Function at 0x4990d0
Capabilities:
Delete file
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6171e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov edi, 1
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call fcn.0040b8d0
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
call fcn.00497e50
mov dword [ebp - 0x38], eax
mov bl, 1
mov byte [ebp - 0x3a], bl
cmp eax, esi
je 0x4991d8
mov eax, dword [0x72a500]
shl eax, 0x14
cdq
cmp dword [ebp + 0x28], edx
jl 0x499153
jg 0x49914e
cmp dword [ebp + 0x24], eax
jbe 0x499153
xor bl, bl
mov byte [ebp - 0x3a], bl
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 3
lea edi, [ebp - 0x28]
call fcn.0040bd70
xor ecx, ecx
mov edx, 0x6d563c
mov esi, edi
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49918f
xor ecx, ecx
mov edx, 0x6d5664
call fcn.004301b0
cmp eax, 0xffffffff
je 0x499194
xor bl, bl
mov byte [ebp - 0x3a], bl
xor ecx, ecx
mov edx, 0x6ca140
lea esi, [ebp - 0x28]
call fcn.004301b0
test eax, eax
jne 0x4991af
cmp dword [0x72a4cc], eax
je 0x4991c3
test bl, bl
je 0x4991c8
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.004a8280
test al, al
je 0x4991c8
xor bl, bl
mov byte [ebp - 0x3a], bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040ba40
test bl, bl
je 0x499249
push 0
push 0
push 0x713dd8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x499249
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 4
lea edi, [ebp - 0x28]
call fcn.0040bd70
xor ecx, ecx
mov edx, 0x6d4f5c
mov esi, edi
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x499238
xor ecx, ecx
mov edx, str.serial
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x499238
xor ecx, ecx
mov edx, str.crack
call fcn.004301b0
cmp eax, 0xffffffff
je 0x49923d
xor bl, bl
mov byte [ebp - 0x3a], bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x3b], 0
mov byte [ebp - 0x51], 0
test bl, bl
je 0x49bebd
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x24]
add dword [esi + 0x38], ecx
mov edx, dword [ebp + 0x28]
adc dword [esi + 0x3c], edx
lea eax, [ebp - 0x34]
push eax
call fcn.0040b700
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x10]
call fcn.004c0da0
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 6
cmp eax, 0xffffffff
je 0x49bcb4
push eax
mov ebx, dword [0x729b74]
call fcn.004c2c10
test al, al
jne 0x49bcb4
cmp dword [esi + 0x18], 0x3e8
jne 0x499973
cmp byte [ebp + 0x30], al
jne 0x499966
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov esi, 7
mov byte [ebp - 4], 7
lea edi, [ebp - 0x24]
call fcn.0040bd70
mov byte [ebp - 0x39], 1
lea edx, [ebp - 0x6c]
push edx
mov ecx, str.:programdata
call fcn.0040b990
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], 3
lea eax, [ebp - 0x6c]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x499385
lea eax, [ebp - 0x20]
push eax
mov ecx, str.:program_files
call fcn.0040b990
mov dword [ebp - 4], 9
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x499385
lea ecx, [ebp - 0x30]
push ecx
mov ecx, str.:program_files__x86_
call fcn.0040b990
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x30]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x499385
lea edx, [ebp - 0x28]
push edx
mov ecx, str.:windows_servicing
call fcn.0040b990
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x14], 0x1f
lea eax, [ebp - 0x28]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x499385
xor bl, bl
jmp 0x499387
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x14], 0x10
je 0x4993a0
and dword [ebp - 0x14], 0xffffffef
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov dword [ebp - 4], 9
test byte [ebp - 0x14], 8
je 0x4993b9
and dword [ebp - 0x14], 0xfffffff7
lea ecx, [ebp - 0x30]
call fcn.0040ba40
mov dword [ebp - 4], 8
test byte [ebp - 0x14], 4
je 0x4993d2
and dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0x20]
call fcn.0040ba40
mov dword [ebp - 4], esi
test byte [ebp - 0x14], 2
je 0x4993e7
and dword [ebp - 0x14], 0xfffffffd
lea ecx, [ebp - 0x6c]
call fcn.0040ba40
test bl, bl
jne 0x499461
mov eax, dword [0x713db0]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x4c], esp
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.0040b930
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
call fcn.00435350
add esp, 4
cmp edx, esi
jl 0x499422
jg 0x499461
cmp eax, edi
ja 0x499461
cmp dword [0x713db4], 0
je 0x499465
xor ecx, ecx
mov edx, 0x6d4f5c
lea esi, [ebp - 0x24]
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x499461
xor ecx, ecx
mov edx, str.serial
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x499461
xor ecx, ecx
mov edx, str.crack
call fcn.004301b0
cmp eax, 0xffffffff
je 0x499465
mov byte [ebp - 0x39], 0
xor ecx, ecx
mov edx, str.hp_
lea esi, [ebp - 0x24]
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x4994bd
xor ecx, ecx
mov edx, str.laserjet
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x4994bd
xor ecx, ecx
mov edx, str.printer
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x4994bd
xor ecx, ecx
mov edx, str.scanner
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x4994bd
xor ecx, ecx
mov edx, str._mfp
call fcn.004301b0
cmp eax, 0xffffffff
je 0x4994c6
mov byte [ebp - 0x39], 0
jmp 0x499957
cmp byte [ebp - 0x39], 0
je 0x499957
mov ecx, 0x2e
lea esi, [ebp - 0x24]
call fcn.00442b40
cmp eax, 0xffffffff
je 0x499957
lea edx, [eax + 1]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
push ecx
call fcn.00442bc0
mov byte [ebp - 4], 0xd
lea edi, [ebp - 0x20]
call fcn.0040bd70
lea edx, [ebp - 0x28]
push edx
call fcn.0040b8d0
mov byte [ebp - 4], 0xe
mov eax, edi
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040b930
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x30]
push edx
mov ecx, 0x6d51b8
call fcn.00442e60
add esp, 4
test al, al
jne 0x499552
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x6d7800
call fcn.00442e60
add esp, 4
test al, al
jne 0x499552
lea edi, [ebp - 0x30]
call fcn.00442b60
jmp 0x49955f
mov edx, 0x6d7808
lea edi, [ebp - 0x30]
call fcn.0040bab0
cmp dword [0x72a414], 1
jne 0x4995cf
lea ecx, [ebp - 0x44]
push ecx
mov ecx, str.Malware.
call fcn.0040b990
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x48]
push ecx
mov ebx, eax
call fcn.004247e0
mov byte [ebp - 4], 0x11
push eax
lea edx, [ebp - 0x38]
push edx
mov ebx, str..DeepDive
call fcn.0041e2b0
add esp, 0x10
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x28]
call fcn.0040ddb0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x38]
call fcn.0040ba40
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.0040ba40
mov eax, dword [ebp - 0x28]
cmp dword [eax - 0xc], 0
jne 0x4996a6
xor bl, bl
mov dword [ebp - 0x5c], 0x72aa64
push 0x72aa64
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x13
xor edi, edi
mov dword [ebp - 0x188], edi
mov ecx, dword [0x72aaac]
sub ecx, dword [0x72aaa8]
sar ecx, 2
cmp edi, ecx
jae 0x49962d
mov esi, 0x72aa9c
call fcn.00424a10
mov eax, dword [eax]
lea edx, [ebp - 0x20]
push edx
mov ecx, eax
call fcn.0040bb30
test eax, eax
je 0x499631
inc edi
jmp 0x4995f6
test bl, bl
je 0x499698
lea eax, [ebp - 0x44]
push eax
mov ecx, str.Malware.
