Function at 0x49ce40
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5c24
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
lea eax, [edi - 0xd3]
mov dword [ebp - 0x14], esi
cmp eax, 0x54
ja case.0x49ce80.251
xor ecx, ecx
mov cl, byte [eax + 0x4a04ac]
jmp dword [ecx*4 + 0x4a0408]
mov eax, dword [esi + 0x114]
xor ebx, ebx
cmp eax, ebx
jne case.0x49ce80.221
push ebx
push edi
mov ecx, esi
call fcn.004a5ee0
jmp case.0x49ce80.221
mov eax, dword [esi + 0x114]
test eax, eax
jne case.0x49ce80.221
push 1
push edi
mov ecx, esi
call fcn.004a5ee0
test eax, eax
jne case.0x49ce80.221
jmp 0x4a03ef
mov eax, dword [0x50d0e0]
mov dword [ebp + 8], eax
push ecx
lea ecx, [eax - 0xc]
mov dword [ebp - 0xc4], esp
xor ebx, ebx
mov edx, dword [ecx]
mov dword [ebp - 4], ebx
cmp edx, ebx
mov dword [ebp - 0x44], esp
mov dword [ebp - 0x10], ecx
jl 0x49cefc
mov edx, esp
mov ebx, ecx
push ebx
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x49cf23
mov ecx, dword [ebp - 0x44]
cmp eax, ebx
mov dword [ecx], eax
jne 0x49cf09
xor eax, eax
jmp 0x49cf13
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x44]
push eax
call fcn.004021f0
mov ebx, dword [ebp - 0x10]
push edi
mov ecx, esi
call fcn.004a21d0
mov edx, dword [ebp + 8]
mov eax, dword [0x50d0e4]
add edx, 0xfffffff4
cmp edx, eax
je case.0x49ce80.221
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg case.0x49ce80.221
push ebx
call fcn.004de3a6
add esp, 4
jmp case.0x49ce80.221
mov ecx, esi
call fcn.004a2780
jmp case.0x49ce80.221
mov eax, dword [esi + 0x114]
xor ebx, ebx
cmp eax, ebx
jne case.0x49ce80.221
mov ecx, 0x104
xor eax, eax
lea edi, [ebp - 0xa2c]
push ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 8]
lea eax, [ebp - 0xa2c]
push eax
push ecx
call fcn.004a8cc0
add esp, 0xc
test eax, eax
je case.0x49ce80.221
mov eax, dword [esi + 0x120]
mov ecx, dword [esi + 0x11c]
lea edi, [esi + 0x118]
push eax
push ecx
mov ecx, edi
call fcn.004bdfc0
mov eax, dword [esi + 0xc8]
push ebx
push ebx
push 0x1004
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ecx
lea edx, [ebp - 0xa2c]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.00406b50
mov ecx, esi
call fcn.004a6a70
cmp eax, ebx
je case.0x49ce80.221
mov eax, dword [edi + 4]
cmp eax, ebx
je case.0x49ce80.221
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
je case.0x49ce80.221
mov dword [esi + 0x114], 1
mov edx, dword [esi + 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push ebx
push fcn.004a70f0
call fcn.004df750
add esp, 0xc
jmp case.0x49ce80.221
cmp edi, 0xf3
jne 0x49d04d
mov edi, 0xd6
push edi
mov ecx, esi
call fcn.004a1d80
jmp case.0x49ce80.221
push edi
mov ecx, esi
call fcn.004a0850
jmp case.0x49ce80.221
mov ecx, esi
call fcn.004b3690
jmp case.0x49ce80.221
mov eax, dword [esi + 0xc4]
xor ebx, ebx
push ebx
push ebx
mov eax, dword [eax + 4]
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jge 0x49d098
xor eax, eax
jmp 0x4a03ef
lea ecx, [ebp - 0x3c]
call fcn.00427790
mov edx, dword [esi + 0x10c]
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004a9f10
test eax, eax
je 0x49d1d7
lea ecx, [ebp - 0x60]
call fcn.00427790
mov edi, dword [esi + 0x108]
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.00427790
push str.QvodPlaylist
lea ecx, [ebp - 0x74]
mov word [ebp - 0x74], bx
call fcn.00406940
lea eax, [ebp + 8]
lea ecx, [ebp - 0x74]
push eax
push ecx
push str.selectSingleNode
lea ecx, [edi + 4]
mov byte [ebp - 4], 4
call fcn.004080f0
lea edx, [ebp - 0x74]
mov dword [edi + 8], eax
push edx
mov byte [ebp - 4], 3
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [edi + 8]
cmp eax, ebx
mov eax, dword [ebp + 8]
jl 0x49d137
cmp eax, ebx
je 0x49d137
push eax
lea ecx, [ebp - 0x60]
call fcn.004080d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 1
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x49d145
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x10], ebx
jne 0x49d176
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x49d15b
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x49d16f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x4a03ef
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x90]
push edx
call fcn.0046d400
push ebx
push eax
push str.removeChild
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 5
call fcn.00406990
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esi + 0xc4]
mov eax, dword [esi + 0x10c]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
push ebx
mov ecx, esi
call fcn.004a9e60
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x49d1d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je case.0x49ce80.221
mov edx, dword [eax]
push eax
call dword [edx + 8]
jmp case.0x49ce80.221
mov eax, dword [esi + 0x138]
cmp eax, 1
jne 0x49d222
mov ecx, dword [esi + 0xc4]
mov eax, dword [esi + 0x10c]
push 0
push eax
mov edx, dword [ecx + 4]
push 0x1076
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x49ce80.221
cmp eax, 2
jne case.0x49ce80.221
mov ecx, dword [esi + 0xd4]
mov eax, dword [esi + 0xe4]
push 0
push eax
mov edx, dword [ecx + 4]
push 0x1076
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x49ce80.221
xor ebx, ebx
cmp edi, 0xdd
jne 0x49d2a1
mov esi, dword [esi + 0xc8]
mov dword [esi + 0x14], 1
push 0x476cf0
push esi
mov eax, dword [esi + 4]
lea edi, [esi + 0x14]
push 0x1030
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
add esi, 0x64
push edi
mov ecx, esi
call fcn.004bcdf0
mov ecx, dword [eax]
xor edx, edx
cmp ecx, ebx
push edi
sete dl
mov ecx, esi
mov dword [ebp + 8], edx
call fcn.004bcdf0
mov ecx, dword [ebp + 8]
jmp 0x49d2f0
cmp edi, 0xde
jne 0x49d2f5
mov esi, dword [esi + 0xc8]
mov dword [esi + 0x14], 2
push 0x476cf0
push esi
mov edx, dword [esi + 4]
lea edi, [esi + 0x14]
push 0x1030
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
add esi, 0x64
push edi
mov ecx, esi
call fcn.004bcdf0
mov ecx, dword [eax]
xor edx, edx
cmp ecx, ebx
push edi
sete dl
mov ecx, esi
mov dword [ebp + 8], edx
call fcn.004bcdf0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [0x50d0e0]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], edx
call fcn.00427790
lea eax, [ebp - 0xa8]
lea ecx, [ebp - 0x80]
push eax
mov dword [ebp - 4], 6
call fcn.00409410
test eax, eax
jne 0x49d34f
mov ecx, dword [0x4fc218]
mov edx, dword [0x4fc21c]
mov eax, dword [0x4fc220]
mov dword [ebp - 0xa8], ecx
mov ecx, dword [0x4fc224]
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
lea edx, [ebp - 0x7c]
lea eax, [ebp - 0xa8]
push edx
push 0x4fc6ec
push 3
push ebx
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x78], eax
mov eax, dword [esi + 0xc8]
push ebx
push ebx
mov ecx, dword [eax + 4]
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x10], eax
call fcn.00427790
mov eax, dword [esi + 0x10c]
lea edx, [ebp - 0x98]
push ebx
push edx
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004a9f10
test eax, eax
jne 0x49d3e0
mov eax, dword [ebp - 0x94]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x49d3c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 8
call fcn.0042ca10
lea ecx, [ebp - 0x80]
call fcn.00402160
xor eax, eax
jmp 0x4a03ef
mov edx, dword [0x50d0e0]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x61c]
push 0x104
push eax
push 0x9d0e
mov byte [ebp - 4], 9
call fcn.00432b50
push str.QvodPlaylist
push str.list
push str.hotitem
push str.counts
push 0x5209fc
lea ecx, [ebp - 0x61c]
push str.createtime
push ecx
push str.title
push str.list
push 0x519f9c
push str.deftitle
push str._A____T
push str.tagtitle
push str.format
push str.hotitem
push str.3.5.0.65
push str.version
push str.QvodPlaylist
lea edx, [ebp - 0x28]
push str.__s__s__s___s_0___r_n__s__s__s___s__s____r_n__s__s__s___s__s___s_0___s_0___r_n___s__r_n___s_
push edx
call fcn.004074f0
add esp, 0x5c
mov word [ebp - 0x90], bx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x74]
push eax
mov word [ebp - 0x74], bx
call fcn.00406940
lea ecx, [ebp - 0x90]
lea edx, [ebp - 0x74]
push ecx
push edx
push str.loadXml
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xb
call fcn.00406990
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x74]
push eax
call esi
lea ecx, [ebp - 0x90]
push ecx
call esi
lea ecx, [ebp - 0x3c]
call fcn.00427790
lea ecx, [ebp + 8]
call fcn.00427790
push str.QvodPlaylist
lea ecx, [ebp - 0x74]
mov word [ebp - 0x74], bx
call fcn.00406940
lea edx, [ebp + 8]
lea eax, [ebp - 0x74]
push edx
push eax
push str.selectSingleNode
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xe
