e24
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x457cf1
cmp esi, 8
jne 0x457e35
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x457cf1
cmp esi, 9
jne 0x457e46
mov dword [ebp - 0x108], edi
inc esi
jmp 0x457cf1
cmp esi, 0xa
jne 0x457e54
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x457cf1
cmp esi, 0xb
jne 0x457e65
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x457cf1
jle 0x457e6f
cmp esi, 0xf
jge 0x457e72
mov dword [ebp - 0x64], edi
cmp esi, 0xf
jne 0x457e80
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x457cf1
jle 0x457e8a
cmp esi, 0x12
jge 0x457e8a
mov dword [ebp - 0x78], edi
cmp esi, 0x1b
jne 0x457e9b
mov dword [ebp - 0x100], edi
inc esi
jmp 0x457cf1
cmp esi, 0x1c
jne 0x457eac
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x457cf1
cmp esi, 0x1d
je 0x457ebb
cmp esi, 0x1e
je 0x457ebb
cmp esi, 0x39
jne 0x457ebe
mov dword [ebp - 0x58], edi
cmp esi, 0x1f
je 0x457ec8
cmp esi, 0x20
jne 0x457ecb
mov dword [ebp - 0x70], edi
cmp esi, 0x21
je 0x457ed5
cmp esi, 0x22
jne 0x457ed8
mov dword [ebp - 0x60], edi
cmp esi, 0x23
je 0x457ee2
cmp esi, 0x24
jne 0x457ee5
mov dword [ebp - 0x4c], edi
cmp esi, 0x25
je 0x457eef
cmp esi, 0x26
jne 0x457ef5
mov dword [ebp - 0xf8], edi
cmp esi, 0x27
jne 0x457f06
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x457cf1
cmp esi, 0x28
jne 0x457f17
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x457cf1
cmp esi, 0x29
jne 0x457f28
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x457cf1
cmp esi, 0x2c
jne 0x457f36
mov dword [ebp - 0x50], edi
inc esi
jmp 0x457cf1
cmp esi, 0x2d
jne 0x457f44
mov dword [ebp - 0x28], edi
inc esi
jmp 0x457cf1
cmp esi, 0x2e
jne 0x457f52
mov dword [ebp - 0x54], edi
inc esi
jmp 0x457cf1
cmp esi, 0x2f
jne 0x457f63
mov dword [ebp - 0xac], edi
inc esi
jmp 0x457cf1
cmp esi, 0x30
jne 0x457f74
mov dword [ebp - 0x94], edi
inc esi
jmp 0x457cf1
cmp esi, 0x31
jne 0x457f85
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x457cf1
cmp esi, 0x32
jne 0x457f96
mov dword [ebp - 0x88], edi
inc esi
jmp 0x457cf1
cmp esi, 0x34
jne 0x457fa7
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x457cf1
cmp esi, 0x35
jne 0x457fb8
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x457cf1
cmp esi, 0x36
jne 0x457fc9
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x457cf1
cmp esi, 0x37
jne 0x457fde
mov dword [ebp - 0xdc], 0
inc esi
jmp 0x457cf1
cmp esi, 0x38
jne 0x457fef
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x457cf1
cmp esi, 0x3a
je 0x457ffe
cmp esi, 0x3b
je 0x457ffe
cmp esi, 0x3c
jne 0x458001
mov dword [ebp - 0x38], edi
cmp esi, 0x3d
jne 0x45800f
mov dword [ebp - 0x28], edi
inc esi
jmp 0x457cf1
cmp esi, 0x3e
jne 0x458020
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x457cf1
cmp esi, 0x3f
jne 0x45802e
mov dword [ebp - 0x68], edi
inc esi
jmp 0x457cf1
cmp esi, 0x40
jne 0x45803c
mov dword [ebp - 0x20], edi
inc esi
jmp 0x457cf1
cmp esi, 0x41
jne 0x45804d
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x457cf1
cmp esi, 0x46
je 0x45805c
cmp esi, 0x47
je 0x45805c
cmp esi, 0x48
jne 0x458062
mov dword [ebp - 0x98], edi
cmp esi, 0x49
jne 0x45806d
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x457cf1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
inc ecx
cmp eax, edi
mov dword [ebp - 0x18], ecx
jne 0x45808a
inc dword [ebp - 0x90]
cmp dword [ebp - 0x124], edi
jne 0x458098
inc dword [ebp - 0x118]
cmp dword [ebp - 0x18], 0xc350
jg 0x458101
mov esi, dword [ebp - 0x114]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp + 0xc]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x114], esi
mov esi, dword [ebp - 0x10c]
mov dword [ebp - 0x74], edx
mov dword [ebp + 0xc], ecx
mov eax, ecx
jmp 0x457bff
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xfc]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xfc], eax
mov ebx, 1
xor edi, edi
jmp 0x457aa6
xor edi, edi
mov edx, dword [0xd8a438]
mov dword [ebp - 4], edi
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x10c], eax
jne 0x4581f7
mov dword [ebp + 8], 6
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
mov ebx, 1
mov edx, dword [0xd8a438]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x4581d8
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x458329
push 0x515b6c
jmp 0x459c6e