call fcn.0040b990
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x48]
push edx
mov ebx, eax
call fcn.004247e0
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x38]
push eax
mov ebx, str..DeepDive
call fcn.0041e2b0
add esp, 0x10
mov byte [ebp - 4], 0x16
lea edi, [ebp - 0x28]
call fcn.0040ddb0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x38]
call fcn.0040ba40
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x44]
call fcn.0040ba40
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d51fc
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d5204
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d520c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d5214
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d521c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5224
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d522c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d07d4
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5234
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d523c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d5244
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d524c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d5254
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d525c
call fcn.00442e60
add esp, 4
test al, al
jne 0x499801
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5264
call fcn.00442e60
add esp, 4
test al, al
je 0x499868
lea edx, [ebp - 0x44]
push edx
mov ecx, str.Malware.
call fcn.0040b990
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x48]
push edx
mov ebx, eax
call fcn.004247e0
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x38]
push eax
mov ebx, str..DeepScript
call fcn.0041e2b0
add esp, 0x10
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0x28]
call fcn.0040ddb0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x38]
call fcn.0040ba40
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.0040ba40
mov ecx, dword [ebp - 0x28]
cmp dword [ecx - 0xc], 0
je 0x499933
mov bl, 0x1a
mov byte [ebp - 4], bl
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x74]
push eax
call fcn.0045a060
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x38]
call fcn.0040ba40
cmp byte [ebp - 0x3b], 0
jne 0x49992c
cmp byte [ebp - 0x3c], 0
jne 0x49992c
push 0x1b7740
mov ecx, dword [0x72a528]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x4c], 0x72a7c8
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1c
call fcn.00468340
test al, al
je 0x49991e
lea edx, [ebp - 0x24]
push edx
call fcn.00468190
test al, al
jne 0x49991e
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d520c
call fcn.0040bdd0
add esp, 4
test al, al
jne 0x499911
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0043f070
add esp, 4
test al, al
je 0x49991e
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x34]
call fcn.0041cc80
mov bl, 0x1a
mov byte [ebp - 4], bl
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xf
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x30]
call fcn.0040ba40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.0040ba40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.0040ba40
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0x3e8
je 0x49b7d7
mov edx, dword [ebp - 0x34]
cmp dword [edx - 0xc], 0
jne 0x49b6f0
mov byte [ebp - 0xa8], 0
xor eax, eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
lea edi, [ebp - 0xc0]
mov ebx, dword [ebp - 0x74]
lea esi, [ebp - 0xa0]
call fcn.004c1320
cmp byte [ebp - 0x94], 0
je 0x49b6ed
cmp byte [ebp - 0xa8], 0
je 0x49b6ed
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xac]
cmp eax, ecx
jb 0x499a12
ja 0x4999ef
mov edx, dword [ebp - 0xc0]
cmp edx, dword [ebp - 0xb0]
jbe 0x499a12
mov edi, dword [ebp - 0xc0]
mov dword [ebp - 0x88], edi
mov ebx, eax
mov dword [ebp - 0x84], ebx
jmp 0x499a28
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov ebx, ecx
mov edi, eax
lea ecx, [ebp - 0x34]
push ecx
push ebx
push edi
mov esi, dword [ebp - 0x9c]
push esi
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [0x72a504]
call fcn.004d0520
test al, al
jne 0x49b6e9
lea ecx, [ebp - 0x34]
push ecx
push ebx
push edi
push esi
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [0x72a50c]
call fcn.004d0520
test al, al
jne 0x49b6ed
lea ecx, [ebp - 0x6c]
push ecx
mov esi, dword [ebp + 0x10]
mov ecx, esi
call fcn.0040b990
mov byte [ebp - 4], 0x1e
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x3b]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x74]
push eax
call fcn.00459330
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6c]
call fcn.0040ba40
cmp byte [ebp - 0x3c], 0
jne 0x49afa5
cmp byte [ebp - 0x3b], 0
jne 0x49afa5
mov ecx, dword [ebp - 0x34]
cmp dword [ecx - 0xc], 0
jne 0x49afa5
lea edx, [ebp - 0x38]
push edx
mov ecx, 0x6d6984
call fcn.0040b990
mov byte [ebp - 4], 0x1f
mov edi, 0x20
or dword [ebp - 0x14], edi
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], edi
mov edi, 0x40
or dword [ebp - 0x14], edi
lea eax, [ebp - 0x38]
call fcn.004c18c0
test al, al
jne 0x49a635
lea ecx, [ebp - 0x48]
push ecx
mov ecx, 0x6d7850
call fcn.0040b990
mov dword [ebp - 4], 0x21
or dword [ebp - 0x14], 0x80
lea edx, [ebp - 0x58]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x22
or dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x48]
call fcn.004c18c0
test al, al
jne 0x49a635
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x6d697c
call fcn.0040b990
mov dword [ebp - 4], 0x23
or dword [ebp - 0x14], 0x200
lea ecx, [ebp - 0x64]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x24
or dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x44]
call fcn.004c18c0
test al, al
jne 0x49a635
lea edx, [ebp - 0x5c]
push edx
mov ecx, 0x6d6974
call fcn.0040b990
mov dword [ebp - 4], 0x25
or dword [ebp - 0x14], 0x800
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x26
or dword [ebp - 0x14], 0x1000
lea eax, [ebp - 0x5c]
call fcn.004c18c0
test al, al
jne 0x49a635
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, 0x6d695c
call fcn.0040b990
mov dword [ebp - 4], 0x27
or dword [ebp - 0x14], 0x2000
lea edx, [ebp - 0x68]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x28
or dword [ebp - 0x14], 0x4000
lea eax, [ebp - 0xcc]
call fcn.004c18c0
test al, al
jne 0x49a635
lea eax, [ebp - 0x120]
push eax
mov ecx, 0x6d7858
call fcn.0040b990
mov dword [ebp - 4], 0x29
or dword [ebp - 0x14], 0x8000
lea ecx, [ebp - 0x70]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x2a
or dword [ebp - 0x14], 0x10000
lea eax, [ebp - 0x120]
call fcn.004c18c0
test al, al
jne 0x49a635
lea edx, [ebp - 0x100]
push edx
mov ecx, 0x6d694c
call fcn.0040b990
mov dword [ebp - 4], 0x2b
or dword [ebp - 0x14], 0x20000
lea eax, [ebp - 0x8c]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x2c
or dword [ebp - 0x14], 0x40000
lea eax, [ebp - 0x100]
call fcn.004c18c0
test al, al
jne 0x49a635
lea ecx, [ebp - 0x138]
push ecx
mov ecx, str.GADGET
call fcn.0040b990
mov dword [ebp - 4], 0x2d
or dword [ebp - 0x14], 0x80000
lea edx, [ebp - 0x15c]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x2e
or dword [ebp - 0x14], 0x100000
lea eax, [ebp - 0x138]
call fcn.004c18c0
test al, al
jne 0x49a635
lea eax, [ebp - 0xf8]
push eax
mov ecx, str.INF1
call fcn.0040b990
mov dword [ebp - 4], 0x2f
or dword [ebp - 0x14], 0x200000
lea ecx, [ebp - 0x154]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x30
or dword [ebp - 0x14], 0x400000
lea eax, [ebp - 0xf8]
call fcn.004c18c0
test al, al
jne 0x49a635
lea edx, [ebp - 0x118]
push edx
mov ecx, 0x6d6928
call fcn.0040b990
mov dword [ebp - 4], 0x31
or dword [ebp - 0x14], 0x800000
lea eax, [ebp - 0x14c]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x32
or dword [ebp - 0x14], 0x1000000
lea eax, [ebp - 0x118]
call fcn.004c18c0
test al, al
jne 0x49a635
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, 0x6d6920
call fcn.0040b990
mov dword [ebp - 4], 0x33
or dword [ebp - 0x14], 0x2000000
lea edx, [ebp - 0x144]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x34
or dword [ebp - 0x14], 0x4000000
lea eax, [ebp - 0xf0]
call fcn.004c18c0
test al, al
jne 0x49a635
lea eax, [ebp - 0x128]
push eax
mov ecx, 0x6d6910
call fcn.0040b990
mov dword [ebp - 4], 0x35
or dword [ebp - 0x14], 0x8000000
lea ecx, [ebp - 0x1c0]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x36
or dword [ebp - 0x14], 0x10000000
lea eax, [ebp - 0x128]
call fcn.004c18c0
test al, al
jne 0x49a635
lea edx, [ebp - 0xe8]
push edx
mov ecx, 0x6d6908
call fcn.0040b990
mov dword [ebp - 4], 0x37
or dword [ebp - 0x14], 0x20000000
lea eax, [ebp - 0x180]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x38
or dword [ebp - 0x14], 0x40000000
lea eax, [ebp - 0xe8]
call fcn.004c18c0
test al, al
jne 0x49a635
lea ecx, [ebp - 0x110]
push ecx
mov ecx, 0x6d6900
call fcn.0040b990
mov dword [ebp - 4], 0x39
or dword [ebp - 0x14], 0x80000000
lea edx, [ebp - 0x1a0]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x3a
mov ebx, dword [ebp - 0x1c]
or ebx, 1
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x110]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0xe0]
push eax
mov ecx, 0x6d68e8
call fcn.0040b990
mov dword [ebp - 4], 0x3b
or ebx, 2
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x178]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x3c
or ebx, 4
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xe0]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x130]
push edx
mov ecx, 0x6d68e0
call fcn.0040b990
mov dword [ebp - 4], 0x3d
or ebx, 8
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1b0]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x3e
or ebx, 0x10
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x130]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, 0x6d68d8
call fcn.0040b990
mov dword [ebp - 4], 0x3f
or ebx, 0x20
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x170]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], edi
or ebx, edi
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xd8]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0xf4]
push eax
mov ecx, 0x6d68d0
call fcn.0040b990
mov dword [ebp - 4], 0x41
or ebx, 0x80
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x198]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x42
or ebx, 0x100
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xf4]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x108]
push edx
mov ecx, 0x6d68b8
call fcn.0040b990
mov dword [ebp - 4], 0x43
or ebx, 0x200
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x168]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x44
or ebx, 0x400
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x108]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0x13c]
push ecx
mov ecx, 0x6d68b0
call fcn.0040b990
mov dword [ebp - 4], 0x45
or ebx, 0x800
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x1b8]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x46
or ebx, 0x1000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x13c]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x6d7860
call fcn.0040b990
mov dword [ebp - 4], 0x47
or ebx, 0x2000
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x160]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x48
or ebx, 0x4000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x134]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x12c]
push edx
mov ecx, 0x6d68a0
call fcn.0040b990
mov dword [ebp - 4], 0x49
or ebx, 0x8000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x190]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x4a
or ebx, 0x10000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x12c]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0x124]
push ecx
mov ecx, 0x6d6898
call fcn.0040b990
mov dword [ebp - 4], 0x4b
or ebx, 0x20000
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x158]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x4c
or ebx, 0x40000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x124]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x6d6890
call fcn.0040b990
mov dword [ebp - 4], 0x4d
or ebx, 0x80000
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1a8]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x4e
or ebx, 0x100000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x11c]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x114]
push edx
mov ecx, 0x6d6880
call fcn.0040b990
mov dword [ebp - 4], 0x4f
or ebx, 0x200000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x150]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x50
or ebx, 0x400000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x114]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, 0x6d6878
call fcn.0040b990
mov dword [ebp - 4], 0x51
or ebx, 0x800000
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x140]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x52
or ebx, 0x1000000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x10c]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0x104]
push eax
mov ecx, 0x6d6870
call fcn.0040b990
mov dword [ebp - 4], 0x53
or ebx, 0x2000000
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x148]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x54
or ebx, 0x4000000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x104]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0xfc]
push edx
mov ecx, 0x6d6868
call fcn.0040b990
mov dword [ebp - 4], 0x55
or ebx, 0x8000000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c4]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x56
or ebx, 0x10000000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xfc]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0xec]
push ecx
mov ecx, 0x6d6860
call fcn.0040b990
mov dword [ebp - 4], 0x57
or ebx, 0x20000000
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x1bc]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x58
or ebx, 0x40000000
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xec]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0xe4]
push eax
mov ecx, 0x6d6858
call fcn.0040b990
mov dword [ebp - 4], 0x59
or ebx, 0x80000000
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1b4]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x5a
or dword [ebp - 0x18], 1
lea eax, [ebp - 0xe4]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0xdc]
push edx
mov ecx, 0x6d6850
call fcn.0040b990
mov dword [ebp - 4], 0x5b
or dword [ebp - 0x18], 2
lea eax, [ebp - 0x194]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x5c
or dword [ebp - 0x18], 4
lea eax, [ebp - 0xdc]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, 0x6d6848
call fcn.0040b990
mov dword [ebp - 4], 0x5d
or dword [ebp - 0x18], 8
lea edx, [ebp - 0x18c]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x5e
or dword [ebp - 0x18], 0x10
lea eax, [ebp - 0xd4]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0xd0]
push eax
mov ecx, str.VBSCRIPT
call fcn.0040b990
mov dword [ebp - 4], 0x5f
or dword [ebp - 0x18], 0x20
lea ecx, [ebp - 0x184]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x60
or dword [ebp - 0x18], edi
lea eax, [ebp - 0xd0]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d6818
call fcn.0040b990
mov dword [ebp - 4], 0x61
or dword [ebp - 0x18], 0x80
lea eax, [ebp - 0x17c]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x62
or dword [ebp - 0x18], 0x100
lea eax, [ebp - 0x20]
call fcn.004c18c0
test al, al
jne 0x49a638
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x6d6810
call fcn.0040b990
mov dword [ebp - 4], 0x63
or dword [ebp - 0x18], 0x200
lea edx, [ebp - 0x174]
push edx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x64
or dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x24]
call fcn.004c18c0
test al, al
jne 0x49a638
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x6d6808
call fcn.0040b990
mov dword [ebp - 4], 0x65
or dword [ebp - 0x18], 0x800
lea ecx, [ebp - 0x16c]
push ecx
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x66
or dword [ebp - 0x18], 0x1000
lea eax, [ebp - 0x30]
call fcn.004c18c0
test al, al
jne 0x49a638
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x6d1d44
call fcn.0040b990
mov dword [ebp - 4], 0x67
or dword [ebp - 0x18], 0x2000
lea eax, [ebp - 0x164]
push eax
mov ecx, esi
call fcn.0040b990
mov ecx, eax
mov dword [ebp - 4], 0x68
or dword [ebp - 0x18], 0x4000
lea eax, [ebp - 0x28]
call fcn.004c18c0
test al, al
jne 0x49a638
mov byte [ebp - 0x29], al
jmp 0x49a63c
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 0x29], 1
mov dword [ebp - 4], 0x67
test dword [ebp - 0x18], 0x4000
je 0x49a65e
and dword [ebp - 0x18], 0xffffbfff
lea ecx, [ebp - 0x164]
call fcn.0040ba40
mov dword [ebp - 4], 0x66
test dword [ebp - 0x18], 0x2000
je 0x49a67d
and dword [ebp - 0x18], 0xffffdfff
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov dword [ebp - 4], 0x65
test dword [ebp - 0x18], 0x1000
je 0x49a69f
and dword [ebp - 0x18], 0xffffefff
lea ecx, [ebp - 0x16c]
call fcn.0040ba40
mov dword [ebp - 4], 0x64
test dword [ebp - 0x18], 0x800
je 0x49a6be
and dword [ebp - 0x18], 0xfffff7ff
lea ecx, [ebp - 0x30]
call fcn.0040ba40
mov dword [ebp - 4], 0x63
test dword [ebp - 0x18], 0x400
je 0x49a6e0
and dword [ebp - 0x18], 0xfffffbff
lea ecx, [ebp - 0x174]
call fcn.0040ba40
mov dword [ebp - 4], 0x62
test dword [ebp - 0x18], 0x200
je 0x49a6ff
and dword [ebp - 0x18], 0xfffffdff
lea ecx, [ebp - 0x24]
call fcn.0040ba40
mov dword [ebp - 4], 0x61
mov esi, 0x100
test dword [ebp - 0x18], esi
je 0x49a722
and dword [ebp - 0x18], 0xfffffeff
lea ecx, [ebp - 0x17c]
call fcn.0040ba40
mov dword [ebp - 4], 0x60
test byte [ebp - 0x18], 0x80
je 0x49a73e
and dword [ebp - 0x18], 0xffffff7f
lea ecx, [ebp - 0x20]
call fcn.0040ba40
mov dword [ebp - 4], 0x5f
test byte [ebp - 0x18], 0x40
je 0x49a75a
and dword [ebp - 0x18], 0xffffffbf
lea ecx, [ebp - 0x184]
call fcn.0040ba40
mov dword [ebp - 4], 0x5e
test byte [ebp - 0x18], 0x20
je 0x49a776
and dword [ebp - 0x18], 0xffffffdf
lea ecx, [ebp - 0xd0]
call fcn.0040ba40
mov dword [ebp - 4], 0x5d
test byte [ebp - 0x18], 0x10
je 0x49a792
and dword [ebp - 0x18], 0xffffffef
lea ecx, [ebp - 0x18c]
call fcn.0040ba40
mov dword [ebp - 4], 0x5c
test byte [ebp - 0x18], 8
je 0x49a7ae
and dword [ebp - 0x18], 0xfffffff7
lea ecx, [ebp - 0xd4]
call fcn.0040ba40
mov dword [ebp - 4], 0x5b
test byte [ebp - 0x18], 4
je 0x49a7ca
and dword [ebp - 0x18], 0xfffffffb
lea ecx, [ebp - 0x194]
call fcn.0040ba40
mov dword [ebp - 4], 0x5a
test byte [ebp - 0x18], 2
je 0x49a7e6
and dword [ebp - 0x18], 0xfffffffd
lea ecx, [ebp - 0xdc]
call fcn.0040ba40
mov dword [ebp - 4], 0x59
test byte [ebp - 0x18], 1
je 0x49a802
and dword [ebp - 0x18], 0xfffffffe
lea ecx, [ebp - 0x1b4]
call fcn.0040ba40
mov dword [ebp - 4], 0x58
test ebx, ebx
jns 0x49a821
and ebx, 0x7fffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xe4]
call fcn.0040ba40
mov dword [ebp - 4], 0x57
test ebx, 0x40000000
je 0x49a844
and ebx, 0xbfffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040ba40
mov dword [ebp - 4], 0x56
test ebx, 0x20000000
je 0x49a867
and ebx, 0xdfffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xec]
call fcn.0040ba40
mov dword [ebp - 4], 0x55
test ebx, 0x10000000
je 0x49a88a
and ebx, 0xefffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c4]
call fcn.0040ba40
mov dword [ebp - 4], 0x54
test ebx, 0x8000000
je 0x49a8ad
and ebx, 0xf7ffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xfc]
call fcn.0040ba40
mov dword [ebp - 4], 0x53
test ebx, 0x4000000
je 0x49a8d0
and ebx, 0xfbffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x148]
call fcn.0040ba40
mov dword [ebp - 4], 0x52
test ebx, 0x2000000
je 0x49a8f3
and ebx, 0xfdffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x104]
call fcn.0040ba40
mov dword [ebp - 4], 0x51
test ebx, 0x1000000
je 0x49a916
and ebx, 0xfeffffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x140]
call fcn.0040ba40
mov dword [ebp - 4], 0x50
test ebx, 0x800000
je 0x49a939
and ebx, 0xff7fffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x10c]
