Function at 0x4bd650
Capabilities:
Check for peb ntglobalflag flag
Check for time delay via gettickcount
Check http status code
Check os version
Get file size
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x608038
mov eax, dword fs:[0]
push eax
mov eax, 0x7318
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x7314], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6aae14]
xor eax, esp
push eax
lea eax, [esp + 0x732c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x7348]
mov eax, dword [esp + 0x7340]
mov ecx, dword [esp + 0x7344]
mov esi, dword [esp + 0x739c]
mov dword [esp + 0xe0], edx
mov edx, dword [esp + 0x7354]
mov ebp, dword [esp + 0x733c]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x734c]
mov dword [esp + 0xd0], ecx
mov ecx, dword [esp + 0x7350]
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x7360]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x7358]
mov dword [esp + 0xc0], ecx
mov ecx, dword [esp + 0x735c]
mov dword [esp + 0xf0], edx
mov edx, dword [esp + 0x736c]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x7364]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x7368]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x7378]
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0x7370]
mov dword [esp + 0xf8], ecx
mov ecx, dword [esp + 0x7374]
mov dword [esp + 0xa4], edx
mov edx, dword [esp + 0x7384]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x737c]
mov dword [esp + 0xd4], ecx
mov ecx, dword [esp + 0x7380]
mov dword [esp + 0xc4], edx
mov edx, dword [esp + 0x7390]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7388]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x738c]
mov dword [esp + 0x104], edx
mov edx, dword [esp + 0x73a4]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x7394]
mov dword [esp + 0xec], ecx
mov ecx, dword [esp + 0x73a0]
xor ebx, ebx
push 0xfff
mov dword [esp + 0x64], edx
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x73ac]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x73b0]
lea edx, [esp + 0x32d]
push ebx
push edx
mov dword [esp + 0x9c], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0xd4], ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0xf0], ebx
mov byte [esp + 0x334], bl
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x131]
push ebx
push eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x138], bl
call fcn.005dfd60
mov dword [esp + 0x30], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0xf4], ebx
push 0x3ff
lea ecx, [esp + 0x1345]
push ebx
push ecx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x58], ebx
mov byte [esp + 0x134c], bl
call fcn.005dfd60
or edi, 0xffffffff
add esp, 0x24
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xa8], ebx
cmp dword [esp + 0x7398], ebx
je 0x4bd93f
cmp esi, ebx
je 0x4bd93f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x78], eax
cmp dword [0x748bac], ebx
jne 0x4bd954
push 0x748bac
call fcn.004a68b0
add esp, 4
cmp dword [0x748ba8], ebx
jne 0x4bd992
push 0x100
push ebx
push 0x748aa8
mov dword [0x748ba8], 1
call fcn.005dfd60
add esp, 0xc
push 0x748aa4
push str.CloudScanExtA
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov edx, dword [esp + 0x38]
mov dword [edx], 1
cmp dword [0x7433d8], ebx
jne 0x4bdfbe
push 0x2710
push 0x74250c
mov dword [0x7433d8], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4bd9d1
push 0x74250c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x58
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], ebx
cmp esi, ebx
je 0x4bda09
push ebx
push str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___
call fcn.004dd6c0
add esp, 4
push eax
push str.__NOT_______MHonArc____AND___NOT__.data____AND___NOT__open.exe.torrent____AND___NOT__javax.sun.base.exe____AND___NOT____php____AND___NOT__3Dcid:THE_CID____AND___NOT__function_exists____AND___NOT__Document_was_scanned____AND___NOT__AIRMAIL____AND___NOT__CreateObject_____AND___NOT_____iframe__AND__hidden______AND___NOT_____iframe__AND__bgColor3Dffffff______AND___NOT___meta_____AND___NOT__Lmxuaw_____AND___NOT__Yi5sbms_____AND___NOT__Y2IubG5r_____AND____Message_Id:__OR__MIME_Version:___
mov ecx, esi
call fcn.005ff200
jmp 0x4bda0b
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424fc], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 1
cmp eax, ebx
je 0x4bda48
mov ecx, dword [0x7424fc]
push ebx
push ecx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bda4a
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x742490], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 2
cmp esi, ebx
je 0x4bda92
push ebx
push str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__
call fcn.004dd6c0
add esp, 4
push eax
push str.___Joy_peffpwpc__OR_APPLttxt_OR_APPLaplt_OR__Mac_Mag__OR_INITPSMD_OR_STAKWILD_OR_APPLCTC__
mov ecx, esi
call fcn.005ff200
jmp 0x4bda94
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424e4], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 3
cmp eax, ebx
je 0x4bdad1
mov edx, dword [0x7424e4]
push ebx
push edx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdad3
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x742494], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 4
cmp esi, ebx
je 0x4bdb1b
push ebx
push str.____ffff__OR__FileAttach___
call fcn.004dd6c0
add esp, 4
push eax
push str.____ffff__OR__FileAttach___
mov ecx, esi
call fcn.005ff200
jmp 0x4bdb1d
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424b8], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 5
cmp eax, ebx
je 0x4bdb5a
mov ecx, dword [0x7424b8]
push ebx
push ecx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdb5c
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424a8], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 6
cmp esi, ebx
je 0x4bdba4
push ebx
push str.___Android__OR__.classPK__OR__classes.dex__OR__META_INF___OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____
call fcn.004dd6c0
add esp, 4
push eax
push str.___Android__OR__.classPK__OR__classes.dex__OR__META_INF___OR__res_layout___OR__res_drawable__OR__res_mipmap___OR__locale___OR__skin___OR__mozapps____
mov ecx, esi
call fcn.005ff200
jmp 0x4bdba6
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x74249c], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 7
cmp eax, ebx
je 0x4bdbe3
mov edx, dword [0x74249c]
push ebx
push edx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdbe5
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424bc], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 8
cmp esi, ebx
je 0x4bdc2d
push ebx
push str.___META_INF___OR__content_PK__OR__locale___OR__content___OR__browser_PK___
call fcn.004dd6c0
add esp, 4
push eax
push str.___META_INF___OR__content_PK__OR__locale___OR__content___OR__browser_PK___
mov ecx, esi
call fcn.005ff200
jmp 0x4bdc2f
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x742500], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 9
cmp eax, ebx
je 0x4bdc6c
mov ecx, dword [0x742500]
push ebx
push ecx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdc6e
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424e0], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 0xa
cmp esi, ebx
je 0x4bdcb6
push ebx
push str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___
call fcn.004dd6c0
add esp, 4
push eax
push str.___rtsp:__OR______OR__phpcode__OR___Task___OR__eval___OR__base64_decode___OR___jar___OR___img___OR___Content_Types_.xml__OR__binData__OR__.mso__OR__Word.Document___
mov ecx, esi
call fcn.005ff200
jmp 0x4bdcb8
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424b0], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 0xb
cmp eax, ebx
je 0x4bdcf5
mov edx, dword [0x7424b0]
push ebx
push edx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdcf7
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424a4], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 0xc
cmp esi, ebx
je 0x4bdd3f
push ebx
push str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___
call fcn.004dd6c0
add esp, 4
push eax
push str.___Kernel32__OR__User32__OR__Rundll32__OR__UrlMon___
mov ecx, esi
call fcn.005ff200
jmp 0x4bdd41
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424ec], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 0xd
cmp eax, ebx
je 0x4bdd7e
mov ecx, dword [0x7424ec]
push ebx
push ecx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdd80