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp + 0xc], ebx
mov ecx, dword [ebp - 0x10c]
cmp bx, word [ecx + 2]
jae 0x45818a
xor edx, edx
push str..asp
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov byte [ebp - 0x7c], dl
mov eax, dword [edi]
mov dword [ebp - 0x84], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x84]
mov dword [ebp - 0x80], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x458258
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x84]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x458273
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x84]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45828e
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x84]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4582a9
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x84]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4582c4
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x84]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4582df
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 0xc]
inc eax
cmp eax, 0x64
mov dword [ebp + 0xc], eax
jg 0x45818a
add edi, 0x28
inc ebx
jmp 0x45820c
mov eax, dword [ebp - 0x90]
mov dword [ebp + 8], edi
test esi, esi
mov dword [ebp - 0x18], eax
je 0x458ac6
cmp edi, ebx
jge 0x458ac6
lea ecx, [ebp - 0x13d0]
xor esi, esi
push ecx
mov dword [ebp - 0x1c], esi
call fcn.004f2beb
jmp 0x458368
lea edx, [ebp - 0x10d0]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0xb50]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x458399
push ebx
lea ecx, [ebp - 0x278]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x4583c3
lea ecx, [ebp - 0xb50]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x4583d7
lea edx, [ebp - 0xa30]
push str.c:endpcachemonitor_procPath5.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x278]
push eax
push ebx
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp + 0xc], esi
call fcn.004f0727
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x274]
cmp dword [eax + 0x30], 0xffffffff
jne 0x458429
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
jmp 0x4585e4
mov edi, dword [ebp - 0x274]
push 0xa
lea eax, [ebp - 0x830]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x274], edi
call fcn.004f0ae9
lea edi, [ebp - 0x830]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x458a58
lea ecx, [ebp - 0x830]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x458486
mov dword [ebp - 0x11c], ebx
lea edx, [ebp - 0x830]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4584a8
push 0x5147b4
jmp 0x4585e4
lea eax, [ebp - 0x830]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x458a58
lea ecx, [ebp - 0x830]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x458a58
lea edx, [ebp - 0x830]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x458a58
cmp dword [ebp - 0x44], ebx
jne 0x458504
inc dword [ebp + 8]
cmp dword [ebp - 0x30], ebx
jne 0x45850c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x34], ebx
jne 0x458517
inc dword [ebp - 0x110]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x458a55
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x830]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x458a4f
mov ecx, dword [ebp - 0xa0]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xa0], ecx
jne 0x45861b
lea edx, [ebp - 0xed0]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xed0]
lea ecx, [ebp - 0x1450]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1450]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x4585c2
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x1550]
push edx
push 0x5153f4
push eax
jmp 0x4585d5
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x1550]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1550]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x264]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x264]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x458686
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x45863b
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x830]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4586f3
test ebx, ebx
jne 0x4586f3
test eax, eax
mov dword [ebp - 0x30], ebx
je 0x4586fa
jmp 0x4586f3
cmp esi, 0x1a
jne 0x458762
