Function at 0x49f5f0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbb0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x15d8
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x130], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x12c], eax
lea edx, [ebp - 0x548]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xae8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x548]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 3
jge 0x49f7be
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x548], 0x5c
jne 0x49f7dd
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x548]
push 0x516860
push eax
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x49f7fd
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x548]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f818
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x548]
push str..TMP
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f833
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x548]
push str._temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f84e
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x548]
push str.Temp_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f869
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x548]
push str.TEMP_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f884
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x548]
push str.Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f89f
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x548]
push str..dll_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49f9b6
lea edx, [ebp - 0x548]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0xe56c90]
mov edx, dword [0xe56c50]
inc ecx
test edx, edx
mov dword [0xe56c90], ecx
jle 0x49f954
shl edx, 8
lea ecx, [ebp - 0x548]
lea edx, [edx + 0xd70d90]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49f998
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x548]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49f998
jmp 0x49f98e
mov ebx, edx
lea edi, [ebp - 0x548]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49f998
mov dword [0xe56c50], 0
push 0x51f348
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x548]
push str..Dll_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49facd
lea edx, [ebp - 0x548]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0xe56c90]
mov edx, dword [0xe56c50]
inc ecx
test edx, edx
mov dword [0xe56c90], ecx
jle 0x49fa6b
shl edx, 8
lea ecx, [ebp - 0x548]
lea edx, [edx + 0xd70d90]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49faaf
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x548]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49faaf
jmp 0x49faa5
mov ebx, edx
lea edi, [ebp - 0x548]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49faaf
mov dword [0xe56c50], 0
push 0x51f348
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x548]
push str..DLL_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49fbe4
lea edx, [ebp - 0x548]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0xe56c90]
mov edx, dword [0xe56c50]
inc ecx
test edx, edx
mov dword [0xe56c90], ecx
jle 0x49fb82
shl edx, 8
lea ecx, [ebp - 0x548]
lea edx, [edx + 0xd70d90]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49fbc6
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x548]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49fbc6
jmp 0x49fbbc
mov ebx, edx
lea edi, [ebp - 0x548]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49fbc6
mov dword [0xe56c50], 0
push 0x51f348
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x548]
xor edx, edx
cmp al, 0x25
mov dword [ebp + 8], 0
jne 0x49fbf9
mov edx, edi
lea eax, [esi - 2]
test eax, eax
jle 0x49fc24
mov cl, byte [ebp + eax - 0x548]
cmp cl, 0x3a
jne 0x49fc16
cmp byte [ebp + eax - 0x547], 0x5c
je 0x49fc24
cmp edx, edi
jne 0x49fc1f
cmp cl, 0x5c
je 0x49fc2c
dec eax
test eax, eax
jg 0x49fc00
cmp edx, edi
jne 0x49fcd4
sub esi, eax
xor ecx, ecx
lea edx, [esi - 1]
test edx, edx
jle 0x49fc56
mov ecx, edx
lea esi, [ebp + eax - 0x547]
mov eax, ecx
lea edi, [ebp - 0x1068]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0x1068], 0
lea edi, [ebp - 0x1068]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x548]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1c8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xbe8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x548]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0xbe8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x548]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49fd22
cmp eax, esi
je 0x49fd22
mov edx, esi
test esi, esi
mov dword [ebp + 8], edx
jle 0x49fcf3
cmp byte [ebp + edx - 0x548], 0x2e
je 0x49fcf0
dec edx
test edx, edx
jg 0x49fce1
mov dword [ebp + 8], edx
mov esi, edx
xor ecx, ecx
sub esi, eax
mov byte [ebp - 0x548], 0
add esi, 5
test esi, esi
jle 0x49fd1a
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x548], al
inc ecx
cmp ecx, esi
jl 0x49fd0b
mov byte [ebp + edx - 0x543], 0
lea edi, [ebp - 0x548]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x49fd45
cmp byte [ebp + ecx - 0x548], 0x2e
je 0x49fd45
dec ecx
test ecx, ecx
jg 0x49fd36
mov eax, dword [ebp + 8]
mov byte [ebp + ecx - 0x544], 0
test eax, eax
jne 0x49fd72
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x548]
push ecx
call fcn.004ab3c0
mov ebx, 1
add esp, 4
cmp eax, ebx
jge 0x49fe5d
mov edx, dword [0xe56c50]
test edx, edx
jle 0x49fdfb
shl edx, 8
lea eax, [ebp - 0x548]
lea ecx, [edx + 0xd70d90]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49fe3f