call fcn.0040ba40
mov dword [ebp - 4], 0x4f
test ebx, 0x400000
je 0x49a95c
and ebx, 0xffbfffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x150]
call fcn.0040ba40
mov dword [ebp - 4], 0x4e
test ebx, 0x200000
je 0x49a97f
and ebx, 0xffdfffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x114]
call fcn.0040ba40
mov dword [ebp - 4], 0x4d
test ebx, 0x100000
je 0x49a9a2
and ebx, 0xffefffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1a8]
call fcn.0040ba40
mov dword [ebp - 4], 0x4c
test ebx, 0x80000
je 0x49a9c5
and ebx, 0xfff7ffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x11c]
call fcn.0040ba40
mov dword [ebp - 4], 0x4b
test ebx, 0x40000
je 0x49a9e8
and ebx, 0xfffbffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x158]
call fcn.0040ba40
mov dword [ebp - 4], 0x4a
test ebx, 0x20000
je 0x49aa0b
and ebx, 0xfffdffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x124]
call fcn.0040ba40
mov dword [ebp - 4], 0x49
test ebx, 0x10000
je 0x49aa2e
and ebx, 0xfffeffff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x190]
call fcn.0040ba40
mov dword [ebp - 4], 0x48
test ebx, 0x8000
je 0x49aa51
and ebx, 0xffff7fff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x12c]
call fcn.0040ba40
mov dword [ebp - 4], 0x47
test ebx, 0x4000
je 0x49aa74
and ebx, 0xffffbfff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x160]
call fcn.0040ba40
mov dword [ebp - 4], 0x46
test ebx, 0x2000
je 0x49aa97
and ebx, 0xffffdfff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x134]
call fcn.0040ba40
mov dword [ebp - 4], 0x45
test ebx, 0x1000
je 0x49aaba
and ebx, 0xffffefff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1b8]
call fcn.0040ba40
mov dword [ebp - 4], 0x44
test ebx, 0x800
je 0x49aadd
and ebx, 0xfffff7ff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x13c]
call fcn.0040ba40
mov dword [ebp - 4], 0x43
test ebx, 0x400
je 0x49ab00
and ebx, 0xfffffbff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x168]
call fcn.0040ba40
mov dword [ebp - 4], 0x42
test ebx, 0x200
je 0x49ab23
and ebx, 0xfffffdff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x108]
call fcn.0040ba40
mov dword [ebp - 4], 0x41
test esi, ebx
je 0x49ab42
and ebx, 0xfffffeff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x198]
call fcn.0040ba40
mov dword [ebp - 4], edi
test bl, bl
jns 0x49ab5d
and ebx, 0xffffff7f
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xf4]
call fcn.0040ba40
mov dword [ebp - 4], 0x3f
test bl, 0x40
je 0x49ab7a
and ebx, 0xffffffbf
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x170]
call fcn.0040ba40
mov dword [ebp - 4], 0x3e
test bl, 0x20
je 0x49ab97
and ebx, 0xffffffdf
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xd8]
call fcn.0040ba40
mov dword [ebp - 4], 0x3d
test bl, 0x10
je 0x49abb4
and ebx, 0xffffffef
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1b0]
call fcn.0040ba40
mov dword [ebp - 4], 0x3c
test bl, 8
je 0x49abd1
and ebx, 0xfffffff7
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x130]
call fcn.0040ba40
mov dword [ebp - 4], 0x3b
test bl, 4
je 0x49abee
and ebx, 0xfffffffb
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x178]
call fcn.0040ba40
mov dword [ebp - 4], 0x3a
test bl, 2
je 0x49ac0b
and ebx, 0xfffffffd
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xe0]
call fcn.0040ba40
mov dword [ebp - 4], 0x39
test bl, 1
je 0x49ac28
and ebx, 0xfffffffe
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1a0]
call fcn.0040ba40
mov dword [ebp - 4], 0x38
test dword [ebp - 0x14], 0x80000000
je 0x49ac4a
and dword [ebp - 0x14], 0x7fffffff
lea ecx, [ebp - 0x110]
call fcn.0040ba40
mov dword [ebp - 4], 0x37
test dword [ebp - 0x14], 0x40000000
je 0x49ac6c
and dword [ebp - 0x14], 0xbfffffff
lea ecx, [ebp - 0x180]
call fcn.0040ba40
mov dword [ebp - 4], 0x36
test dword [ebp - 0x14], 0x20000000
je 0x49ac8e
and dword [ebp - 0x14], 0xdfffffff
lea ecx, [ebp - 0xe8]
call fcn.0040ba40
mov dword [ebp - 4], 0x35
test dword [ebp - 0x14], 0x10000000
je 0x49acb0
and dword [ebp - 0x14], 0xefffffff
lea ecx, [ebp - 0x1c0]
call fcn.0040ba40
mov dword [ebp - 4], 0x34
test dword [ebp - 0x14], 0x8000000
je 0x49acd2
and dword [ebp - 0x14], 0xf7ffffff
lea ecx, [ebp - 0x128]
call fcn.0040ba40
mov dword [ebp - 4], 0x33
test dword [ebp - 0x14], 0x4000000
je 0x49acf4
and dword [ebp - 0x14], 0xfbffffff
lea ecx, [ebp - 0x144]
call fcn.0040ba40
mov dword [ebp - 4], 0x32
test dword [ebp - 0x14], 0x2000000
je 0x49ad16
and dword [ebp - 0x14], 0xfdffffff
lea ecx, [ebp - 0xf0]
call fcn.0040ba40
mov dword [ebp - 4], 0x31
test dword [ebp - 0x14], 0x1000000
je 0x49ad38
and dword [ebp - 0x14], 0xfeffffff
lea ecx, [ebp - 0x14c]
call fcn.0040ba40
mov dword [ebp - 4], 0x30
test dword [ebp - 0x14], 0x800000
je 0x49ad5a
and dword [ebp - 0x14], 0xff7fffff
lea ecx, [ebp - 0x118]
call fcn.0040ba40
mov dword [ebp - 4], 0x2f
test dword [ebp - 0x14], 0x400000
je 0x49ad7c
and dword [ebp - 0x14], 0xffbfffff
lea ecx, [ebp - 0x154]
call fcn.0040ba40
mov dword [ebp - 4], 0x2e
test dword [ebp - 0x14], 0x200000
je 0x49ad9e
and dword [ebp - 0x14], 0xffdfffff
lea ecx, [ebp - 0xf8]
call fcn.0040ba40
mov dword [ebp - 4], 0x2d
test dword [ebp - 0x14], 0x100000
je 0x49adc0
and dword [ebp - 0x14], 0xffefffff
lea ecx, [ebp - 0x15c]
call fcn.0040ba40
mov dword [ebp - 4], 0x2c
test dword [ebp - 0x14], 0x80000
je 0x49ade2
and dword [ebp - 0x14], 0xfff7ffff
lea ecx, [ebp - 0x138]
call fcn.0040ba40
mov dword [ebp - 4], 0x2b
test dword [ebp - 0x14], 0x40000
je 0x49ae04
and dword [ebp - 0x14], 0xfffbffff
lea ecx, [ebp - 0x8c]
call fcn.0040ba40
mov dword [ebp - 4], 0x2a
test dword [ebp - 0x14], 0x20000
je 0x49ae26
and dword [ebp - 0x14], 0xfffdffff
lea ecx, [ebp - 0x100]
call fcn.0040ba40
mov dword [ebp - 4], 0x29
test dword [ebp - 0x14], 0x10000
je 0x49ae45
and dword [ebp - 0x14], 0xfffeffff
lea ecx, [ebp - 0x70]
call fcn.0040ba40
mov dword [ebp - 4], 0x28
test dword [ebp - 0x14], 0x8000
je 0x49ae67
and dword [ebp - 0x14], 0xffff7fff
lea ecx, [ebp - 0x120]
call fcn.0040ba40
mov dword [ebp - 4], 0x27
test dword [ebp - 0x14], 0x4000
je 0x49ae86
and dword [ebp - 0x14], 0xffffbfff
lea ecx, [ebp - 0x68]
call fcn.0040ba40
mov dword [ebp - 4], 0x26
test dword [ebp - 0x14], 0x2000
je 0x49aea8
and dword [ebp - 0x14], 0xffffdfff
lea ecx, [ebp - 0xcc]
call fcn.0040ba40
mov dword [ebp - 4], 0x25
test dword [ebp - 0x14], 0x1000
je 0x49aec7
and dword [ebp - 0x14], 0xffffefff
lea ecx, [ebp - 0x60]
call fcn.0040ba40
mov dword [ebp - 4], 0x24
test dword [ebp - 0x14], 0x800
je 0x49aee6
and dword [ebp - 0x14], 0xfffff7ff
lea ecx, [ebp - 0x5c]
call fcn.0040ba40
mov dword [ebp - 4], 0x23
test dword [ebp - 0x14], 0x400
je 0x49af05
and dword [ebp - 0x14], 0xfffffbff
lea ecx, [ebp - 0x64]
call fcn.0040ba40
mov dword [ebp - 4], 0x22
test dword [ebp - 0x14], 0x200
je 0x49af24
and dword [ebp - 0x14], 0xfffffdff
lea ecx, [ebp - 0x44]
call fcn.0040ba40
mov dword [ebp - 4], 0x21
test dword [ebp - 0x14], esi
je 0x49af3f
and dword [ebp - 0x14], 0xfffffeff
lea ecx, [ebp - 0x58]
call fcn.0040ba40
mov dword [ebp - 4], 0x20
test byte [ebp - 0x14], 0x80
je 0x49af5b
and dword [ebp - 0x14], 0xffffff7f
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov dword [ebp - 4], 0x1f
test byte [ebp - 0x14], 0x40
je 0x49af74
and dword [ebp - 0x14], 0xffffffbf
lea ecx, [ebp - 0x4c]
call fcn.0040ba40
mov dword [ebp - 4], 6
test byte [ebp - 0x14], 0x20
je 0x49af8d
and dword [ebp - 0x14], 0xffffffdf
lea ecx, [ebp - 0x38]
call fcn.0040ba40
cmp byte [ebp - 0x29], 0
je 0x49af99
mov byte [ebp - 0x3d], 1
jmp 0x49afd0
mov ebx, dword [ebp - 0x84]
mov edi, dword [ebp - 0x88]
cmp byte [ebp - 0x3d], 0
jne 0x49afd0
push ebx
push edi
mov ecx, dword [ebp - 0x9c]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x98]
push eax
lea edx, [ebp - 0x34]
mov ecx, dword [0x72a504]
call fcn.004d03e0
mov ecx, dword [ebp - 0x34]
cmp dword [ecx - 0xc], 0
jne 0x49b6ed
cmp dword [0x72a4c4], 0
je 0x49b6ed
push 0
push 0
push 0x713e04
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x49b6ed
mov esi, dword [ebp + 0xc]
add esi, 0x20
push esi
mov ecx, str.Quick
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b030
push esi
mov ecx, str.Full
call fcn.00442e60
add esp, 4
test al, al
je 0x49b6ed
cmp byte [ebp + 0x30], 0
jne 0x49b6ed
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 0x69
lea edi, [ebp - 0x24]
call fcn.0040bd70
mov byte [ebp - 0x2a], 1
lea eax, [ebp - 0x5c]
push eax
mov ecx, str.:programdata
call fcn.0040b990
mov byte [ebp - 4], 0x6a
or dword [ebp - 0x18], 0x8000
lea eax, [ebp - 0x5c]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x49b103
lea ecx, [ebp - 0x44]
push ecx
mov ecx, str.:program_files
call fcn.0040b990
mov dword [ebp - 4], 0x6b
or dword [ebp - 0x18], 0x10000
lea eax, [ebp - 0x44]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x49b103
lea edx, [ebp - 0x48]
push edx
mov ecx, str.:program_files__x86_
call fcn.0040b990
mov dword [ebp - 4], 0x6c
or dword [ebp - 0x18], 0x20000
lea eax, [ebp - 0x48]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x49b103
lea eax, [ebp - 0x38]
push eax
mov ecx, str.:windows_servicing
call fcn.0040b990
mov dword [ebp - 4], 0x6d
or dword [ebp - 0x18], 0x40000
lea eax, [ebp - 0x38]
mov edx, edi
call fcn.004c23c0
test al, al
jne 0x49b103
xor bl, bl
jmp 0x49b105
mov bl, 1
mov dword [ebp - 4], 0x6c
mov esi, dword [ebp - 0x18]
test esi, 0x40000
je 0x49b128
and esi, 0xfffbffff
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x38]
call fcn.0040ba40
mov dword [ebp - 4], 0x6b
test esi, 0x20000
je 0x49b148
and esi, 0xfffdffff
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov dword [ebp - 4], 0x6a
test esi, 0x10000
je 0x49b168
and esi, 0xfffeffff
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x44]
call fcn.0040ba40
mov dword [ebp - 4], 0x69
test esi, 0x8000
je 0x49b188
and esi, 0xffff7fff
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba40
test bl, bl
jne 0x49b202
mov eax, dword [0x713db0]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
lea edx, [ebp - 0x24]
push edx
push ecx
call fcn.0040b930
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x69
call fcn.00435350
add esp, 4
cmp edx, esi
jl 0x49b1c3
jg 0x49b202
cmp eax, edi
ja 0x49b202
cmp dword [0x713db4], 0
je 0x49b206
xor ecx, ecx
mov edx, 0x6d4f5c
lea esi, [ebp - 0x24]
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b202
xor ecx, ecx
mov edx, str.serial
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b202
xor ecx, ecx
mov edx, str.crack
call fcn.004301b0
cmp eax, 0xffffffff
je 0x49b206
mov byte [ebp - 0x2a], 0
xor ecx, ecx
mov edx, str.hp_
lea esi, [ebp - 0x24]
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b25e
xor ecx, ecx
mov edx, str.laserjet
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b25e
xor ecx, ecx
mov edx, str.printer
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b25e
xor ecx, ecx
mov edx, str.scanner
call fcn.004301b0
cmp eax, 0xffffffff
jne 0x49b25e
xor ecx, ecx
mov edx, str._mfp
call fcn.004301b0
cmp eax, 0xffffffff
je 0x49b273
mov byte [ebp - 0x2a], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.0040ba40
jmp 0x49b6ed
cmp byte [ebp - 0x2a], 0
je 0x49b6ce
cmp dword [0x713e08], 0
je 0x49b2a8
lea eax, [ebp - 0x24]
push eax
call fcn.0042ebf0
test al, al
je 0x49b2a8
mov byte [ebp - 0x2a], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.0040ba40
jmp 0x49b6ed
mov ecx, 0x2e
lea esi, [ebp - 0x24]
call fcn.00442b40
cmp eax, 0xffffffff
je 0x49b6ce
lea edx, [eax + 1]
lea ecx, [ebp - 0x20]
push ecx
mov eax, esi
push eax
call fcn.00442bc0
mov byte [ebp - 4], 0x6f
lea edi, [ebp - 0x20]
call fcn.0040bd70
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040b8d0
mov byte [ebp - 4], 0x70
mov edx, edi
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.0040b930
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x6d51b8
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b32a
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x6d7800
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b32a
lea edi, [ebp - 0x28]
call fcn.00442b60
jmp 0x49b337
mov edx, 0x6d7808
lea edi, [ebp - 0x28]
call fcn.0040bab0
cmp dword [0x713da8], 0
je 0x49b491
cmp dword [0x72a414], 1
jne 0x49b3b4
lea eax, [ebp - 0x64]
push eax
mov ecx, str.Malware.
call fcn.0040b990
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x58]
push edx
mov ebx, eax
call fcn.004247e0
mov byte [ebp - 4], 0x73
push eax
lea eax, [ebp - 0x4c]
push eax
mov ebx, str..DeepDive
call fcn.0041e2b0
add esp, 0x10
mov byte [ebp - 4], 0x74
lea edi, [ebp - 0x30]
call fcn.0040ddb0
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x4c]
call fcn.0040ba40
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x58]
call fcn.0040ba40
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x64]
call fcn.0040ba40
mov ecx, dword [ebp - 0x30]
cmp dword [ecx - 0xc], 0
jne 0x49b491
xor bl, bl
mov dword [ebp - 0x8c], 0x72aa64
push 0x72aa64
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x75
xor edi, edi
mov dword [ebp - 0x19c], edi
mov edx, dword [0x72aaac]
sub edx, dword [0x72aaa8]
sar edx, 2
cmp edi, edx
jae 0x49b415
mov esi, 0x72aa9c
call fcn.00424a10
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0040bb30
test eax, eax
je 0x49b419
inc edi
jmp 0x49b3de
test bl, bl
je 0x49b480
lea edx, [ebp - 0x70]
push edx
mov ecx, str.Malware.
call fcn.0040b990
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ebx, eax
call fcn.004247e0
mov byte [ebp - 4], 0x77
push eax
lea eax, [ebp - 0x60]
push eax
mov ebx, str..DeepDive
call fcn.0041e2b0
add esp, 0x10
mov byte [ebp - 4], 0x78
lea edi, [ebp - 0x30]
call fcn.0040ddb0
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x60]
call fcn.0040ba40
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x68]
call fcn.0040ba40
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x70]
call fcn.0040ba40
mov byte [ebp - 4], 0x71
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x72a4c8], 0
je 0x49b606
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d51fc
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d5204
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d520c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d5214
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d521c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5224
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d522c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d07d4
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5234
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d523c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d5244
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d524c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d5254
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6d525c
call fcn.00442e60
add esp, 4
test al, al
jne 0x49b5f9
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x6d5264
call fcn.00442e60
add esp, 4
test al, al
je 0x49b606
mov edx, str.Malware.DeepScript
lea edi, [ebp - 0x30]
call fcn.0040bab0
mov edx, dword [ebp - 0x30]
cmp dword [edx - 0xc], 0
je 0x49b6aa
mov byte [ebp - 4], 0x79
cmp byte [ebp - 0x3b], 0
jne 0x49b6a3
cmp byte [ebp - 0x3c], 0
jne 0x49b6a3
push 0x1b7740
mov eax, dword [0x72a528]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x60], 0x72a7c8
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x7a
call fcn.00468340
test al, al
je 0x49b694
lea ecx, [ebp - 0x24]
push ecx
call fcn.00468190
test al, al
jne 0x49b694
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x6d520c
call fcn.0040bdd0
add esp, 4
test al, al
jne 0x49b689
mov eax, dword [ebp - 0x24]
push eax
call fcn.0043f070
add esp, 4
test al, al
je 0x49b694
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
call fcn.0041cc80
mov byte [ebp - 4], 0x79
push 0x72a7c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0x71
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x30]
call fcn.0040ba40
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x20]
call fcn.0040ba40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.0040ba40
jmp 0x49b6ed
mov byte [ebp - 0x51], 1
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0x3e8
je 0x49b7d7
mov ecx, dword [ebp - 0x34]
cmp dword [ecx - 0xc], 0
jne 0x49b7d7
mov edi, dword [ebp + 0x28]
test edi, edi
jl 0x49b7da
jg 0x49b721
cmp dword [ebp + 0x24], 0
jbe 0x49b7da
cmp edi, 0xffffffff
ja 0x49b7da
jb 0x49b736
cmp dword [ebp + 0x24], 0xffffffff
jae 0x49b7da
cmp dword [0x713d9c], 0
je 0x49b7da
mov byte [ebp - 0x3e], 0
lea edx, [ebp - 0x3e]
push edx
push 0
mov eax, dword [ebp + 0x24]
push eax
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
call fcn.0041e190
mov byte [ebp - 4], 0x7c
lea ebx, [ebp - 0x34]
call fcn.0040dcb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
call fcn.0040b810
mov ecx, dword [ebp - 0x34]
cmp dword [ecx - 0xc], 0
je 0x49b7da
push 0x72a4ec
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [0x72a4ec]
push edx
push ecx
mov eax, esp
mov dword [ebp - 0x58], esp
push eax
mov ecx, str.CloudFound
call fcn.0040b990
mov byte [ebp - 4], 0x7d
mov byte [ebp - 4], 6
call fcn.0044f000
push 0x6d56b0
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, ebx
call fcn.00424670
add esp, 8
mov byte [ebp - 4], 0x7e
call fcn.0040dcb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
call fcn.0040b810
jmp 0x49b7da
mov edi, dword [ebp + 0x28]
cmp dword [esi + 0x18], 0x3e8
je 0x49b83f
mov edx, dword [ebp - 0x34]
cmp dword [edx - 0xc], 0
jne 0x49b83f
test edi, edi
jl 0x49b83f
mov eax, dword [ebp + 0x24]
jg 0x49b7f9
test eax, eax
jbe 0x49b83f
cmp edi, 0xffffffff
ja 0x49b83f
jb 0x49b805
cmp eax, 0xffffffff
jae 0x49b83f
push eax
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
call fcn.004bdd20
mov byte [ebp - 4], 0x7f
lea ebx, [ebp - 0x34]
call fcn.0040dcb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
call fcn.0040b810
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x49b83f
push str.Ransomware.
mov ecx, ebx
push ecx
call fcn.0045a170
mov edx, dword [ebp - 0x34]
cmp dword [edx - 0xc], 0
je 0x49bcb4
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 0x80
lea edi, [ebp - 0x28]
call fcn.0040bd70
lea ebx, [esi + 0x128]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], eax
mov ecx, dword [ebx]
mov dword [ebp - 0x84], ecx
mov edx, edi
push edx
lea eax, [ebp - 0x50]
push eax
mov esi, ebx
call fcn.00425300
lea esi, [ebp - 0x84]
mov edi, eax
call fcn.004b1720
test al, al
je 0x49bca5
lea ecx, [ebp - 0x28]
push ecx
push ebx
lea ebx, [ebp - 0x88]
call fcn.004251c0
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x68]
push eax
call fcn.004c1430
mov edi, eax
mov byte [ebp - 4], 0x81
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x148]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x60]
push edx
mov ecx, ebx
call fcn.004245c0
mov byte [ebp - 4], 0x82
push 0x6cb960
lea ecx, [ebp - 0x64]
push ecx
mov ecx, eax
call fcn.00424670
mov byte [ebp - 4], 0x83
push edi
lea edx, [ebp - 0x58]
push edx
mov ecx, eax
call fcn.004245c0
mov byte [ebp - 4], 0x84
push 0x6d1afc
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.00424670
add esp, 0x28
mov byte [ebp - 4], 0x85
call fcn.0040dcb0
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x4c]
call fcn.0040b810
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x58]
call fcn.0040b810
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x64]
call fcn.0040b810
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x60]
call fcn.0040b810
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x68]
call fcn.0040b810
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.00433a20
add esp, 8
mov byte [ebp - 4], 0x86
mov ebx, dword [ebp + 8]
mov edi, ebx
call fcn.0040ddb0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x70]
call fcn.0040ba40
push esi
push ebx
call fcn.00492420
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00491e00
mov byte [ebp - 4], 0x87
mov edx, dword [ebp + 0x2c]
cmp dword [edx - 0xc], 0
je 0x49b9b2
lea eax, [ebp + 0x2c]
jmp 0x49b9c9
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040b990
mov byte [ebp - 4], 0x88
or dword [ebp - 0x18], 0x80000
lea edi, [ebp - 0xc8]
call fcn.0040ddb0
