Function at 0x49e330
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f1e68
mov eax, dword fs:[0]
push eax
mov eax, 0x5850
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x584c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x5864]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x586c], 0
cmp byte [0x103a972], 0
jne 0x49ffa1
cmp dword [0x103a97c], 0x77
jne 0x49e3bc
movzx eax, byte [0x10dc519]
mov ecx, dword [0x10dd278]
mov edx, dword [esp + 0x5874]
push eax
push ecx
push edx
push str.SetInitSendLog__s___s___d_
push 8
call fcn.0043d500
add esp, 0x14
mov eax, dword [esp + 0x5874]
push eax
mov ecx, 0x10dd278
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x49ffa1
cmp byte [0x10dc519], 0
jne 0x49ffa1
lea ecx, [esp + 0x5874]
push ecx
mov ecx, 0x10dd360
call dword [sym.imp.mfc90.dll_Ordinal_817]
push 0
push str..txlog
lea ecx, [esp + 0x587c]
mov byte [0x10dc519], 1
mov byte [esp + 0x33], 0
call dword [sym.imp.mfc90.dll_Ordinal_2481]
cmp eax, 0xffffffff
je 0x49e421
mov byte [esp + 0x2b], 1
lea ebp, [esi + 0x324f4]
push 0xffffffffffffffff
push 0
mov ecx, ebp
mov dword [esp + 0x58], ebp
call sub.mfc90.dll_Ordinal_6494
push 0x1070cd0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x2bff
lea edx, [esp + 0x2c65]
push 0
push edx
mov byte [esp + 0x2c6c], 0
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x5880]
push 0x502a9c
push eax
mov byte [esp + 0x3e], 0
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x49e4bf
push 0x1070cd0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5116d8
mov ecx, 0x10dd360
mov byte [0x10dc519], 0
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov dword [esp + 0x586c], 0xffffffff
lea ecx, [esp + 0x5874]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor al, al
jmp 0x49ffbb
mov edi, dword [sym.imp.MSVCR90.dll_fgets]
push esi
lea ecx, [esp + 0x2c64]
push 0x2c00
push ecx
call edi
xor edx, edx
add esp, 0xc
cmp edx, eax
sbb eax, eax
neg eax
je 0x49e5de
mov bl, 0x2d
jmp 0x49e4f0
cmp byte [0x103a972], 0
jne 0x49e502
test byte [0x1043104], 8
je 0x49e56b
push ecx
lea edx, [esp + 0x2c64]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x5870], 1
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x5874], 0
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x586c], 2
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x2c60]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x49e550
mov byte [esp + 0x586c], cl
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [esp + 0x2c62], bl
jne 0x49e5a9
mov al, byte [esp + 0x2c71]
cmp al, 0x2c
je 0x49e583
cmp al, 0x7c
jne 0x49e5a9
cmp byte [esp + 0x2c77], bl
jne 0x49e5a9
cmp byte [esp + 0x2c80], 0x3a
jne 0x49e5a9
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x2c60]
push ecx
push eax
mov ecx, ebp
call sub.mfc90.dll_Ordinal_6154
push 0x2c00
lea edx, [esp + 0x2c64]
push 0
push edx
call sub.MSVCR90.dll_memset
push esi
lea eax, [esp + 0x2c70]
push 0x2c00
push eax
call edi
xor ecx, ecx
add esp, 0x18
cmp ecx, eax
sbb edx, edx
neg edx
jne 0x49e4f0
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push 0x1070cd0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x14]
call sub.mfc90.dll_Ordinal_580
mov ebp, 3
mov byte [esp + 0x586c], 3
mov eax, dword [esp + 0x48]
cmp dword [eax + 0x324fc], 0
mov byte [esp + 0x37], 0
mov dword [esp + 0x4c], 0
jle 0x49ff6c
mov edi, dword [esp + 0x4c]
lea esi, [ebp + 0x7d]
lea ebx, [ebp - 2]
test edi, edi
jl 0x49fd00
mov ecx, dword [esp + 0x50]
cmp edi, dword [ecx + 8]
jge 0x49fd00
mov edx, ecx
mov eax, dword [edx + 4]
lea eax, [eax + edi*4]
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x586c], 4
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call sub.mfc90.dll_Ordinal_6494
push 0
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x5874], 5
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x505a90
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x587c], 6
mov byte [esp + 0x587c], 4
call fcn.004d90e0
mov eax, dword [esp + 0x2c]
add esp, 0x10
cmp eax, 9
jge 0x49e755
cmp dword [0x103a97c], 0x77
jne 0x49e6df
push eax
push str.SetInitSendLog_err__d_
push 8
call fcn.0043d500
add esp, 0xc
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call sub.mfc90.dll_Ordinal_6494
push 0
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x5874], 7
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x505a8c
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x587c], 8
mov byte [esp + 0x587c], 4
call fcn.004d90e0
add esp, 0x10
cmp dword [esp + 0x1c], 9
jge 0x49e755
mov byte [esp + 0x586c], 3
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x49fce8
cmp dword [0x103a97c], 0x77
jne 0x49e772
mov ecx, dword [esp + 0x30]
push ecx
push str.SetInitSendLog___s_
push 8
call fcn.0043d500
add esp, 0xc
push 0x1b80
call sub.mfc90.dll_Ordinal_798
push 0x1b80
mov edi, eax
push 0
push edi
mov dword [esp + 0x48], edi
call sub.MSVCR90.dll_memset
add esp, 0x10
cmp dword [esp + 0x1c], ebx
jle 0x49fd00
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 4]
cmp dword [edx - 0xc], 0x200
jae 0x49e7bc
mov ecx, edx
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x49e7b0
mov dword [edi + 0x200], 0x370
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.File_strain_leakage_blocking
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e7f7
mov dword [edi + 0x604], 5
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.AntiVirus
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e828
mov dword [edi + 0x604], 0x80000
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.ExtendType
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e859
mov dword [edi + 0x604], 0x10000
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.File_strain_transfer
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e88a
mov dword [edi + 0x604], 6
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.RansomFilter
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e8bb
mov dword [edi + 0x604], 0x40442
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.RansomDetect
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e8ec
mov dword [edi + 0x604], 0x402
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.RansomBlock
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e91d
mov dword [edi + 0x604], 0x401
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Detect_to_Block
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e94e
mov dword [edi + 0x604], 0x42
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Transfer
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e97f
mov dword [edi + 0x604], 2
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Block_Device_Size
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49e9b0
mov dword [edi + 0x604], 0x21
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
push str.Block_Device
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x49e9e0
mov dword [edi + 0x604], 0x11
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0xc]
push str.Detect_Device
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x49ea10
mov dword [edi + 0x604], 0x10
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Block_DDoS
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ea56
cmp byte [esp + 0x2b], 0
mov dword [edi + 0x604], 8
je 0x49eb7b
mov dword [edi + 0x604], 0xc
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Detect_Diagnose
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ea83
mov dword [edi + 0x604], esi
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Detect_SSL
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eab4
mov dword [edi + 0x604], 0x100000
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.DDoS_detection
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eafa
cmp byte [esp + 0x2b], 0
mov dword [edi + 0x604], 0x48
je 0x49eb7b
mov dword [edi + 0x604], 0x4c
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Block
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eb24
mov dword [edi + 0x604], ebx
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str.Forensic
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eb52
mov dword [edi + 0x604], 0x8000
jmp 0x49eb7b
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push 0xffffffffffffffda
call dword [sym.imp.mfc90.dll_Ordinal_2480]
test eax, eax
jl 0x49eb7b
mov dword [edi + 0x604], 0x200000
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Movable_USB_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ebac
mov dword [edi + 0x608], 0x10
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Except_by_Stack_Over_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ebe7
mov dword [edi + 0x608], 2
mov dword [edi + 0x604], 0x10000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Except_by_user_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ec1e
mov dword [edi + 0x608], ebx
mov dword [edi + 0x604], 0x10000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._BlueTooth_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ec4f
mov dword [edi + 0x608], 0x1000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Windows_Password_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ec80
mov dword [edi + 0x608], 2
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._RansomWare_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ecb1
mov dword [edi + 0x608], 0x80000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Network_Connect_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ece2
mov dword [edi + 0x608], 0x20
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Network_Drive_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ed13
mov dword [edi + 0x608], 0x40
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._CD_DVD_ROM_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ed40
mov dword [edi + 0x608], esi
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Share_Folder_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ed71
mov dword [edi + 0x608], 0x100
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Web_Mail_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eda2
mov dword [edi + 0x608], 0x2200
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Mail_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49edd3
mov dword [edi + 0x608], 0x200
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._TETHERING_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ee04
mov dword [edi + 0x608], 4
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push 0x502478
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ee35
mov dword [edi + 0x608], 0x20000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Web_Upload_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ee66
mov dword [edi + 0x608], 0x2000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Printer_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ee97
mov dword [edi + 0x608], 0x4000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._ScreenShot_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eec8
mov dword [edi + 0x608], 0x400000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push 0x5024e0
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49eef9
mov dword [edi + 0x608], 0x8000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Messenger_Body_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ef2a
mov dword [edi + 0x608], 0x2000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._BLACK_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49ef5b
mov dword [edi + 0x608], 0x40000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xc]
push str._Internet_Connection_
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x49ef8b
mov dword [edi + 0x608], 0x10000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._IrDA_1394_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49efbc
mov dword [edi + 0x608], 0x1000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push 0x502778
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49efed
mov dword [edi + 0x608], 0x10
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push 0x502770
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f01e
mov dword [edi + 0x608], 0x20
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Memory_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f04f
mov dword [edi + 0x608], 0x40
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Network_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f07c
mov dword [edi + 0x608], esi
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Handle_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f0ad
mov dword [edi + 0x608], 0x100
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Thread_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f0de
mov dword [edi + 0x608], 0x200
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Process_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f10f
mov dword [edi + 0x608], 0x400
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._Mobile_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f140
mov dword [edi + 0x608], 0x4000000
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._TCP_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f171
mov dword [edi + 0x608], 0x800
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_EDIT_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f1a2
mov dword [edi + 0x608], 0x200
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_CREATE_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f1d3
mov dword [edi + 0x608], 0x100
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_R_W_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f204
mov dword [edi + 0x608], 6
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_READ_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f235
mov dword [edi + 0x608], 2
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_WRITE_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f266
mov dword [edi + 0x608], 4
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_ALL_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f293
mov dword [edi + 0x608], ebx
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FILE_RENAME_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f2c4
mov dword [edi + 0x608], 8
jmp 0x49f3b6
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
cmp dword [esp + 0x1c], ebp
jle 0x49fd00
mov ecx, dword [esp + 0x18]
push 0
add ecx, 0xc
push str._FTP_
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x49f3e7
mov ecx, dword [esp + 0x48]
add edi, ebx
cmp edi, dword [ecx + 0x324fc]
mov dword [esp + 0x4c], edi
jl 0x49e631
jmp 0x49fd17
call sub.mfc90.dll_Ordinal_1252
mov byte [esp + 0x586c], 3
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [esp + 0x37], 0
je 0x49ff37
mov edx, dword [esp + 0x48]
cmp dword [edx + 0x324fc], 0
jne 0x49fd42
mov eax, dword [esp + 0x5874]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x49ff37
mov ecx, dword [esp + 0x5874]
push 0x5059c0
push ecx
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.MSVCR90.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x49ff37
push 0x2bff
push eax
mov byte [esp + 0x68], al
lea eax, [esp + 0x69]
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x48]
add esp, 0xc
test eax, eax
je 0x49ff37
push 0
push 0
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
mov ecx, dword [esp + 0x54]
xor esi, esi
add esp, 0xc
cmp dword [ecx + 0x324fc], esi
jle 0x49ff05
mov edi, dword [sym.imp.MSVCR90.dll_fputs]
mov ebp, dword [esp + 0x50]
mov bl, 0xe
test esi, esi
jl 0x49fd00
cmp esi, dword [ebp + 8]
jge 0x49fd00
mov edx, dword [ebp + 4]
lea eax, [edx + esi*4]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x586c], bl
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 0xc]
cmp ecx, 0xa
jl 0x49fee2
cmp ecx, 0x2c00
jae 0x49fe0a
lea edx, [esp + 0x60]
sub edx, eax
jmp 0x49fe00
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x49fe00
cmp byte [0x103a972], 0
jne 0x49fe1c
test byte [0x1043104], 8
je 0x49fe7b
push ecx
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x5870], 0xf
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x5874], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x586c], 0x10
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x60]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x49fe60
mov byte [esp + 0x586c], bl
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [esp + 0x60]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49fe82
sub eax, edx
cmp byte [esp + eax + 0x5e], 0xd
je 0x49fece
lea eax, [esp + 0x60]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49fea0
sub eax, edx
cmp byte [esp + eax + 0x5f], 0xa
je 0x49fece
lea eax, [esp + 0x60]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49feb7
sub eax, edx
mov byte [esp + eax + 0x60], 0xd
mov byte [esp + eax + 0x61], 0xa
mov byte [esp + eax + 0x62], cl
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x64]
push eax
call edi
add esp, 8
mov byte [esp + 0x2a], 1
mov byte [esp + 0x586c], 3
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x48]
inc esi
cmp esi, dword [ecx + 0x324fc]
jl 0x49fdb4
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.MSVCR90.dll_fflush]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 8
cmp byte [0x103a972], 0
je 0x49ff37
mov ecx, dword [esp + 0x5874]
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [esp + 0x2a], 0
je 0x49ff6c
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x5874]
push 0
add esi, 0x321fc
push edx
mov ecx, esi
call sub.mfc90.dll_Ordinal_2485
test eax, eax
jne 0x49ff6c
lea eax, [esp + 0x5874]
push eax
mov ecx, esi
call sub.mfc90.dll_Ordinal_1041
mov ecx, dword [esp + 0x50]
push 0xffffffffffffffff
push 0
call sub.mfc90.dll_Ordinal_6494
push 0x5116d8
mov ecx, 0x10dd360
mov byte [0x10dc519], 0
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov byte [esp + 0x586c], 0
lea ecx, [esp + 0x14]
call sub.mfc90.dll_Ordinal_781
mov dword [esp + 0x586c], 0xffffffff
lea ecx, [esp + 0x5874]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, 1
mov ecx, dword [esp + 0x5864]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x584c]
xor ecx, esp
call fcn.004e0148
add esp, 0x585c
ret 4