call fcn.004080f0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
push ecx
mov byte [ebp - 4], 0xd
call esi
mov eax, dword [ebp - 0x78]
cmp eax, ebx
mov eax, dword [ebp + 8]
jl 0x49d519
cmp eax, ebx
je 0x49d519
push eax
lea ecx, [ebp - 0x3c]
call fcn.004080d0
mov eax, dword [ebp + 8]
cmp eax, ebx
mov byte [ebp - 4], 0xc
je 0x49d527
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [ebp - 0xac]
call fcn.00427790
lea ecx, [ebp + 8]
call fcn.00427790
push str.list
lea ecx, [ebp - 0x74]
mov word [ebp - 0x74], bx
call fcn.00406940
lea eax, [ebp + 8]
lea ecx, [ebp - 0x74]
push eax
push ecx
push str.selectSingleNode
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x11
call fcn.004080f0
lea edx, [ebp - 0x74]
mov dword [ebp - 0x40], eax
push edx
mov byte [ebp - 4], 0x10
call esi
mov eax, dword [ebp - 0x40]
cmp eax, ebx
mov eax, dword [ebp + 8]
jl 0x49d58e
cmp eax, ebx
je 0x49d58e
push eax
lea ecx, [ebp - 0xac]
call fcn.004080d0
mov eax, dword [ebp + 8]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0x49d59c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
mov dword [ebp + 8], ebx
jle 0x49dbfa
lea ecx, [ebp - 0x54]
call fcn.00427790
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x98]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.004aa2d0
test eax, eax
je 0x49dbdc
lea ecx, [ebp - 0x2c]
call fcn.00427790
lea ecx, [ebp - 0x1c]
call fcn.00427790
push str.item
lea ecx, [ebp - 0x74]
mov word [ebp - 0x74], bx
call fcn.00406940
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x74]
push edx
push eax
push str.createElement
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x15
call fcn.004080f0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
push ecx
mov byte [ebp - 4], 0x14
call esi
mov eax, dword [ebp - 0x78]
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
jl 0x49d63c
cmp eax, ebx
je 0x49d63c
push eax
lea ecx, [ebp - 0x2c]
call fcn.004080d0
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
mov byte [ebp - 4], 0x13
je 0x49d64a
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea eax, [ebp - 0x18]
push 0x50e548
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x18]
mov word [ebp - 0x1a8], bx
push ecx
lea ecx, [ebp - 0x1a8]
call fcn.00406940
push 0x50e548
lea ecx, [ebp - 0x168]
mov word [ebp - 0x168], bx
call fcn.00406940
lea edx, [ebp - 0x1a8]
push ebx
lea eax, [ebp - 0x168]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x18
call fcn.00406a10
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x16
push edx
call esi
lea eax, [ebp - 0x24]
push str.title
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x24]
mov word [ebp - 0x1b8], bx
push ecx
lea ecx, [ebp - 0x1b8]
call fcn.00406940
push str.title
lea ecx, [ebp - 0x1d8]
mov word [ebp - 0x1d8], bx
call fcn.00406940
lea edx, [ebp - 0x1b8]
push ebx
lea eax, [ebp - 0x1d8]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
call fcn.00406a10
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x1b8]
mov byte [ebp - 4], 0x19
push edx
call esi
lea eax, [ebp - 0x48]
push 0x519544
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x48]
mov word [ebp - 0x1e8], bx
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.00406940
mov word [ebp - 0x138], bx
push 0x519544
lea ecx, [ebp - 0x138]
call fcn.00406940
lea edx, [ebp - 0x1e8]
push ebx
lea eax, [ebp - 0x138]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1e
call fcn.00406a10
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x1c
push edx
call esi
lea eax, [ebp - 0x4c]
push str.author
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x4c]
mov word [ebp - 0x1fc], bx
push ecx
lea ecx, [ebp - 0x1fc]
call fcn.00406940
push str.author
lea ecx, [ebp - 0x158]
mov word [ebp - 0x158], bx
call fcn.00406940
lea edx, [ebp - 0x1fc]
push ebx
lea eax, [ebp - 0x158]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x21
call fcn.00406a10
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x1fc]
mov byte [ebp - 4], 0x1f
push edx
call esi
lea eax, [ebp - 0x5c]
push str.special
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x5c]
mov word [ebp - 0x108], bx
push ecx
lea ecx, [ebp - 0x108]
call fcn.00406940
push str.special
lea ecx, [ebp - 0x178]
mov word [ebp - 0x178], bx
call fcn.00406940
lea edx, [ebp - 0x108]
push ebx
lea eax, [ebp - 0x178]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x24
call fcn.00406a10
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x22
push edx
call esi
lea eax, [ebp - 0x20]
push str.bits
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x20]
mov word [ebp - 0x1c8], bx
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.00406940
push str.bits
lea ecx, [ebp - 0x198]
mov word [ebp - 0x198], bx
call fcn.00406940
lea edx, [ebp - 0x1c8]
push ebx
lea eax, [ebp - 0x198]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x27
call fcn.00406a10
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x25
push edx
call esi
lea eax, [ebp - 0x50]
push str.type
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x50]
mov word [ebp - 0x128], bx
push ecx
lea ecx, [ebp - 0x128]
call fcn.00406940
push str.type
lea ecx, [ebp - 0x118]
mov word [ebp - 0x118], bx
call fcn.00406940
lea edx, [ebp - 0x128]
push ebx
lea eax, [ebp - 0x118]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2a
call fcn.00406a10
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0x128]
mov byte [ebp - 4], 0x28
push edx
call esi
lea eax, [ebp - 0x44]
push str.format
push eax
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov ecx, dword [ebp - 0x44]
mov word [ebp - 0xc0], bx
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00406940
push str.format
lea ecx, [ebp - 0x148]
mov word [ebp - 0x148], bx
call fcn.00406940
lea edx, [ebp - 0xc0]
push ebx
lea eax, [ebp - 0x148]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2d
call fcn.00406a10
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x30], eax
push ecx
call esi
lea edx, [ebp - 0xc0]
push edx
call esi
mov word [ebp - 0xa8], bx
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0x2e
call fcn.0046d400
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x2f
push ecx
push eax
push str.appendChild
lea ecx, [ebp - 0xac]
call fcn.00406990
lea edx, [ebp - 0x90]
mov dword [ebp - 0xb0], eax
push edx
mov byte [ebp - 4], 0x2e
call esi
cmp dword [ebp - 0xb0], ebx
jl 0x49da7f
cmp word [ebp - 0xa8], 9
jne 0x49da7f
cmp dword [ebp - 0xa0], ebx
je 0x49da7f
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xa0]
push eax
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xa8]
push ecx
call esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49dab1
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49dab1
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x50]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49dada
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49dada
mov edx, dword [ebp - 0x50]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49db03
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49db03
mov edx, dword [ebp - 0x20]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x5c]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49db2c
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49db2c
mov edx, dword [ebp - 0x5c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x4c]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49db55
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49db55
mov edx, dword [ebp - 0x4c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x48]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49db7e
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49db7e
mov edx, dword [ebp - 0x48]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x24]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49dba7
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49dba7
mov edx, dword [ebp - 0x24]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x18]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49dbd0
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49dbd0
mov edx, dword [ebp - 0x18]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
call fcn.0042ca10
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xf
call fcn.0042ca10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x49d5b0
lea ecx, [ebp - 0x34]
call fcn.00427790
lea ecx, [ebp + 8]
call fcn.00427790
push str.item
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], bx
call fcn.00406940
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc0]
push eax
push ecx
push str.selectNodes
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x32
call fcn.004080f0
lea edx, [ebp - 0xc0]
mov dword [ebp - 0x98], eax
push edx
mov byte [ebp - 4], 0x31
call esi
cmp dword [ebp - 0x98], ebx
jl 0x49dc6b
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x49dc6b
push eax
lea ecx, [ebp - 0x34]
call fcn.004080d0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x30
call fcn.0042ca10
push ebx
push str.removeAll
lea ecx, [ebp - 0x34]
call fcn.004a0530
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x38], eax
call fcn.00427790
lea ecx, [ebp + 8]
call fcn.00427790
push str.item
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], bx
call fcn.00406940
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc0]
push eax
push ecx
push str.selectNodes
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x35
call fcn.004080f0
lea edx, [ebp - 0xc0]
mov dword [ebp - 0xb0], eax
push edx
mov byte [ebp - 4], 0x34
call esi
cmp dword [ebp - 0xb0], ebx
jl 0x49dcf9
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x49dcf9
push eax
lea ecx, [ebp - 0x60]
call fcn.004080d0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x33
call fcn.0042ca10
mov dword [ebp + 8], ebx
xor edi, edi
mov word [ebp - 0x74], bx
lea eax, [ebp - 0x74]
lea ecx, [ebp - 0x60]
push eax
push str.length
mov byte [ebp - 4], 0x36
call fcn.00469ae0
cmp eax, ebx
mov dword [ebp - 0x64], eax
jl 0x49dd34
cmp word [ebp - 0x74], 3
jne 0x49dd34
mov edi, dword [ebp - 0x6c]
lea ecx, [ebp - 0x74]
push ecx
call esi
cmp dword [ebp + 8], edi
jge 0x49e3fd
lea ecx, [ebp - 0x2c]
call fcn.00427790
lea ecx, [ebp - 0x54]
call fcn.00427790
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, ebx
jl 0x49e3dd
lea ecx, [ebp - 0x18]
call fcn.00427790
mov edx, dword [ebp + 8]
mov word [ebp - 0xc0], 3
mov dword [ebp - 0xb8], edx
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0xc0]
push eax
push ecx
push str.item
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x3a
call fcn.004080f0
lea edx, [ebp - 0xc0]
mov dword [ebp - 0x64], eax
push edx
mov byte [ebp - 4], 0x39
call esi
cmp dword [ebp - 0x64], ebx
jl 0x49ddc0
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x49ddc0
push eax
lea ecx, [ebp - 0x54]
call fcn.004080d0
mov edi, 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x38
call fcn.0042ca10
cmp edi, ebx
je 0x49e3dd
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov edi, dword [eax + 0x108]
call fcn.00427790
push str.item
lea ecx, [ebp - 0x148]
mov word [ebp - 0x148], bx
call fcn.00406940
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x148]
push ecx
push edx
push str.createElement
lea ecx, [edi + 4]
mov byte [ebp - 4], 0x3c
call fcn.004080f0
mov dword [edi + 8], eax
lea eax, [ebp - 0x148]
push eax
mov byte [ebp - 4], 0x3b
call esi
cmp dword [edi + 8], ebx
jl 0x49de3d
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x49de3d
push eax
lea ecx, [ebp - 0x2c]
call fcn.004080d0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x38
call fcn.0042ca10
lea ecx, [ebp - 0x10]
push 0x50e548
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
push edx
mov word [ebp - 0x118], bx
call fcn.00406940
push 0x50e548
lea ecx, [ebp - 0x128]
mov word [ebp - 0x128], bx
call fcn.00406940
lea eax, [ebp - 0x118]
push ebx
lea ecx, [ebp - 0x128]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3f
call fcn.00406a10
lea edx, [ebp - 0x128]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x3d
push eax
call esi
lea ecx, [ebp - 0x20]
push str.title
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x198]
push edx
mov word [ebp - 0x198], bx
call fcn.00406940
push str.title
lea ecx, [ebp - 0x1c8]
mov word [ebp - 0x1c8], bx
call fcn.00406940
lea eax, [ebp - 0x198]
push ebx
lea ecx, [ebp - 0x1c8]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x42
call fcn.00406a10
lea edx, [ebp - 0x1c8]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x198]
mov byte [ebp - 4], 0x40
push eax
call esi
lea ecx, [ebp - 0x1c]
push 0x519544
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x1c]
mov word [ebp - 0x178], bx
push edx
lea ecx, [ebp - 0x178]
call fcn.00406940
push 0x519544
lea ecx, [ebp - 0x108]
mov word [ebp - 0x108], bx
call fcn.00406940
lea eax, [ebp - 0x178]
push ebx
lea ecx, [ebp - 0x108]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x45
call fcn.00406a10
lea edx, [ebp - 0x108]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0x43
push eax
call esi
lea ecx, [ebp - 0x50]
push str.author
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x158]
push edx
mov word [ebp - 0x158], bx
call fcn.00406940
push str.author
lea ecx, [ebp - 0x1fc]
mov word [ebp - 0x1fc], bx
call fcn.00406940
lea eax, [ebp - 0x158]
push ebx
lea ecx, [ebp - 0x1fc]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x48
call fcn.00406a10
lea edx, [ebp - 0x1fc]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x46
push eax
call esi
lea ecx, [ebp - 0x44]
push str.special
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x138]
push edx
mov word [ebp - 0x138], bx
call fcn.00406940
push str.special
lea ecx, [ebp - 0x1e8]
mov word [ebp - 0x1e8], bx
call fcn.00406940
lea eax, [ebp - 0x138]
push ebx
lea ecx, [ebp - 0x1e8]
push eax
mov byte [ebp - 4], 0x4b
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
call fcn.00406a10
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 0x49
push eax
call esi
lea ecx, [ebp - 0x5c]
push str.bits
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1d8]
push edx
mov word [ebp - 0x1d8], bx
call fcn.00406940
push str.bits
lea ecx, [ebp - 0x1b8]
mov word [ebp - 0x1b8], bx
call fcn.00406940
lea eax, [ebp - 0x1d8]
push ebx
lea ecx, [ebp - 0x1b8]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x4e
call fcn.00406a10
lea edx, [ebp - 0x1b8]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x4c
push eax
call esi
lea ecx, [ebp - 0x4c]
push str.type
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x168]
push edx
mov word [ebp - 0x168], bx
call fcn.00406940
push str.type
lea ecx, [ebp - 0x1a8]
mov word [ebp - 0x1a8], bx
call fcn.00406940
lea eax, [ebp - 0x168]
push ebx
lea ecx, [ebp - 0x1a8]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x51
call fcn.00406a10
lea edx, [ebp - 0x1a8]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x4f
push eax
call esi
push str.format
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004086e0
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x90]
push edx
mov word [ebp - 0x90], bx
call fcn.00406940
push str.format
lea ecx, [ebp - 0x188]
mov word [ebp - 0x188], bx
call fcn.00406940
lea eax, [ebp - 0x90]
push ebx
lea ecx, [ebp - 0x188]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x54
call fcn.00406a10
lea edx, [ebp - 0x188]
mov dword [ebp - 0x30], eax
push edx
call esi
lea eax, [ebp - 0x90]
push eax
call esi
mov word [ebp - 0xa8], bx
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x55
push ecx
lea ecx, [ebp - 0x20c]
call fcn.0046d400
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x94]
push edx
push eax
push str.appendChild
mov byte [ebp - 4], 0x56
call fcn.00406990
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 4], 0x55
call esi
cmp dword [ebp - 0x98], ebx
jl 0x49e27e
cmp word [ebp - 0xa8], 9
jne 0x49e27e
cmp dword [ebp - 0xa0], ebx
je 0x49e27e
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xa0]
push eax
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xa8]
push ecx
call esi
mov eax, dword [ebp - 0x48]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49e2b8
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e2be
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
jmp 0x49e2be
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [ebp - 0x4c]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e2e7
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e2e7
mov edx, dword [ebp - 0x4c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x5c]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e310
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e310
mov edx, dword [ebp - 0x5c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x44]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e339
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e339
mov edx, dword [ebp - 0x44]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x50]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e362
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e362
mov edx, dword [ebp - 0x50]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e38b
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e38b
mov edx, dword [ebp - 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e3b4
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e3b4
mov edx, dword [ebp - 0x20]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x10]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49e3dd
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49e3dd
mov edx, dword [ebp - 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x37
call fcn.0042ca10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x33
call fcn.0042ca10
inc dword [ebp + 8]
jmp 0x49dd08
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x108]
mov eax, dword [0x50d0e0]
mov dword [ebp + 8], eax
mov ecx, dword [edi]
mov byte [ebp - 4], 0x57
cmp dword [ecx - 8], ebx
jle 0x49e425
push edi
lea ecx, [ebp + 8]
call fcn.00402090
mov eax, dword [ebp + 8]
cmp dword [eax - 8], ebx
jle 0x49e468
mov ecx, dword [edi + 4]
add edi, 4
cmp ecx, ebx
je 0x49e468
push eax
lea ecx, [ebp - 0x90]
mov word [ebp - 0x90], bx
call fcn.00406940
lea edx, [ebp - 0x90]
push ebx
push edx
push str.Save
mov ecx, edi
mov byte [ebp - 4], 0x58
call fcn.00406990
lea eax, [ebp - 0x90]
push eax
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x33
call fcn.00402160
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x49e484
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x7c], ebx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x30
call fcn.0042ca10
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.0042ca10
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0xc
call fcn.0042ca10
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.0042ca10
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49e4e4
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x49e4e4
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 6
call fcn.0042ca10
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0x59
call fcn.0042ca10
lea ecx, [ebp - 0x80]
call fcn.00402160
jmp case.0x49ce80.221
lea ecx, [ebp - 0x34]
call fcn.00427790
mov edx, dword [esi + 0x10c]
xor ebx, ebx
lea ecx, [ebp - 0x38]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [ebp - 4], 0x5a
call fcn.004a9f10
test eax, eax
je 0x49e612
add edi, 0xffffff21
mov word [ebp - 0x188], 3
mov dword [ebp - 0x180], edi
push str.order
lea ecx, [ebp - 0x90]
mov word [ebp - 0x90], bx
call fcn.00406940
lea eax, [ebp - 0x188]
push ebx
lea ecx, [ebp - 0x90]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x5c
call fcn.00406a10
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x90]
push edx
mov dword [ebp - 0x38], eax
call edi
lea eax, [ebp - 0x188]
push eax
call edi
mov eax, dword [0x50d0e0]
mov esi, dword [esi + 0x108]
mov dword [ebp + 8], eax
mov ecx, dword [esi]
mov byte [ebp - 4], 0x5d
cmp dword [ecx - 8], ebx
jle 0x49e5c7
push esi
lea ecx, [ebp + 8]
call fcn.00402090
mov eax, dword [ebp + 8]
cmp dword [eax - 8], ebx
jle 0x49e60a
mov ecx, dword [esi + 4]
add esi, 4
cmp ecx, ebx
je 0x49e60a
push eax
lea ecx, [ebp - 0x90]
mov word [ebp - 0x90], bx
call fcn.00406940
lea edx, [ebp - 0x90]
push ebx
push edx
push str.Save
mov ecx, esi
mov byte [ebp - 4], 0x5e
call fcn.00406990
lea eax, [ebp - 0x90]
push eax
call edi
lea ecx, [ebp + 8]
call fcn.00402160
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.0042ca10
jmp case.0x49ce80.221
mov eax, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
push 0x100c
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, esi
call fcn.004b1a50
jmp case.0x49ce80.221
mov eax, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
push 0x100c
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x69
mov ecx, esi
call fcn.004b1250
jmp case.0x49ce80.221
mov eax, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
push 0x100c
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je case.0x49ce80.221
mov ecx, dword [0x50d0e0]
mov dword [ebp + 8], ecx
mov edx, dword [esi + 0xcc]
xor ebx, ebx
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0xf4]
mov dword [ebp - 0xf8], ebx
rep stosd dword es:[edi], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0x5f
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xf0], 2
call fcn.00406cd0
mov edi, 0x100
lea ecx, [ebp + 8]
push edi
mov dword [ebp - 0xe0], edi
call fcn.004569b0
cmp eax, ebx
mov dword [ebp - 0xe4], eax
je 0x49e73b
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [edx + 4]
push ecx
push 0x1073
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [edi - 1]
mov dword [ebp - 0x24], eax
cmp eax, ecx
jl 0x49e73f
add edi, edi
lea ecx, [ebp + 8]
push edi
mov dword [ebp - 0xe0], edi
call fcn.004569b0
cmp eax, ebx
mov dword [ebp - 0xe4], eax
jne 0x49e6f9
xor edi, edi
jmp 0x49e742
mov edi, dword [ebp - 0x24]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00407e30
cmp edi, ebx
je 0x49e824
push ebx
push str.taskid:
lea ecx, [ebp + 8]
call fcn.00414af0
test eax, eax
jl 0x49e824
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
mov eax, dword [edx - 8]
add eax, 0xfffffff9
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004071a0
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x60
push ecx
call fcn.004debd7
push 0x268
mov dword [ebp - 0x10], eax
call fcn.004de48f
add esp, 8
mov edx, eax
mov ecx, 0x9a
xor eax, eax
push 1
mov edi, edx
push 0x268
mov dword [ebp - 0x24], edx
push edx
mov edx, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x13c]
push edx
call fcn.00495eb0
mov edi, dword [ebp - 0x24]
test eax, eax
jle 0x49e7ea
cmp byte [edi + 0x57], 1
jne 0x49e7d9
mov eax, dword [ebp - 0x10]
push 2
push eax
jmp 0x49e7df
mov ecx, dword [ebp - 0x10]
push 1
push ecx
mov ecx, dword [esi + 0x13c]
call fcn.00495f90
cmp edi, ebx
je 0x49e7f7
push edi
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49e824
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x49e824
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp + 8]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je case.0x49ce80.221
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg case.0x49ce80.221
mov edx, dword [ebp + 8]
add edx, 0xfffffff4
push edx
call fcn.004de3a6
add esp, 4
jmp case.0x49ce80.221
mov esi, dword [esi + 0x13c]
xor ebx, ebx
cmp esi, ebx
je case.0x49ce80.221
cmp edi, 0xfe
mov ecx, esi
setne al
inc eax
push eax
push ebx
call fcn.00495f90
jmp case.0x49ce80.221
mov eax, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
push 0x100c
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je case.0x49ce80.221
mov edx, dword [0x50d0e0]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi + 0xcc]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0xf4]
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 4], 0x61
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xf0], 2
call fcn.00406cd0
mov edi, 0x100
lea ecx, [ebp - 0x1c]
push edi
mov dword [ebp - 0xe0], edi
call fcn.004569b0
cmp eax, ebx
mov dword [ebp - 0xe4], eax
je 0x49e94d
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xf8]
push ecx
mov ecx, dword [eax + 4]
push edx
push 0x1073
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [edi - 1]
mov dword [ebp - 0x18], eax
cmp eax, edx
jl 0x49e951
add edi, edi
lea ecx, [ebp - 0x1c]
push edi
mov dword [ebp - 0xe0], edi
call fcn.004569b0
cmp eax, ebx
mov dword [ebp - 0xe4], eax
jne 0x49e90b
xor edi, edi
jmp 0x49e954
mov edi, dword [ebp - 0x18]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.00407e30
cmp edi, ebx
je 0x49ede6
push ebx
push str.taskid:
lea ecx, [ebp - 0x1c]
call fcn.00414af0
test eax, eax
jl 0x49ede6
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 8]
add eax, 0xfffffff9
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004071a0
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], 0x62
push edx
call fcn.004debd7
push 0x268
mov dword [ebp + 8], eax
call fcn.004de48f
mov edx, eax
add esp, 8
mov ecx, 0x9a
xor eax, eax
mov edi, edx
push 1
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x13c]
push 0x268
push edx
push eax
mov dword [ebp - 0x14], edx
call fcn.00495eb0
cmp eax, ebx
jle 0x49edce
mov ecx, dword [0x50d0e0]
mov dword [ebp + 8], ecx
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 0x63
mov edx, dword [edi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
jbe 0x49eb8f
mov ax, word [edi + 0x5c]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push eax
call esi
cmp ax, 1
jbe 0x49eb9c
mov ecx, dword [0x50d0e0]
lea esi, [edi + 0x5f]
cmp esi, ebx
mov dword [ebp - 0x28], ecx
je 0x49ea5a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, ebx
je 0x49ea5a
push edi
lea ecx, [ebp - 0x28]
call fcn.00402190
test eax, eax
je 0x49ea5a
mov edx, dword [ebp - 0x28]
inc edi
push edi
push esi
push edx
call fcn.00409840
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
call fcn.00407e30
push ebx
push 0x516334
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x64
call fcn.00414af0
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jle 0x49eb07
push eax
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407030
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
cmp ecx, eax
mov byte [ebp - 4], 0x65
je 0x49ead6
cmp dword [ecx - 0xc], ebx
jge 0x49eaab
mov edx, dword [0x50d0e4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x49eab0
cmp dword [eax - 0xc], ebx
jge 0x49eabf
mov ecx, dword [eax - 8]
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.004021f0
jmp 0x49ead6
lea ecx, [ebp + 8]
call fcn.00402350
mov esi, dword [esi]
mov dword [ebp + 8], esi
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49eb4f
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49eb4f
mov eax, dword [ebp - 0xc8]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
jmp 0x49eb4f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
je 0x49eb4f
cmp dword [ecx - 0xc], ebx
jge 0x49eb23
mov edx, dword [0x50d0e4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x49eb28
cmp dword [eax - 0xc], ebx
jge 0x49eb37
mov ecx, dword [eax - 8]
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.004021f0
jmp 0x49eb4f
lea ecx, [ebp + 8]
call fcn.00402350
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [ebp + 8]
push 1
push ebx
push ebx
push edx
push str.explore
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x28]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49eb8c
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x49eb8c
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff4
push edx
call fcn.004de3a6
add esp, 4
mov edi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
call fcn.00402160
jmp 0x49edd1
mov ax, word [edi + 0x5c]
push eax
call esi
cmp ax, 1
jne 0x49eb8f
mov ecx, dword [0x50d0e0]
lea esi, [edi + 0x5f]
cmp esi, ebx
mov dword [ebp - 0x28], ecx
je 0x49ebef
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, ebx
je 0x49ebec
push edi
lea ecx, [ebp - 0x28]
call fcn.00402190
test eax, eax
je 0x49ebec
mov edx, dword [ebp - 0x28]
inc edi
push edi
push esi
push edx
call fcn.00409840
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
call fcn.00407e30
mov edi, dword [ebp - 0x14]
push ebx
push 0x516334
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x66
call fcn.00414af0
cmp eax, ebx
jle 0x49ec9e
push eax
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407030
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
cmp ecx, eax
mov byte [ebp - 4], 0x67
je 0x49ec65
cmp dword [ecx - 0xc], ebx
jge 0x49ec3a
mov edx, dword [0x50d0e4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x49ec3f
cmp dword [eax - 0xc], ebx
jge 0x49ec4e
mov ecx, dword [eax - 8]
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.004021f0
jmp 0x49ec65
lea ecx, [ebp + 8]
call fcn.00402350
mov esi, dword [esi]
mov dword [ebp + 8], esi
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [0x50d0e4]
mov byte [ebp - 4], 0x66
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x49ecf3
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x49ecf3
mov eax, dword [ebp - 0xcc]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
jmp 0x49ecf3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
je 0x49ecf3
cmp dword [eax - 0xc], ebx
jge 0x49ecba
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x49ecbf
cmp dword [ecx - 0xc], ebx
jge 0x49ecd6
push ecx
lea ecx, [ebp - 0x28]
call fcn.00442710
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp + 8]
call fcn.004021f0
jmp 0x49ecf3
lea ecx, [ebp + 8]
call fcn.00402350
mov edx, dword [ebp - 0x28]
lea ecx, [ebp + 8]
mov dword [ebp + 8], edx
call fcn.00442710
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp + 8]
lea ecx, [ebp - 0x20]
push eax
call fcn.0040bd90
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x68
call fcn.00406cd0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp + 8]
call fcn.00402090
lea ecx, [ebp + 8]
call fcn.00406cb0
test eax, eax
jle 0x49edb4
lea ecx, [ebp - 0x20]
call fcn.00406cd0
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
cmp edx, eax
jne 0x49ed82
mov eax, dword [edi + 0x40]
mov ecx, dword [edi + 0x38]
cmp ecx, eax
jne 0x49ed82
cmp eax, ebx
je 0x49ed82
lea ecx, [ebp + 8]
call fcn.00406cb0
push eax
lea ecx, [ebp + 8]
call fcn.00407d70
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49ed73
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push eax
push str._select___s._mv
push ecx
jmp 0x49ed8f
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edx
push str._select___s
push eax
jmp 0x49ed8f
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x20]
push ecx
push str._select___s._mv
push edx
call fcn.004074f0
add esp, 0xc
lea ecx, [ebp - 0x20]
push 5
push ebx
call fcn.00473390
push eax
push str.Explorer.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x20]
call fcn.00402160
lea ecx, [ebp - 0x28]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
jmp 0x49edd1
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x49edde
push edi
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x1c]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
xor ebx, ebx
cmp eax, ebx
jge 0x49ee0f
xor eax, eax
jmp 0x4a03ef
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00406830
push 0x104
lea ecx, [ebp - 0x61c]
push ebx
push ecx
call fcn.00406830
lea edx, [ebp - 0x414]
push 0x104
push edx
push 0x9d01
call fcn.00432b50
lea eax, [ebp - 0x61c]
push 0x104
push eax
push 0xa77f
call fcn.00432b50
mov eax, dword [esi + 8]
add esp, 0x30
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x61c]
push 0x121
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x49ee8b
xor eax, eax
jmp 0x4a03ef
lea ecx, [esi + 0x144]
call fcn.004bcc70
mov edi, dword [esi + 0x140]
push 2
inc edi
push 0xffffffffffffffff
mov dword [esi + 0x140], edi
mov ecx, dword [esi + 0xcc]
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x18], edi
je 0x49f123
lea ecx, [ebp - 0x1c]
call fcn.00406b40
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x69
push ecx
mov ecx, dword [esi + 0xcc]
push 2
push edi
call fcn.00473020
test eax, eax
je 0x49f0f8
push str.taskid:
lea ecx, [ebp - 0x1c]
call fcn.004a0690
test eax, eax
jl 0x49f0f8
lea ecx, [ebp - 0x1c]
call fcn.00406cb0
sub eax, 7
lea edx, [ebp - 0x48]
push eax
push edx
lea ecx, [ebp - 0x1c]
call fcn.004071a0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x6a
call fcn.00473390
push eax
call fcn.004debd7
push 0x268
mov dword [ebp - 0x24], eax
call fcn.004de48f
add esp, 8
mov ecx, dword [esi + 0x13c]
mov dword [ebp - 0x14], eax
push ebx
push 0x268
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.00495eb0
cmp eax, ebx
jle 0x49f033
cmp dword [esi + 0x14], ebx
je 0x49ef9f
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xf7]
mov byte [ebp - 0xf8], bl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x14]
push 0x28
lea edx, [ebp - 0xf8]
push ecx
push edx
call fcn.004de950
mov ecx, dword [esi + 0x14]
add esp, 0xc
lea edx, [ebp - 0xf8]
mov eax, dword [ecx]
push ebx
push edx
push 0x52c
call dword [eax]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.004a06c0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x6b
mov al, byte [eax + 0x5a]
cmp al, 3
je 0x49efc0
cmp al, 1
mov dword [ebp - 0x40], 2
jne 0x49efc7
mov dword [ebp - 0x40], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x5f
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040b220
push 0x7c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x6c
call fcn.004a0660
lea edx, [ebp - 0x1ec]
push eax
push edx
lea ecx, [ebp - 0x10]
call fcn.00407030
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x6d
call fcn.00402090
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x6c
call fcn.00402160
lea eax, [ebp - 0x40]
lea ecx, [esi + 0x144]
push eax
call fcn.004bcad0
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x6a
call fcn.004a0810
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x49f045
mov ecx, eax
push ecx
call fcn.004de3a6
add esp, 4
mov ecx, dword [esi + 0xcc]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esi + 0xcc]
call fcn.004bbed0
cmp edi, eax
mov dword [ebp - 0x18], eax
jge 0x49f0c3
lea ecx, [ebp - 0x20]
call fcn.00406b40
mov ecx, dword [esi + 0xcc]
lea eax, [ebp - 0x20]
push eax
push 2
push edi
mov byte [ebp - 4], 0x6e
call fcn.00473020
push str.tindex:
lea ecx, [ebp - 0x20]
call fcn.004a0690
test eax, eax
jl 0x49f0b7
mov ecx, dword [esi + 0xcc]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x6a
call fcn.00402160
mov eax, dword [ebp - 0x18]
dec eax
cmp edi, eax
mov dword [ebp - 0x18], eax
jl 0x49f063
jmp 0x49f0c3
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x6a
call fcn.00402160
mov edi, dword [ebp - 0x24]
mov eax, dword [esi + 0x154]
cmp edi, eax
jne 0x49f0e2
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x49f0e2
mov eax, dword [ecx]
push ebx
push edi
push 0x582
call dword [eax]
mov ecx, dword [esi + 0x13c]
push 3
push edi
call fcn.00495f90
lea ecx, [ebp - 0x48]
call fcn.00402160
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402160
cmp dword [esi + 0x140], 1
jle 0x49ee96
mov dword [esi + 0x140], 5
jmp 0x49ee96
lea ecx, [esi + 0x144]
call fcn.00428d90
test eax, eax
jbe case.0x49ce80.221
cmp dword [ebp + 8], 0xea
jne case.0x49ce80.221
push esi
push ebx
push 0x4b8f50
call fcn.004df750
add esp, 0xc
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp - 0x1c]
call fcn.00406b40
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x6f
push ecx
mov ecx, dword [esi + 0xcc]
push 2
push edi
call fcn.00473020
test eax, eax
je 0x49f5c9
push str.taskid:
lea ecx, [ebp - 0x1c]
call fcn.004a0690
test eax, eax
jl 0x49f5c9
lea ecx, [ebp - 0x1c]
call fcn.00406cb0
sub eax, 7
lea edx, [ebp - 0x4c]
push eax
push edx
lea ecx, [ebp - 0x1c]
call fcn.004071a0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x70
call fcn.00473390
push eax
call fcn.004debd7
mov ebx, eax
push 0x268
mov dword [ebp - 0x24], ebx
call fcn.004de48f
add esp, 8
mov edx, eax
mov ecx, 0x9a
xor eax, eax
mov edi, edx
push 1
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x13c]
push 0x268
push edx
push ebx
mov dword [ebp + 8], edx
call fcn.00495eb0
xor ebx, ebx
cmp eax, ebx
jle 0x49f5b1
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
add eax, 0x5f
push eax
call fcn.0040b220
push 0x7c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x71
call fcn.004a0660
lea ecx, [ebp - 0x20]
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00407030
push 0x104
lea edx, [ebp - 0x61c]
push ebx
push edx
mov byte [ebp - 4], 0x72
call fcn.00406830
lea eax, [ebp - 0x61c]
push 0x104
push eax
push 0x9d9f
call fcn.00432b50
push 0x104
lea ecx, [ebp - 0x414]
push ebx
push ecx
call fcn.00406830
lea edx, [ebp - 0x414]
push 0x104
push edx
push 0x9d95
call fcn.00432b50
push 0x208
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.00406830
add esp, 0x3c
lea ecx, [ebp - 0x20]
push 0x5c
call fcn.0044ca20
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp - 0x14]
dec eax
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.004071a0
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 0x73
mov al, byte [edi + 0x5a]
cmp al, 3
je 0x49f330
cmp al, 1
je 0x49f330
lea ecx, [ebp - 0x14]
call fcn.00473390
lea edx, [ebp - 0xa2c]
push eax
push edx
call fcn.004df3e0
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0x9d95
call fcn.00432b50
lea ecx, [ebp - 0x414]
push ecx
call fcn.004debba
lea eax, [ebp + eax*2 - 0x412]
push str..torrent
push eax
call fcn.004df3b6
add esp, 0x20
jmp 0x49f3a3
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.0044ca20
lea edx, [ebp - 0x18]
push eax
push edx
lea ecx, [ebp - 0x14]
call fcn.00407030
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x74
call fcn.00473390
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004df3e0
lea ecx, [ebp - 0x414]
push 0x104
push ecx
push 0xa78c
call fcn.00432b50
lea edx, [ebp - 0x414]
push edx
call fcn.004debba
lea eax, [ebp + eax*2 - 0x412]
push str..qsed
push eax
call fcn.004df3b6
add esp, 0x20
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x73
call fcn.00402160
push 0x81800
lea eax, [ebp - 0xa2c]
push 0x208
lea ecx, [ebp - 0x414]
push eax
mov eax, dword [esi + 8]
lea edx, [ebp - 0x61c]
push ecx
push edx
push eax
call fcn.004a8a50
add esp, 0x18
cmp eax, ebx
jle 0x49f597
cmp dword [esi + 0x13c], ebx
je 0x49f597
mov al, byte [edi + 0x5a]
cmp al, 3
je 0x49f434
cmp al, 1
je 0x49f434
lea ecx, [ebp - 0xa2c]
push 0x50fcac
push ecx
call fcn.004a0510
add esp, 8
test eax, eax
jne 0x49f419
lea edx, [ebp - 0xa2c]
push 0x50fcac
push edx
call fcn.004df3b6
add esp, 8
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0xa2c]
push eax
push ecx
mov ecx, dword [esi + 0x13c]
call fcn.00495fc0
jmp 0x49f597
lea edx, [ebp - 0xa2c]
push 0x514560
push edx
call fcn.004a0510
add esp, 8
cmp eax, ebx
jne 0x49f460
lea eax, [ebp - 0xa2c]
push 0x514560
push eax
call fcn.004df3b6
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00473390
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x49f474
mov dword [ebp - 0x18], ebx
jmp 0x49f49b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004ded50
mov ecx, dword [ebp - 0x18]
mov eax, esp
push edi
push ecx
push eax
call fcn.004068a0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [edx + 0x34]
push eax
call edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov edx, dword [ecx + 0x38]
push edx
call edi
mov edi, eax
mov eax, dword [ebp - 0x38]
push 1
push ebx
push ebx
push eax
call fcn.004df990
add eax, edi
mov ecx, 0xa
mov dword [ebp - 0x38], eax
mov eax, 0
lea edi, [ebp - 0xf8]
push 0x28
adc edx, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xf8]
push edi
push ecx
mov dword [ebp - 0x34], edx
call fcn.004de950
add edi, 0x5f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
add edi, 0x230
push edi
call fcn.004de48f
mov edx, eax
mov ecx, edi
mov dword [ebp - 0x24], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [ebp - 0x34]
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xf8]
push eax
mov eax, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x24]
push edx
push eax
push str.qvod:___I64d_s_s_r_n
push ecx
call fcn.004df42f
mov edx, dword [ebp - 0x24]
add esp, 0x28
lea ecx, [ebp - 0x48]
push edx
call fcn.0040b220
push ecx
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 0x75
call fcn.0040bd90
mov byte [ebp - 4], 0x76
push ecx
lea edx, [ebp - 0xa2c]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
call fcn.00406b50
mov ecx, esi
mov byte [ebp - 4], 0x75
call fcn.004bb390
lea ecx, [ebp - 0x48]
call fcn.00402160
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp - 0x20]
call fcn.00402160
lea ecx, [ebp - 0x10]
call fcn.00402160
jmp 0x49f5b4
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x49f5c1
push edi
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.00402160
lea ecx, [ebp - 0x1c]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
mov ecx, dword [esi + 0xcc]
lea eax, [ebp + 8]
push eax
push 2
push edi
mov dword [ebp - 4], 0x77
call fcn.00473020
test eax, eax
je 0x49f6db
push str.taskid:
lea ecx, [ebp + 8]
call fcn.004a0690
test eax, eax
jl 0x49f6db
lea ecx, [ebp + 8]
call fcn.00406cb0
sub eax, 7
lea ecx, [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.004071a0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x78
call fcn.00473390
push eax
call fcn.004debd7
push 0x268
mov ebx, eax
call fcn.004de48f
add esp, 8
mov edx, eax
mov ecx, 0x9a
xor eax, eax
mov edi, edx
push 1
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x13c]
push 0x268
push edx
push ebx
mov dword [ebp - 0x18], edx
call fcn.00495eb0
test eax, eax
jle 0x49f6d3
mov edx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xf7]
mov byte [ebp - 0xf8], bl
rep stosd dword es:[edi], eax
push 0x28
lea eax, [ebp - 0xf8]
push edx
push eax
call fcn.004de950
mov ecx, dword [esi + 0x14]
add esp, 0xc
cmp ecx, ebx
je 0x49f6d3
mov edx, dword [ecx]
lea eax, [ebp - 0xf8]
push ebx
push eax
push 0x52b
call dword [edx]
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0x79
push ecx
mov ecx, dword [esi + 0xcc]
push 2
push edi
call fcn.00473020
test eax, eax
je 0x49f781
push str.taskid:
lea ecx, [ebp + 8]
call fcn.004a0690
test eax, eax
jl 0x49f781
lea ecx, [ebp + 8]
call fcn.00406cb0
sub eax, 7
lea edx, [ebp - 0x10]
push eax
push edx
lea ecx, [ebp + 8]
call fcn.004071a0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x7a
call fcn.00473390
push eax
call fcn.004debd7
mov ecx, dword [esi + 0x14]
xor ebx, ebx
add esp, 4
cmp ecx, ebx
je 0x49f779
mov edx, dword [ecx]
push ebx
push eax
push 0x51c
call dword [edx]
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xd4]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
mov ecx, dword [esi + 0xd4]
lea eax, [ebp + 8]
push eax
push 1
push edi
mov dword [ebp - 4], 0x7b
call fcn.00473020
test eax, eax
je 0x49f8ad
lea ecx, [ebp + 8]
call fcn.00406cb0
test eax, eax
jle 0x49f8ad
lea ecx, [ebp - 0x38]
call fcn.004098a0
xor ebx, ebx
lea ecx, [ebp - 0x38]
push ebx
push ecx
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push edx
mov byte [ebp - 4], 0x7c
call fcn.0040bd90
mov ecx, esi
call fcn.004aaab0
cmp eax, ebx
je 0x49f8a1
lea ecx, [ebp + 8]
call fcn.00406cd0
lea eax, [ebp - 0xc4]
push str.link
push eax
lea ecx, [ebp - 0x38]
call fcn.004086e0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x7d
call fcn.00402090
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x7c
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00406cb0
test eax, eax
jle 0x49f8a1
lea ecx, [ebp - 0x14]
call fcn.00406b40
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
push ecx
push str.http:__js.23nini.com___s
push edx
mov byte [ebp - 4], 0x7e
call fcn.004074f0
mov eax, dword [esi + 0x14]
add esp, 0xc
lea ecx, [ebp - 0x14]
mov edi, dword [eax]
push ebx
call fcn.00406cb0
push eax
lea ecx, [ebp - 0x14]
call fcn.00407d70
mov ecx, dword [esi + 0x14]
push eax
push 0x531
call dword [edi]
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x7b
call fcn.004098b0
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xd8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp - 0x1c]
call fcn.00406b40
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x7f
push ecx
mov ecx, dword [esi + 0xd8]
push 1
push edi
call fcn.00473020
test eax, eax
je 0x49f951
lea ecx, [ebp - 0x1c]
call fcn.00406cb0
test eax, eax
jle 0x49f951
lea ecx, [ebp + 8]
call fcn.00406b40
mov edx, dword [ebp - 0x1c]
lea eax, [ebp + 8]
push edx
push str.http:__js.23nini.com___s
push eax
mov byte [ebp - 4], 0x80
call fcn.004074f0
mov ecx, dword [esi + 0x14]
add esp, 0xc
mov edi, dword [ecx]
push 0
lea ecx, [ebp + 8]
call fcn.00406cb0
push eax
lea ecx, [ebp + 8]
call fcn.00407d70
mov ecx, dword [esi + 0x14]
push eax
push 0x531
call dword [edi]
lea ecx, [ebp + 8]
call fcn.00402160
lea ecx, [ebp - 0x1c]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xd8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
mov ecx, dword [esi + 0xd8]
lea edx, [ebp + 8]
push edx
push 2
push edi
mov dword [ebp - 4], 0x81
call fcn.00473020
test eax, eax
je 0x49f9d8
lea ecx, [ebp + 8]
call fcn.00406cb0
test eax, eax
jle 0x49f9d8
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x49f9d8
mov dword [0x5258e8], ebx
mov dword [0x5258e4], ebx
mov eax, dword [esi + 0x14]
lea ecx, [ebp + 8]
mov edi, dword [eax]
call fcn.00473390
mov ecx, dword [esi + 0x14]
push eax
push 0x31
push 0x574
call dword [edi]
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xd4]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
mov eax, dword [esi + 0xdc]
xor ebx, ebx
cmp eax, ebx
jne case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0x82
push ecx
mov ecx, dword [esi + 0xd4]
push 1
push edi
call fcn.00473020
test eax, eax
je 0x49fb4d
lea ecx, [ebp + 8]
call fcn.00406cb0
test eax, eax
jg 0x49fa53
lea ecx, [ebp + 8]
call fcn.00402160
xor eax, eax
jmp 0x4a03ef
lea ecx, [ebp - 0x40]
call fcn.004098a0
lea edx, [ebp - 0x40]
push 1
push edx
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 0x83
call fcn.0040bd90
mov ecx, esi
call fcn.004aaab0
cmp eax, ebx
je 0x49fb41
mov ecx, dword [esi + 0xd4]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esi + 0xd0]
push ebx
call fcn.00402ba0
mov ecx, dword [esi + 0xd4]
call fcn.004bbed0
mov ecx, dword [esi + 0xd8]
mov edi, eax
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, ebx
jle 0x49fb41
mov ecx, dword [esi + 0xd4]
push ebx
call fcn.004bc040
lea ecx, [ebp - 0x14]
call fcn.00406b40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x84
push ecx
mov ecx, dword [esi + 0xd4]
push 1
push ebx
call fcn.00473020
lea ecx, [ebp - 0x14]
call fcn.00406cb0
test eax, eax
jle 0x49fb39
lea ecx, [ebp - 0x38]
mov dword [esi + 0xe4], ebx
call fcn.004098a0
lea edx, [ebp - 0x38]
push ebx
push edx
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 0x85
call fcn.0040bd90
mov ecx, esi
call fcn.004aaab0
cmp eax, ebx
je 0x49fb2d
lea ecx, [ebp - 0x38]
push ecx
mov ecx, esi
call fcn.004aa6e0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x84
call fcn.004098b0
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x82
call fcn.004098b0
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, esi
call fcn.004b7e40
jmp case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
mov ecx, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
mov dword [ebp - 4], 0x86
call fcn.004bbf90
mov ecx, dword [esi + 0xc8]
lea edx, [ebp + 8]
push edx
push 3
push eax
call fcn.00473020
lea eax, [ebp - 0x24]
push 4
push eax
lea ecx, [ebp + 8]
call fcn.00407030
mov ecx, dword [str.ftp:httprtspmms:]
mov byte [ebp - 4], 0x87
push ecx
lea ecx, [ebp - 0x18]
call fcn.00406b50
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x88
call fcn.00473390
push eax
lea ecx, [ebp - 0x18]
call fcn.004a0690
test eax, eax
jge 0x49fc18
lea ecx, [ebp - 0x10]
call fcn.00406b40
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edx
push str._select___s
push eax
mov byte [ebp - 4], 0x89
call fcn.004074f0
add esp, 0xc
xor ebx, ebx
lea ecx, [ebp - 0x10]
push 5
push ebx
call fcn.00473390
push eax
push str.Explorer.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x18]
call fcn.00402160
lea ecx, [ebp - 0x24]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, esi
call fcn.004b8400
jmp case.0x49ce80.221
mov ecx, esi
call fcn.004b8450
jmp case.0x49ce80.221
push 0xfc
mov ecx, esi
call fcn.004b3e70
jmp case.0x49ce80.221
push 0x100
mov ecx, esi
call fcn.004b3e70
jmp case.0x49ce80.221
push 0x101
mov ecx, esi
call fcn.004b4d40
jmp case.0x49ce80.221
push edi
mov ecx, esi
call fcn.004ba320
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl case.0x49ce80.221
push 0x104
lea ecx, [ebp - 0x61c]
push ebx
push ecx
call fcn.00406830
lea edx, [ebp - 0x61c]
push 0x104
push edx
push 0x9f55
call fcn.00432b50
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00406830
lea ecx, [ebp - 0x414]
push 0x104
push ecx
push 0x9f56
call fcn.00432b50
lea edx, [ebp - 0x414]
push edx
call fcn.004debba
mov ecx, dword [str..lrc]
lea eax, [ebp + eax*2 - 0x412]
push ecx
push eax
call fcn.004df3b6
push 0x208
lea edx, [ebp - 0xa2c]
push ebx
push edx
call fcn.00406830
add esp, 0x48
lea eax, [ebp - 0xa2c]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x61c]
push 0x81800
push 0x208
push eax
mov eax, dword [esi + 8]
push ecx
push edx
push eax
call fcn.004a89d0
add esp, 0x18
cmp eax, ebx
jle case.0x49ce80.221
lea ecx, [ebp - 0x40]
call fcn.004098a0
mov edx, dword [esi + 0x10c]
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [ebp - 4], 0x8a
call fcn.004a9f10
test eax, eax
je 0x49fdd2
lea ecx, [ebp - 0x38]
call fcn.004098a0
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x40]
push eax
push ecx
push edi
mov ecx, esi
mov byte [ebp - 4], 0x8b
call fcn.004aa2d0
test eax, eax
je 0x49fdc6
lea edx, [ebp - 0xa2c]
lea ecx, [ebp - 0x38]
push edx
push 0x51a0c0
call fcn.00408380
mov ecx, dword [esi + 0x108]
push ebx
call fcn.00402ba0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x8a
call fcn.004098b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.004098b0
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl case.0x49ce80.221
lea ecx, [ebp - 0x40]
call fcn.004098a0
mov ecx, dword [esi + 0x10c]
lea eax, [ebp - 0x40]
push ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 4], 0x8c
call fcn.004a9f10
test eax, eax
je 0x49fe71
lea ecx, [ebp - 0x38]
call fcn.004098a0
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x40]
push edx
push eax
push edi
mov ecx, esi
mov byte [ebp - 4], 0x8d
call fcn.004aa2d0
test eax, eax
je 0x49fe65
push 0x5209fc
push 0x51a0c0
lea ecx, [ebp - 0x38]
call fcn.00408380
mov ecx, dword [esi + 0x108]
push ebx
call fcn.00402ba0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x8c
call fcn.004098b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.004098b0
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl case.0x49ce80.221
lea ecx, [ebp - 0x40]
call fcn.004098a0
mov edx, dword [esi + 0x10c]
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [ebp - 4], 0x8e
call fcn.004a9f10
test eax, eax
je 0x4a0014
lea ecx, [ebp - 0x38]
call fcn.004098a0
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x40]
push eax
push ecx
push edi
mov ecx, esi
mov byte [ebp - 4], 0x8f
call fcn.004aa2d0
test eax, eax
je 0x4a0008
lea edx, [ebp + 8]
push 0x50e548
push edx
lea ecx, [ebp - 0x38]
call fcn.004086e0
push 0x5c
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x90
call fcn.0044ca20
lea ecx, [ebp + 8]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp + 8]
dec eax
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004071a0
push 0x2e
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x91
call fcn.0044ca20
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004071a0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x92
call fcn.004a05a0
mov edx, dword [str..qmv_.m4v_.f4v_.tim_.swf_.csf_.scm_.ts_.tp_.mkv_.dat_.vob_.qt_.ram_.wav_.wmv_.asf_.rm_.rmvb_.mov_.avi_.mpg_.mpeg_.mpe_.3gp_.mp2_.mp4_.flv_._mv_.wm_.rp_.rpm_.rt_.rsc_.3gp2_.3gpp_.acc_.aif_.aifc_.aiff_.asx_.bik_.flc_.roq_.d2v_.dsa_.dss_.dsv_.m1v_.m2p_.m2v_.m4b_.mkv_.mod_.ogm_.pmp_.pm2_.pss_.m4p_.mv_.m2ts_.evo_.3g2_.wmp_.wm_.ivf_.rmm_.mjp_.pva_.rat_.dvd_.smk_.tpr_.vg2_.vid_.vp6_.vp7_.amv_.fli_.pmp2_.mts_.drc]
lea ecx, [ebp - 0x18]
push edx
call fcn.00406b50
mov eax, dword [str..smv_.spx_.au_.flac_.ra_.amr_.m4a_.mpga_.mp5_.dsm_.mpa_.mac_.dts_.mpga_.wma_.mp3_.midi_.ac3_.aac_.ogg_.mid_.ape_.cda_.rmi_.tta_.tta]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0x93
call fcn.00406b50
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x94
call fcn.00473390
push eax
lea ecx, [ebp - 0x18]
call fcn.004a0690
test eax, eax
jl 0x49ffae
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
call fcn.0040bd90
push 1
mov ecx, esi
call fcn.004baeb0
jmp 0x49ffe0
lea ecx, [ebp - 0x14]
call fcn.00473390
push eax
lea ecx, [ebp - 0x10]
call fcn.004a0690
test eax, eax
jl 0x49ffe0
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x49ffe0
mov edi, dword [eax]
push ebx
lea ecx, [ebp + 8]
call fcn.00473390
mov ecx, dword [esi + 0x14]
push eax
push 0x528
call dword [edi]
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x18]
call fcn.00402160
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp - 0x1c]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x8e
call fcn.004098b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.004098b0
jmp case.0x49ce80.221
lea ecx, [ebp + 8]
call fcn.00406b40
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 4], 0x95
call fcn.0040bd90
push 0
mov ecx, esi
call fcn.004baeb0
lea ecx, [ebp + 8]
call fcn.00402160
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xc8]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl case.0x49ce80.221
lea ecx, [ebp - 0x40]
call fcn.004098a0
mov edx, dword [esi + 0x10c]
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [ebp - 4], 0x96
call fcn.004a9f10
test eax, eax
je 0x4a019e
lea ecx, [ebp - 0x38]
call fcn.004098a0
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x40]
push eax
push ecx
push edi
mov ecx, esi
mov byte [ebp - 4], 0x97
call fcn.004aa2d0
test eax, eax
je 0x4a0192
lea edx, [ebp + 8]
push 0x50e548
push edx
lea ecx, [ebp - 0x38]
call fcn.004086e0
push 0x5c
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x98
call fcn.0044ca20
lea ecx, [ebp + 8]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp + 8]
dec eax
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004071a0
push 0x2e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x99
call fcn.0044ca20
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp - 0x14]
call fcn.004071a0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x9a
call fcn.004a05a0
mov edx, dword [str..qmv_.m4v_.f4v_.tim_.swf_.csf_.scm_.ts_.tp_.mkv_.dat_.vob_.qt_.ram_.wav_.wmv_.asf_.rm_.rmvb_.mov_.avi_.mpg_.mpeg_.mpe_.3gp_.mp2_.mp4_.flv_._mv_.wm_.rp_.rpm_.rt_.rsc_.3gp2_.3gpp_.acc_.aif_.aifc_.aiff_.asx_.bik_.flc_.roq_.d2v_.dsa_.dss_.dsv_.m1v_.m2p_.m2v_.m4b_.mkv_.mod_.ogm_.pmp_.pm2_.pss_.m4p_.mv_.m2ts_.evo_.3g2_.wmp_.wm_.ivf_.rmm_.mjp_.pva_.rat_.dvd_.smk_.tpr_.vg2_.vid_.vp6_.vp7_.amv_.fli_.pmp2_.mts_.drc]
lea ecx, [ebp - 0x18]
push edx
call fcn.00406b50
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x9b
call fcn.00473390
push eax
lea ecx, [ebp - 0x18]
call fcn.004a0690
test eax, eax
jl 0x4a0172
mov eax, dword [esi + 0x14]
push ebx
lea ecx, [ebp + 8]
mov edi, dword [eax]
call fcn.00473390
mov ecx, dword [esi + 0x14]
push eax
push 0x587
call dword [edi]
lea ecx, [ebp - 0x18]
call fcn.00402160
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp + 8]
call fcn.00402160
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x96
call fcn.004098b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.004098b0
jmp case.0x49ce80.221
mov ecx, dword [esi + 0xcc]
push 2
push 0xffffffffffffffff
call fcn.004bbf90
mov edi, eax
cmp edi, 0xffffffff
je case.0x49ce80.221
lea ecx, [ebp - 0x20]
call fcn.00406b40
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0x9c
push ecx
mov ecx, dword [esi + 0xcc]
push 2
push edi
call fcn.00473020
test eax, eax
je 0x4a0394
push str.taskid:
lea ecx, [ebp - 0x20]
call fcn.004a0690
test eax, eax
jl 0x4a0394
lea ecx, [ebp - 0x20]
call fcn.00406cb0
sub eax, 7
lea edx, [ebp - 0x4c]
push eax
push edx
lea ecx, [ebp - 0x20]
call fcn.004071a0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x9d
call fcn.00473390
push eax
call fcn.004debd7
push 0x268
mov ebx, eax
call fcn.004de48f
add esp, 8
mov edx, eax
mov ecx, 0x9a
xor eax, eax
mov edi, edx
push 1
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x13c]
push 0x268
push edx
push ebx
mov dword [ebp + 8], edx
call fcn.00495eb0
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4a037f
mov ax, word [edi + 0x5c]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 1
ja 0x4a037f
lea ecx, [ebp - 0x44]
call fcn.00406b40
add edi, 0x5f
lea ecx, [ebp - 0x44]
push edi
mov byte [ebp - 4], 0x9e
call fcn.00430190
push 0x7c
lea ecx, [ebp - 0x44]
call fcn.004a0660
lea ecx, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00407030
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x9f
call fcn.0044ca20
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea edx, [ebp - 0x50]
dec eax
lea ecx, [ebp - 0x14]
push eax
push edx
call fcn.004071a0
push 0x2e
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xa0
call fcn.0044ca20
lea ecx, [ebp - 0x50]
mov edi, eax
call fcn.00406cb0
sub eax, edi
lea ecx, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004071a0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa1
call fcn.004a05a0
mov ecx, dword [str..qmv_.m4v_.f4v_.tim_.swf_.csf_.scm_.ts_.tp_.mkv_.dat_.vob_.qt_.ram_.wav_.wmv_.asf_.rm_.rmvb_.mov_.avi_.mpg_.mpeg_.mpe_.3gp_.mp2_.mp4_.flv_._mv_.wm_.rp_.rpm_.rt_.rsc_.3gp2_.3gpp_.acc_.aif_.aifc_.aiff_.asx_.bik_.flc_.roq_.d2v_.dsa_.dss_.dsv_.m1v_.m2p_.m2v_.m4b_.mkv_.mod_.ogm_.pmp_.pm2_.pss_.m4p_.mv_.m2ts_.evo_.3g2_.wmp_.wm_.ivf_.rmm_.mjp_.pva_.rat_.dvd_.smk_.tpr_.vg2_.vid_.vp6_.vp7_.amv_.fli_.pmp2_.mts_.drc]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00406b50
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa2
call fcn.00473390
push eax
lea ecx, [ebp - 0x48]
call fcn.004a0690
test eax, eax
jl 0x4a0354
mov edx, dword [esi + 0x14]
push ebx
lea ecx, [ebp - 0x14]
mov edi, dword [edx]
call fcn.00473390
mov ecx, dword [esi + 0x14]
push eax
push 0x587
call dword [edi]
lea ecx, [ebp - 0x48]
call fcn.00402160
lea ecx, [ebp - 0x10]
call fcn.00402160
lea ecx, [ebp - 0x50]
call fcn.00402160
lea ecx, [ebp - 0x14]
call fcn.00402160
lea ecx, [ebp - 0x44]
call fcn.00402160
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x4a038c
push edi
call fcn.004de3a6
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.00402160
lea ecx, [ebp - 0x20]
call fcn.00402160
jmp case.0x49ce80.221
cmp edi, 0x1072
jb 0x4a03b8
cmp edi, 0x1130
ja 0x4a03b8
push edi
mov ecx, esi
call fcn.004b3e70
jmp case.0x49ce80.221
cmp edi, 0x1131
jb 0x4a03d2
cmp edi, 0x1194
ja 0x4a03d2
push edi
mov ecx, esi
call fcn.004b4d40
jmp case.0x49ce80.221
cmp edi, 0x2009
jb case.0x49ce80.221
cmp edi, 0x206c
ja case.0x49ce80.221
push edi
mov ecx, esi
call fcn.004bb6c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0xa38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4