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x4586aa
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x830]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4586f3
test ebx, ebx
jne 0x4586f3
test eax, eax
mov dword [ebp - 0x30], ebx
je 0x4586fa
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x830]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x45874e
test ebx, ebx
jne 0x45874e
test eax, eax
jne 0x45874e
mov dword [ebp - 0x34], eax
mov ebx, 1
inc esi
jmp 0x45851b
xor edi, edi
mov dword [ebp - 0x34], 1
mov ebx, 1
inc esi
jmp 0x45851b
cmp esi, 0x2a
jne 0x45877c
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
inc esi
jmp 0x45851b
cmp esi, 0x2b
jne 0x458796
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
inc esi
jmp 0x45851b
cmp esi, edi
jne 0x4587a3
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x45851b
cmp esi, ebx
jne 0x4587b0
mov dword [ebp - 0x20], ebx
inc esi
jmp 0x45851b
cmp esi, 2
je 0x458a4f
cmp esi, 4
jne 0x4587ca
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x45851b
cmp esi, 5
jne 0x4587db
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x45851b
cmp esi, 6
jne 0x4587ec
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x45851b
cmp esi, 7
jne 0x4587fd
mov dword [ebp - 0xc0], ebx
inc esi
jmp 0x45851b
cmp esi, 8
jne 0x45880e
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x45851b
cmp esi, 9
jne 0x45881f
mov dword [ebp - 0x108], ebx
inc esi
jmp 0x45851b
cmp esi, 0xa
jne 0x45882d
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x45851b
cmp esi, 0xb
jne 0x45883e
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x45851b
jle 0x458848
cmp esi, 0xf
jge 0x45884b
mov dword [ebp - 0x64], ebx
cmp esi, 0xf
jne 0x458859
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x45851b
jle 0x458863
cmp esi, 0x12
jge 0x458863
mov dword [ebp - 0x78], ebx
cmp esi, 0x11
jle 0x458870
cmp esi, 0x19
jge 0x458870
mov dword [ebp - 0x24], ebx
cmp esi, 0x1b
jne 0x458881
mov dword [ebp - 0x100], ebx
inc esi
jmp 0x45851b
cmp esi, 0x1c
jne 0x458892
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x45851b
cmp esi, 0x1d
je 0x4588a1
cmp esi, 0x1e
je 0x4588a1
cmp esi, 0x39
jne 0x4588a4
mov dword [ebp - 0x58], ebx
cmp esi, 0x1f
je 0x4588ae
cmp esi, 0x20
jne 0x4588b1
mov dword [ebp - 0x70], ebx
cmp esi, 0x21
je 0x4588bb
cmp esi, 0x22
jne 0x4588be
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x4588c8
cmp esi, 0x24
jne 0x4588cb
mov dword [ebp - 0x4c], ebx
cmp esi, 0x25
je 0x4588d5
cmp esi, 0x26
jne 0x4588db
mov dword [ebp - 0xf8], ebx
cmp esi, 0x27
jne 0x4588ec
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x45851b
cmp esi, 0x28
jne 0x4588fd
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x45851b
cmp esi, 0x29
jne 0x45890e
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x45851b
cmp esi, 0x2c
jne 0x45891c
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x45851b
cmp esi, 0x2d
jne 0x45892a
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x45851b
cmp esi, 0x2e
jne 0x458938
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x45851b
cmp esi, 0x2f
jne 0x458949
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x45851b
cmp esi, 0x30
jne 0x45895a
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x45851b
cmp esi, 0x31
jne 0x45896b
inc esi
jmp 0x45851b
inc dword [ebp + 0xc]
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x270], 1
je 0x458429
lea ecx, [ebp - 0x278]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jle 0x458a8b
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
jle 0x458a97
sub eax, ecx
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x104]
test ecx, ecx
jne 0x458aac
cmp eax, 6
jle 0x458aac
sub eax, 6
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x264]
call fcn.004f05fb
mov eax, dword [ebp - 0xd0]
mov byte [ebp - 0x6b0], 0
cmp eax, ebx
jne 0x458b62
mov edi, 0x515b20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x48]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jge 0x458b2a
mov ecx, dword [ebp - 0x120]
cmp ecx, 0x4b000
jle 0x458b6b
push 0x515b0c
jmp 0x459c6e
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x6b0]
push eax
push 0x515af0
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6b0]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x120]
cmp dword [ebp - 0x98], ebx