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424b4], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 0xe
cmp esi, ebx
je 0x4bddc8
push ebx
push str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___
call fcn.004dd6c0
add esp, 4
push eax
push str.___escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME___
mov ecx, esi
call fcn.005ff200
jmp 0x4bddca
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x742504], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 0xf
cmp eax, ebx
je 0x4bde07
mov edx, dword [0x742504]
push ebx
push edx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bde09
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x7424f4], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 0x10
cmp esi, ebx
je 0x4bde51
push ebx
push str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___
call fcn.004dd6c0
add esp, 4
push eax
push str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc___
mov ecx, esi
call fcn.005ff200
jmp 0x4bde53
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424dc], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 0x11
cmp eax, ebx
je 0x4bde90
mov ecx, dword [0x7424dc]
push ebx
push ecx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bde92
xor eax, eax
push 0x58
mov dword [esp + 0x7338], edi
mov dword [0x742498], eax
call fcn.005e1c04
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x7334], 0x12
cmp esi, ebx
je 0x4bdeda
push ebx
push str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____
call fcn.004dd6c0
add esp, 4
push eax
push str.___Content_Type:_application___OR__Content_Type:____OR__escape___OR__window___OR_fromchar_OR__document___OR__.registerFont__OR___jar___OR___img___OR_FCKLang_OR___decode__OR_dropbuf_OR__FONT_SIZE__OR___IFRAME__OR____html___OR____array___OR______on___OR__raw_____AND___::_OR_:start:_OR_:load:_OR_:connect:_OR_:text:_____OR_____timeout__AND___variables_____OR_____dcc_OR_irc___AND____script__OR__aliases__OR__autorun_OR__users__OR__servers__OR__options__OR__text__OR__warn__OR__dde______OR__for___OR__catch___OR_document.create_OR___set___OR__format_c:__OR___javascript___OR__setq___OR_window.document_OR_window.onerror_OR__function___OR__function____OR__end_function__OR_DelReg_OR_rmdir_OR___script___OR___iframe__OR__split___OR_getElement_OR__if_exist___OR__net_share__OR__shutdown___OR__echo___OR__movefile___OR_movefile.exe_OR__jQuery.__OR__reg_add__OR_taskkill_OR__del___OR__execute___OR__execute____OR__String___OR__netsh_firewall__OR_contentscript_OR_ENDFUNC_OR_santanderrio_OR__perl___OR____var___AND___NOT__pvar_____AND___NOT__var_db____AND___NOT__var_ad______OR_document.location_OR___autorun__OR____Len___AND___NOT__mystrlen_______OR__Chr___OR__ChrW___OR__Asc____AscW___OR_ExecutionPolicy_OR_powershell_OR_wscript_OR_vbscript_OR___.code_AND___.data_OR___proc_______OR___.data_AND_____struct__OR___db_______OR___date_AND_2005_10_25___OR___form___OR___input___OR__read_attachment_for_detail__OR__EICAR_ST__OR__z0mbie__OR___setup.z__OR__61.191.52.__OR___kaspersky.com__OR___kaspersky.ru__OR__67.159.14.__OR__127.0.0.__OR_avp.com_OR_EXTRACTFILE_OR___bin___OR___yandex.__OR__3Dcid:THE_CID__OR____Lmxuaw_____OR____Yi5sbms_____OR____Y2IubG5r_____OR__system32_OR_bradesco_OR_bancodobrasil_OR_itau.com_OR_santandernet_OR_open.exe.torrent_OR_javax.sun.base.exe_OR_zhqlc.cn_OR_zhssq.com_OR_qxcglw.net_OR_3dp3p5.com_OR_zhifasoft.com_OR_bancoreal_OR_bancoamazonia_OR_caixa.com_OR___script___OR_document.write_OR__text_javascript__OR___rhino.acme.com___OR_bancanetemp_OR_shExpMatch_OR____open___AND____get___OR__append_____AND___quit_OR_bye_____OR__dccoff__OR__dccon__OR_FindProxyForURL_OR_isInNet_OR___findfile___OR___disk___OR___rand___OR_is_callable_OR_in_array_OR__:sockupd__OR__:udpread__OR__:sockread__OR__:load:__OR__:start:__OR__Invoke_Item___OR__rtsp:__OR______OR__phpcode__OR__eval___OR__base64_decode___OR___crack.exe_AND_serial.exe_AND_keygen.exe___OR_7zg.exe_OR_::startup_OR__CreateObject___OR___ON_AND_ERROR_AND_RESUME_AND_NEXT_AND___ATTRIBUTE_OR__DIM_______OR________AND______AND________OR_____command__AND_____Getvar__OR___Setvar______OR_____OR____e_0100__OR__e_100__OR__e100____OR__HackerDefend__OR___nOrorrseR___OR__.bat__OR__.rsrc__OR__Kernel32__OR__User32__OR__Rundll32__OR__UrlMon__OR__wininit__OR__127.0.0.__OR__Array____
mov ecx, esi
call fcn.005ff200
jmp 0x4bdedc
xor eax, eax
push 0x80
mov dword [esp + 0x7338], edi
mov dword [0x7424d8], eax
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7334], 0x13
cmp eax, ebx
je 0x4bdf19
mov edx, dword [0x7424d8]
push ebx
push edx
mov ecx, eax
call fcn.005fe6d0
jmp 0x4bdf1b
xor eax, eax
push 0x68aeac
push str.MaxSizeForOverlayCheck
push 0x61c550
push connect
mov dword [esp + 0x7344], edi
mov dword [0x7424e8], eax
call fcn.004d5820
test al, al
jne 0x4bdf69
push 0x30d400
push str.MaxSizeForOverlayCheck
push 0x61c550
push connect
mov dword [0x68aeac], 0x30d400
call fcn.004f48a0
jmp 0x4bdf86
mov eax, dword [0x68aeac]
cmp eax, 0x100000
je 0x4bdf7c
cmp eax, 0x13d620
jne 0x4bdf86
mov dword [0x68aeac], 0x30d400
push 0x748aa0
push str.CheckCABSfx
push 0x61c550
push connect
call fcn.004d5820
test al, al
jne 0x4bdfbe
push ebx
push str.CheckCABSfx
push 0x61c550
push connect
mov dword [0x748aa0], ebx
call fcn.004f48a0
mov esi, dword [esp + 0x38]
mov dword [esi], 2
cmp ebp, ebx
jne 0x4bdfed
cmp dword [esp + 0x80], ebx
jne 0x4bdfed
mov eax, dword [esp + 0xb0]
push eax
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x4be38b
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x18], ecx
mov dword [esi], 3
cmp ebp, ebx
je 0x4be032
cmp dword [esp + 0x80], ebx
jne 0x4be023
push 0x400
lea edx, [esp + 0x132c]
push edx
push ebp
call fcn.004e82a0
add esp, 0xc
jmp 0x4be032
push ebp
lea eax, [esp + 0x132c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x8c]
cmp eax, ebx
je 0x4be040
mov byte [eax], 0
mov eax, dword [esp + 0xc8]
cmp eax, ebx
je 0x4be04d
mov dword [eax], ebx
mov eax, dword [esp + 0xec]
cmp eax, ebx
je 0x4be05a
mov dword [eax], ebx
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x4be064
mov dword [eax], ebx
mov eax, dword [esp + 0x60]
cmp eax, ebx
je 0x4be06e
mov dword [eax], ebx
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x4be07b
mov dword [eax], ebx
mov eax, dword [esp + 0x7c]
cmp eax, ebx
je 0x4be085
mov dword [eax], ebx
mov eax, dword [esp + 0xf0]
cmp eax, ebx
je 0x4be092
mov dword [eax], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4be09c
mov dword [eax], ebx
mov eax, dword [esp + 0xbc]
cmp eax, ebx
je 0x4be0a9
mov dword [eax], ebx
mov eax, dword [esp + 0xf8]
cmp eax, ebx
je 0x4be0b6
mov dword [eax], ebx
mov eax, dword [esp + 0xd4]
cmp eax, ebx
je 0x4be0c3
mov dword [eax], ebx
mov eax, dword [esp + 0xa4]
cmp eax, ebx
je 0x4be0d0
mov dword [eax], ebx
mov eax, dword [esp + 0xe0]
cmp eax, ebx
je 0x4be0de
mov byte [eax], 0
mov eax, dword [esp + 0x104]
cmp eax, ebx
je 0x4be0eb
mov dword [eax], ebx
mov eax, dword [esp + 0xd0]
cmp eax, ebx
je 0x4be0f8
mov dword [eax], ebx
mov eax, dword [esp + 0x68]
cmp eax, ebx
je 0x4be102
mov dword [eax], ebx
mov eax, dword [esp + 0x98]
cmp eax, ebx
je 0x4be10f
mov dword [eax], ebx
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x4be119
mov dword [eax], ebx
mov eax, dword [esp + 0x94]
cmp eax, ebx
je 0x4be126
mov dword [eax], ebx
push 0x1000
lea ecx, [esp + 0x32c]
push 0xff
push ecx
call fcn.005dfd60
add esp, 0xc
cmp byte [esp + 0x1328], 0
mov byte [esp + 0x1327], 0
mov byte [esp + 0x1326], 0
mov dword [esi], 5
je 0x4be2be
lea edx, [esp + 0x1328]
push 0x5c
push edx
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4be185
lea esi, [esp + 0x1328]
jmp 0x4be186
inc esi
push str.scflist.txt
push esi
mov dword [esp + 0x4c], esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be38b
push str.hash.dat
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be38b
push ebx
push str.autorun
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, edi
je 0x4be1d4
mov dword [esp + 0x88], 1
lea eax, [esp + 0x1328]
push ebx
push eax
call fcn.004da790
mov ebp, eax
add esp, 8
mov dword [esp + 0x34], ebp
cmp ebp, ebx
je 0x4be2be
cmp byte [ebp + 1], 0
lea esi, [ebp + 1]
je 0x4be2be
push str..VIR
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4be222
mov dword [esp + 0x9c], 1
jmp 0x4be2a8
push str..EML
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4be23e
mov dword [esp + 0x48], 1
jmp 0x4be2a8
push esi
call fcn.004ad500
add esp, 4
test eax, eax
je 0x4be258