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x548]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49fe3f
jmp 0x49fe35
mov ebx, edx
lea edi, [ebp - 0x548]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x49fe3f
mov dword [0xe56c50], 0
push 0x51f318
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0x548]
push ecx
push edx
mov dword [ebp - 0x78], eax
call fcn.004d9590
movsx edi, ax
lea eax, [ebp - 0x348]
xor esi, esi
push str.Microsoft
push eax
mov dword [ebp - 0x38], edi
mov dword [ebp + 8], esi
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x49fe9b
mov esi, ebx
mov dword [ebp + 8], esi
cmp dword [0xe56be4], ebx
jne 0x49ff9b
test edi, edi
jle 0x49feee
cmp dword [0xe56bf0], ebx
jne 0x49ff9b
mov esi, 0x510b24
lea ecx, [ebp - 0x348]
push esi
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49ff45
add esi, 0x80
cmp esi, 0x510ba4
jl 0x49febc
mov eax, dword [0xe56be4]
mov esi, dword [ebp + 8]
cmp eax, ebx
jne 0x49ff9b
cmp dword [0xe56bf0], ebx
jne 0x49ff9b
mov esi, 0x510ba4
lea edx, [ebp - 0x1c8]
push esi
push edx
lea eax, [ebp - 0xbe8]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0xbe8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x49ff7d
add esi, 0x80
cmp esi, str.WBWMD.dll
jl 0x49feff
mov esi, dword [ebp + 8]
jmp 0x49ff9b
lea edx, [ebp - 0x348]
lea eax, [ebp - 0xbe8]
push edx
push 0x526cbc
push eax
call fcn.004f175f
lea ecx, [ebp - 0xbe8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x526ca4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._s_ntdll.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x49ffeb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sKERNEL32.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a003b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._s_advapi32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a008b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sWS2_32.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a00db
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._swsock32.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a012b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._sWINMM.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a017b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._smswsock.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a01cb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._smsgina.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a021b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._swsock32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a026b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sws2_32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a02bb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sCOMCTL32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a030b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a035b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sNETUI1.DLl
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a03ab
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a03fb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a044b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a049b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._surlmon.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a04eb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._smshtml.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a053b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._smfc42u.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a058b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._smprapi.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a05db
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._sole32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a062b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._scrypt32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a067b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._scryptui.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a06cb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._s_shlwapi.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a071b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sinetcomm.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a076b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._smsvbvm60.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a07bf
cmp esi, ebx
jne 0x4a07bf
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._soleaut32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0813
cmp esi, ebx
jne 0x4a0813
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._swinsrv.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0867
cmp esi, ebx
jne 0x4a0867
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sCLBCATQ.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a08bb
cmp esi, ebx
jne 0x4a08bb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._smsv1_0.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a090f
cmp esi, ebx
jne 0x4a090f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sole32.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0963
cmp esi, ebx
jne 0x4a0963
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._scomdlg32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a09b7
cmp esi, ebx
jne 0x4a09b7
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._s_netapi32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0a0b
cmp esi, ebx
jne 0x4a0a0b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._s_sfc.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0a5f
cmp esi, ebx
jne 0x4a0a5f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._s_sfc_os.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0ab3
cmp esi, ebx
jne 0x4a0ab3
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._siphlpapi.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0b07
cmp esi, ebx
jne 0x4a0b07
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sWMI.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0b5b
cmp esi, ebx
jne 0x4a0b5b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sCOMRes.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0baf
cmp esi, ebx
jne 0x4a0baf
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0c03
cmp esi, ebx
jne 0x4a0c03
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._smsvcrt.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0c57
cmp esi, ebx
jne 0x4a0c57
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._s_advapi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0cab
cmp esi, ebx
jne 0x4a0cab
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._suser32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0cff
cmp esi, ebx
jne 0x4a0cff
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sgdi32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0d53
cmp esi, ebx
jne 0x4a0d53
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x2c8]
push ecx
push str._sWINSTA.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x2c8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0da7
cmp esi, ebx
jne 0x4a0da7
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x2c8]
push edx
push str._sSHSVCS.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x2c8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0dfb
cmp esi, ebx
jne 0x4a0dfb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x2c8]
push eax
push str._sUSERENV.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x548]
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a0e4f
cmp esi, ebx
jne 0x4a0e4f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x348]
push str.Beijing_Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0e8f
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0ecf
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0f0f
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0f4f
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0f8f
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a0fcf
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a100f
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a104f
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Panda_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a108f
mov edi, 0x5156ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a10cf
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x548]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4a1103
lea esi, [ebp + ecx - 0x548]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x1268], dl
jne 0x4a10fd
cmp eax, 2
jge 0x4a1103
inc eax
dec esi
cmp eax, ecx
jl 0x4a10ea
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x4a112a
mov ebx, ecx
lea esi, [ebp - 0x548]
lea edi, [ebp - 0xe68]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xe68], 0
test eax, eax
jle 0x4a115d
lea esi, [ebp + edx - 0x547]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x4a1150
mov byte [ebp + ecx - 0x1268], dl
jne 0x4a1158
mov byte [ebp + ecx - 0x1268], 0
inc ecx
cmp ecx, eax
jl 0x4a113f
mov byte [ebp + eax - 0x1268], 0
mov al, byte [ebp - 0xe66]
cmp al, 0x5c
je 0x4a117d
mov byte [ebp - 0xe66], 0x5c
mov byte [ebp - 0xe65], 0
cmp byte [ebp - 0xe67], 0x3a
je 0x4a1242
lea edi, [ebp - 0xe68]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp - 0x2c], ecx
jle 0x4a11b0
cmp byte [ebp + eax - 0xe68], 0x3a
je 0x4a11b0
inc eax
cmp eax, ecx
jl 0x4a11a1
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x4a11e0
mov ecx, edi
lea esi, [ebp + eax - 0xe69]
mov ebx, ecx
lea edi, [ebp - 0x1368]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
mov byte [ebp + edx - 0x1367], 0
jne 0x4a1219
lea ecx, [ebp - 0x5c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x5c8]
lea eax, [ebp - 0x1368]
push edx
push 0x50d39c
push eax
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x1368]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xe68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xe66], 0x5c
je 0x4a1252
mov byte [ebp - 0xe66], 0x5c
lea ecx, [ebp - 0xe68]
push ecx
call fcn.004cb750
lea edx, [ebp - 0x548]
mov dword [ebp - 0x13c], eax
push edx
call fcn.004abe70
add esp, 8
cmp eax, ebx
je 0x4a1295
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xe67], 0x3a
je 0x4a12bc
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xe66], 0x5c
je 0x4a12cc
mov byte [ebp - 0xe66], 0x5c
lea edi, [ebp - 0x1268]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4a12f7
cmp byte [ebp + eax - 0x1268], 0x2e
jne 0x4a12ee
mov edx, ebx
inc eax
cmp eax, ecx
jl 0x4a12e2
test edx, edx
jne 0x4a1315
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x1264], 0
jge 0x4a1340
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c8]
push 0x80
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xae8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x548]
push 0x100
lea eax, [ebp - 0xa48]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x1268]
push 0x40
lea edx, [ebp - 0x828]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x548]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
mov dword [ebp - 0x148], esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x4a13dc
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x548]
push 0x80
lea edx, [ebp - 0xee8]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x548]
push 0x80
lea ecx, [ebp - 0xc68]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0xae8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x1c8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xee8], al
lea edx, [ebp - 0xae8]
mov byte [ebp + ecx - 0xc68], al
lea eax, [ebp - 0xee8]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x4a1487
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1487
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0xc68]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a14da
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x12c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a14da
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x548]
push str.System32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a1525
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1525
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x548]
push str.system32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a1570
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1570
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x548]
push str.system
push edx
call fcn.004f2d80
xor edi, edi
add esp, 8
cmp eax, edi
je 0x4a15bd
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a15bd
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xd53b20
mov dword [ebp - 4], edi
call fcn.004a6b50
add esp, 4
lea eax, [ebp - 0x548]
push 0xd53b20
push eax
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x4a161e
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x548]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x4a1f94
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x144], eax
mov eax, dword [0xd53b28]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x124], eax
jne 0x4a16ab
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x20], 2
mov edx, dword [0xd53b28]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x64], esi
jne 0x4a1e53
mov dword [ebp - 0x20], 6
jmp 0x4a1f85
mov dword [ebp - 0x114], edi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4a167a
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd53b28]
mov eax, dword [ebp - 0x144]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x24]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x24], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.HKCommand.dll
inc eax
push edi
mov dword [ebp - 0x64], eax
call fcn.004f61e0
add esp, 0x10
mov ebx, 1
test eax, eax
jne 0x4a170b
mov dword [ebp - 0x128], ebx
push str.HTHW.dll
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1723
mov dword [ebp - 0x138], ebx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4a175a
lea ecx, [ebp - 0x1268]
lea edx, [ebp - 0xe68]
push ecx
push edx
call fcn.004e9e90
add esp, 8
cmp eax, 0x800
jle 0x4a175a
cmp eax, 0x3e800
mov eax, dword [ebp - 0x60]
jle 0x4a1756
add eax, 2
jmp 0x4a1757
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x10c]
inc eax
xor esi, esi
mov dword [ebp - 0x10c], eax
cmp esi, 0x69
jge 0x4a1806
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a1800
cmp esi, 0xf
jle 0x4a179b
cmp esi, 0x12
jge 0x4a179b
mov dword [ebp - 0x90], ebx
cmp esi, 0x1d
je 0x4a17aa
cmp esi, 0x1e
je 0x4a17aa
cmp esi, 0x39
jne 0x4a17ad
mov dword [ebp - 0x74], ebx
cmp esi, 0x1f
je 0x4a17b7
cmp esi, 0x20
jne 0x4a17ba
mov dword [ebp - 0x6c], ebx
cmp esi, 0x21
je 0x4a17c4
cmp esi, 0x22
jne 0x4a17c7
mov dword [ebp - 0x7c], ebx
cmp esi, 0x23
je 0x4a17d1
cmp esi, 0x24
jne 0x4a17d7
mov dword [ebp - 0x8c], ebx
cmp esi, 0x2c
jne 0x4a17e5
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x4a1769
cmp esi, 0x2d
je 0x4a17fd
cmp esi, 0x2e
jne 0x4a17f8
mov dword [ebp - 0x70], ebx
inc esi
jmp 0x4a1769
cmp esi, 0x3d
jne 0x4a1800
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x4a1769
mov ecx, dword [0xd53b28]
mov byte [ebp - 4], 2
push ecx
mov dword [ebp - 0x104], 0
call fcn.004a6bb0
mov edx, dword [0xd53b28]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x140], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x114]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x4a184f
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd53b28]
push eax
push edx
push esi
mov dword [ebp - 0x2c], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4a167a
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4a1d97
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x4a18e0
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x948]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x948]
jmp 0x4a1964
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0x140]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4a191f
xor ecx, ecx
lea edx, [ebp - 0x7e8]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x120], esi
jmp 0x4a196f
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa68]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xa68]
mov dword [ebp - 0x120], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x4a1d51
mov eax, dword [ebp - 0x120]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a1d4b
cmp esi, 0x45
jne 0x4a1a45
lea ecx, [ebp - 0x5c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x5c8]
lea eax, [ebp - 0x13e8]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x13e8]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x4a1a0a
lea edx, [ebp - 0x348]
lea eax, [ebp - 0x1068]
push edx
push 0x5153f4
push eax
jmp 0x4a1a1d
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0x1068]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1068]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x4a1a52
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x4a1971
cmp esi, edi
jne 0x4a1a5f
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x4a1971
cmp esi, 2
je 0x4a1d4b
cmp esi, 4
jne 0x4a1a79
mov dword [ebp - 0x110], edi
inc esi
jmp 0x4a1971
cmp esi, 5
jne 0x4a1a8a
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x4a1971
cmp esi, 6
jne 0x4a1a9b
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x4a1971
cmp esi, 7
jne 0x4a1aac
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x4a1971
cmp esi, 8
jne 0x4a1abd
mov dword [ebp - 0x108], edi
inc esi
jmp 0x4a1971
cmp esi, 9
jne 0x4a1ace
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x4a1971
cmp esi, 0xa
jne 0x4a1adc
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4a1971
cmp esi, 0xb
jle 0x4a1ae9
cmp esi, 0xf
jge 0x4a1aec
mov dword [ebp - 0x54], edi
cmp esi, 0xf
jne 0x4a1afa
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x4a1971
jle 0x4a1b07
cmp esi, 0x12
jge 0x4a1b07
mov dword [ebp - 0x90], edi
cmp esi, 0x1b
jne 0x4a1b18
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x4a1971
cmp esi, 0x1c
jne 0x4a1b29
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4a1971
cmp esi, 0x1d
je 0x4a1b38
cmp esi, 0x1e
je 0x4a1b38
mov dword [ebp - 0x74], edi
cmp esi, 0x1f
je 0x4a1b45
inc esi
jmp 0x4a1971
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x64]
inc ecx
cmp eax, edi
mov dword [ebp - 0x48], ecx
jne 0x4a1d65
inc dword [ebp - 0x88]
cmp dword [ebp - 0x48], 0x1388
jg 0x4a1d97
mov esi, dword [ebp - 0x104]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], ecx
mov eax, ecx
jmp 0x4a1879
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x104]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x124]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x124], eax
jmp 0x4a16b1
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x2c], ebx
cmp bx, word [esi + 2]
jae 0x4a1f85
xor ecx, ecx
push str..asp
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 0x98], cl
mov edx, dword [edi]
mov dword [ebp - 0xa0], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x9c], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4a1eb5
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xa0]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1ed0
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xa0]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1eeb
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xa0]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1f06
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xa0]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1f21
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xa0]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a1f3c
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x2c]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x2c], eax
jg 0x4a1f85
mov esi, dword [ebp - 0x64]
add edi, 0x28
inc ebx
jmp 0x4a1e66
mov esi, dword [ebp - 0x20]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
xor edi, edi
add esp, 4
cmp eax, edi
jne 0x4a1fd2
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x4a2001
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x88]
cmp esi, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x4a27b5
cmp eax, ebx
jge 0x4a27b5
lea edx, [ebp - 0xe68]
mov dword [ebp - 0x24], edi
push edx
call fcn.004f2beb
jmp 0x4a2041
lea eax, [ebp - 0x1268]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1068]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x4a2072
push ebx
lea ecx, [ebp - 0x590]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x4a209c
lea edx, [ebp - 0x1068]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x4a20b0
lea eax, [ebp - 0xa48]
push str.c:endpcachemonitor_procPath2.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp - 0x2c], edi
push ecx
push ebx
push str.c:endpcachemonitor_procPath2.txt
lea ecx, [ebp - 0x590]
call fcn.004f0727
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x58c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x4a20fd
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x4a22b6
mov esi, dword [ebp - 0x58c]
push 0xa
lea ecx, [ebp - 0x928]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x590]
mov dword [ebp - 0x58c], esi
call fcn.004f0ae9
lea edi, [ebp - 0x928]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x4a2737
lea edx, [ebp - 0x928]
push str.Bound_to
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a2737
lea eax, [ebp - 0x928]
push str.Dump_of
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a2737
lea ecx, [ebp - 0x928]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a2737
lea edx, [ebp - 0x928]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a21ae
mov dword [ebp - 0x134], ebx
lea eax, [ebp - 0x928]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a21d0
push 0x5147b4
jmp 0x4a22ae
cmp dword [ebp - 0x58], ebx
jne 0x4a21d8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x4a21e0
inc dword [ebp - 0x20]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x4a2734
lea ecx, [esi + esi*2]
lea edx, [ebp - 0x928]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x4a272e
mov ecx, dword [ebp - 0x130]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x130], ecx
jne 0x4a22e5
lea eax, [ebp - 0x13e8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x13e8]
lea edx, [ebp - 0xf68]
push ecx
push str._sMicrosoft.NETFramework
push edx
call fcn.004f175f
lea eax, [ebp - 0xf68]
push eax
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x4a228c
lea edx, [ebp - 0x348]
lea eax, [ebp - 0xbe8]
push edx
push 0x5153f4
push eax
jmp 0x4a229f
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0xbe8]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xbe8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x57c]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x57c]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x4a2365
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x24], edx
jle 0x4a2305
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x928]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x928]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x928]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4a23dd
test ebx, ebx
jne 0x4a23dd
test eax, eax
jne 0x4a23dd
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4a21e4
cmp esi, 0x1a
jne 0x4a23f1
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x24], edx
jle 0x4a2389
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x928]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x928]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x928]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4a23dd
test ebx, ebx
jne 0x4a23dd
test eax, eax
jne 0x4a23dd
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4a21e4
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x4a21e4
cmp esi, 0x2a
jne 0x4a2408
mov dword [ebp - 0x58], edi
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4a21e4
cmp esi, 0x2b
jne 0x4a241f
mov dword [ebp - 0x58], edi
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4a21e4
cmp esi, edi
jne 0x4a242c
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x4a21e4
cmp esi, ebx
jne 0x4a2439
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x4a21e4
cmp esi, 2
je 0x4a272e
cmp esi, 4
jne 0x4a2453
inc esi
jmp 0x4a21e4
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x590]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x588], 1
je 0x4a20fd
lea ecx, [ebp - 0x590]
call fcn.004f076e
mov eax, dword [ebp - 0x1c]
mov ecx, 5
cmp eax, ecx
mov byte [ebp - 0x7c8], 0
jle 0x4a2771
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x20]
cmp edx, ecx
jle 0x4a277d
sub edx, ecx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0xe8]
test ecx, ecx
jne 0x4a2792
cmp eax, 6
jle 0x4a2792
sub eax, 6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x57c]
call fcn.004f05fb
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x14], 0
cmp ecx, ebx
jne 0x4a2831
cmp dword [ebp - 0x138], ebx
jne 0x4a27fc
cmp dword [ebp - 0x38], ebx
jge 0x4a2841
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x19000
jle 0x4a27ff
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x78]
cmp edx, 0x50
jle 0x4a2834
cmp eax, 0x96
jle 0x4a2834
cmp ecx, 0xc800
jle 0x4a2834
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x78]
cmp dword [ebp - 0x60], ebx
jle 0x4a285f
cmp ecx, 0xc800
jle 0x4a285f
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x32000
jle 0x4a2888
cmp dword [ebp - 0x38], 5
jle 0x4a2888
cmp dword [ebp + 8], ebx
jne 0x4a2888
cmp edx, 0x46
jle 0x4a2888
lea eax, [ebp - 0x348]
push eax
push 0x51f1d8
jmp 0x4a2909
cmp ecx, 0x4b000
jle 0x4a28a8
cmp dword [ebp - 0x38], ebx
jle 0x4a28a8
cmp edx, 0x64
jle 0x4a28a8
lea eax, [ebp - 0x348]
push eax
push 0x51f1b4
jmp 0x4a2909
mov eax, dword [ebp - 0x68]
cmp eax, 2
jle 0x4a28c9
cmp ecx, 0xa000
jg 0x4a28bd
cmp edx, 0x28
jle 0x4a28c9
mov esi, dword [ebp - 0x40]
test esi, esi
jg 0x4a28fd
cmp dword [ebp - 0x44], ebx
jg 0x4a28fd
cmp dword [ebp - 0x11c], ebx
jne 0x4a2935
cmp ecx, 0x9c00
jg 0x4a28de
cmp edx, 0x27
jle 0x4a28e9
cmp dword [ebp - 0x40], ebx
jg 0x4a28fd
cmp dword [ebp - 0x44], 2
jg 0x4a28fd
mov edx, dword [ebp - 0x50]
test edx, edx
jle 0x4a2935
cmp eax, 2
jle 0x4a2935
cmp ecx, 0x9c00
jle 0x4a2935
lea eax, [ebp - 0x348]
push eax
push 0x526038
lea ecx, [ebp - 0x7c8]
push ecx
call fcn.004f175f
lea edx, [ebp - 0x7c8]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, 1
xor ebx, ebx
cmp eax, edx
je 0x4a2970
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x64], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], edx
jne 0x4a29a8
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x4a29e9
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 0x18], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x108]
mov eax, 1
cmp ecx, eax
jne 0x4a2a2d
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x5c], eax
jne 0x4a2a68
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x4a2aa6
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
je 0x4a2ab6
cmp dword [ebp - 0xc0], eax
jne 0x4a2aeb
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x118], eax
jne 0x4a2b29
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], eax
jne 0x4a2b66
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], eax
jne 0x4a2ba4
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], eax
jne 0x4a2be6
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], eax
jne 0x4a2c2a
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x110], eax
jne 0x4a2c68
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x4a2ca6
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x100], eax
jne 0x4a2ce3
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], eax
jne 0x4a2d86
cmp dword [ebp - 0xe0], eax
je 0x4a2d09
cmp dword [ebp - 0xa4], eax
je 0x4a2d09
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xa8]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x7c8]
mov edi, 0x515258
je 0x4a2d54
cmp dword [ebp - 0xac], eax
jne 0x4a2dc4
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb4], eax
jne 0x4a2e09