jne 0x458bdc
cmp eax, ebx
jge 0x458b89
cmp ecx, 0x4b000
jle 0x458bdc
push 0x515adc
jmp 0x459c6e
cmp dword [ebp - 0x6c], ebx
jne 0x458bb5
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x6b0]
push eax
push 0x515ac4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x6b0]
push ecx
jmp 0x459c6e
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x6b0]
push edx
push 0x515aa8
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x6b0]
push ecx
jmp 0x459c6e
cmp dword [ebp - 0xf0], ebx
jne 0x458c32
cmp eax, ebx
jge 0x458bfa
cmp ecx, 0x4b000
jle 0x458c32
push 0x515a5c
jmp 0x459c6e
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x6b0]
push edx
push 0x515a3c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x6b0]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa0]
mov dword [ebp + 0xc], 0
cmp eax, ebx
jle 0x458c72
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
jmp 0x458c75
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0xd8], 1
jne 0x458cae
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x458cf3
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0xa8]
mov eax, 1
cmp ecx, eax
jne 0x458d37
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x458d75
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x100], eax
jne 0x458db6
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xb0], eax
je 0x458dc6
cmp dword [ebp - 0xe0], eax
jne 0x458dfb
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x458e3c
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xf8], eax
jne 0x458e79
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc0], eax
jne 0x458eb6
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3c], eax
jne 0x458ef4
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xe8], eax
jne 0x458f3c
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xc8], eax
jne 0x458f7d
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x108], eax
jne 0x458fbe
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x8c], eax
jne 0x458fff
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x64], eax
jne 0x45909e
cmp dword [ebp - 0x94], eax
je 0x459025
cmp dword [ebp - 0x9c], eax
je 0x459025
lea edx, [ebp - 0x6b0]
mov edi, 0x515278
jmp 0x459070
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x88]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x6b0]
mov edi, 0x515258
je 0x459070
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xac], eax
jne 0x4590df
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xb4], eax
jne 0x459120
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x78], eax
jne 0x45915e
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x24], eax
jne 0x4591dd
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x6c]
mov ecx, edx
and ecx, 3
mov edx, 1
inc ebx
cmp eax, edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
jne 0x4591e2
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
jmp 0x4591e2
mov edx, 1
cmp dword [ebp - 0xbc], edx
jne 0x4592a0
cmp dword [ebp - 0xc4], edx
jne 0x4592a0
cmp dword [ebp - 0xcc], edx
jne 0x4592a0
cmp dword [ebp - 0xd4], edx
jne 0x459253
mov eax, dword [ebp - 0x68]
mov edi, 0x5151ec
cmp eax, edx
lea edx, [ebp - 0x6b0]
je 0x459225
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xdc], edx
jne 0x4592a0
mov eax, dword [ebp - 0x68]
mov edi, 0x5151c4
cmp eax, edx
lea edx, [ebp - 0x6b0]
je 0x459272
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xe4], edx
jne 0x4592dd
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x58], edx
jne 0x45931b
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x70], edx
jne 0x459359
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x60], edx
jne 0x459397
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x4c], edx
jne 0x4593d5
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x45941f
mov eax, dword [ebp - 0x11c]
test eax, eax
jne 0x45941f
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xec], edx
jle 0x459460
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x50], edx
jne 0x45949e
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x28], edx
jne 0x4594dc
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x54], edx
jne 0x459516
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], edx
jne 0x459553
mov edi, 0x52088c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], edx
jne 0x459590
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x45959e
mov eax, 4
jmp 0x4595a1
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], 0
cmp ecx, eax
jl 0x4595b4
cmp ecx, 7
jge 0x4595ff
mov eax, dword [ebp - 0x5c]
mov edi, 0x5150f8
cmp eax, edx
lea edx, [ebp - 0x6b0]
je 0x4595cb
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x20], edx
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
cmp eax, edx
jle 0x45964d
cmp dword [ebp - 0x1c], edx
jne 0x45964d
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
mov edx, 1
inc ebx
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x5c], edx
jne 0x459693
cmp eax, 5
jge 0x459693
test eax, eax
jle 0x459693
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
mov dword [ebp - 0x20], edx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x48]
cmp eax, 7
jge 0x45975b
cmp dword [ebp - 0x2c], edx
jne 0x45971e
cmp eax, edx
lea edx, [ebp - 0x6b0]
jge 0x4596e5
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x459757
mov dword [ebp + 0xc], 1
jmp 0x459757
mov edi, 0x52086c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], eax
jne 0x459757
mov dword [ebp + 0xc], eax
jmp 0x459757
cmp eax, edx
lea edx, [ebp - 0x6b0]
mov edi, 0x515078
jl 0x459732
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x4b0]
push eax
call fcn.004d9260
movsx edx, ax
add esp, 4
test edx, edx
jne 0x4597d7
mov edi, 0x51505c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x6b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x48]
cmp ecx, 6
jle 0x4597ed
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x3c]
test esi, esi
jne 0x4597f0
test edi, edi
jne 0x4597f0
mov esi, dword [ebp - 0x20]
test esi, esi
jne 0x4597f0
test edx, edx
jle 0x4597f0
test eax, eax
jne 0x4597f0
push 0x5147b4
jmp 0x459c6e
cmp edx, 1
jle 0x4597a5
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x4597a8
push 0x5147b4
jmp 0x459c6e
mov edi, dword [ebp - 0x3c]
cmp edx, 0xfffffffe
je 0x4597ff
cmp edx, 0xffffffff
je 0x4597ff
cmp edx, 0xfffffffd
jne 0x459828
cmp ecx, 6
jle 0x459828
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x459828
test edi, edi
jne 0x4598ed
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x459830
test eax, eax
jne 0x459830
push 0x5147b4
jmp 0x459c6e
test edi, edi
jne 0x4598ed
cmp ecx, 4
jle 0x4598ed
cmp dword [ebp - 0x6c], 1
jne 0x4598df
push 0xd9b940
push 0xd6d890
lea ecx, [ebp - 0x4b0]
push 0xd56eac
push ecx
call fcn.004b7fe0
add esp, 0x10
lea edx, [ebp - 0x4b0]
movsx esi, ax
push 0xd4f1d0
push edx
call fcn.004b83e0
add esp, 8
cmp esi, 6
jle 0x4598ed
push 0xd56eac
push 0xd9b8c0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4598ed
test eax, eax
jne 0x4598ed
push 0x520824
jmp 0x459c6e
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x459927
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5147b4
jmp 0x459c6e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x459987
cmp edi, 1
je 0x459987
cmp dword [ebp + 0xc], 1
je 0x459987
lea eax, [ebp - 0x6b0]
lea ecx, [ebp - 0x1650]
push eax
push 0x514fd8
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x40]
add esp, 0xc
test eax, eax
jne 0x4599cd
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x1650]
push edx
jmp 0x459c6e
lea eax, [ebp - 0xa30]
push 0xdb198c
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x459a08
lea ecx, [ebp - 0xa30]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x459b94
lea edx, [ebp - 0xa30]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xa30]
push eax
call esi
lea ecx, [ebp - 0xa30]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x459c01
lea edx, [ebp - 0xa30]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0xa30]
push eax
call esi
test eax, eax
jne 0x459c01
lea ecx, [ebp - 0xa30]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x459c01
lea edx, [ebp - 0xa30]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x6b0]
mov edi, 0x514f5c
jmp 0x459c0c
lea edx, [ebp - 0x6b0]
mov edi, 0x514f2c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c9c]
mov dword [0xe56d20], eax
inc edi
or ecx, 0xffffffff
mov dword [0xe56c9c], edi
lea edi, [ebp - 0xa30]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x6b0]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret