Function at 0x47c8a0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb7ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1b40
call fcn.004f2630
push ebx
push esi
xor eax, eax
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x12d0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x8f8]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x47caef
push edx
lea ecx, [ebp - 0x8f8]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f8]
push 0x520bd4
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cb11
mov dword [ebp - 0x1ac], 1
mov al, byte [ebp - 0x8f8]
xor ecx, ecx
cmp al, 0x25
jne 0x47cb22
mov ecx, 1
lea edx, [ebx - 2]
test edx, edx
jle 0x47cb4c
mov al, byte [ebp + edx - 0x8f8]
cmp al, 0x3a
jne 0x47cb3e
cmp byte [ebp + edx - 0x8f7], 0x5c
je 0x47cb4c
cmp ecx, 1
jne 0x47cb47
cmp al, 0x5c
je 0x47cb51
dec edx
test edx, edx
jg 0x47cb29
cmp ecx, 1
jne 0x47cbaf
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x47cb79
mov ecx, ebx
lea esi, [ebp + edx - 0x8f7]
mov edx, ecx
lea edi, [ebp - 0xaf8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xaf8], 0
lea edi, [ebp - 0xaf8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x8f8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47cc5d
test edx, edx
je 0x47cc5d
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0xfd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x47cbf7
cmp byte [ebp + ebx - 0x8f8], 0x2e
je 0x47cbf7
dec ebx
test ebx, ebx
jg 0x47cbe8
sub ebx, edx
mov byte [ebp - 0x8f8], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x47cc22
lea esi, [ebp + edx - 0xfd9]
mov edx, ecx
lea edi, [ebp - 0x8f8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x8f3], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x47cc4d
cmp byte [ebp + ecx - 0x8f8], 0x2e
je 0x47cc4d
dec ecx
test ecx, ecx
jg 0x47cc3e
test ecx, ecx
mov byte [ebp + ecx - 0x8f4], 0
jne 0x47cd23
lea eax, [ebp - 0x6f8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x1150]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x9f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x9f8]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47cd01
lea edx, [ebp - 0x9f8]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47cd01
lea eax, [ebp - 0x9f8]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47cd01
lea ecx, [ebp - 0x9f8]
lea edx, [ebp - 0x6f8]
push ecx
jmp 0x47cd0e
lea ecx, [ebp - 0x9f8]
lea edx, [ebp - 0x1150]
push ecx
push edx
lea eax, [ebp - 0x8f8]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x47cd46
cmp byte [ebp + ecx - 0x8f8], 0x2e
je 0x47cd46
dec ecx
test ecx, ecx
jg 0x47cd37
mov byte [ebp + ecx - 0x8f4], 0
lea ecx, [ebp - 0x8f8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x47cd80
push 0x515844
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push str.DOCUME1_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cd9f
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x8f8]
push str.LOCALS1Temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cdbe
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x8f8]
push str.stem32Cursors_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cddd
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0x8f8]
push edx
call fcn.004ab3c0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x70]
push eax
lea edx, [ebp - 0x8f8]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x158], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x47ce26
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
cmp eax, ecx
je 0x47ce31
mov ebx, 1
mov dword [ebp - 0x158], ebx
lea ecx, [ebp - 0x1650]
lea edx, [ebp - 0x2f8]
push ecx
lea eax, [ebp - 0x8f8]
push edx
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.004d9d40
movsx edi, ax
add esp, 0xc
cmp esi, 0xc8000
mov dword [ebp - 0x38], edi
jle 0x47cec0
cmp edi, 1
jle 0x47ce88
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0xfd8]
push edx
push 0x515e38
push eax
call fcn.004f175f
lea ecx, [ebp - 0xfd8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1350]
lea eax, [ebp - 0x8f8]
xor esi, esi
push edx
push eax
mov dword [ebp + 8], esi
call fcn.004da170
lea ecx, [ebp - 0x1350]
push 0x520a60
push ecx
call fcn.004f61e0
add esp, 0x10
test eax, eax
je 0x47cef7
mov dword [ebp + 8], 1
lea edx, [ebp - 0x2f8]
push str.Morrowsoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cf32
cmp edi, 5
jle 0x47cf32
push 0x5241ac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f8]
push str.Opera_Software
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cf6a
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push str.Microsoft.NETFramework_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cfa2
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f8]
push str.jre_binjre
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47cfda
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f8]
push 0x515dc8
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d010
push 0x516cc8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f8]
push str.32A6Wizard_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d046
push 0x515dbc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push 0x5156a4
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d07e
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f8]
push str.java
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d0b6
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f8]
push str.Microsoft.NETFramework_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d0ee
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push str.microsoft.net_framework_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d126
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2f8]
push str.Microsoft
push ecx
mov dword [ebp - 0x24], esi
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x47d1da
lea edi, [ebp - 0x1650]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x47d17b
lea ecx, [ebp - 0x1650]
push str.Microsoft
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x47d17b
mov dword [ebp - 0x24], 1
jmp 0x47d1aa
mov edi, 0x515e60
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x4c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 1
jne 0x47d1da
mov edi, 0x515e60
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x4c], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x678]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xc98]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1750]
lea ecx, [ebp - 0x8f8]
push eax
push ecx
call fcn.004c9790
add esp, 8
xor edi, edi
xor esi, esi
lea edx, [esi + str.CMBPB]
lea eax, [ebp - 0x1750]
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47d26b
lea ecx, [esi + str.PersonalBankPortal.exe]
lea edx, [ebp - 0xc98]
push ecx
push edx
lea eax, [ebp - 0xaf8]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xaf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x47d2c5
add esi, 0x100
inc edi
cmp esi, 0x200
jl 0x47d218
xor edi, edi
mov esi, str.watchclient.exe
lea edx, [ebp - 0xc98]
push esi
push edx
lea eax, [ebp - 0xaf8]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xaf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x47d300
add esi, 0x100
inc edi
cmp esi, 0x50eba4
jl 0x47d281
jmp 0x47d33b
shl edi, 8
add edi, str.CMBPB
lea eax, [ebp - 0xaf8]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50eba4
lea eax, [ebp - 0xaf8]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe56be4]
mov ebx, 1
cmp eax, ebx
jne 0x47d463
xor edi, edi
mov esi, str.olelink.exe
lea edx, [ebp - 0xc98]
push esi
push edx
lea eax, [ebp - 0xaf8]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xaf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x47d3ed
add esi, 0x100
inc edi
cmp esi, 0x510124
jl 0x47d354
cmp dword [0xe56bf0], ebx
jne 0x47d463
xor edi, edi
mov esi, str.WBWA.exe
lea edx, [ebp - 0x12d0]
push esi
push edx
lea eax, [ebp - 0xaf8]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xaf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x47d428
add esi, 0x100
inc edi
cmp esi, 0x510724
jl 0x47d3a9
jmp 0x47d463
shl edi, 8
add edi, 0x510124
lea eax, [ebp - 0xaf8]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x510724
lea eax, [ebp - 0xaf8]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x678]
lea eax, [ebp - 0xbf8]
push edx
push str._swinlogon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xbf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d4b5
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xbf8]
push ecx
push str._scsrss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x8f8]
lea ecx, [ebp - 0xbf8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d507
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x678]
lea ecx, [ebp - 0xbf8]
push eax
push str._s_services.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
lea eax, [ebp - 0xbf8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d559
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x678]
lea eax, [ebp - 0xbf8]
push edx
push str._slsass.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xbf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d5ab
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xbf8]
push ecx
push str._s_svchost.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x8f8]
lea ecx, [ebp - 0xbf8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d5fd
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x678]
lea ecx, [ebp - 0xbf8]
push eax
push str._suserinit.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
lea eax, [ebp - 0xbf8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d64f
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x678]
lea eax, [ebp - 0xbf8]
push edx
push str._s_taskmgr.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xbf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d6a1
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xbf8]
push ecx
push str._s_spoolsv.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x8f8]
lea ecx, [ebp - 0xbf8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d6f3
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc98]
lea ecx, [ebp - 0xbf8]
push eax
push str._sexplorer.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
lea eax, [ebp - 0xbf8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d745
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push edx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47d77d
lea eax, [ebp - 0x2f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xbf8]
push ecx
push str._sctfmon.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x8f8]
lea ecx, [ebp - 0xbf8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d7cf
lea edx, [ebp - 0x2f8]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc98]
lea ecx, [ebp - 0xbf8]
push eax
push str._s_anotherlockfile.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
lea eax, [ebp - 0xbf8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d81f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xbf8]
push ecx
push str._sServerNT.EXE
push edx
call fcn.004f175f
lea eax, [ebp - 0x8f8]
lea ecx, [ebp - 0xbf8]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d8ee
lea edx, [ebp - 0x678]
lea eax, [ebp - 0xfd8]
push edx
push str._sU8SMSSrv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0xfd8]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x678]
mov esi, eax
push edx
lea eax, [ebp - 0xaf8]
push str._sAlertService.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x678]
mov edi, eax
push edx
lea eax, [ebp - 0x9f8]
push str._sServerNT.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0x9f8]
push ecx
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, ebx
jle 0x47d8ee
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x678]
lea eax, [ebp - 0xbf8]
push edx
push str._sU8SMSSrv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x8f8]
lea edx, [ebp - 0xbf8]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47d9bd
lea eax, [ebp - 0x678]
lea ecx, [ebp - 0xfd8]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xfd8]
push edx
call fcn.004abe70
mov esi, eax
lea eax, [ebp - 0x678]
push eax
lea ecx, [ebp - 0xaf8]
push str._sAlertService.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xaf8]
push edx
call fcn.004abe70
mov edi, eax
lea eax, [ebp - 0x678]
push eax
lea ecx, [ebp - 0x9f8]
push str._sServerNT.EXE
push ecx
call fcn.004f175f
lea edx, [ebp - 0x9f8]
push edx
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, ebx
jle 0x47d9bd
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x678]
lea ecx, [ebp - 0xbf8]
push eax
push str._sAlertService.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8f8]
lea eax, [ebp - 0xbf8]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x47da8c
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xfd8]
push ecx
push str._sU8SMSSrv.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0xfd8]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0xaf8]
push ecx
push str._sAlertService.exe
push edx
mov esi, eax
call fcn.004f175f
lea eax, [ebp - 0xaf8]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x678]
lea edx, [ebp - 0x9f8]
push ecx
push str._sServerNT.EXE
push edx
mov edi, eax
call fcn.004f175f
lea eax, [ebp - 0x9f8]
push eax
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, ebx
jle 0x47da8c
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x8f8]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x30], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x68], edx
cmp ecx, edx
mov dword [ebp - 0x1cc], ebx
jle 0x47dacf
lea esi, [ebp + ecx - 0x8f8]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xe98], al
jne 0x47dac9
cmp edx, 2
jge 0x47dacf
inc edx
dec esi
cmp edx, ecx
jl 0x47dab7
sub ecx, edx
xor eax, eax
mov edi, ecx
test edi, edi
jle 0x47daf8
mov cl, byte [ebp + eax - 0x8f8]
cmp cl, 0x5c
mov byte [ebp + eax - 0x1550], cl
jne 0x47daed
inc ebx
inc eax
cmp eax, edi
jl 0x47dad9
mov dword [ebp - 0x1cc], ebx
xor esi, esi
mov byte [ebp + edi - 0x1550], 0
test edx, edx
jle 0x47db42
mov ecx, dword [ebp - 0x150]
lea edi, [ebp + edi - 0x8f7]
mov al, byte [esi + edi]
cmp al, 0x5c
je 0x47db21
mov byte [ebp + esi - 0xe98], al
cmp al, 0x2e
jne 0x47db26
inc ecx
cmp al, 0x20
jne 0x47db2b
inc ecx
cmp al, 0x5c
jne 0x47db37
mov byte [ebp + esi - 0xe98], 0
inc esi
cmp esi, edx
jl 0x47db13
mov dword [ebp - 0x150], ecx
mov al, byte [ebp - 0x154e]
mov byte [ebp + edx - 0xe98], 0
cmp al, 0x5c
je 0x47db62
mov byte [ebp - 0x154e], 0x5c
mov byte [ebp - 0x154d], 0
lea edi, [ebp - 0xe98]
or ecx, 0xffffffff
xor eax, eax
push 0x516860
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x1dc], ecx
lea ecx, [ebp - 0xe98]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47dba8
lea edx, [ebp - 0xe98]
push str..Tmp
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47dbb5
mov edi, 1
mov dword [ebp - 0x1c0], edi
jmp 0x47dbba
mov edi, 1
lea eax, [ebp - 0x1550]
lea ecx, [ebp - 0x12d0]
push eax
push ecx
call fcn.004f61e0
lea edx, [ebp - 0x1550]
lea eax, [ebp - 0x678]
push edx
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x47dbea
mov dword [ebp - 0x68], edi
lea ecx, [ebp - 0x8f8]
push 0x100
lea edx, [ebp - 0x5f8]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0xe98]
push 0x40
lea ecx, [ebp - 0xed8]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x1550]
push edx
call fcn.004cb750
add esp, 0x1c
cmp eax, 2
jne 0x47dcd8
lea eax, [ebp - 0x5f8]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x5f8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x5f8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x47dc90
lea eax, [ebp - 0x5f8]
push eax
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x47dc90
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4f8]
mov edi, 0x515d4c
jmp 0x47dc9b
lea edx, [ebp - 0x4f8]
mov edi, 0x515d28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, edi
jne 0x47dcdf
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x8f8]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x47dd40
cmp dword [ebp + 8], edi
jne 0x47dd22
push str.rundll
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5144fc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f8]
push 0x80
lea ecx, [ebp - 0x1250]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x8f8]
push 0x80
lea eax, [ebp - 0x11d0]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xc98]
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x678]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x1250], al
lea edx, [ebp - 0x1250]
mov dword [ebp - 0xa4], ebx
mov byte [ebp + ecx - 0x11d0], al
lea ecx, [ebp - 0xc98]
push ecx
push edx
mov dword [ebp - 0x50], ebx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x47ddfa
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47ddef
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 1
mov dword [ebp - 0xa4], ebx
lea eax, [ebp - 0x678]
lea ecx, [ebp - 0x11d0]
push eax
push ecx
call fcn.004f61e0
add esp, 8
mov edi, 1
test eax, eax
jne 0x47de4b
push 0x5144fc
push esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x50], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47de4b
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push str.System
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47decc
push 0x5144fc
push esi
mov dword [ebp - 0x30], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47de92
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f8]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x47decc
push edi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f8]
push str._system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47df51
push 0x5144fc
push esi
mov dword [ebp - 0x30], 1
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47df17
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x47df51
push edi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f8]
push str.SYSTEM
push eax
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x47dfd7
push 0x5144fc
push esi
mov dword [ebp - 0x30], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47df9d
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f8]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x47dfd7
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f8]
push 0x515d14
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47dff2
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x8f8]
push str.Microsoft_SharedMSINFO
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e00d
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x8f8]
push str.Microsoft_SharedMSInfo
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e02d
mov dword [ebp - 0x18], edi
jmp 0x47e305
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x47e305
test ebx, ebx
jne 0x47e305
cmp dword [ebp - 0x38], 2
jle 0x47e305
lea edx, [ebp - 0x2f8]
push str.Beijing_Rising
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e08a
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e0ca
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e10a
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e14a
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e18a
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e1ca
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e20a
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e24a
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e28a
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e2ca
mov edi, 0x5156ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f8]
push str.F_Secure_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e300
push 0x515dec
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x47e591
lea edx, [ebp - 0xe98]
push str.smss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea eax, [ebp - 0xe98]
push str.winlogon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea ecx, [ebp - 0xe98]
push str.csrss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea edx, [ebp - 0xe98]
push str.services.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea eax, [ebp - 0xe98]
push str.lsass.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea ecx, [ebp - 0xe98]
push str.svchost.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea edx, [ebp - 0xe98]
push str.taskmgr.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea eax, [ebp - 0xe98]
push str.spoolsv.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea ecx, [ebp - 0xe98]
push str.explorer.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea edx, [ebp - 0xe98]
push str.userinit.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea eax, [ebp - 0xe98]
push str.ctfmon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea ecx, [ebp - 0xe98]
push str.cmd.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea edx, [ebp - 0xe98]
push str.logo1_.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x47e484
lea eax, [ebp - 0xe98]
push str.net.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47e591
lea ecx, [ebp - 0x5f8]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47e4ab
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x5f8]
push eax
call esi
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x47e518
lea edx, [ebp - 0x5f8]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x5f8]
push eax
call esi
test eax, eax
jne 0x47e518
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x47e518
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4f8]
mov edi, 0x5158dc
jmp 0x47e523
lea edx, [ebp - 0x4f8]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x5f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4f8]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xe98]
push str.iexplore.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47e691
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x47e691
lea edx, [ebp - 0x5f8]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47e5df
lea eax, [ebp - 0x5f8]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x5f8]
push ecx
call esi
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x47e64c
lea eax, [ebp - 0x5f8]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x5f8]
push ecx
call esi
test eax, eax
jne 0x47e64c
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x47e64c
lea eax, [ebp - 0x5f8]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4f8]
mov edi, 0x5209ec
jmp 0x47e657
lea edx, [ebp - 0x4f8]
mov edi, 0x520998
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c98]
mov dword [0xe56d20], eax
inc edi
mov dword [0xe56c98], edi
jmp 0x47e54b
lea edi, [ebp - 0xe98]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0xd8a430
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x1d4], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x190], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x160], esi
call fcn.004a6b50
add esp, 4
lea ecx, [ebp - 0x8f8]
push 0xd8a430
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, esi
jne 0x47e771
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x8f8]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ebx, 1
mov dword [ebp - 0x34], ebx
jmp 0x47f3a6
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 3
push eax
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov dword [ebp - 0x1f0], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, esi
mov dword [ebp - 0x1c], eax
jne 0x47e85a
mov esi, dword [ebp - 0x58]
cmp esi, 0x19000
jle 0x47e81f
lea edx, [ebp + 8]
lea eax, [ebp - 0x1150]
push edx
lea ecx, [ebp - 0xe98]
push eax
lea edx, [ebp - 0x1550]
push ecx
push edx
mov dword [ebp + 8], 0
call fcn.004ca490
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, esi
jge 0x47e7e0
mov dword [ebp + 8], esi
lea eax, [ebp - 0x1150]
push 0x520994
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47e81f
cmp dword [ebp + 8], 0x32000
jle 0x47e81f
push 0x520984
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], 2
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
add esp, 4
mov dword [ebp - 0x1a8], eax
test eax, eax
jne 0x47f22a
mov dword [ebp - 0x34], 6
jmp 0x47f398
mov dword [ebp - 0x2c], esi
cmp dword [eax + 0x10], esi
je 0x47e826
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd8a438]
mov eax, dword [ebp - 0x1f0]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov esi, eax
inc ecx
push 0x515c98
push esi
mov dword [ebp - 0x28], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push esi
mov dword [ebp - 0x1e4], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push esi
mov dword [ebp - 0x1ec], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc71.dll
inc eax
push esi
mov dword [ebp - 0x1d8], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push 0x516b00
inc eax
push esi
mov dword [ebp - 0x1f4], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.comdlg32.dll
inc eax
push esi
mov dword [ebp - 0x1e0], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.rasapi32.dll
inc eax
push esi
mov dword [ebp - 0x1d0], eax
call fcn.004f61e0
add esp, 0x38
mov ebx, 1
test eax, eax
jne 0x47e926
mov dword [ebp - 0x100], ebx
push str.wtsapi32.dll
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47e93e
mov dword [ebp - 0x9c], ebx
push str.opengl.dll
push esi
call fcn.004f61e0
neg eax
sbb eax, eax
push str.glu32.dll
inc eax
push esi
mov dword [ebp - 0x1e8], eax
call fcn.004f61e0
mov ecx, dword [ebp - 0x10c]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
inc ecx
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov dword [ebp - 0x10c], ecx
jne 0x47e9d4
cmp dword [ebp - 0x1cc], 3
jle 0x47e9d4
lea ecx, [ebp - 0x1550]
push esi
push ecx
lea edx, [ebp - 0x1010]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x1010]
push eax
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x47e9d4
mov edx, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1a0]
inc edx
add ecx, eax
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x1a0], ecx
xor edi, edi
cmp edi, 0x69
jge 0x47ea87
lea ecx, [edi + edi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47ea81
cmp edi, 0xf
jle 0x47ea0d
cmp edi, 0x12
jge 0x47ea0d
mov dword [ebp - 0xd4], ebx
cmp edi, 0x1d
je 0x47ea1c
cmp edi, 0x1e
je 0x47ea1c
cmp edi, 0x39
jne 0x47ea22
mov dword [ebp - 0xec], ebx
cmp edi, 0x1f
je 0x47ea2c
cmp edi, 0x20
jne 0x47ea32
mov dword [ebp - 0xb4], ebx
cmp edi, 0x21
je 0x47ea3c
cmp edi, 0x22
jne 0x47ea42
mov dword [ebp - 0xc0], ebx
cmp edi, 0x23
je 0x47ea4c
cmp edi, 0x24
jne 0x47ea52
mov dword [ebp - 0xd8], ebx
cmp edi, 0x2c
jne 0x47ea63
mov dword [ebp - 0xc8], ebx
inc edi
jmp 0x47e9d6
cmp edi, 0x2d
je 0x47ea7e
cmp edi, 0x2e
jne 0x47ea79
mov dword [ebp - 0xe8], ebx
inc edi
jmp 0x47e9d6
cmp edi, 0x3d
jne 0x47ea81
mov dword [ebp - 0x40], ebx
inc edi
jmp 0x47e9d6
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x1b4], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd8a438]
mov dword [ebp - 0x1a8], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0x2c]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x47eacc
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x1b0], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x47e826
mov eax, dword [eax]
test eax, eax
je 0x47f1db
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x47eb59
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1030]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x1030]
jmp 0x47ebd9
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47eb90
xor edx, edx
lea eax, [ebp - 0xc18]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x47ebd9
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1050]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x1050]
push str.SetupCopyOEMInf
push ebx
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x47ebf6
mov dword [ebp - 0x1a4], edi
push str.WTSEnumerateSessions
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47ec0b
mov dword [ebp - 0x68], edi
xor esi, esi
cmp esi, 0x69
jge 0x47f0f3
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47f0ed
cmp esi, 0x45
jne 0x47ed01
lea edx, [ebp - 0x1150]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1150]
lea ecx, [ebp - 0x6f8]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6f8]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x47ecc6
lea eax, [ebp - 0x2f8]
lea ecx, [ebp - 0xaf8]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0xaf8]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x47ed0e
mov dword [ebp - 0x60], edi
inc esi
jmp 0x47ec0d
cmp esi, edi
jne 0x47ed1e
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x47ec0d
cmp esi, 2
je 0x47f0ed
cmp esi, 4
jne 0x47ed38
mov dword [ebp - 0x17c], edi
inc esi
jmp 0x47ec0d
cmp esi, 5
jne 0x47ed49
mov dword [ebp - 0x18c], edi
inc esi
jmp 0x47ec0d
cmp esi, 6
jne 0x47ed5a
mov dword [ebp - 0x124], edi
inc esi
jmp 0x47ec0d
cmp esi, 7
jne 0x47ed6b
mov dword [ebp - 0x19c], edi
inc esi
jmp 0x47ec0d
cmp esi, 8
jne 0x47ed7c
mov dword [ebp - 0x16c], edi
inc esi
jmp 0x47ec0d
cmp esi, 9
jne 0x47ed8d
mov dword [ebp - 0x154], edi
inc esi
jmp 0x47ec0d
cmp esi, 0xa
jne 0x47ed9e
mov dword [ebp - 0x94], edi
inc esi
jmp 0x47ec0d
cmp esi, 0xb
jne 0x47edaf
mov dword [ebp - 0x168], edi
inc esi
jmp 0x47ec0d
jle 0x47edbc
cmp esi, 0xf
jge 0x47edbf
mov dword [ebp - 0xd0], edi
cmp esi, 0xf
jne 0x47edcd
mov dword [ebp - 0x128], edi
inc esi
jmp 0x47ec0d
jle 0x47edda
cmp esi, 0x12
jge 0x47edda
mov dword [ebp - 0xd4], edi
cmp esi, 0x1b
jne 0x47edeb
mov dword [ebp - 0x134], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x1c
jne 0x47edf9
mov dword [ebp - 0x80], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x1d
je 0x47ee08
cmp esi, 0x1e
je 0x47ee08
cmp esi, 0x39
jne 0x47ee0e
mov dword [ebp - 0xec], edi
cmp esi, 0x1f
je 0x47ee18
cmp esi, 0x20
jne 0x47ee1e
mov dword [ebp - 0xb4], edi
cmp esi, 0x21
je 0x47ee28
cmp esi, 0x22
jne 0x47ee2e
mov dword [ebp - 0xc0], edi
cmp esi, 0x23
je 0x47ee38
cmp esi, 0x24
jne 0x47ee3e
mov dword [ebp - 0xd8], edi
cmp esi, 0x25
je 0x47ee48
cmp esi, 0x26
jne 0x47ee4e
mov dword [ebp - 0xf0], edi
cmp esi, 0x27
jne 0x47ee5f
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x28
jne 0x47ee70
mov dword [ebp - 0x14c], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x29
jne 0x47ee81
mov dword [ebp - 0x104], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x2c
jne 0x47ee92
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x2d
jne 0x47eea0
mov dword [ebp - 0x40], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x2e
jne 0x47eeb1
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x2f
jne 0x47eec2
mov dword [ebp - 0x120], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x30
jne 0x47eed3
mov dword [ebp - 0x108], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x31
jne 0x47eee4
mov dword [ebp - 0x110], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x32
jne 0x47eef5
mov dword [ebp - 0x118], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x34
jne 0x47ef06
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x35
jne 0x47ef17
mov dword [ebp - 0xac], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x36
jne 0x47ef28
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x37
jne 0x47ef3d
mov dword [ebp - 0x138], 0
inc esi
jmp 0x47ec0d
cmp esi, 0x38
jne 0x47ef4e
mov dword [ebp - 0x140], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x3a
je 0x47ef5d
cmp esi, 0x3b
je 0x47ef5d
cmp esi, 0x3c
jne 0x47ef63
mov dword [ebp - 0xb8], edi
cmp esi, 0x3d
jne 0x47ef71
mov dword [ebp - 0x40], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x3e
jne 0x47ef7f
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x3f
jne 0x47ef90
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x40
jne 0x47efa1
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x41
jne 0x47efb2
mov dword [ebp - 0x174], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x42
jne 0x47efc3
mov dword [ebp - 0x130], edi
inc esi
jmp 0x47ec0d
cmp esi, 0x43
je 0x47efcd
inc esi
jmp 0x47ec0d
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1e4]
inc ecx
cmp eax, edi
mov dword [ebp - 0x3c], ecx
jne 0x47f10a
inc dword [ebp - 0x90]
cmp dword [ebp - 0x1ec], edi
jne 0x47f118
inc dword [ebp - 0xc4]
cmp dword [ebp - 0x1d8], edi
jne 0x47f126
inc dword [ebp - 0x190]
cmp dword [ebp - 0x1f4], edi
jne 0x47f134
inc dword [ebp - 0xbc]
cmp dword [ebp - 0x1e0], edi
jne 0x47f142
inc dword [ebp - 0x1c8]
cmp dword [ebp - 0x1d0], edi
jne 0x47f150
inc dword [ebp - 0x194]
cmp dword [ebp - 0x1e8], edi
jne 0x47f15e
inc dword [ebp - 0xf4]
cmp dword [ebp - 0x1f8], edi
jne 0x47f16c
inc dword [ebp - 0xfc]
cmp dword [ebp - 0x3c], 0x2710
jg 0x47f1db
mov esi, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x1b4], esi
mov esi, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x47eaee
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
xor esi, esi
jmp 0x47e85d
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0x1a8]
cmp bx, word [ecx + 2]
jae 0x47f398
xor edx, edx
push str..asp
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x74], dl
mov eax, dword [edi]
mov dword [ebp - 0x7c], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x78], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x47f282
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x7c]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f29a
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x7c]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f2b2
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x7c]
push str.upx0
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f2ca
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x7c]
push str.upx1
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f2e2
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x7c]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f2fa
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x7c]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f312
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x7c]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47f32a
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x7c]
push 0x50dc3c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47f345
inc dword [ebp - 0x160]
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + 8]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0x88], esi
mov dword [ebp + 8], eax
jg 0x47f398
add edi, 0x28
inc ebx
jmp 0x47f23f
mov dword [ebp - 4], 2
mov ebx, 1
xor esi, esi
mov edx, dword [0xd8a438]
push edx
call fcn.004a6b80
add esp, 4
cmp eax, esi
jne 0x47f3e4
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x34], 3
push 0xd8a430
call fcn.004a6b50
mov eax, dword [ebp - 0x34]
add esp, 4
cmp eax, ebx
jne 0x47f416
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
mov dword [ebp - 0x1c], eax
jne 0x47fd61
cmp eax, ebx
jge 0x47fd61
lea edx, [ebp - 0x1550]
mov dword [ebp - 0x28], esi
push edx
call fcn.004f2beb
jmp 0x47f45c
lea eax, [ebp - 0xe98]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xaf8]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x47f48d
push ebx
lea ecx, [ebp - 0x6c0]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x47f4b7
lea edx, [ebp - 0xaf8]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x47f4cb
lea eax, [ebp - 0x5f8]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp + 8], esi
push ecx
push ebx
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x6c0]
call fcn.004f0727
mov edx, dword [ebp - 0x6c0]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x6bc]
cmp dword [eax + 0x30], 0xffffffff
jne 0x47f51e
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
jmp 0x47f71f
mov edi, dword [ebp - 0x6bc]
push 0xa
lea ecx, [ebp - 0x9f8]
push 0x100
inc edi
push ecx
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x6bc], edi
call fcn.004f0ae9
lea edi, [ebp - 0x9f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x47fcf2
lea edx, [ebp - 0x9f8]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47f57b
mov dword [ebp - 0x1b8], ebx
lea eax, [ebp - 0x9f8]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x47f59d
push 0x5147b4
jmp 0x47f71f
lea ecx, [ebp - 0x9f8]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, esi
jne 0x47fcf2
lea edx, [ebp - 0x9f8]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
cmp eax, esi
jne 0x47fcf2
lea eax, [ebp - 0x9f8]
push str.Dump_of_file
push eax
call fcn.004f2d80
add esp, 8
cmp eax, esi
jne 0x47fcf2
lea ecx, [ebp - 0x9f8]
push str.SetupCopyOEMInf
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x47f614
mov dword [ebp - 0x1a4], ebx
jmp 0x47fcf2
lea edx, [ebp - 0x9f8]
push str.WTSEnumerateSessions
push edx
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x47f634
mov dword [ebp - 0x68], ebx
jmp 0x47fcf2
cmp dword [ebp - 0x84], ebx
jne 0x47f63f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x44], ebx
jne 0x47f647
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x54], ebx
jne 0x47f652
inc dword [ebp - 0xb0]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x47fce9
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x9f8]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x47fce3
mov ecx, dword [ebp - 0x144]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x144], ecx
jne 0x47f756
lea edx, [ebp - 0x1150]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1150]
lea ecx, [ebp - 0x10d0]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x10d0]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x47f6fd
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0xfd8]
push edx
push 0x5153f4
push eax
jmp 0x47f710
lea ecx, [ebp - 0x2f8]
lea edx, [ebp - 0xfd8]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xfd8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x6ac]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x6ac]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x47f7c4
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x28], edx
jle 0x47f779
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x9f8]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x9f8]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x9f8]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47f834
test ebx, ebx
jne 0x47f834
test eax, eax
mov dword [ebp - 0x44], ebx
je 0x47f83b
jmp 0x47f834
cmp esi, 0x1a
jne 0x47f8a3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x28], edx
jle 0x47f7eb
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x9f8]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x9f8]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x9f8]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47f834
test ebx, ebx
jne 0x47f834
test eax, eax
mov dword [ebp - 0x44], ebx
je 0x47f83b
mov dword [ebp - 0x44], 1
lea ecx, [ebp - 0x9f8]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x9f8]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x9f8]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x47f88f
test ebx, ebx
jne 0x47f88f
test eax, eax
jne 0x47f88f
mov dword [ebp - 0x54], eax
mov ebx, 1
inc esi
jmp 0x47f656
xor edi, edi
mov dword [ebp - 0x54], 1
mov ebx, 1
inc esi
jmp 0x47f656
cmp esi, 0x2a
jne 0x47f8c0
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x54], edi
inc esi
jmp 0x47f656
cmp esi, 0x2b
jne 0x47f8dd
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x54], edi
inc esi
jmp 0x47f656
cmp esi, edi
jne 0x47f8ea
mov dword [ebp - 0x60], ebx
inc esi
jmp 0x47f656
cmp esi, ebx
jne 0x47f8fa
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x47f656
cmp esi, 2
je 0x47fce3
cmp esi, 4
jne 0x47f914
mov dword [ebp - 0x17c], ebx
inc esi
jmp 0x47f656
cmp esi, 5
jne 0x47f925
mov dword [ebp - 0x18c], ebx
inc esi
jmp 0x47f656
cmp esi, 6
jne 0x47f936
mov dword [ebp - 0x124], ebx
inc esi
jmp 0x47f656
cmp esi, 7
jne 0x47f947
mov dword [ebp - 0x19c], ebx
inc esi
jmp 0x47f656
cmp esi, 8
jne 0x47f958
mov dword [ebp - 0x16c], ebx
inc esi
jmp 0x47f656
cmp esi, 9
jne 0x47f969
mov dword [ebp - 0x154], ebx
inc esi
jmp 0x47f656
cmp esi, 0xa
jne 0x47f97a
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x47f656
cmp esi, 0xb
jne 0x47f98b
mov dword [ebp - 0x168], ebx
inc esi
jmp 0x47f656
jle 0x47f998
cmp esi, 0xf
jge 0x47f99b
mov dword [ebp - 0xd0], ebx
cmp esi, 0xf
jne 0x47f9a9
mov dword [ebp - 0x128], ebx
inc esi
jmp 0x47f656
jle 0x47f9b6
cmp esi, 0x12
jge 0x47f9b6
mov dword [ebp - 0xd4], ebx
cmp esi, 0x11
jle 0x47f9c3
cmp esi, 0x19
jge 0x47f9c3
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x47f9d4
mov dword [ebp - 0x134], ebx
inc esi
jmp 0x47f656
cmp esi, 0x1c
jne 0x47f9e2
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x47f656
cmp esi, 0x1d
je 0x47f9f1
cmp esi, 0x1e
je 0x47f9f1
cmp esi, 0x39
jne 0x47f9f7
mov dword [ebp - 0xec], ebx
cmp esi, 0x1f
je 0x47fa01
cmp esi, 0x20
jne 0x47fa07
mov dword [ebp - 0xb4], ebx
cmp esi, 0x21
je 0x47fa11
cmp esi, 0x22
jne 0x47fa17
mov dword [ebp - 0xc0], ebx
cmp esi, 0x23
je 0x47fa21
cmp esi, 0x24
jne 0x47fa27
mov dword [ebp - 0xd8], ebx
cmp esi, 0x25
je 0x47fa31
cmp esi, 0x26
jne 0x47fa37
mov dword [ebp - 0xf0], ebx
cmp esi, 0x27
jne 0x47fa48
mov dword [ebp - 0x13c], ebx
inc esi
jmp 0x47f656
cmp esi, 0x28
jne 0x47fa59
mov dword [ebp - 0x14c], ebx
inc esi
jmp 0x47f656
cmp esi, 0x29
jne 0x47fa6a
mov dword [ebp - 0x104], ebx
inc esi
jmp 0x47f656
cmp esi, 0x2c
jne 0x47fa7b
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x47f656
cmp esi, 0x2d
jne 0x47fa89
mov dword [ebp - 0x40], ebx
inc esi
jmp 0x47f656
cmp esi, 0x2e
jne 0x47fa9a
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x47f656
cmp esi, 0x2f
jne 0x47faab
mov dword [ebp - 0x120], ebx
inc esi
jmp 0x47f656
cmp esi, 0x30
jne 0x47fabc
inc esi
jmp 0x47f656
mov eax, dword [ebp + 8]
inc eax
xor esi, esi
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x6c0]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x6b8], 1
je 0x47f51e
lea ecx, [ebp - 0x6c0]
call fcn.004f076e
mov eax, dword [ebp - 0x2c]
mov ecx, 5
cmp eax, ecx
jle 0x47fd25
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x47fd31
sub eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x12c], esi
jne 0x47fd44
cmp eax, 6
jle 0x47fd44
sub eax, 6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x6ac]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x6ac]
call fcn.004f05fb
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x144]
mov byte [ebp - 0x4f8], 0
cmp ecx, ebx
mov dword [ebp + 8], esi
jle 0x47fda9
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp - 0x34], 5
jne 0x47fec3
cmp eax, esi
jne 0x47fec5
cmp dword [ebp - 0x88], esi
jle 0x47ff8d
mov ebx, dword [ebp - 0x58]
cmp ebx, 0xc800
jge 0x47ff90
cmp ebx, 0x400
jle 0x47ff90
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x5f8]
push ecx
call esi
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x47fe63
lea eax, [ebp - 0x5f8]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x5f8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x5f8]
push edx
call esi
test eax, eax
jne 0x47fe63
lea eax, [ebp - 0x5f8]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x47fe63
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x4f8]
mov edi, 0x515b34
jmp 0x47fe6e
lea edx, [ebp - 0x4f8]
mov edi, 0x5159c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56c98]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xe56d20]
inc ecx
inc eax
mov dword [0xe56d20], ecx
lea ecx, [ebp - 0x4f8]
push ecx
mov dword [0xe56c98], eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, esi
jle 0x47ff8d
cmp eax, 0xa
jge 0x47ff8d
mov ecx, dword [ebp - 0x160]
cmp ecx, esi
jle 0x47ff8d
mov edx, dword [ebp - 0x88]
lea eax, [edx - 1]
cmp ecx, eax
jg 0x47fef5
jne 0x47ff8d
mov ebx, dword [ebp - 0x58]
cmp ebx, 0xa000
jge 0x47ff90
cmp ebx, 0x400
jle 0x47ff90
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x5f8]
push eax
call esi
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x47fe63
lea edx, [ebp - 0x5f8]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x5f8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x5f8]
push ecx
call esi
test eax, eax
jne 0x47fe63
lea edx, [ebp - 0x5f8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x47fe63
lea eax, [ebp - 0x5f8]
push eax
jmp 0x47fe4e
mov ebx, dword [ebp - 0x58]
cmp dword [ebp - 0x168], 1
jne 0x480033
mov edi, 0x515b20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x38]
cmp edi, 1
jge 0x47fffb
cmp ebx, 0x4b000
jle 0x480036
push 0x515b0c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f8]
lea ecx, [ebp - 0x4f8]
push eax
push 0x515af0
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4f8]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x4c]
mov ecx, 1
xor eax, eax
cmp edx, ecx
jne 0x480066
cmp dword [ebp - 0x20], ecx
jne 0x48004b
mov eax, ecx
cmp dword [ebp - 0x94], ecx
jne 0x480066
mov esi, dword [ebp - 0x90]
test esi, esi
jle 0x48006c
cmp esi, 5
jge 0x48006c
mov eax, ecx
jmp 0x48006c
mov esi, dword [ebp - 0x90]
cmp dword [ebp - 0x188], ecx
jne 0x480129
test eax, eax
jne 0x480129
cmp edi, ecx
jge 0x4800ae
cmp ebx, 0x4b000
jle 0x480129
push 0x515adc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], ecx
jne 0x4800ee
lea eax, [ebp - 0x2f8]
lea ecx, [ebp - 0x4f8]
push eax
push 0x515ac4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0x4f8]
push edx
push 0x515aa8
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc4]
cmp ebx, 0x32000
jle 0x480249
cmp eax, 0x64
jle 0x48017d
cmp esi, 0x64
jle 0x48019d
lea edx, [ebp - 0x2f8]
push edx
push 0x515a74
lea eax, [ebp - 0x4f8]
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x64
jle 0x48019d
cmp eax, 0x50
jle 0x48019d
cmp ebx, 0x37000
jle 0x48019d
lea edx, [ebp - 0x2f8]
push edx
push 0x516ad4
jmp 0x480151
cmp dword [ebp - 0xf4], ecx
jle 0x4801c8
cmp dword [ebp - 0xfc], ecx
jle 0x4801c8
cmp esi, 0x1e
jle 0x4801c8
cmp ebx, 0x3e800
jle 0x4801c8
lea edx, [ebp - 0x2f8]
push edx
push 0x516ad4
jmp 0x480151
cmp esi, 0x64
jle 0x4801ff
cmp ebx, 0x3e800
jle 0x4801dd
cmp edi, ecx
jg 0x480145
cmp ebx, 0x70800
jg 0x480145
cmp ebx, 0x64000
jle 0x4801ff
mov edx, dword [ebp - 0x194]
test edx, edx
jg 0x480145
cmp edi, ecx
jle 0x48021c
cmp dword [ebp - 0xbc], 0x96
jle 0x480234
cmp dword [ebp - 0x3c], 0x12c
jg 0x480145
cmp dword [ebp - 0xbc], 0x96
jle 0x480234
cmp ebx, 0x64000
jg 0x480145
cmp dword [ebp - 0x3c], 0x15e
jle 0x480249
cmp ebx, 0x64000
jg 0x480145
cmp dword [ebp - 0xf8], ecx
jne 0x48028c
cmp edi, ecx
jge 0x48027b
cmp ebx, 0x4b000
jle 0x48028c
push 0x515a5c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f8]
push edx
push 0x515a3c
jmp 0x480151
cmp dword [ebp - 0x190], 0x96
jg 0x4802a6
cmp eax, 0x64
jle 0x480343
mov ecx, 1
mov eax, dword [ebp - 0x100]
cmp edi, ecx
jge 0x480303
cmp eax, ecx
push 0x514ba8
jne 0x4802c7
lea edx, [ebp - 0x4f8]
push 0x520934
push edx
jmp 0x4802d3
lea eax, [ebp - 0x4f8]
push 0x515aa8
push eax
call fcn.004f175f
add esp, 0xc
cmp ebx, 0x4b000
jle 0x480343
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ecx
jne 0x48031c
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0x4f8]
push edx
push 0x520934
push eax
jmp 0x48032f
lea ecx, [ebp - 0x2f8]
lea edx, [ebp - 0x4f8]
push ecx
push 0x515aa8
push edx
call fcn.004f175f
add esp, 0xc
cmp ebx, 0x28000
jg 0x47e571
mov eax, dword [ebp - 0x198]
mov ecx, 1
test eax, eax
jle 0x4803c5
cmp eax, ecx
jle 0x480367
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
mov eax, dword [ebp - 0x1a0]
cmp eax, 0x400
jle 0x4803c5
add eax, ebx
cmp eax, 0x64000
jle 0x48038e
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
cmp esi, 0x3c
jle 0x4803ab
cmp eax, 0x4b000
jle 0x4803ab
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
cmp esi, 0x64
jle 0x4803c5
cmp eax, 0x32000
jle 0x4803c5
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
cmp dword [ebp - 0x10c], 0x16
jle 0x4803dc
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
cmp dword [ebp - 0x9c], ecx
jne 0x480407
cmp ebx, 0xc800
jle 0x480407
cmp esi, 0x3c
jle 0x480407
cmp dword [0xe56be4], ecx
jne 0x480407
lea ecx, [ebp - 0x2f8]
push ecx
push 0x516174
jmp 0x480432
cmp dword [ebp - 0x15c], ecx
jne 0x48045e
test edi, edi
jg 0x480426
cmp dword [ebp - 0xcc], ecx
jne 0x48045e
cmp dword [ebp - 0x64], 2
jle 0x48045e
cmp esi, 0x28
jle 0x48045e
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a8c
lea edx, [ebp - 0x4f8]
push edx
call fcn.004f175f
lea eax, [ebp - 0x4f8]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x114], ecx
jne 0x48048c
cmp ebx, 0x57800
jle 0x48048c
push 0x515a2c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xcc], ecx
jne 0x480525
lea ecx, [ebp - 0xe98]
push str.WiseCustom
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4804eb
cmp ebx, 0x64
jle 0x4804eb
cmp esi, 0x19
jle 0x4804eb
lea edx, [ebp - 0x4f8]
push 0x5208e8
push edx
call fcn.004f175f
lea eax, [ebp - 0x4f8]
push eax
call fcn.004fa6c0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x184]
mov eax, 1
cmp ecx, eax
jne 0x48052a
cmp dword [ebp - 0x11c], eax
jne 0x48052a
cmp dword [ebp - 0x164], eax
jne 0x48052a
cmp esi, 0x19
jle 0x48052a
cmp ebx, 0x64
jle 0x48052a
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
mov eax, 1
cmp dword [ebp - 0x64], 2
jle 0x480560
cmp ebx, 0xa000
jg 0x48053d
cmp esi, 0x28
jle 0x480560
mov ecx, dword [ebp - 0x98]
test ecx, ecx
jg 0x48054f
cmp dword [ebp - 0xa0], eax
jle 0x480560
lea ecx, [ebp - 0x2f8]
push ecx
push 0x515a74
jmp 0x480432
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x9c], 0
cmp ecx, eax
jne 0x4805a9
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], eax
jne 0x4805ec
mov edi, 0x524170
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x8f8]
push eax
call ebx
test al, 2
je 0x480641
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
mov eax, dword [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc eax
mov dword [ebp - 0x14], eax
mov eax, 1
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x18], eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x1550]
push eax
call ebx
test al, 2
je 0x480658
mov dword [ebp - 0x1bc], 1
mov al, byte [ebp - 0xe98]
mov dword [ebp - 0xb0], 0
cmp al, 0x30
je 0x480694
cmp al, 0x31
je 0x480694
cmp al, 0x32
je 0x480694
cmp al, 0x33
je 0x480694
cmp al, 0x34
je 0x480694
cmp al, 0x35
je 0x480694
cmp al, 0x36
je 0x480694
cmp al, 0x37
je 0x480694
cmp al, 0x38
je 0x480694
cmp al, 0x39
jne 0x480721
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov edx, 1
and ecx, 3
mov dword [ebp - 0xb0], edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x1d4]
cmp ecx, 7
jge 0x480715
mov al, byte [ebp - 0xe97]
cmp al, 0x30
je 0x48070f
cmp al, 0x31
je 0x48070f
cmp al, 0x32
je 0x48070f
cmp al, 0x33
je 0x48070f
cmp al, 0x34
je 0x48070f
cmp al, 0x35
je 0x48070f
cmp al, 0x36
je 0x48070f
cmp al, 0x37
je 0x48070f
cmp al, 0x38
je 0x48070f
cmp al, 0x39
jne 0x480715
mov dword [ebp - 0x18], edx
mov dword [ebp + 8], edx
cmp ecx, 4
jne 0x480721
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1ac]
mov ebx, 1
cmp eax, ebx
jne 0x48076d
mov edi, 0x5208ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x1a4], ebx
jne 0x4807ab
lea eax, [ebp - 0xe98]
push str.AegisI5.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4807ab
push 0x516100
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x68], ebx
jne 0x4807e6
lea ecx, [ebp - 0xe98]
push str.wltrysvc.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4807e6
push str.Broadcom
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x16c], ebx
jne 0x48081e
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], ebx
jne 0x48085d
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x134], ebx
jne 0x48089c
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18c], ebx
je 0x4808ac
cmp dword [ebp - 0x13c], ebx
jne 0x4808dc
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x174], ebx
jne 0x48091b
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf0], ebx
jne 0x480953
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x19c], ebx
jne 0x48098b
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], ebx
jne 0x4809c7
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14c], ebx
jne 0x480a09
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x17c], ebx
jne 0x480a48
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x154], ebx
jne 0x480a87
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x104], ebx
jne 0x480ac6
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd0], ebx
jne 0x480b65
cmp dword [ebp - 0x108], ebx
je 0x480aef
cmp dword [ebp - 0x110], ebx
je 0x480aef
lea edx, [ebp - 0x4f8]
mov edi, 0x515278
jmp 0x480b39
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x118]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x4f8]
mov edi, 0x515258
je 0x480b39
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x120], ebx
jne 0x480ba4
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x128], ebx
jne 0x480be3
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd4], ebx
jne 0x480c22
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x20], ebx
jne 0x480c98
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x480c98
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x80], ebx
jne 0x480d14
cmp dword [ebp - 0x8c], ebx
jne 0x480d14
cmp dword [ebp - 0xac], ebx
jne 0x480d14
cmp dword [ebp - 0xdc], ebx
jne 0x480d14
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0x4f8]
cmp eax, ebx
mov edi, 0x5151ec
je 0x480ccf
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x480d14
cmp dword [ebp - 0x1c4], ebx
jne 0x480d14
cmp dword [ebp - 0x130], ebx
jne 0x480db3
cmp dword [ebp - 0x80], ebx
jne 0x480d72
cmp dword [ebp - 0x8c], ebx
jne 0x480d72
cmp dword [ebp - 0xac], ebx
jne 0x480d72
cmp dword [ebp - 0xdc], ebx
jne 0x480d72
mov edi, 0x5160c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x480da2
mov edi, 0x5160b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x480db3
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x1c0], ebx
jne 0x480dce
cmp dword [ebp - 0x30], ebx
jne 0x480dc3
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xa4], ebx
jne 0x480dce
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x80], ebx
jne 0x480e31
cmp dword [ebp - 0x8c], ebx
jne 0x480e31
cmp dword [ebp - 0xac], ebx
jne 0x480e31
cmp dword [ebp - 0x138], ebx
jne 0x480e31
cmp dword [ebp - 0x140], ebx
jne 0x480e69
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], ebx
jne 0x480ea8
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x148], ebx
jne 0x480ee7