mov dword [esp + 0xd8], 1
jmp 0x4be2a8
push str..cpp
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be2a0
push 0x63e6fc
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be2a0
push 0x63e6f8
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be2a0
push 0x63e6ec
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4be2a8
mov dword [esp + 0x54], 1
push esi
call fcn.004af530
dec eax
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x38]
mov dword [ecx], 6
cmp dword [esp + 0x18], ebx
jne 0x4be411
mov ebp, dword [esp + 0x80]
push ebx
push 0x80
push 3
push ebx
push 3
push connect
cmp ebp, ebx
jne 0x4be3b2
lea edx, [esp + 0x1340]
push edx
call fcn.004e0400
add esp, 0x1c
mov dword [esp + 0x18], eax
cmp eax, edi
jne 0x4be411
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x1328]
push eax
call fcn.004e9d50
test eax, eax
je 0x4be36b
push ebx
call fcn.00503120
test eax, eax
je 0x4be36b
push ebx
push ebx
push ebx
call fcn.00504d70
test eax, eax
jne 0x4be36b
push ebx
push 0x80
push 3
push ebx
push 3
lea ecx, [esp + 0x133c]
push connect
push ecx
mov dword [esp + 0xa0], 1
call fcn.004e0400
add esp, 0x1c
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], edi
jne 0x4be411
cmp dword [esp + 0x84], 1
jne 0x4be384
call fcn.00504780
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp + 0x7398], ebx
je 0x4be3ab
mov esi, dword [esp + 0x90]
cmp esi, ebx
je 0x4be3ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x78]
mov dword [esi], eax
xor eax, eax
jmp 0x4c11e7
push ebp
call fcn.004e0530
add esp, 0x1c
mov dword [esp + 0x18], eax
cmp eax, edi
jne 0x4be411
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
call fcn.004e9e40
test eax, eax
je 0x4be36b
push ebx
call fcn.00503120
test eax, eax
je 0x4be36b
push ebx
push ebx
push ebx
call fcn.00504d70
test eax, eax
jne 0x4be36b
push ebx
push 0x80
push 3
push ebx
push 3
push connect
push ebp
mov dword [esp + 0xa0], 1
call fcn.004e0530
jmp 0x4be364
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push edx
mov dword [edi], 7
call esi
mov ebp, eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x20], ebp
cmp eax, ebx
je 0x4be440
mov dword [eax], 1
mov dword [edi], 8
cmp dword [esp + 0x5c], ebx
je 0x4be552
mov edi, dword [esp + 0x34]
cmp edi, ebx
je 0x4be552
cmp byte [edi + 1], 0
je 0x4be552
push str..HTML
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be4a0
push str..HTM
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4be4a0
push str..ASPX
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4be552
mov eax, dword [esp + 0x18]
push ebx
push eax
call esi
mov edi, eax
cmp edi, ebx
je 0x4be552
lea ecx, [edi + 1]
push ecx
call fcn.004d9470
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4be552
mov edx, dword [esp + 0x18]
push 1
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
mov ebp, eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x14], ebx
jbe 0x4be545
cmp byte [esi], 0
je 0x4be545
push ebx
push str._script
push esi
call fcn.004a3410
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4be53b
push ebx
push str._iframe
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4be545
mov ecx, dword [esp + 0x5c]
mov dword [ecx], 1
push esi
call fcn.005e0865
mov ebp, dword [esp + 0x24]
add esp, 4
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push ebx
push ebx
push edx
mov dword [edi], 9
call esi
push ebx
push ebx
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0xffe
lea edx, [esp + 0x334]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebp, 0x400
jbe 0x4be63e
cmp ebp, dword [0x68aeac]
ja 0x4be63e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x4be63e
movzx edx, byte [esp + 0x328]
push edx
call fcn.005e3ae6
add esp, 4
cmp eax, 0x4d
jne 0x4be63e
movzx eax, byte [esp + 0x329]
push eax
call fcn.005e3ae6
add esp, 4
cmp eax, 0x5a
jne 0x4be63e
mov eax, dword [esp + 0x364]
lea ecx, [ebp - 4]
cmp eax, ecx
ja 0x4be63e
cmp dword [esp + eax + 0x328], 0x4550
jne 0x4be63e
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xe8]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x104]
push ecx
push ebp
push edx
lea eax, [esp + 0x33c]
push eax
call fcn.004ad670
add esp, 0x18
mov dword [esp + 0x110], eax
mov dword [edi], 0xa
cmp dword [esp + 0x60], ebx
je 0x4be7e5
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jbe 0x4be7e5
mov bl, byte [esp + 0x328]
cmp ecx, 5
jb 0x4be69a
cmp byte [esp + 0x329], bl
jne 0x4be7e5
cmp byte [esp + 0x32a], bl
jne 0x4be7e5
cmp byte [esp + 0x32b], bl
jne 0x4be7e5
cmp byte [esp + 0x32c], bl
jne 0x4be7e5
cmp ecx, dword [esp + 0x20]
jne 0x4be6fa
push ecx
call fcn.005e20e4
mov edi, eax
add esp, 4
test edi, edi
je 0x4be7ae
mov ecx, dword [esp + 0x14]
movzx edx, bl
push ecx
push edx
push edi
call fcn.005dfd60
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x328]
mov esi, edi
cmp eax, 4
jb 0x4be777
jmp 0x4be6e0
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4be7a5
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4be6e0
jmp 0x4be777
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4be712
cmp word [eax], 0x5c
jne 0x4be712
cmp word [eax + 2], 0x5c
je 0x4be72e
cmp byte [esp + 0x1328], 0x5c
jne 0x4be7ae
cmp byte [esp + 0x1329], 0x5c
jne 0x4be7ae
test bl, bl
jne 0x4be7ae
push ecx
call fcn.005e20e4
mov edi, eax
add esp, 4
test edi, edi
je 0x4be7ae
mov edx, dword [esp + 0x14]
push edx
push 0
push edi
call fcn.005dfd60
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x328]
mov esi, edi
cmp eax, 4
jb 0x4be777
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4be7a5
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4be763
test eax, eax
je 0x4be79b
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4be7a5
cmp eax, 1
jbe 0x4be79b
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4be7a5
cmp eax, 2
jbe 0x4be79b
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4be7a5
mov ecx, dword [esp + 0x60]
mov dword [ecx], 1
push edi
call fcn.005e0865
add esp, 4
mov edx, dword [esp + 0x60]
cmp dword [edx], 1
jne 0x4be7e5
cmp dword [esp + 0xb0], 0
jne 0x4be7cb
lea eax, [esp + 0x18]
push eax
call fcn.004dca10
cmp dword [esp + 0x84], 1
jne 0x4be3ab
call fcn.00504780
xor eax, eax
jmp 0x4c11e7
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [ebp], 0xb
cmp eax, ebx
jbe 0x4be99b
mov byte [esp + eax + 0x328], bl
mov byte [esp + eax + 0x329], bl
mov cl, byte [esp + 0x328]
mov dl, byte [esp + 0x329]
xor edi, edi
cmp cl, 0xef
jne 0x4be89a
cmp dl, 0xbb
jne 0x4be904
cmp byte [esp + 0x32a], 0xbf
jne 0x4be904
lea ecx, [esp + 0x32b]
dec eax
push eax
mov edx, ecx
push edx
lea eax, [esp + 0x330]
push eax
mov dword [esp + 0x34], ecx
call fcn.005e4630
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp edx, ebx
jbe 0x4be880
mov al, byte [ecx]
inc edi
cmp al, 0x20
je 0x4be877
cmp al, 9
je 0x4be877
cmp al, 0xd
je 0x4be877
cmp al, 0xa
jne 0x4be87c
inc ecx
cmp edi, edx
jb 0x4be864
mov dword [esp + 0x28], ecx
cmp ecx, ebx
je 0x4be997
push ecx
call fcn.004dd6c0
add esp, 4
mov dword [esp + 0x6c], eax
jmp 0x4be99b
cmp cl, 0xff
jne 0x4be916
cmp dl, 0xfe
jne 0x4be904
cmp byte [esp + 0x32b], 0
jne 0x4be904
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x32e]
push edx
mov dword [esp + 0x64], ebx
call fcn.004da960
add esp, 8
test eax, eax
je 0x4be858
mov esi, dword [esp + 0x5c]
cmp esi, ebx
je 0x4be858
mov eax, 1
lea edx, [esp + 0x328]
mov dword [esp + 0xb8], eax
mov dword [esp + 0xcc], eax
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4be8f1
push esi
call fcn.005e0865
add esp, 4
lea eax, [esp + 0x328]
mov dword [esp + 0x28], eax
mov ecx, eax
jmp 0x4be85c
cmp cl, 0xfe
jne 0x4be904
cmp dl, 0xff
jne 0x4be904
cmp byte [esp + 0x32a], 0
jne 0x4be904
add eax, 2
push eax
call fcn.004d9470
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4be858
lea ecx, [esp + 0x32a]
push ecx
push esi
mov dword [esp + 0xc0], 2
mov dword [esp + 0xd4], 1
call fcn.004a0e50
lea edx, [esp + 0x330]
add esp, 8
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4be972
push esi
call fcn.005e0865
lea edx, [esp + 0x32c]
add esp, 4
mov dword [esp + 0x28], edx
mov ecx, edx
jmp 0x4be85c
mov dword [esp + 0x6c], ebx
mov eax, dword [esp + 0x34]
mov dword [ebp], 0xc
cmp eax, ebx
je 0x4be9ee
inc eax
cmp byte [eax], 0
je 0x4be9ee
lea ecx, [esp + 0xb4]
push ecx
push eax
call fcn.004af3c0
add esp, 8
test eax, eax
je 0x4be9f5
cmp byte [esp + 0x328], 0x4d
jne 0x4be9f5
cmp byte [esp + 0x329], 0x5a
jne 0x4be9f5
push str.MZ_EXE_DLL_File
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4be9f5
mov dword [esp + 0xb4], ebx
mov eax, dword [esp + 0x11c]
cmp eax, ebx
je 0x4bea09
mov ecx, dword [esp + 0xb4]
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [ebp], 0xd
cmp edx, 0x100
jb 0x4beb42
mov edi, dword [esp + 0x98]
cmp edi, ebx
je 0x4beb42
cmp dword [esp + 0xb4], ebx
je 0x4beb42
mov eax, 0x100
xor ecx, ecx
mov esi, dword [esp + ecx + 0x328]
cmp esi, dword [ecx + 0x748aa8]
jne 0x4beb40
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4bea43
cmp edx, 0x2a9
je 0x4beb40
push 0x100
lea edx, [esp + 0x228]
push ebx
push edx
mov dword [esp + 0xa4], ebx
call fcn.005dfd60
mov eax, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push 1
push ebx
push ebx
push eax
mov dword [esp + 0xb0], 1
call ebp
mov ecx, dword [esp + 0x18]
push 2
push ebx
push 0xffffff00
push ecx
mov esi, eax
call ebp
mov ecx, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x9c]
push edx
push 0x100
lea eax, [esp + 0x230]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push esi
push edx
call ebp
mov eax, dword [esp + 0x98]
mov ecx, 0x748aa8
lea esi, [esp + 0x224]
cmp eax, 4
jb 0x4beb14
lea ebx, [ebx]
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4beb40
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4beb00
cmp eax, ebx
je 0x4beb38
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4beb40
cmp eax, 1
jbe 0x4beb38
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4beb40
cmp eax, 2
jbe 0x4beb38
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4beb40
mov dword [edi], 1
jmp 0x4beb42
mov dword [edi], ebx
cmp dword [esp + 0x14], 0x40
mov ecx, dword [esp + 0x38]
mov dword [ecx], 0xe
mov ebp, 0x4c4355
jbe 0x4bec4c
cmp byte [esp + 0x328], 0x4d
jne 0x4bec4c
cmp byte [esp + 0x329], 0x5a
jne 0x4bec4c
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xec]
mov ebx, dword [esp + 0x2c]
lea edx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x80]
push eax
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ebx
lea eax, [esp + 0x30]
push eax
push ecx
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34c]
push ecx
call fcn.004a3700
add esp, 0x28
cmp dword [esp + 0x110], 0
je 0x4bebf9
mov eax, dword [esp + 0xfc]
cmp eax, 7
je 0x4bebf0
cmp eax, 0xa
je 0x4bebf0
cmp eax, 0xb
je 0x4bebf0
cmp eax, 2
jne 0x4bebf9
cmp dword [esp + 0x20], 0x100000
ja 0x4bebf9
mov dword [esp + 0x120], ebp
jmp 0x4bec50
cmp dword [0x748aa0], 0
je 0x4bec15
cmp dword [esp + 0xe8], 1
jne 0x4bec15
mov dword [esp + 0x120], ebp
jmp 0x4bec50
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4bec39
inc eax
cmp byte [eax], 0
je 0x4bec50
push eax
call fcn.004adc70
add esp, 4
test eax, eax
je 0x4bec50
mov dword [esp + 0x120], ebp
jmp 0x4bec50
cmp dword [esp + 0x20], 0xb00000
jae 0x4bec50
mov dword [esp + 0x120], ebp
jmp 0x4bec50
mov ebx, dword [esp + 0x2c]
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x38]
mov dword [esi], 0xf
jbe 0x4becbd
cmp byte [esp + 0x328], 0x4c
jne 0x4becbd
cmp byte [esp + 0x329], 0
jne 0x4becbd
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x8c]
lea edx, [esp + 0x1328]
push edx
mov edx, dword [esp + 0x98]
push eax
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ebx
lea eax, [esp + 0x30]
push eax
push ecx
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34c]
push ecx
call fcn.004a3b90
add esp, 0x28
cmp dword [esp + 0x14], 0
mov dword [esi], 0x10
jbe 0x4bede4
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4bed8d
cmp byte [edi + 1], 0
je 0x4bed8d
push 4
push str..PST
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4bf03a
push 4
push str..OST
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4bf03a
push 5
push str..MBOX
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4bf03a
push 4
push str..MSF
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4bf03a
push 4
push str..IMM
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4bf03a
mov al, byte [esp + 0x328]
cmp al, 0x21
jne 0x4bf009
cmp byte [esp + 0x329], 0x42
jne 0x4bed8d
cmp byte [esp + 0x32a], 0x44
jne 0x4bed8d
cmp byte [esp + 0x32b], 0x4e
je 0x4bf03a
cmp dword [esp + 0x14], 0
jbe 0x4bede4
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4bede4
push str.PE1BSUw
call fcn.004dd6c0
push eax
push str.PE1BSUw
push edi
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4bede4
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x128], ebp
call fcn.004a12b0
add esp, 8
test ebx, ebx
je 0x4beddc
mov dword [ebx], 1
mov dword [esp + 0x14], 0
cmp dword [esp + 0x14], 0x4c
mov dword [esi], 0x11
jbe 0x4bef9b
cmp byte [esp + 0x328], 0
je 0x4bef9b
cmp dword [esp + 0x9c], 0
jne 0x4bef9b
lea edx, [esp + 0x328]
push str.regedit
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4bef9b
lea eax, [esp + 0x328]
push str.Windows_Registry
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4bef9b
lea ecx, [esp + 0x328]
push ecx
call fcn.0049ea20
add esp, 4
test eax, eax
jne 0x4bef9b
mov edx, dword [esp + 0x14]
inc edx
push edx
call fcn.005e20e4
mov edi, eax
add esp, 4
test edi, edi
je 0x4bef9b
mov eax, dword [esp + 0x14]
inc eax
push eax
xor ebp, ebp
push ebp
push edi
call fcn.005dfd60
push 0x4000
lea ecx, [esp + 0x3338]
push ebp
push ecx
call fcn.005dfd60
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x344]
push eax
push edi
call fcn.004d5c40
add esp, 0x24
lea ecx, [esp + 0x73]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x9c]
push edx
push edi
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xac], ebp
mov dword [esp + 0xb4], ebp
call fcn.004d5cb0
mov esi, eax
cmp esi, ebp
je 0x4bef53
push esi
call fcn.004dd6c0
push esi
mov ebx, eax
call fcn.004e1290
add esp, 8
test eax, eax
je 0x4bef24
cmp byte [esi], 0
je 0x4bef24
push ebx
lea eax, [esp + ebp + 0x332c]
push eax
push esi
call fcn.004e2fc0
add esp, 0xc
add ebp, eax
lea ecx, [esp + 0x73]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x9c]
push edx
push 0
call fcn.004d5cb0
mov esi, eax
test esi, esi
jne 0x4beef6
cmp byte [esp + 0x3328], 0
je 0x4bef85
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x332c]
push ecx
lea edx, [esp + 0x330]
push edx
mov dword [esp + 0xf0], 1
call fcn.005e13c0
add esp, 0xc
push edi
call fcn.005e0865
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
add esp, 4
mov ebp, 0x4c4355
cmp dword [esp + 0x14], 0
mov dword [esi], 0x12
jbe 0x4bf06d
cmp byte [esp + 0x328], 0
je 0x4bf06d
mov edi, dword [esp + 0xac]
test edi, edi
jne 0x4bf074
mov eax, dword [0x742490]
push edi
push edi
push eax
lea ecx, [esp + 0x334]
push ecx
call fcn.004bb0e0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4bf074
cmp dword [esp + 0x20], 0x100000
jb 0x4bf074
cmp dword [esp + 0x48], edi
jne 0x4bf074
mov edi, 1
jmp 0x4bf074
cmp al, 0xff
jne 0x4bed8d
cmp byte [esp + 0x329], al
jne 0x4bed8d
cmp byte [esp + 0x32a], 1
jne 0x4bed8d
cmp byte [esp + 0x32b], 0
jne 0x4bed8d
push 0x62e0ac
lea edx, [esp + 0x124]
push edx
mov dword [esp + 0xb4], 1
mov dword [esp + 0x38], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x3c], 1
jmp 0x4beddc
mov edi, dword [esp + 0xac]
mov dword [esi], 0x13
test edi, edi
jne 0x4bf0ab
cmp byte [esp + 0x328], 0
je 0x4bf0d6
lea edx, [esp + 0x328]
push str.From
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bf0d6
cmp dword [esp + 0x20], 0x100000
jb 0x4bf0d6
push 0x62e0ac
lea eax, [esp + 0x124]
push eax
mov dword [esp + 0x38], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x14], 0
mov dword [esp + 0x3c], 1
mov eax, dword [esp + 0x14]
mov dword [esi], 0x14
test eax, eax
jbe 0x4bf99e
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
push eax
push edi
push ecx
lea edx, [esp + 0x334]
push edx
call fcn.004a5250
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
je 0x4bf358
mov edi, dword [esp + esi + 0x342]
push 0x104
lea eax, [esp + 0x228]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
cmp edi, 0x103
jae 0x4bf347
push edi
lea ecx, [esp + esi + 0x34a]
push ecx
lea edx, [esp + 0x22c]
push edx
call fcn.005e13c0
lea eax, [esp + 0x230]
push 0x5c
push eax
call fcn.005e0940
add esp, 0x14
test eax, eax
jne 0x4bf347
lea ecx, [esp + 0x224]
push 0x2f
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4bf347
lea edx, [esp + 0x224]
push 0x2e
push edx
call fcn.005e0a00
mov esi, eax
add esp, 8
test esi, esi
je 0x4bf347
push str..SCR
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..PIF
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..VBE
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..VBS
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..COM
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..CPL
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..WSF
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..HTA
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..CMD
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..URL
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..CHM
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..SHTML
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push 0x628400
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf2dc
push str..JSON
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf2dc
push str..JSP
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf336
push 0x6283e8
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..JSE
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..JAR
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push str..LNK
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf336
push 0x6283c8
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf347
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x4bf347
mov dword [eax], 1
mov edi, 1
mov dword [esp + 0xdc], edi
jmp 0x4bf9a2
cmp byte [esp + 0x328], 0
je 0x4bf3b2
push 4
lea eax, [esp + 0x32c]
push 0x6402c4
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bf385
lea edi, [eax + 1]
jmp 0x4bf9a2
cmp byte [esp + 0x328], 0
je 0x4bf3b2
push 4
lea ecx, [esp + 0x32c]
push str.MSCF
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bf3b2
lea edi, [eax + 1]
jmp 0x4bf9a2
push 2
lea edx, [esp + 0x32c]
push 0x634a04
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bf3e9
cmp byte [esp + 0x32a], 0xbc
jne 0x4bf3e9
cmp byte [esp + 0x32b], 0xaf
jne 0x4bf3e9
lea edi, [eax + 1]
jmp 0x4bf9a2
cmp byte [esp + 0x328], 0xfd
jne 0x4bf41f
push 4
lea eax, [esp + 0x32d]
push str.7zXZ
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bf41f
cmp byte [esp + 0x32d], al
jne 0x4bf41f
lea edi, [eax + 1]
jmp 0x4bf9a2
cmp byte [esp + 0x32f], 0
je 0x4bf6af
push 7
lea ecx, [esp + 0x333]
push str.ACE
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bf6af
mov dl, byte [esp + 0x37e]
mov dword [esp + 0x5c], eax
push 0x104
lea edi, [eax + 1]
mov al, byte [esp + 0x383]
lea ecx, [esp + 0x228]
push 0
push ecx
mov byte [esp + 0x68], dl
mov byte [esp + 0x69], al
call fcn.005dfd60
mov eax, dword [esp + 0x68]
add esp, 0xc
test eax, eax
je 0x4bf9a2
cmp eax, 0x103
jae 0x4bf9a2
push eax
lea edx, [esp + 0x384]
push edx
lea eax, [esp + 0x22c]
push eax
call fcn.005e13c0
lea ecx, [esp + 0x230]
push 0x5c
push ecx
call fcn.005e0940
add esp, 0x14
test eax, eax
jne 0x4bf9a2
lea edx, [esp + 0x224]
push 0x2f
push edx
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4bf9a2
lea eax, [esp + 0x224]
push 0x2e
push eax
call fcn.005e0a00
mov esi, eax
add esp, 8
test esi, esi
je 0x4bf9a2
push str..SCR
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..PIF
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..VBE
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..VBS
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..COM
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..CPL
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..WSF
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..HTA
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..CMD
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..URL
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..CHM
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..SHTML
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push 0x628400
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf63b
push str..JSON
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf63b
push str..JSP
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf699
push 0x6283e8
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..JSE
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..JAR
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push str..LNK
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bf699
push 0x6283c8
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bf9a2
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x4bf9a2
mov dword [eax], edi
jmp 0x4bf9a2
cmp byte [esp + 0x328], 0x1f
jne 0x4bf6cd
cmp byte [esp + 0x329], 0x8b
jne 0x4bf6cd
mov edi, 1
jmp 0x4bf9a2
cmp byte [esp + 0x32a], 0x2d
jne 0x4bf718
cmp byte [esp + 0x32e], 0x2d
jne 0x4bf718
mov al, byte [esp + 0x32b]
cmp al, 0x6c
jne 0x4bf705
mov al, byte [esp + 0x32c]
cmp al, 0x68
je 0x4bf6fb
cmp al, 0x7a
jne 0x4bf718
mov edi, 1
jmp 0x4bf9a2
cmp al, 0x70
jne 0x4bf718
mov al, byte [esp + 0x32c]
cmp al, 0x63
je 0x4bf6fb
cmp al, 0x6d
je 0x4bf6fb
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004a0e20
add esp, 4
test eax, eax
je 0x4bf751
push 0x61b02c
lea edx, [esp + 0x124]
push edx
mov dword [esp + 0x38], 0x3ea
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x3c], 1
jmp 0x4bf996
cmp dword [esp + 0x14], 0
jbe 0x4bf99e
cmp dword [esp + 0x3c], 0
jne 0x4bf799
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0xa4]
push eax
mov eax, dword [esp + 0x28]
push edi
push ecx
push ebx
lea edx, [esp + 0x2c]
push edx
push eax
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x348]
push eax
call fcn.004a3450
add esp, 0x24
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x4bf99e
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x68]
push edx
push ecx
lea edx, [esp + 0xb0]
push edx
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x68]
push ecx
push edx
push eax
lea eax, [esp + 0x344]
push eax
mov dword [esp + 0xc4], 0
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4bf99e
cmp byte [esp + 0x328], 0x47
jne 0x4bf815
cmp byte [esp + 0x329], 0x49
jne 0x4bf815
cmp byte [esp + 0x32a], 0x46
jne 0x4bf815
mov dword [esp + 0x120], ebp
jmp 0x4bf97a
mov esi, dword [esp + 0xa4]
test esi, esi
jbe 0x4bf85a
lea ecx, [esp + esi + 0x328]
push 0x641ac8
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bf85a
lea edx, [esp + 0x328]
push esi
push edx
call fcn.0049eb30
add esp, 8
test eax, eax
je 0x4bf85a
mov dword [esp + 0x120], ebp
jmp 0x4bf97a
mov al, byte [esp + 0x328]
cmp al, 0xca
jne 0x4bf8bc
cmp byte [esp + 0x329], 0xfe
jne 0x4bf90c
cmp byte [esp + 0x32a], 0xba
jne 0x4bf90c
cmp byte [esp + 0x32b], 0xbe
jne 0x4bf90c
mov eax, dword [str.MacBinary]
mov ecx, dword [0x63e70c]
mov dx, word [0x63e710]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov word [esp + 0x128], dx
jmp 0x4bf97a
cmp al, 0xce
je 0x4bf8c4
cmp al, 0xcf
jne 0x4bf90c
cmp byte [esp + 0x329], 0xfa
jne 0x4bf90c
cmp byte [esp + 0x32a], 0xed
jne 0x4bf90c
cmp byte [esp + 0x32b], 0xfe
jne 0x4bf90c
mov eax, dword [str.MacBinary]
mov ecx, dword [0x63e70c]
mov dx, word [0x63e710]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov word [esp + 0x128], dx
jmp 0x4bf97a
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x32c]
push ecx
call fcn.004bb3b0
add esp, 8
test eax, eax
jne 0x4bf952
mov al, byte [esp + 0x32b]
cmp al, 0xce
je 0x4bf934
cmp al, 0xcf
jne 0x4bf97a
cmp byte [esp + 0x32a], 0xfa
jne 0x4bf97a
cmp byte [esp + 0x329], 0xed
jne 0x4bf97a
cmp byte [esp + 0x328], 0xfe
jne 0x4bf97a
mov cx, word [0x63e710]
mov eax, dword [0x63e70c]
mov edx, dword [str.MacBinary]
mov word [esp + 0x128], cx
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], edx
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.004a12b0
add esp, 8
test ebx, ebx
je 0x4bf996
mov dword [ebx], 1
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x74]
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x38]
mov dword [esi], 0x15
jbe 0x4bf9ee
test edi, edi
jne 0x4bf9ee
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x38]
push eax
push ebx
lea ecx, [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x348]
push edx
call fcn.004a1620
add esp, 0x24
cmp dword [esp + 0x14], 0
mov dword [esi], 0x16
jbe 0x4bfa45
test edi, edi
jne 0x4bfa45
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x44]
push edx
push ebx
lea eax, [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x144]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x354]
push ecx
call fcn.004bb450
add esp, 0x30
cmp dword [esp + 0x14], 0
mov dword [esi], 0x17
jbe 0x4bfde2
mov ebp, dword [esp + 0x14]
push 0
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x334]
push ecx
call fcn.004aca30
mov esi, eax
add esp, 0x10
mov dword [esp + 0x40], esi
mov edi, 1
test esi, esi
jne 0x4bfd31
mov ecx, dword [esp + 0x28]
push edi
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x128]
push eax
push ecx
call fcn.004aca30
mov esi, eax
add esp, 0x10
mov dword [esp + 0x40], esi
test esi, esi
jne 0x4bfd31
push 2
lea edx, [esp + 0x32c]
push 0x63eddc
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfae4
cmp byte [esp + 0x32a], 3
jne 0x4bfae4
cmp byte [esp + 0x32b], 4
je 0x4bfaee
cmp dword [esp + 0xdc], 0
je 0x4bfb10
push 0x62f418
lea eax, [esp + 0x124]
mov esi, edi
push eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x328], 0
je 0x4bfba2
push 4
lea ecx, [esp + 0x32c]
push 0x6402c4
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfb5b
push 0x63ad98
lea edx, [esp + 0x124]
mov esi, edi
push edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x328], 0
je 0x4bfba2
push 4
lea eax, [esp + 0x32c]
push str.MSCF
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfba2
push 0x63b0d8
lea ecx, [esp + 0x124]
mov esi, edi
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
push 2
lea edx, [esp + 0x32c]
push 0x634a04
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfbf3
cmp byte [esp + 0x32a], 0xbc
jne 0x4bfbf3
cmp byte [esp + 0x32b], 0xaf
jne 0x4bfbf3
push 0x634a04
lea eax, [esp + 0x124]
mov esi, edi
push eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x328], 0xfd
jne 0x4bfc43
push 4
lea ecx, [esp + 0x32d]
push str.7zXZ
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfc43
cmp byte [esp + 0x32d], al
jne 0x4bfc43
push 0x641ac4
lea edx, [esp + 0x124]
mov esi, edi
push edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x32f], 0
je 0x4bfc8a
push 7
lea eax, [esp + 0x333]
push str.ACE
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bfc8a
push 0x63ab8c
lea ecx, [esp + 0x124]
mov esi, edi
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x328], 0x1f
jne 0x4bfcc0
cmp byte [esp + 0x329], 0x8b
jne 0x4bfcc0
push 0x63a104
lea edx, [esp + 0x124]
mov esi, edi
push edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp byte [esp + 0x32a], 0x2d
jne 0x4bfd8e
cmp byte [esp + 0x32e], 0x2d
jne 0x4bfd8e
mov al, byte [esp + 0x32b]
cmp al, 0x6c
jne 0x4bfd1c
mov al, byte [esp + 0x32c]
cmp al, 0x68
je 0x4bfcfa
cmp al, 0x7a
jne 0x4bfd8e
push 0x63aaa8
lea eax, [esp + 0x124]
mov esi, edi
push eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
cmp al, 0x70
jne 0x4bfd8e
mov al, byte [esp + 0x32c]
cmp al, 0x63
je 0x4bfcfa
cmp al, 0x6d
je 0x4bfcfa
jmp 0x4bfd8e
lea ecx, [esp + 0x120]
push 0x641924
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x4bfd8e
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4bfd8e
push eax
call fcn.004b0b70
add esp, 4
test eax, eax
je 0x4bfd8e
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x128], 0x4c4355
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x4bfd86
mov dword [eax], edi
mov dword [esp + 0x14], 0
test esi, esi
jne 0x4bfded
mov ecx, dword [esp + 0x28]
cmp byte [ecx], 0x7b
jne 0x4bfded
push 0x6410f8
call fcn.004dd6c0
mov edx, dword [esp + 0x2c]
push eax
inc edx
push 0x6410f8
push edx
call fcn.0049e940
add esp, 0x10
test eax, eax
jne 0x4bfded
push 0x62f42c
lea eax, [esp + 0x124]
mov esi, 1
push eax
mov dword [esp + 0x108], esi
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4bfded
mov ebp, dword [esp + 0x118]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov dword [ecx], 0x18
test esi, esi
je 0x4bfeb7
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x64]
push edx
push eax
push ecx
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xbc]
push ecx
push edx
mov edx, dword [esp + 0x114]
push 0
push eax
mov eax, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x48]
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
push eax
mov eax, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x135c]
push edx
mov edx, dword [esp + 0xa0]
push eax
lea ecx, [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0xbc]
push edx
lea eax, [esp + 0x144]
push eax
push ecx
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
push edi
lea ecx, [esp + 0x74]
push ecx
push ebx
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x390]
push ecx
call fcn.004bc6a0
add esp, 0x6c
jmp 0x4bff53
cmp dword [esp + 0x48], 0
mov ebx, dword [esp + 0x24]
je 0x4bff4f
cmp dword [ebx], 0
jne 0x4bff4f
mov esi, dword [esp + 0x7c]
test esi, esi
je 0x4bff4f
cmp dword [esi], 0
jne 0x4bff4f
cmp dword [esp + 0x28], 0
je 0x4bff4f
mov edx, dword [esp + 0x28]
cmp byte [edx], 0
je 0x4bff4f
mov edi, edx
push str.HELO_btamail.net.cn
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bff4f
push eax
push str.is_comming
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bff4f
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esi], 2
mov dword [esp + 0x128], 0x4c4d45
call fcn.004a12b0
mov edi, dword [esp + 0x34]
add esp, 8
test edi, edi
je 0x4bff45
mov dword [edi], 1
mov dword [esp + 0x14], 0
jmp 0x4bff53
mov edi, dword [esp + 0x2c]
cmp dword [esp + 0x14], 0
mov ecx, dword [esp + 0x38]
mov dword [ecx], 0x19
jbe 0x4c050a
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x114]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x34]
push ecx
push ebx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x350]
push ecx
call fcn.004a2490
add esp, 0x2c
cmp dword [esp + 0x30], 0
jne 0x4c050a
mov esi, dword [esp + 0x14]
cmp esi, 0x100
jbe 0x4c001a
cmp dword [esp + 0xa8], 0
jne 0x4c001a
lea edx, [esp + 0x328]
push esi
push edx
call fcn.0049eb30
add esp, 8
mov dword [esp + 0xa8], 1
cmp eax, 1
jne 0x4c001a
mov eax, dword [str.Mangled_EXE]
mov ecx, dword [0x6419d4]
mov edx, dword [0x6419d8]
mov dword [esp + 0x120], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x124], ecx
mov dword [esp + 0x128], edx
push eax
jmp 0x4c0380
cmp byte [esp + 0x32c], 0x20
jne 0x4c009f
cmp byte [esp + 0x32d], 0
jne 0x4c009f
cmp byte [esp + 0x32e], 0
jne 0x4c009f
cmp byte [esp + 0x32f], 0
jne 0x4c009f
cmp byte [esp + 0x330], 0xff
jne 0x4c009f
cmp byte [esp + 0x331], 0xff
jne 0x4c009f
cmp byte [esp + 0x332], 0
jne 0x4c009f
cmp byte [esp + 0x333], 0
jne 0x4c009f
push esi
lea ecx, [esp + 0x32c]
push 0x641ac8
push ecx
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4c037b
mov dword [esp + 0x30], 0x8f
push 0x641aa0
jmp 0x4c04fc
push str.Standard_Jet
call fcn.004dd6c0
push eax
lea ecx, [esp + 0x334]
push str.Standard_Jet
push ecx
call fcn.0049e940
add esp, 0x10
test eax, eax
je 0x4c04cd
push str.Jet_DB
call fcn.004dd6c0
push eax
lea edx, [esp + 0x339]
push str.Jet_DB
push edx
call fcn.0049e940
add esp, 0x10
test eax, eax
je 0x4c04cd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4c02c7
mov eax, esi
push 0x23
push eax
call fcn.005e0940
mov esi, eax
add esp, 8
test esi, esi
je 0x4c02c3
push 8
push str.include
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4c0166
push 3
push 0x641a78
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4c0166
push 7
push str.define
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4c0166
push 7
push str.pragma
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4c02c3
cmp dword [esp + 0x58], 0
jne 0x4c01ba
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x78]
push 0
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push eax
push ecx
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c01ba
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.004a12b0
add esp, 8
mov dword [esp + 0x14], 0
jmp 0x4c050a
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x14]
mov esi, 0x1000
cmp eax, 0x1000
ja 0x4c01d0
mov esi, eax
cmp eax, 0x30
jbe 0x4c029b
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push eax
mov dword [esp + 0x60], 0
mov dword [esp + 0xb0], 1
call ebx
mov edx, dword [esp + 0x18]
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edx
mov edi, eax
call ebx
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x54]
push eax
push esi
lea ecx, [esp + 0x2334]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
push 0
push 0
push edi
push eax
call ebx
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x58]
push eax
push 0
push 0
push ecx
push edx
lea eax, [esp + 0x2344]
push eax
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c029b
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x4c028a
mov dword [eax], 1
mov dword [esp + 0x14], 0
mov ebx, edx
mov edi, eax
jmp 0x4c050a
push 0x641a64
lea eax, [esp + 0x124]
push eax
mov dword [esp + 0x38], 0x5a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
jmp 0x4c050a
mov esi, dword [esp + 0x28]
cmp byte [esi], 0x2f
jne 0x4c050a
mov al, byte [esi + 1]
cmp al, 0x2a
je 0x4c02df
cmp al, 0x2f
jne 0x4c050a
cmp dword [esp + 0x34], 0
je 0x4c0346
mov ecx, dword [esp + 0x34]
push 0x628400
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c032c
mov edx, dword [esp + 0x34]
push str..JSON
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c032c
mov eax, dword [esp + 0x34]
push str..JSP
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c050a
mov ecx, dword [esp + 0x34]
push str..CSS
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c050a
cmp dword [esp + 0x58], 0
jne 0x4c03a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x78]
push 0
lea edx, [esp + 0x68]
push edx
push eax
push ecx
push esi
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c03a0
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.004a12b0
add esp, 8
test edi, edi
je 0x4c0393
mov dword [edi], 1
mov dword [esp + 0x14], 0
jmp 0x4c050a
mov eax, dword [esp + 0x6c]
push eax
push 0x641a54
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c03c8
mov dword [esp + 0x108], 1
jmp 0x4c050a
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x14]
mov esi, 0x1000
cmp eax, 0x1000
ja 0x4c03de
mov esi, eax
cmp eax, 0x30
jbe 0x4c04a8
mov ecx, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ecx
mov dword [esp + 0x60], 0
mov dword [esp + 0xb0], 1
call ebx
push 2
push 0
mov edx, esi
neg edx
mov edi, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call ebx
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x54]
push ecx
push esi
lea edx, [esp + 0x2334]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x18]
push 0
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x58]
push ecx
push 0
push 0
push edx
push eax
lea ecx, [esp + 0x2344]
push ecx
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c04a8
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x4c0498
mov dword [eax], 1
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov edi, eax
jmp 0x4c050a
push str.Source_File
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x38], 0x5a
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
jmp 0x4c050a
cmp byte [esp + 0x33c], 0
jne 0x4c04ef
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.004a12b0
add esp, 8
mov dword [esp + 0x14], 0
jmp 0x4c050a
mov dword [esp + 0x30], 0x4c
push str.JET_DB
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp byte [esp + 0x328], 0x4d
jne 0x4c0525
cmp byte [esp + 0x329], 0x5a
jne 0x4c0525
mov eax, 1
cmp dword [esp + 0x14], 0
mov ecx, dword [esp + 0x38]
mov dword [ecx], 0x1a
jbe 0x4c0798
cmp dword [esp + 0x30], 0
jne 0x4c0798
test eax, eax
jne 0x4c0798
lea edx, [esp + 0x50]
push edx
push edi
mov dword [esp + 0x58], eax
lea eax, [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x130]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x340]
push eax
call fcn.004a1bc0
mov eax, dword [esp + 0x6c]
add esp, 0x1c
test eax, eax
jne 0x4c0779
cmp dword [esp + 0x3c], eax
jne 0x4c06b2
cmp dword [esp + 0x108], eax
jne 0x4c0636
mov esi, dword [esp + 0x28]
push 4
push 0x641a54
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4c0636
push str.REGEDIT
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4c0636
push str.Windows_Registry
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4c0636
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
push ecx
push 0x20
push 0x3b
push edx
push esi
call fcn.004a1180
add esp, 0x14
cmp eax, 0x20
jge 0x4c0636
cmp dword [esp + 0x58], 0
jne 0x4c06b2
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x78]
push 0
lea eax, [esp + 0x68]
push eax
push ecx
push edx
push esi
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c06b2
mov eax, dword [esp + 0x14]
mov dword [esp + 0x120], 0x45534a
cmp eax, 0x100
jbe 0x4c066c
cmp dword [esp + 0xa8], 0
jne 0x4c066c
push eax
lea eax, [esp + 0x32c]
push eax
call fcn.0049eb30
add esp, 8
cmp eax, 1
je 0x4c0686
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4c0691
push 0x6283c8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c0691
mov dword [esp + 0x120], 0x4c4355
lea ecx, [esp + 0x1c]
push ecx
push ebx
call fcn.004a12b0
add esp, 8
test edi, edi
je 0x4c0798
mov dword [edi], 1
jmp 0x4c0798
push str.etQhsockTS
call fcn.004dd6c0
add eax, 0xf6
add esp, 4
cmp dword [esp + 0x14], eax
jbe 0x4c0798
xor edi, edi
mov bl, 0x51
jmp 0x4c06e0
cmp byte [esp + edi + 0x328], 0x65
lea esi, [esp + edi + 0x328]
jne 0x4c0719
cmp byte [esi + 1], 0x74
jne 0x4c0719
cmp byte [esi + 2], bl
jne 0x4c0719
push str.etQhsockTS
call fcn.004dd6c0
push eax
push str.etQhsockTS
push esi
call fcn.004dd670
add esp, 0x10
test eax, eax
je 0x4c0724
inc edi
cmp edi, 0xf6
jl 0x4c06e0
jmp 0x4c0798
mov eax, dword [0x641a20]
mov ecx, dword [0x641a24]
mov edx, dword [str.Witty_Packet]
mov dword [esp + 0x124], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x128], ecx
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x124], edx
mov dl, byte [0x641a28]
push ecx
mov byte [esp + 0x134], dl
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x4c077e
mov dword [eax], 1
jmp 0x4c077e
cmp eax, 1
jne 0x4c0798
mov eax, dword [esp + 0x68]
mov dword [esp + 0x14], 0
test eax, eax
je 0x4c0832
mov dword [eax], 1
cmp dword [esp + 0x68], 0
je 0x4c0832
mov edx, dword [esp + 0x68]
cmp dword [edx], 1
jne 0x4c0832
cmp dword [esp + 0x1c], 0
jne 0x4c0832
cmp dword [esp + 0x34], 0
je 0x4c0832
mov eax, dword [esp + 0x34]
cmp byte [eax + 1], 0
je 0x4c0832
mov esi, eax
push str..PART
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c0800
push str..TMP
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c0800
push str..crdownload
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c0832
cmp dword [esp + 0x20], 0x190
jae 0x4c0832
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
je 0x4c082a
mov dword [eax], 1
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov dword [edi], 0x1b
test eax, eax
jbe 0x4c0883
cmp dword [esp + 0x30], 0
jne 0x4c0883
cmp dword [esp + 0x1c], 0
jne 0x4c0883
cmp eax, 0x14
jbe 0x4c0883
mov ecx, dword [esp + 0x24]
push ebx
lea eax, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x33c]
push ecx
call fcn.004a1370
add esp, 0x18
cmp dword [esp + 0x14], 0
mov dword [edi], 0x1c
jbe 0x4c0a2c
cmp dword [esp + 0x30], 0
jne 0x4c0a2c
cmp dword [esp + 0x1c], 0
jne 0x4c0a2c
mov esi, dword [esp + 0x3c]
test esi, esi
jne 0x4c0a30
mov cl, byte [esp + 0x328]
cmp cl, 0x82
jne 0x4c08cd
mov al, byte [esp + 0x329]
test al, al
jmp 0x4c0906
cmp cl, 0x88
je 0x4c08c2
mov al, byte [esp + 0x329]
cmp cl, 0x81
jne 0x4c08f6
cmp al, 0xc6
jne 0x4c0920
cmp byte [esp + 0x32a], 7
jne 0x4c0920
cmp byte [esp + 0x32b], 1
jmp 0x4c091a
cmp cl, 0x5c
jne 0x4c08ff
cmp al, 0xe
jmp 0x4c0906
cmp cl, 0xac
jne 0x4c0920
cmp al, 0xe9
jne 0x4c0920
cmp byte [esp + 0x32a], 0
jne 0x4c0920
cmp byte [esp + 0x32b], 0
je 0x4c09d7
cmp byte [esp + 0x32c], 0xe9
jne 0x4c094c
cmp byte [esp + 0x32d], 0xc6
jne 0x4c094c
cmp byte [esp + 0x32e], 1
jne 0x4c094c
cmp byte [esp + 0x32f], 0x9c
je 0x4c09d7
cmp cl, 0xbd
jne 0x4c0969
cmp al, 0x11
jne 0x4c0976
cmp byte [esp + 0x32a], 0xa5
jne 0x4c0997
cmp byte [esp + 0x32b], 0x55
jmp 0x4c0995
cmp cl, 0x8b
jne 0x4c09fd
cmp al, 0x29
je 0x4c09d7
cmp al, 0x45
jne 0x4c098e
cmp byte [esp + 0x32a], 0x4c
jne 0x4c098e
cmp byte [esp + 0x32b], 0x46
je 0x4c09d7
cmp cl, 0xf8
jne 0x4c0997
cmp al, 0x94
je 0x4c09d7
cmp dword [esp + 0x58], 0
jne 0x4c0a30
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x20]
push 0
lea edx, [esp + 0x68]
push edx
push eax
push ecx
lea edx, [esp + 0x344]
push edx
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4c0a30
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.004a12b0
add esp, 8
test ebx, ebx
je 0x4c09f3
mov dword [ebx], 1
mov dword [esp + 0x14], 0
jmp 0x4c0a30
cmp cl, 0x83
jne 0x4c0a09
cmp al, 0xec
jmp 0x4c0974
cmp cl, 0xe9
je 0x4c09d7
cmp cl, 0x45
jne 0x4c0976
cmp al, 0x4c
jne 0x4c0976
cmp byte [esp + 0x32a], 0x46
jmp 0x4c0995
mov esi, dword [esp + 0x3c]
cmp dword [esp + 0x14], 0
mov dword [edi], 0x1d
jbe 0x4c0a7d
cmp dword [esp + 0x88], 0
je 0x4c0a7d
cmp dword [esp + 0x30], 0
jne 0x4c0a7d
cmp dword [esp + 0x1c], 0
jne 0x4c0a7d
test esi, esi
jne 0x4c0a7d
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.004a12b0
add esp, 8
test ebx, ebx
je 0x4c0a75
mov dword [ebx], 1
mov dword [esp + 0x14], 0
lea ecx, [ebp - 1]
mov dword [edi], 0x1e
cmp ecx, 0x7fe
ja 0x4c0ae2
cmp dword [esp + 0x1c], 0
jne 0x4c0ae2
push 2
push ebp
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x334]
push eax
mov byte [esp + 0x70], 0xeb
mov byte [esp + 0x71], 0x72
call fcn.004f5bd0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4c0ae2
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004a12b0
xor eax, eax
add esp, 8
cmp ebx, eax
je 0x4c0ada
mov dword [ebx], 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
mov dword [edi], 0x1f
test ecx, ecx
jbe 0x4c0cfc
cmp dword [esp + 0x1c], 0
jne 0x4c0cf5
cmp dword [esp + 0xa0], 0
jne 0x4c0cf5
test esi, esi
jne 0x4c0cf5
cmp dword [esp + 0x54], esi
jne 0x4c0cf5
cmp dword [esp + 0x114], esi
jne 0x4c0cf5
mov eax, dword [esp + 0x20]
sub eax, ecx
cmp eax, 0x30
jbe 0x4c0cf5
mov dword [esp + 0x3c], esi
mov esi, 0xc00
cmp eax, 0xc00
ja 0x4c0b4d
mov esi, eax
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push eax
call ebp
mov edx, dword [esp + 0x18]
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edx
mov edi, eax
call ebp
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x1734]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
push 0
push 0
push edi
push eax
call ebp
cmp dword [esp + 0xcc], 1
jne 0x4c0cb5
mov eax, dword [esp + 0x3c]
xor esi, esi
mov byte [esp + eax + 0x1727], 0
mov byte [esp + eax + 0x1726], 0
test eax, eax
jbe 0x4c0cb9
cmp byte [esp + esi + 0x1728], 0
jne 0x4c0bd9
inc esi
cmp esi, eax
jb 0x4c0bc5
jmp 0x4c0cb9
cmp esi, eax
jae 0x4c0cb9
cmp dword [esp + 0xb8], 2
jne 0x4c0c4d
test esi, esi
jne 0x4c0bf6
mov esi, 1
jmp 0x4c0bf7
dec esi
add eax, 2
push eax
call fcn.004d9470
mov edi, eax
add esp, 4
test edi, edi
je 0x4c0cb5
lea ecx, [esp + esi + 0x1728]
push ecx
push edi
call fcn.004a0e50
mov edx, dword [esp + 0x44]
dec edx
push edx
lea eax, [esp + 0x1734]
push 0
push eax
call fcn.005dfd60
lea edx, [esp + 0x173c]
add esp, 0x14
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4c0c40
push edi
jmp 0x4c0cad
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + esi + 0x172c]
push edx
mov dword [esp + 0x90], 0
call fcn.004da960
add esp, 8
test eax, eax
je 0x4c0cb5
mov esi, dword [esp + 0x88]
test esi, esi
je 0x4c0cb5
mov eax, dword [esp + 0x3c]
dec eax
push eax
lea ecx, [esp + 0x172c]
push 0
push ecx
call fcn.005dfd60
lea edx, [esp + 0x1734]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4c0ca2
push esi
call fcn.005e0865
add esp, 4
mov eax, dword [esp + 0x3c]
push eax
lea edx, [esp + 0x172c]
push edx
call fcn.004bc600
add esp, 8
cmp eax, 0xffffffff
je 0x4c0cf5
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.004a12b0
add esp, 8
test ebx, ebx
je 0x4c0ceb
mov dword [ebx], 1
mov dword [esp + 0x14], 0
jmp 0x4c0cfc
cmp dword [esp + 0x14], 0
ja 0x4c0d0a
cmp byte [esp + 0x120], 0
jne 0x4c0ee2
cmp dword [esp + 0x30], 0
jne 0x4c0ee2
cmp byte [esp + 0x328], 0
jne 0x4c0ee2
cmp byte [esp + 0x329], 0
jne 0x4c0ee2
cmp byte [esp + 0x32a], 0
jne 0x4c0ee2
cmp byte [esp + 0x32b], 0
jne 0x4c0ee2
cmp byte [esp + 0x32c], 0
jne 0x4c0ee2
cmp byte [esp + 0x32d], 0
jne 0x4c0ee2
cmp byte [esp + 0x32e], 0
jne 0x4c0ee2
cmp byte [esp + 0x32f], 0
jne 0x4c0ee2
cmp dword [esp + 0x1c], 0
jne 0x4c0d94
mov dword [esp + 0x30], 0x3e8
cmp byte [esp + 0x120], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x4c0db3
push str.Generic_NullByte_Header
lea edx, [esp + 0x124]
push edx
call ebx
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4c0eec
cmp byte [edi + 1], 0
lea esi, [edi + 1]
je 0x4c0eec
push str..ISO
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c0ebb
push str..IMG
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c0ebb
push str..ING
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c0ebb
mov al, byte [esi]
cmp al, 0x72
je 0x4c0e18
cmp al, 0x52
jne 0x4c0e68
mov al, byte [edi + 2]
cmp al, 0x30
jl 0x4c0e68
cmp al, 0x32
jg 0x4c0e68
mov al, byte [edi + 3]
cmp al, 0x30
jl 0x4c0e68
cmp al, 0x39
jg 0x4c0e68
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
xor ecx, ecx
push edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x128], 0x4c4355
call fcn.004a12b0
mov eax, dword [esp + 0x34]
add esp, 8
cmp eax, ecx
je 0x4c0e5f
mov dword [eax], 1
mov dword [esp + 0x14], ecx
jmp 0x4c0f41
cmp dword [esp + 0x14], 0
jbe 0x4c0ef3
mov eax, dword [esp + 0x20]
fild dword [esp + 0x20]
test eax, eax
jge 0x4c0e85
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x4c0eec
push esi
call fcn.004adc70
add esp, 4
test eax, eax
je 0x4c0eec
mov ecx, dword [esp + 0x80]
push ecx
lea edx, [esp + 0x132c]
push edx
call fcn.004ad650
add esp, 8
test eax, eax
je 0x4c0eec
push 0x63aab8
lea eax, [esp + 0x124]
push eax
mov dword [esp + 0x38], 0
call ebx
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4c0eec
mov dword [eax], 1
jmp 0x4c0eec
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x34]
cmp dword [esp + 0x14], 0
ja 0x4c0efd
cmp byte [esp + 0x120], 0
jne 0x4c0f41
cmp dword [esp + 0x30], 0
jne 0x4c0f41
test edi, edi
je 0x4c0f41
cmp byte [edi + 1], 0
je 0x4c0f41
push str..TAR
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c0f41
push 0x63ab94
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x38], eax
call ebx
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4c0f41
mov dword [eax], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
mov dword [ecx], 0x20
test eax, eax
je 0x4c0fdb
cmp dword [eax], 0
je 0x4c0fdb
cmp byte [esp + 0x328], 0x4d
jne 0x4c0fdb
cmp byte [esp + 0x329], 0x5a
jne 0x4c0fdb
mov ebp, dword [esp + 0x7c]
test ebp, ebp
je 0x4c0f83
mov dword [ebp], 1
mov al, byte [esp + 0x336]
cmp al, 0xf0
jne 0x4c0fbc
cmp byte [esp + 0x337], 0xff
jne 0x4c0fdf
cmp byte [esp + 0x338], 0xfe
jne 0x4c0fdf
cmp byte [esp + 0x339], 0xff
jne 0x4c0fdf
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4c0fdf
mov dword [eax], 1
jmp 0x4c0fdf
test al, al
jne 0x4c0fdf
cmp byte [esp + 0x337], al
jne 0x4c0fdf
cmp byte [esp + 0x338], al
jne 0x4c0fdf
cmp byte [esp + 0x339], al
jmp 0x4c0faa
mov ebp, dword [esp + 0x7c]
cmp dword [esp + 0x30], 0
mov dword [ecx], 0x21
jne 0x4c1024
mov esi, dword [esp + 0xd0]
test esi, esi
je 0x4c1024
cmp dword [esp + 0x10c], 1
je 0x4c101e
cmp dword [esp + 0x24], 0
je 0x4c1024
test edi, edi
je 0x4c101e
push str..TXT
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c1024
mov dword [esi], 1
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x38]
push 0
push 0
push edx
push eax
mov dword [esi], 0x22
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x104]
mov dword [esi], 0x23
test edi, edi
je 0x4c1075
lea ecx, [esp + 0x120]
push str.MacBinary
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c1075
mov dword [edi], 1
mov esi, dword [esp + 0xd4]
test esi, esi
je 0x4c109f
lea edx, [esp + 0x120]
push 0x63a360
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c109f
mov dword [esi], 1
mov eax, dword [esp + 0x38]
mov dword [eax], 0x24
cmp dword [0x748aa4], 2
jne 0x4c114b
mov eax, dword [esp + 0xf4]
test eax, eax
je 0x4c114b
cmp byte [eax], 0
jne 0x4c114b
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4c114b
mov edx, dword [0x748bac]
shl edx, 0xa
cmp dword [esp + 0x20], edx
jae 0x4c114b
cmp dword [esp + 0xd8], 0
jne 0x4c1122
mov edx, dword [esp + 0xbc]
test edx, edx
je 0x4c10ff
cmp dword [edx], 0
jne 0x4c1122
test ebp, ebp
je 0x4c1109
cmp dword [ebp], 0
jne 0x4c1122
mov edx, dword [esp + 0xc4]
test edx, edx
je 0x4c1119
cmp dword [edx], 0
jne 0x4c1122
test edi, edi
je 0x4c114b
cmp dword [edi], 0
je 0x4c114b
cmp dword [esp + 0x80], 0
push 0
push 0
push ecx
push 0
push eax
jne 0x4c113e
lea eax, [esp + 0x133c]
push eax
jmp 0x4c1146
lea ecx, [esp + 0x133c]
push ecx
call fcn.004fe960
cmp dword [esp + 0xb0], 0
mov edi, dword [esp + 0x38]
mov dword [edi], 0x25
jne 0x4c1169
lea edx, [esp + 0x18]
push edx
call fcn.004dca10
cmp dword [esp + 0x84], 1
jne 0x4c1178
call fcn.00504780
mov ecx, dword [esp + 0xe0]
test ecx, ecx
je 0x4c11bc
cmp dword [esp + 0x64], 0
je 0x4c11b1
mov eax, dword [esp + 0x20]
fild dword [esp + 0x20]
test eax, eax
jge 0x4c119c
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x4c11b1
mov dword [ecx], 0x4c4355
jmp 0x4c11bc
lea edx, [esp + 0x120]
push edx
push ecx
call ebx
cmp dword [esp + 0x7398], 0
je 0x4c11dd
mov esi, dword [esp + 0x90]
test esi, esi
je 0x4c11dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x78]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [edi], 0x26
mov ecx, dword [esp + 0x732c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7314]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x7324
ret