mov dword [ebp - 4], 0x87
test dword [ebp - 0x18], 0x80000
je 0x49b9f3
and dword [ebp - 0x18], 0xfff7ffff
lea ecx, [ebp - 0x4c]
call fcn.0040ba40
mov eax, ebx
lea edi, [ebp - 0xac]
call fcn.0040ddb0
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x49ba1f
lea ecx, [ebp - 0xc4]
push ecx
push eax
lea edx, [ebp - 0xc8]
push edx
push esi
call fcn.00498970
add esp, 0x10
lea eax, [ebp - 0xc8]
push eax
mov edi, dword [ebp + 0x18]
add edi, 0x1c
call fcn.004aeec0
cmp byte [ebp + 0x20], 0
jne 0x49ba4e
push 0
push 0
push 0x713dcc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov byte [ebp - 0x30], 0
jne 0x49ba52
mov byte [ebp - 0x30], 1
xor edi, edi
mov ecx, dword [ebp - 0x30]
push ecx
push ecx
mov edx, esp
mov dword [ebp - 0x4c], esp
push ebx
push edx
call fcn.0040b930
mov byte [ebp - 4], 0x89
push ecx
mov eax, esp
mov dword [ebp - 0x58], esp
lea ecx, [ebp - 0xc8]
push ecx
push eax
call fcn.0040b930
mov byte [ebp - 4], 0x8a
push esi
mov byte [ebp - 4], 0x87
mov ecx, edi
mov esi, dword [ebp + 0x18]
call fcn.00498760
add esp, 0x10
push 0x72a4e0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0x1a4], edi
mov edx, dword [ebp - 0xb4]
sub edx, dword [ebp - 0xb8]
sar edx, 2
cmp edi, edx
jae 0x49bb13
push 0x72a4dc
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0x72a4e0
call esi
mov eax, dword [ebp - 0x30]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push ebx
push ecx
call fcn.0040b930
mov byte [ebp - 4], 0x8b
lea esi, [ebp - 0xc4]
call fcn.00424a10
push ecx
mov edx, esp
mov dword [ebp - 0x58], esp
push eax
push edx
call fcn.0040b930
mov byte [ebp - 4], 0x8c
mov eax, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 0x87
xor ecx, ecx
mov esi, dword [ebp + 0x18]
call fcn.00498760
add esp, 0x10
inc edi
jmp 0x49ba9d
mov ecx, dword [0x72a4e0]
push ecx
push ecx
mov edx, esp
mov dword [ebp - 0x4c], esp
push edx
mov ecx, str.ManualFound
call fcn.0040b990
mov byte [ebp - 4], 0x8d
mov byte [ebp - 4], 0x87
call fcn.0044f000
cmp byte [ebp + 0x20], 0
jne 0x49bb55
push 0
push 0
push 0x713dcc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x49bc95
mov ecx, dword [ebp - 0xb4]
sub ecx, dword [ebp - 0xb8]
sar ecx, 2
inc ecx
mov eax, dword [ebp + 0xc]
add dword [eax + 0x40], ecx
push 1
mov esi, ebx
call fcn.0040be30
sub esp, 0x1c
mov dword [ebp - 0x4c], esp
mov ecx, esp
call fcn.0040b3c0
mov byte [ebp - 4], 0x8e
sub esp, 0x1c
mov dword [ebp - 0x58], esp
mov esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, esp
call fcn.0040b3c0
mov byte [ebp - 4], 0x8f
mov byte [ebp - 4], 0x87
call fcn.004948d0
add esp, 0x3c
mov byte [ebp - 0x29], 0
lea edx, [ebp - 0x38]
push edx
mov ecx, esi
call fcn.0040b990
mov byte [ebp - 4], 0x90
push ebx
lea ecx, [ebp - 0x38]
call fcn.0043fc30
add esp, 4
test al, al
sete byte [ebp - 0x3e]
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x38]
call fcn.0040ba40
cmp byte [ebp - 0x3e], 0
je 0x49bc7f
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x6d4204
call fcn.0040b990
mov byte [ebp - 4], 0x91
lea eax, [ebp - 0x38]
mov ecx, ebx
call fcn.004c18c0
mov bl, al
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x38]
call fcn.0040ba40
test bl, bl
je 0x49bc32
lea ecx, [ebp - 0x29]
push ecx
push 1
mov edx, dword [ebp + 0x24]
push edx
mov edx, esi
lea ecx, [ebp - 0x4c]
call fcn.0041e190
lea ecx, [ebp - 0x4c]
call fcn.0040b810
cmp byte [ebp - 0x29], 0
jne 0x49bc39
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov dword [ebp - 0x1ac], edi
mov eax, dword [ebp - 0xb4]
mov ecx, eax
sub ecx, dword [ebp - 0xb8]
sar ecx, 2
cmp edi, ecx
jae 0x49bc85
lea esi, [ebp - 0xc4]
call fcn.00424a10
push eax
call fcn.0043b470
add esp, 4
test al, al
je 0x49bc7c
call fcn.00424a10
push eax
call fcn.0043b560
add esp, 4
inc edi
jmp 0x49bc3b
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
sar eax, 2
inc eax
mov ecx, dword [ebp + 0x18]
add dword [ecx + 8], eax
mov byte [ebp - 4], 0x80
lea edx, [ebp - 0xc8]
push edx
call fcn.0049bf00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.0040ba40
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x18]
cmp byte [ebp + 0x14], 0
je 0x49bcdc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
mov edx, dword [esi]
push edx
test eax, eax
setne al
movzx ecx, al
push ecx
call fcn.00492b00
add esp, 8
inc dword [esi + 0x28]
cmp byte [ebp - 0x3d], 0
je 0x49be9c
cmp byte [ebp + 0x34], 0
jne 0x49be9c
cmp byte [ebp - 0x51], 0
jne 0x49be9c
mov edx, dword [ebp - 0x34]
cmp dword [edx - 0xc], 0
jne 0x49be9c
lea eax, [ebp - 0xa0]
push eax
call fcn.00491fb0
mov byte [ebp - 4], 0x92
mov edx, dword [ebp + 0x10]
lea edi, [ebp - 0xa0]
call fcn.0040bab0
mov ecx, dword [ebp - 0xa0]
cmp dword [ecx - 0xc], 0
je 0x49bdc4
lea edx, [ebp - 0x44]
push edx
mov edi, dword [ebp + 0x10]
mov ecx, edi
call fcn.0040b990
mov byte [ebp - 4], 0x93
or ebx, 0x100000
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x4c]
push eax
call fcn.004c12a0
add esp, 4
mov dword [ebp - 4], 0x94
or ebx, 0x200000
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x44]
call fcn.004c23c0
test al, al
jne 0x49bdc4
lea ecx, [ebp - 0x48]
push ecx
mov ecx, str.vibraniumupdater
call fcn.0040b990
mov dword [ebp - 4], 0x95
or ebx, 0x400000
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x38]
push edx
mov ecx, edi
call fcn.0040b990
mov dword [ebp - 4], 0x96
or ebx, 0x800000
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x38]
call fcn.004c23c0
test al, al
mov byte [ebp - 0x29], 1
je 0x49bdc8
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0x95
test ebx, 0x800000
je 0x49bde8
and ebx, 0xff7fffff
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x38]
call fcn.0040ba40
mov dword [ebp - 4], 0x94
test ebx, 0x400000
je 0x49be08
and ebx, 0xffbfffff
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x48]
call fcn.0040ba40
mov dword [ebp - 4], 0x93
test ebx, 0x200000
je 0x49be28
and ebx, 0xffdfffff
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x4c]
call fcn.0040ba40
mov dword [ebp - 4], 0x92
test ebx, 0x100000
je 0x49be48
and ebx, 0xffefffff
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x44]
call fcn.0040ba40
cmp byte [ebp - 0x29], 0
je 0x49be8c
lea eax, [ebp - 0x34]
lea ebx, [ebp - 0x9c]
call fcn.0040dcb0
lea edi, [esi + 0x110]
mov dword [ebp - 0x4c], edi
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x97
lea ebx, [esi + 0xf4]
lea eax, [ebp - 0xa0]
call fcn.004af1a0
mov byte [ebp - 4], 0x92
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 6
lea eax, [ebp - 0xa0]
push eax
call fcn.0049bf70
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x74]
cmp eax, 0xffffffff
je 0x49beaf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.0040b810
jmp 0x49bec3
mov eax, dword [ebp + 0xc]
inc dword [eax + 0x44]
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x2c]
call fcn.0040ba40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret