Function at 0x44a870
Capabilities:
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb1ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x17b4
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x5a4]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x104], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x884]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x5a4]
lea eax, [ebp - 0x12c4]
push edx
push str._sdriversProtectorA.sys
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5a4]
lea edx, [ebp - 0x10c4]
push ecx
push str._sdriversProtector.sys
push edx
call fcn.004f175f
lea eax, [ebp - 0x5a4]
push eax
lea ecx, [ebp - 0x17c4]
push str._sdrivers_tcpip.sys
push ecx
call fcn.004f175f
mov eax, dword [0xe56bf8]
add esp, 0x24
cmp eax, esi
jne 0x44aa2c
lea edx, [ebp - 0x5a4]
lea eax, [ebp - 0x15c4]
push edx
push str._sdrivers_npf.sys
push eax
call fcn.004f175f
add esp, 0xc
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x11c], esi
cmp ecx, 3
jge 0x44aa5c
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x11c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x7c4]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [edx + 1]
and ecx, 3
cmp al, 0x3a
rep movsb byte es:[edi], byte [esi]
je 0x44adc0
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
mov dword [ebp - 4], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x7c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
lea esi, [ebp + ecx - 0x7c4]
cmp edx, ecx
jge 0x44ab1a
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xfc4], al
jne 0x44ab16
cmp edx, 2
jge 0x44ab1a
inc edx
dec esi
jmp 0x44ab00
mov al, byte [ebp - 0x7c4]
sub ecx, edx
cmp al, 0x22
mov esi, ecx
jne 0x44ab4c
xor eax, eax
lea edi, [esi - 1]
cmp eax, edi
jge 0x44ab42
mov cl, byte [ebp + eax - 0x7c3]
mov byte [ebp + eax - 0xbc4], cl
inc eax
jmp 0x44ab2d
mov byte [ebp + esi - 0xbc5], 0
jmp 0x44ab6b
xor eax, eax
cmp eax, esi
jge 0x44ab63
mov cl, byte [ebp + eax - 0x7c4]
mov byte [ebp + eax - 0xbc4], cl
inc eax
jmp 0x44ab4e
mov byte [ebp + esi - 0xbc4], 0
xor ecx, ecx
cmp ecx, edx
jge 0x44ab93
lea eax, [ecx + esi]
mov al, byte [ebp + eax - 0x7c3]
cmp al, 0x5c
je 0x44ab88
mov byte [ebp + ecx - 0xfc4], al
jne 0x44ab90
mov byte [ebp + ecx - 0xfc4], 0
inc ecx
jmp 0x44ab6d
lea edi, [ebp - 0xfc4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0xfc4], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xfc5]
mov cl, byte [ebp + ecx - 0xfc5]
cmp cl, 0x22
jne 0x44abc1
mov byte [eax], 0
lea edi, [ebp - 0xbc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x44abe4
cmp byte [ebp + eax - 0xbc4], 0x3a
je 0x44abe4
inc eax
jmp 0x44abd3
mov esi, edi
xor edx, edx
sub esi, eax
lea ecx, [esi + 1]
cmp edx, ecx
jge 0x44ac0b
lea ebx, [edx + eax]
inc edx
mov bl, byte [ebp + ebx - 0xbc5]
mov byte [ebp + edx - 0x9a5], bl
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x44abed
cmp eax, edi
mov byte [ebp + esi - 0x9a3], 0
jne 0x44ac40
lea ecx, [ebp - 0x1a4]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x9a4]
push edx
push str._s_system32drivers
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xbc4]
push str.SystemRoot
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44ac81
lea edx, [ebp - 0x1a4]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x9a4]
push eax
push str._s_system32drivers
push ecx
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0xbc4]
push str.systemroot
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44acc2
lea eax, [ebp - 0x1a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x9a4]
push ecx
push str._s_system32drivers
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xbc4]
push str.Systemroot
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44ad03
lea ecx, [ebp - 0x1a4]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x9a4]
push edx
push str._s_system32drivers
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xbc4]
push str.System32
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44ad5c
lea edx, [ebp - 0xbc4]
push str.rivers
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44ad5c
lea eax, [ebp - 0x1a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x9a4]
push ecx
push str._s_system32
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xfc4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x9a4]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x11c4]
push eax
push str._s_s
push edx
call fcn.004f175f
lea edi, [ebp - 0x11c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x7c4]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 4], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0x12c4]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44ae0c
lea eax, [ebp - 0x10c4]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x44ae0c
push 0x51f93c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0x10c4]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44ae58
lea eax, [ebp - 0x12c4]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x44ae58
push 0x51f93c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0x17c4]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44ae90
push str.TCPIP
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe56bf8]
test eax, eax
jne 0x44aed1
lea eax, [ebp - 0x7c4]
lea ecx, [ebp - 0x15c4]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44aed1
push 0x51f8fc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov esi, str.DriversCMBProtector.dat
lea edx, [ebp - 0x884]
push esi
push edx
lea eax, [ebp - 0xcc4]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0xcc4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x44afb7
lea eax, [ebp - 0x7c4]
push esi
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44aff2
add esi, 0x100
inc edi
cmp esi, 0x50fa24
jl 0x44aed8
mov byte [ebp - 0x524], al
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x7c4]
push edx
push eax
call fcn.004d9590
movsx esi, ax
lea ecx, [ebp - 0x7c4]
mov dword [ebp - 0x1c], esi
push ecx
call fcn.004ab3c0
mov edi, 1
add esp, 0xc
cmp esi, edi
mov dword [ebp - 0x20], eax
jle 0x44b02d
cmp eax, 0x32000
jle 0x44b07b
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x13c4]
push edx
push 0x51f8e4
push eax
call fcn.004f175f
lea ecx, [ebp - 0x13c4]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50fa24
lea ecx, [ebp - 0xcc4]
push edi
push 0x51f8bc
push ecx
call fcn.004f175f
lea edx, [ebp - 0xcc4]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50fa24
lea eax, [ebp - 0xcc4]
push edi
push 0x51f8bc
push eax
call fcn.004f175f
lea ecx, [ebp - 0xcc4]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x64000
jle 0x44b052
push 0x51f8ac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x400
jge 0x44b07b
cmp eax, edi
jle 0x44b07b
push 0x51f898
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x7c4]
xor esi, esi
push eax
push ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x78], esi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x44b0a9
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
cmp edx, eax
je 0x44b0ac
mov dword [ebp - 0x78], edi
lea eax, [ebp - 0x524]
push str.Microsoft
push eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xf8], esi
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x44b0d7
mov dword [ebp - 0xf8], edi
lea edi, [ebp - 0x7c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jle 0x44b10b
lea esi, [ebp + ecx - 0x7c4]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0xfc4], dl
jne 0x44b105
cmp eax, 2
jge 0x44b10b
inc eax
dec esi
cmp eax, ecx
jl 0x44b0f2
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x44b133
mov ebx, ecx
lea esi, [ebp - 0x7c4]
lea edi, [ebp - 0xbc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xbc4], 0
test eax, eax
jle 0x44b166
lea esi, [ebp + edx - 0x7c3]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x44b159
mov byte [ebp + ecx - 0xfc4], dl
jne 0x44b161
mov byte [ebp + ecx - 0xfc4], 0
inc ecx
cmp ecx, eax
jl 0x44b148
mov byte [ebp + eax - 0xfc4], 0
mov al, byte [ebp - 0xbc2]
cmp al, 0x5c
je 0x44b186
mov byte [ebp - 0xbc2], 0x5c
mov byte [ebp - 0xbc1], 0
mov al, byte [ebp - 0xbc3]
mov byte [ebp - 0x9a4], 0
cmp al, 0x3a
je 0x44b254
lea edi, [ebp - 0xbc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x44b1c1
cmp byte [ebp + eax - 0xbc4], 0x3a
je 0x44b1c1
inc eax
cmp eax, ecx
jl 0x44b1b2
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x44b1f2
mov ecx, edi
lea esi, [ebp + eax - 0xbc5]
mov ebx, ecx
lea edi, [ebp - 0x9a4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x9a3], 0
jne 0x44b22b
lea ecx, [ebp - 0x1a4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x9a4]
push edx
push 0x50d39c
push eax
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x9a4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xbc4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xbc2], 0x5c
je 0x44b264
mov byte [ebp - 0xbc2], 0x5c
lea ecx, [ebp - 0x7c4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
je 0x44b296
push 0x51f888
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xbc3], 0x3a
je 0x44b2bd
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xbc2], 0x5c
je 0x44b2cd
mov byte [ebp - 0xbc2], 0x5c
lea edi, [ebp - 0xfc4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x44b2fb
cmp byte [ebp + eax - 0xfc4], 0x2e
jne 0x44b2f2
mov edx, 1
inc eax
cmp eax, ecx
jl 0x44b2e3
test edx, edx
jne 0x44b319
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0xfc0], 0
jge 0x44b344
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x5a4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x884]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x7c4]
push 0x100
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0xfc4]
push 0x40
lea ecx, [ebp - 0x804]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x2a4]
push edx
call fcn.004dab80
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x7c4]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x28
test eax, eax
jne 0x44b3de
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xf8], 1
jne 0x44b42c
mov eax, dword [0xe56be0]
test eax, eax
jle 0x44b42c
lea ecx, [ebp - 0x7c4]
push ecx
call fcn.004bd760
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x44b42c
push 0x5144fc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x7c4]
push 0x80
lea eax, [ebp - 0xdc4]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x7c4]
push 0x80
lea edx, [ebp - 0xd44]
push ecx
push edx
call fcn.004f27c0
lea edi, [ebp - 0x884]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x5a4]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xdc4], al
mov byte [ebp + ecx - 0xd44], al
lea eax, [ebp - 0x884]
lea ecx, [ebp - 0xdc4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x44b4d4
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b4d4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x5a4]
lea eax, [ebp - 0xd44]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b51e
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b51e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c4]
push str.System32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44b566
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b566
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x7c4]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44b5ae
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b5ae
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x7c4]
push str.system
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44b5f6
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44b5f6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c4]
push str.Temp_
push ecx
call fcn.004f2d80
add esp, 8
mov ebx, 1
test eax, eax
je 0x44b616
mov dword [ebp - 0x60], ebx
lea edx, [ebp - 0x7c4]
push str._temp_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44b631
mov dword [ebp - 0x60], ebx
lea eax, [ebp - 0x7c4]
push str.TEMP_
push eax
call fcn.004f2d80
xor esi, esi
add esp, 8
cmp eax, esi
je 0x44b64e
mov dword [ebp - 0x60], ebx
lea ecx, [ebp - 0xfc4]
lea edx, [ebp - 0x5a4]
push ecx
push edx
lea eax, [ebp - 0x16c4]
push str._s_s
push eax
call fcn.004f175f
push 0xdd7fe0
mov dword [ebp - 4], 4
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x80], esi
call fcn.004a6b50
add esp, 0x14
lea ecx, [ebp - 0x7c4]
push 0xdd7fe0
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, esi
jne 0x44b6a6
mov edi, ebx
jmp 0x44b718
mov edx, dword [0xdd7fe8]
mov byte [ebp - 4], 5
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x120], eax
mov eax, dword [0xdd7fe8]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, esi
mov dword [ebp - 0x10c], eax
jne 0x44b793
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x80], 2
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x80]
mov dword [ebp - 4], 4
mov ebx, 1
mov edx, dword [0xdd7fe8]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x44bf8d
cmp edi, 2
jne 0x44becc
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2a4]
push edx
call fcn.004abbf0
add esp, 4
lea eax, [ebp - 0x2a4]
push eax
call fcn.004abcc0
add esp, 4
push 0x51f85c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [ebp - 0x9c], edi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44b706
mov ecx, dword [eax + 0xc]
mov edx, dword [0xdd7fe8]
mov eax, dword [ebp - 0x120]
push ecx
push edx
push eax
call fcn.004a6c30
add esp, 0xc
mov esi, eax
push str.ntoskrnl.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44b802
push str.ntkrnlpa.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44b802
push str.ntkrnlmp.exe
push esi
call fcn.004f61e0
add esp, 8
mov dword [ebp - 0x114], 0
test eax, eax
jne 0x44b80c
mov dword [ebp - 0x114], 1
mov ecx, dword [0xdd7fe8]
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x118], 0
call fcn.004a6bb0
mov edx, dword [0xdd7fe8]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x124], esi
call fcn.004a6ca0
lea ecx, [edi + edi*4]
add esp, 4
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x44b84f
mov eax, dword [ecx + 0x10]
mov edx, dword [0xdd7fe8]
push eax
push edx
push esi
mov dword [ebp - 0x6c], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x44b706
mov eax, dword [eax]
test eax, eax
je 0x44be71
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x44b8d9
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x9c4]
jmp 0x44b95f
mov ecx, dword [0xdd7fe8]
mov edx, dword [ebp - 0x124]
push eax
push ecx
push edx
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x44b916
xor eax, eax
lea ecx, [ebp - 0x5c4]
mov ax, word [esi]
push eax
push str._04lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x44b95f
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x8a4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x8a4]
xor esi, esi
mov edi, 1
cmp esi, 0x38
jge 0x44bdfa
mov ecx, esi
shl ecx, 6
add ecx, str.RtlQueryRegistryValues
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44bdf4
test esi, esi
jne 0x44b9a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, edi
jne 0x44b9b4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 2
jne 0x44b9c9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 3
jne 0x44b9de
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 4
jne 0x44b9f6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 5
jne 0x44ba0e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 6
jne 0x44ba26
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xbc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 7
jne 0x44ba3e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 8
jne 0x44ba56
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 9
jne 0x44ba6e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0xa
jne 0x44ba86
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0xb
jne 0x44ba9e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0xc
jne 0x44bab6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0xd
jne 0x44bacb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0xe
jne 0x44bae7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], edi
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
inc eax
inc esi
mov dword [ebp - 0x40], eax
jmp 0x44b966
cmp esi, 0xf
jne 0x44bafc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x10
jne 0x44bb11
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x11
jne 0x44bb29
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x84], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x12
jne 0x44bb41
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x13
jne 0x44bb56
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x74], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x14
jne 0x44bb6e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x15
jne 0x44bb86
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x16
jne 0x44bb9e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x17
jne 0x44bbb6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x18
jne 0x44bbce
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x19
jne 0x44bbe6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x1a
jne 0x44bbfe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x1b
je 0x44bc08
cmp esi, 0x1c
jne 0x44bc15
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x90], edi
inc eax
mov dword [ebp - 0x14], eax
cmp esi, 0x1d
jne 0x44bc2d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x1e
jne 0x44bc45
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x1f
jne 0x44bc56
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x44b966
cmp esi, 0x20
jne 0x44bc64
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x44b966
cmp esi, 0x21
jne 0x44bc75
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x44b966
cmp esi, 0x22
jne 0x44bc86
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x44b966
cmp esi, 0x23
jne 0x44bc9e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x108], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x24
jne 0x44bcb6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x25
jne 0x44bcce
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44b966
cmp esi, 0x26
jne 0x44bcdf
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x44b966
cmp esi, 0x27
jne 0x44bcf1
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44b966
cmp esi, 0x28
jne 0x44bd03
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44b966
cmp esi, 0x29
jne 0x44bd15
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44b966
cmp esi, 0x2a
jne 0x44bd27
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44b966
cmp esi, 0x2c
jne 0x44bd39
mov eax, dword [ebp - 0x24]
inc eax
inc esi
mov dword [ebp - 0x24], eax
jmp 0x44b966
cmp esi, 0x2d
jne 0x44bd4a
mov dword [ebp - 0x88], edi
inc esi
jmp 0x44b966
cmp esi, 0x2e
jne 0x44bd5c
mov eax, dword [ebp - 0x30]
inc eax
inc esi
mov dword [ebp - 0x30], eax
jmp 0x44b966
cmp esi, 0x2f
jne 0x44bd6e
mov eax, dword [ebp - 0x2c]
inc eax
inc esi
mov dword [ebp - 0x2c], eax
jmp 0x44b966
cmp esi, 0x30
jne 0x44bd80
mov eax, dword [ebp - 0x38]
inc eax
inc esi
mov dword [ebp - 0x38], eax
jmp 0x44b966
cmp esi, 0x31
jne 0x44bd92
mov eax, dword [ebp - 0x3c]
inc eax
inc esi
mov dword [ebp - 0x3c], eax
jmp 0x44b966
cmp esi, 0x32
jne 0x44bda4
mov eax, dword [ebp - 0x54]
inc eax
inc esi
mov dword [ebp - 0x54], eax
jmp 0x44b966
cmp esi, 0x33
jne 0x44bdb6
mov eax, dword [ebp - 0x5c]
inc eax
inc esi
mov dword [ebp - 0x5c], eax
jmp 0x44b966
cmp esi, 0x34
jne 0x44bdc8
mov eax, dword [ebp - 0x58]
inc eax
inc esi
mov dword [ebp - 0x58], eax
jmp 0x44b966
cmp esi, 0x35
jne 0x44bdda
mov eax, dword [ebp - 0x4c]
inc eax
inc esi
mov dword [ebp - 0x4c], eax
jmp 0x44b966
cmp esi, 0x36
jne 0x44bdec
mov eax, dword [ebp - 0x44]
inc eax
inc esi
mov dword [ebp - 0x44], eax
jmp 0x44b966
cmp esi, 0x37
jne 0x44bdf4
inc dword [ebp - 0x34]
inc esi
jmp 0x44b966
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x114]
inc ecx
cmp eax, edi
mov dword [ebp - 0x28], ecx
jne 0x44be0e
inc dword [ebp - 0x70]
cmp dword [ebp - 0x28], 0x2710
jg 0x44be71
mov esi, dword [ebp - 0x118]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x6c], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x44b86e
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x10c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 5
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x10c], eax
mov edi, ecx
jmp 0x44b79b
cmp dword [ebp - 0x20], 0xffffffff
jne 0x44bf32
lea ecx, [ebp - 0x2a4]
push str.sptd.sys
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44bf32
mov edi, 0x51f828
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x13c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x13c4]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2a4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x2a4]
push ecx
call fcn.004abbf0
add esp, 4
lea edx, [ebp - 0x2a4]
push edx
call fcn.004abcc0
add esp, 4
push 0x51f7f8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xdd7fe0
call fcn.004a6b50
add esp, 4
cmp edi, ebx
jne 0x44bfbc
push 0x51f7e0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x44bffe
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jle 0x44c006
cmp eax, 0x1400
jge 0x44c006
cmp dword [ebp - 0x1c], ebx
jge 0x44c006
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2a4]
push edx
jmp 0x44b76d
cmp esi, ebx
jge 0x44c68e
test edi, edi
je 0x44c68e
push str.c:endpcachemonitor_procPath8.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xbc4]
push eax
call fcn.004f2beb
jmp 0x44c037
lea ecx, [ebp - 0xfc4]
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x14c4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath8.txt
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x44c068
push ebx
lea ecx, [ebp - 0x16c]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x44c092
lea eax, [ebp - 0x14c4]
push eax
call fcn.004f2ce2
add esp, 4
jmp 0x44c0a6
lea ecx, [ebp - 0x2a4]
push str.c:endpcachemonitor_procPath8.txt
push ecx
call fcn.00403af0
add esp, 8
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x16c]
push edx
push ebx
push str.c:endpcachemonitor_procPath8.txt
mov dword [ebp + 8], 0
call fcn.004f0727
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x168]
cmp dword [eax + 0x30], 0xffffffff
jne 0x44c121
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
lea ecx, [ebp - 0x158]
mov esi, eax
mov byte [ebp - 4], 4
call fcn.004f0714
lea ecx, [ebp - 0x158]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x168]
push 0xa
lea edx, [ebp - 0xcc4]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x168], esi
call fcn.004f0ae9
lea edi, [ebp - 0xcc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x44c652
lea eax, [ebp - 0xcc4]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44c652
lea ecx, [ebp - 0xcc4]
push str.Dump_of
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44c652
lea edx, [ebp - 0xcc4]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44c652
xor esi, esi
cmp esi, 0x38
jge 0x44c64f
mov eax, esi
lea ecx, [ebp - 0xcc4]
shl eax, 6
add eax, str.RtlQueryRegistryValues
push eax
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44c649
test esi, esi
jne 0x44c1f5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, ebx
jne 0x44c209
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdc], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 2
jne 0x44c21e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 3
jne 0x44c233
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 4
jne 0x44c24b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb4], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 5
jne 0x44c263
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 6
jne 0x44c27b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xbc], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 7
jne 0x44c293
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfc], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 8
jne 0x44c2ab
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc4], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 9
jne 0x44c2c3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0xa
jne 0x44c2db
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0xb
jne 0x44c2f3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcc], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0xc
jne 0x44c30b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc0], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0xd
jne 0x44c320
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0xe
jne 0x44c33c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], ebx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
inc eax
inc esi
mov dword [ebp - 0x40], eax
jmp 0x44c1b6
cmp esi, 0xf
jne 0x44c351
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x10
jne 0x44c366
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x11
jne 0x44c37e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x84], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x12
jne 0x44c396
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa0], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x13
jne 0x44c3ab
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x74], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x14
jne 0x44c3c3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x15
jne 0x44c3db
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd4], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x16
jne 0x44c3f3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x17
jne 0x44c40b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb8], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x18
jne 0x44c423
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x19
jne 0x44c43b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x1a
jne 0x44c453
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x1b
je 0x44c45d
cmp esi, 0x1c
jne 0x44c46a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x90], ebx
inc eax
mov dword [ebp - 0x14], eax
cmp esi, 0x1d
jne 0x44c482
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd0], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x1e
jne 0x44c49a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x1f
jne 0x44c4ab
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x20
jne 0x44c4b9
mov dword [ebp - 0x7c], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x21
jne 0x44c4ca
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x22
jne 0x44c4db
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x23
jne 0x44c4f3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x108], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x24
jne 0x44c50b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x25
jne 0x44c523
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa8], ebx
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x44c1b6
cmp esi, 0x26
jne 0x44c534
mov dword [ebp - 0xf4], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x27
jne 0x44c546
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44c1b6
cmp esi, 0x28
jne 0x44c558
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44c1b6
cmp esi, 0x29
jne 0x44c56a
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44c1b6
cmp esi, 0x2a
jne 0x44c57c
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x44c1b6
cmp esi, 0x2c
jne 0x44c58e
mov eax, dword [ebp - 0x24]
inc eax
inc esi
mov dword [ebp - 0x24], eax
jmp 0x44c1b6
cmp esi, 0x2d
jne 0x44c59f
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x44c1b6
cmp esi, 0x2e
jne 0x44c5b1
mov eax, dword [ebp - 0x30]
inc eax
inc esi
mov dword [ebp - 0x30], eax
jmp 0x44c1b6
cmp esi, 0x2f
jne 0x44c5c3
mov eax, dword [ebp - 0x2c]
inc eax
inc esi
mov dword [ebp - 0x2c], eax
jmp 0x44c1b6
cmp esi, 0x30
jne 0x44c5d5
mov eax, dword [ebp - 0x38]
inc eax
inc esi
mov dword [ebp - 0x38], eax
jmp 0x44c1b6
cmp esi, 0x31
jne 0x44c5e7
mov eax, dword [ebp - 0x3c]
inc eax
inc esi
mov dword [ebp - 0x3c], eax
jmp 0x44c1b6
cmp esi, 0x32
jne 0x44c5f9
mov eax, dword [ebp - 0x54]
inc eax
inc esi
mov dword [ebp - 0x54], eax
jmp 0x44c1b6
cmp esi, 0x33
jne 0x44c60b
mov eax, dword [ebp - 0x5c]
inc eax
inc esi
mov dword [ebp - 0x5c], eax
jmp 0x44c1b6
cmp esi, 0x34
jne 0x44c61d
mov eax, dword [ebp - 0x58]
inc eax
inc esi
mov dword [ebp - 0x58], eax
jmp 0x44c1b6
cmp esi, 0x35
jne 0x44c62f
mov eax, dword [ebp - 0x4c]
inc eax
inc esi
mov dword [ebp - 0x4c], eax
jmp 0x44c1b6
cmp esi, 0x36
jne 0x44c641
mov eax, dword [ebp - 0x44]
inc eax
inc esi
mov dword [ebp - 0x44], eax
jmp 0x44c1b6
cmp esi, 0x37
jne 0x44c649
inc dword [ebp - 0x34]
inc esi
jmp 0x44c1b6
inc dword [ebp + 8]
mov edx, dword [ebp - 0x16c]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x164], 1
je 0x44c121
lea ecx, [ebp - 0x16c]
call fcn.004f076e
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 4
call fcn.004f0714
lea ecx, [ebp - 0x158]
call fcn.004f05fb
lea ecx, [ebp - 0x524]
xor ebx, ebx
push str._company_name_here_
push ecx
mov byte [ebp - 0x4a4], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x6c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44c6c5
cmp dword [ebp - 0x14], ebx
jle 0x44c6c5
mov ebx, 1
mov dword [ebp - 0x6c], ebx
lea edi, [ebp - 0x524]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x7c4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x44c797
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x20]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp edx, ebx
mov dword [ebp - 0x14], ecx
jle 0x44c8df
cmp edx, 0x2800
jge 0x44c8e7
cmp dword [ebp - 0x1c], ebx
jge 0x44c8e7
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2a4]
push edx
call fcn.004abcc0
add esp, 4
push 0x51f74c
jmp 0x44b77a
test ebx, ebx
jne 0x44c8df
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x5c]
test eax, eax
jle 0x44c810
test ecx, ecx
jg 0x44c8d5
mov esi, dword [ebp - 0x58]
mov eax, 1
cmp esi, eax
jg 0x44c8d5
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
jg 0x44c8d5
cmp dword [ebp - 0x40], eax
jg 0x44c8d5
cmp dword [ebp - 0x44], eax
jg 0x44c8d5
cmp dword [ebp - 0x34], eax
jg 0x44c8d5
cmp dword [ebp - 0x18], eax
jg 0x44c806
cmp dword [ebp - 0x30], eax
jg 0x44c806
mov edx, dword [ebp - 0x2c]
test edx, edx
jg 0x44c806
mov edx, dword [ebp - 0x38]
cmp edx, eax
jg 0x44c806
mov edi, dword [ebp - 0x3c]
cmp edi, eax
jle 0x44c81c
push 0x51f738
jmp 0x44b77a
mov esi, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x44c878
mov eax, dword [ebp - 0x18]
test eax, eax
jg 0x44c8d5
mov eax, dword [ebp - 0x2c]
test eax, eax
jg 0x44c8d5
cmp dword [ebp - 0x44], 1
jg 0x44c8d5
cmp dword [ebp - 0x34], 1
jg 0x44c8d5
test ecx, ecx
jg 0x44c8d5
cmp esi, 1
jg 0x44c8d5
test ebx, ebx
jg 0x44c8d5
cmp dword [ebp - 0x40], 1
jg 0x44c8d5
cmp edx, 1
jg 0x44c86e
cmp edi, 1
jle 0x44c878
push 0x51f738
jmp 0x44b77a
xor eax, eax
test ecx, ecx
jle 0x44c883
mov eax, 1
test esi, esi
jle 0x44c888
inc eax
test ebx, ebx
jle 0x44c88d
inc eax
mov esi, dword [ebp - 0x40]
mov ecx, 1
cmp esi, ecx
jle 0x44c89a
inc eax
mov esi, dword [ebp - 0x44]
test esi, esi
jle 0x44c8a2
inc eax
cmp dword [ebp - 0x34], ecx
jle 0x44c8a8
inc eax
test edx, edx
jle 0x44c8ad
inc eax
test edi, edi
jle 0x44c8b2
inc eax
mov edx, dword [ebp - 0x18]
test edx, edx
jle 0x44c8ba
inc eax
mov edx, dword [ebp - 0x2c]
test edx, edx
jg 0x44c8c8
mov edx, dword [ebp - 0x30]
test edx, edx
jle 0x44c8c9
inc eax
mov edx, dword [ebp - 0x54]
test edx, edx
jle 0x44c8d1
inc eax
cmp eax, ecx
jle 0x44c8df
push 0x51f738
jmp 0x44b77a
mov edx, dword [ebp - 0x20]
mov ebx, 1
mov al, byte [ebp - 0xfc4]
cmp al, 0x30
je 0x44c915
cmp al, 0x31
je 0x44c915
cmp al, 0x32
je 0x44c915
cmp al, 0x33
je 0x44c915
cmp al, 0x34
je 0x44c915
cmp al, 0x35
je 0x44c915
cmp al, 0x36
je 0x44c915
cmp al, 0x37
je 0x44c915
cmp al, 0x38
je 0x44c915
cmp al, 0x39
jne 0x44c94d
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp - 0x24], ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x8c], ebx
jne 0x44c9c0
mov edi, 0x51f728
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [ebp - 0x4a4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x524]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4a4]
push eax
jmp 0x44b77a
cmp dword [ebp - 0x100], ebx
jne 0x44c9fd
mov edi, 0x51f71c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x1c], 2
jge 0x44ca38
mov edi, 0x51f710
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x94], ebx
jne 0x44ca78
mov edi, 0x51f6ec
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x108], ebx
jne 0x44cad1
mov eax, dword [ebp - 0x70]
test eax, eax
jle 0x44cad1
cmp eax, 0xa
jge 0x44cad1
cmp edx, 0xc800
jge 0x44cad1
cmp dword [ebp - 0x28], 0xf
jge 0x44cad1
mov edi, 0x51f6d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x110], ebx
jne 0x44cb51
mov edi, 0x51f6a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xf4]
mov ecx, edx
mov edx, dword [ebp - 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
inc edx
inc ecx
cmp eax, ebx
mov dword [ebp - 0x24], edx
mov dword [ebp + 8], ecx
jne 0x44cb51
mov edi, str.HOOK
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa4], ebx
jne 0x44cb89
mov edi, 0x51f680
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xdc], ebx
jne 0x44cbc1
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xac], ebx
jne 0x44cbf9
mov edi, 0x51f670
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x104], ebx
jne 0x44cc31
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb4], ebx
jne 0x44cc69
mov edi, 0x51f660
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe4], ebx
jne 0x44cca1
mov edi, 0x51f650
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xbc], ebx
jne 0x44ccd9
mov edi, 0x51f648
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xfc], ebx
jne 0x44cd11
mov edi, 0x51f63c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc4], ebx
jne 0x44cd49
mov edi, 0x51f630
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], ebx
jne 0x44cd81
mov edi, 0x51f620
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcc], ebx
jne 0x44cdc0
mov edi, 0x51f610
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x84], ebx
jne 0x44cdff
mov edi, 0x51f600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0xd4], ebx
jne 0x44ce3e
mov edi, 0x51f5ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x98], ebx
jne 0x44ce7d
mov edi, 0x51f5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0xa0], ebx
je 0x44ce8d
cmp dword [ebp - 0xa8], ebx
jne 0x44cec4
mov edi, 0x51f5cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x74], ebx
jne 0x44cef9
mov edi, 0x51f5c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0xb0]
cmp edx, ebx
jne 0x44cf38
mov edi, 0x51f5b4
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], ebx
jne 0x44cf7b
cmp edx, ebx
jne 0x44cf7b
lea eax, [ebp - 0x524]
push str.UnNoo___www.unnoo.com
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44cf71
lea ecx, [ebp - 0x524]
push str.www.unnoo.com
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44cf7b
push 0x51f574
jmp 0x44b77a
cmp dword [ebp - 0xb8], ebx
jne 0x44cfb3
mov edi, 0x51f564
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc0], ebx
jne 0x44cfeb
mov edi, 0x51f554
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x68], ebx
jne 0x44d020
mov edi, 0x51f544
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], ebx
jne 0x44d055
mov edi, 0x51f534
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], ebx
jne 0x44d094
mov edi, 0x51f524
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0xd0], ebx
jne 0x44d0d3
mov edi, 0x51f514
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0xd8], ebx
jne 0x44d112
mov edi, 0x51f504
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0xe0], ebx
je 0x44d11f
cmp dword [ebp - 0x7c], ebx
jne 0x44d14f
mov edi, 0x51f4f8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x18], ebx
jg 0x44d16a
cmp dword [ebp - 0x30], ebx
jg 0x44d16a
mov eax, dword [ebp - 0x2c]
test eax, eax
jg 0x44d16a
cmp dword [ebp - 0x38], ebx
jg 0x44d16a
cmp dword [ebp - 0x3c], ebx
jle 0x44d19a
mov edi, 0x51f4e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], ebx
jne 0x44d1dc
mov eax, dword [ebp - 0xf0]
test eax, eax
jne 0x44d1dc
mov edi, 0x51f4d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], ebx
jne 0x44d211
mov edi, 0x51f4cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp - 0xf8]
cmp ebx, 1
jne 0x44d320
lea eax, [ebp - 0x13c4]
lea ecx, [ebp - 0x7c4]
push eax
push ecx
call fcn.004c23b0
add esp, 8
test ax, ax
jne 0x44d272
mov edi, 0x51613c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x44d2c8
lea eax, [ebp - 0x13c4]
push 0x516158
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44d2c8
mov edi, 0x51613c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 7
jle 0x44d320
lea eax, [ebp - 0x13c4]
push 0x516138
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44d320
mov edi, 0x51f4c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x11c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x7c4]
lea ecx, [ebp - 0x16c4]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44d473
test ebx, ebx
jne 0x44d473
mov edi, 0x51f4b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x4a4]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
and ecx, 3
cmp eax, 0x2800
rep movsb byte es:[edi], byte [esi]
jge 0x44d3e8
mov ecx, dword [ebp - 0x1c]
mov eax, 1
cmp ecx, eax
jge 0x44d3e8
cmp dword [ebp - 0x28], 0x28
jge 0x44d3e8
cmp dword [ebp - 0x14], eax
jle 0x44d3e8
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f494
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44d3ee
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x88], 1
jne 0x44d4c6
cmp dword [ebp - 0x7c], 1
jne 0x44d4c6
cmp dword [ebp - 0x20], 0x1400
jge 0x44d4c6
cmp dword [ebp - 0x1c], 1
jge 0x44d4c6
cmp dword [ebp - 0x28], 0xa
jge 0x44d4c6
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f494
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44d4c6
cmp ebx, 1
jne 0x44d4c0
cmp dword [ebp - 0x78], ebx
jne 0x44d52e
mov edi, 0x51f480
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x44d4cc
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x78], 1
jne 0x44d534
mov eax, dword [ebp - 0x20]
cmp eax, 1
jle 0x44d534
cmp eax, 0x1800
jge 0x44d534
cmp dword [ebp - 0x1c], 1
jge 0x44d534
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f464
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44d534
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x60]
test eax, eax
jg 0x44d541
cmp dword [ebp - 0x6c], 1
jne 0x44d595
cmp dword [ebp - 0x20], 0x7800
jge 0x44d595
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f464
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x28]
cmp ecx, 6
jge 0x44d65b
mov eax, dword [ebp - 0x70]
cmp ecx, eax
jne 0x44d65b
cmp dword [ebp - 0x1c], 1
jge 0x44d65b
test eax, eax
jne 0x44d61d
cmp dword [ebp - 0x20], 0x6400
jge 0x44d610
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f438
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44d65b
lea edx, [ebp - 0x4a4]
mov edi, 0x51f424
jmp 0x44d628
lea edx, [ebp - 0x4a4]
mov edi, 0x51f418
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
inc ecx
inc eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x90], 1
jne 0x44d6af
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f3f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x1c], 2
jge 0x44d718
lea eax, [ebp - 0x7c4]
push str.Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44d718
lea ecx, [ebp - 0x2a4]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x2a4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f3d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x7c4]
push str..txt
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44d748
lea ecx, [ebp - 0x7c4]
push str..TXT
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44d793
lea edx, [ebp - 0x2a4]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f464
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x24], 1
jle 0x44d7e4
lea eax, [ebp - 0x2a4]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f464
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 8], 2
jle 0x44d86f
cmp dword [ebp - 0x1c], 1
jle 0x44d86f
lea eax, [ebp - 0x524]
push str.NVIDIA
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x44d824
lea ecx, [ebp - 0x524]
push str.nvidia
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44d86f
lea edx, [ebp - 0x2a4]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x51f390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], 0x32000
jle 0x44d882
cmp dword [ebp - 0x70], 0x50
jle 0x44d882
xor esi, esi
jmp 0x44d885
mov esi, dword [ebp - 0x14]
push str.c:endpcachemonitor_procPath8.txt
call fcn.004f2cb8
push str.c:endpcache
call fcn.004f2beb
add esp, 8
test esi, esi
jne 0x44c9b4
cmp dword [ebp - 0x11c], 1
jne 0x44d8b7
push 0x51f4c0
jmp 0x44b77a
push 0x51f378
jmp 0x44b77a