Function at 0x436020
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483b0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x18f8
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x1108]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x6a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x4361ca
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
mov eax, 0x49bbd4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x3a8]
push str.rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x436216
lea eax, [ebp - 0x3a8]
push str.RUNDLL32.
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x436216
lea ecx, [ebp - 0x3a8]
push str.Rundll32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4362a1
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x7a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x436276
cmp byte [ebp + eax - 0x7a8], 0x33
jne 0x436273
cmp byte [ebp + eax - 0x7a7], 0x32
jne 0x436273
cmp byte [ebp + eax - 0x7a6], 0x2e
je 0x436276
inc eax
jmp 0x436251
xor esi, esi
mov ecx, edi
sub ecx, eax
sub ecx, 7
cmp esi, ecx
jge 0x436297
lea edx, [esi + eax]
inc esi
mov cl, byte [ebp + edx - 0x7a1]
mov byte [ebp + esi - 0x3a9], cl
jmp 0x436278
sub edi, eax
mov byte [ebp + edi - 0x3af], 0
lea edx, [ebp - 0x3a8]
push 0x48b2f4
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436370
lea eax, [ebp - 0x1a8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xac8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xac8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea ecx, [edi - 0xc]
cmp eax, ecx
jge 0x43631e
cmp byte [ebp + eax - 0xac8], 0x25
je 0x43631e
inc eax
jmp 0x43630a
xor esi, esi
mov edx, edi
sub edx, eax
sub edx, 0xc
cmp esi, edx
jge 0x43633f
lea ecx, [esi + eax]
inc esi
mov dl, byte [ebp + ecx - 0xabc]
mov byte [ebp + esi - 0x7a9], dl
jmp 0x436320
lea eax, [ebp - 0x7a8]
lea ecx, [ebp - 0x1a8]
push eax
push ecx
lea edx, [ebp - 0x3a8]
push str._s_s
push edx
mov byte [ebp + esi - 0x7a8], 0
mov byte [ebp - 0x3a8], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x3a8]
push 0x49bba4
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43643f
lea ecx, [ebp - 0x1a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xac8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xac8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea ecx, [edi - 0xc]
cmp eax, ecx
jge 0x4363ed
cmp byte [ebp + eax - 0xac8], 0x25
je 0x4363ed
inc eax
jmp 0x4363d9
xor esi, esi
mov edx, edi
sub edx, eax
sub edx, 0xc
cmp esi, edx
jge 0x43640e
lea ecx, [esi + eax]
inc esi
mov dl, byte [ebp + ecx - 0xabc]
mov byte [ebp + esi - 0x7a9], dl
jmp 0x4363ef
lea eax, [ebp - 0x7a8]
lea ecx, [ebp - 0x1a8]
push eax
push ecx
lea edx, [ebp - 0x3a8]
push str._s_s
push edx
mov byte [ebp + esi - 0x7a8], 0
mov byte [ebp - 0x3a8], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x3a8]
push str..RECYCLER
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436512
lea ecx, [ebp - 0x1a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xac8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1a6], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xac8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea ecx, [edi - 0xc]
cmp eax, ecx
jge 0x4364c3
cmp byte [ebp + eax - 0xac8], 0x5c
je 0x4364c3
inc eax
jmp 0x4364af
xor esi, esi
mov edx, edi
sub edx, eax
cmp esi, edx
jge 0x4364e1
lea ecx, [esi + eax]
inc esi
mov dl, byte [ebp + ecx - 0xac8]
mov byte [ebp + esi - 0x7a9], dl
jmp 0x4364c5
lea eax, [ebp - 0x7a8]
lea ecx, [ebp - 0x1a8]
push eax
push ecx
lea edx, [ebp - 0x3a8]
push str._s_s
push edx
mov byte [ebp + esi - 0x7a8], 0
mov byte [ebp - 0x3a8], 0
call fcn.0047a8f8
add esp, 0x10
cmp byte [ebp - 0x3a8], 0x22
jne 0x436562
xor edx, edx
xor ecx, ecx
cmp ecx, ebx
jge 0x436539
mov al, byte [ebp + ecx - 0x3a8]
cmp al, 0x22
je 0x436536
mov byte [ebp + edx - 0x1508], al
inc edx
inc ecx
jmp 0x43651f
lea edi, [ebp - 0x1508]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], ecx
lea ebx, [ecx - 2]
test ebx, ebx
jle 0x436595
cmp byte [ebp + ebx - 0x3a8], 0x3a
jne 0x436590
cmp byte [ebp + ebx - 0x3a7], 0x5c
je 0x436593
dec ebx
jmp 0x436578
test ebx, ebx
je 0x4366a6
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1508]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x491a04
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3a8]
xor esi, esi
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4365e3
mov esi, 1
lea edx, [ebp - 0x3a8]
push 0x491a00
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436600
mov esi, 1
mov eax, dword [ebp + 8]
mov dl, 0x65
test eax, eax
jle 0x436646
mov cl, byte [ebp + eax - 0x3a8]
cmp esi, 1
jne 0x436634
cmp cl, 0x2e
jne 0x436643
cmp byte [ebp + eax - 0x3a7], dl
je 0x436646
cmp cl, cl
jne 0x436643
cmp byte [ebp + eax - 0x3a7], 0x45
je 0x436646
dec eax
jmp 0x436605
cmp cl, 0x2e
jne 0x436643
cmp byte [ebp + eax - 0x3a7], 0x2e
jne 0x436646
dec eax
jmp 0x436605
mov byte [ebp - 0x3a8], 0
xor ecx, ecx
mov edx, eax
sub edx, ebx
add edx, 5
cmp ecx, edx
jge 0x43666e
lea edx, [ecx + ebx]
inc ecx
mov dl, byte [ebp + edx - 0x1509]
mov byte [ebp + ecx - 0x3a9], dl
jmp 0x43664f
sub eax, ebx
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
mov byte [ebp + eax - 0x3a3], 0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x436696
cmp byte [ebp + ecx - 0x3a8], 0x2e
jne 0x436687
test ecx, ecx
mov byte [ebp + ecx - 0x3a4], 0
jne 0x436780
lea eax, [ebp - 0x848]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x436738
lea edx, [ebp - 0x1a8]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x436738
lea eax, [ebp - 0x1a8]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x436738
lea ecx, [ebp - 0x1a8]
lea edx, [ebp - 0x6a8]
push ecx
jmp 0x436745
lea ecx, [ebp - 0x1a8]
lea edx, [ebp - 0x848]
push ecx
push edx
lea eax, [ebp - 0x3a8]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x436778
cmp byte [ebp + ecx - 0x3a8], 0x2e
jne 0x436769
mov byte [ebp + ecx - 0x3a4], 0
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.00483565
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 0x3a8]
push edx
mov dword [ebx], eax
call fcn.00429f20
mov esi, 1
add esp, 8
cmp eax, esi
je 0x4367b3
push 0x49e37c
jmp 0x439152
lea eax, [ebp - 0x3a8]
push eax
call fcn.004246a0
lea ecx, [ebp - 0x3a8]
push str..sys
push ecx
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x436853
lea edx, [ebp - 0x3a8]
push edx
call fcn.00428d90
add esp, 4
mov esi, eax
lea eax, [ebp - 0x848]
lea ecx, [ebp - 0x1a8]
push eax
lea edx, [ebp - 0x8c8]
push ecx
lea eax, [ebp - 0x3a8]
push edx
push eax
call fcn.004456c0
add esp, 0x10
lea ecx, [ebp - 0x848]
lea edx, [ebp - 0x1a8]
lea eax, [ebp - 0x8c8]
push ecx
push edx
push eax
push esi
lea ecx, [ebp - 0x1608]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1608]
push edx
call fcn.00483565
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3a8]
push str..SYS
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4368e7
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.00428d90
add esp, 4
mov esi, eax
lea edx, [ebp - 0x8c8]
lea eax, [ebp - 0x848]
push edx
lea ecx, [ebp - 0x1a8]
push eax
lea edx, [ebp - 0x3a8]
push ecx
push edx
call fcn.004456c0
add esp, 0x10
lea eax, [ebp - 0x8c8]
lea ecx, [ebp - 0x848]
lea edx, [ebp - 0x1a8]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x1608]
push 0x49bafc
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x1608]
push ecx
call fcn.00483565
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x3a8]
push str..Sys
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43697b
lea eax, [ebp - 0x3a8]
push eax
call fcn.00428d90
add esp, 4
lea ecx, [ebp - 0x8c8]
mov esi, eax
lea edx, [ebp - 0x848]
push ecx
lea eax, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x3a8]
push eax
push ecx
call fcn.004456c0
add esp, 0x10
lea edx, [ebp - 0x8c8]
lea eax, [ebp - 0x848]
lea ecx, [ebp - 0x1a8]
push edx
push eax
push ecx
push esi
lea edx, [ebp - 0x1608]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1608]
push eax
call fcn.00483565
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x6a8]
lea edx, [ebp - 0xbc8]
push ecx
push str._swinlogon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3a8]
lea ecx, [ebp - 0xbc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4369b7
push 0x49bab4
jmp 0x439152
lea edx, [ebp - 0x6a8]
lea eax, [ebp - 0xbc8]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3a8]
lea edx, [ebp - 0xbc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4369f3
push 0x49bab4
jmp 0x439152
lea eax, [ebp - 0x6a8]
lea ecx, [ebp - 0xbc8]
push eax
push str._s_services.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3a8]
lea eax, [ebp - 0xbc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x436a2f
push 0x49ba7c
jmp 0x439152
lea ecx, [ebp - 0x6a8]
lea edx, [ebp - 0xbc8]
push ecx
push str._slsass.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3a8]
lea ecx, [ebp - 0xbc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x436a6b
push 0x49ba7c
jmp 0x439152
lea edx, [ebp - 0x6a8]
lea eax, [ebp - 0xbc8]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3a8]
lea edx, [ebp - 0xbc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x436aa7
push 0x49ba7c
jmp 0x439152
lea eax, [ebp - 0x6a8]
lea ecx, [ebp - 0xbc8]
push eax
push str._sctfmon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3a8]
lea eax, [ebp - 0xbc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x436ae3
push 0x49ba7c
jmp 0x439152
lea ecx, [ebp - 0x6a8]
lea edx, [ebp - 0xbc8]
push ecx
push str._s_rundll32.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3a8]
lea ecx, [ebp - 0xbc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x436b1f
push 0x49ba7c
jmp 0x439152
lea edx, [ebp - 0x3a8]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436b3d
mov dword [ebp - 0xfc], esi
lea eax, [ebp - 0x3a8]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436b5b
mov dword [ebp - 0xfc], esi
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0x3a8]
push ecx
push edx
call fcn.004290e0
movsx eax, ax
add esp, 8
lea ecx, [ebp - 0xc88]
mov dword [ebp - 0x120], eax
lea edx, [ebp - 0x1208]
push ecx
lea eax, [ebp - 0x3a8]
push edx
push eax
call fcn.00455090
add esp, 0xc
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x40], 0
push str.Maxthon_International
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436bc0
push 0x49b9d8
jmp 0x439152
lea edx, [ebp - 0x428]
push str.Mozilla_Corporation
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436be2
push 0x49b9d8
jmp 0x439152
lea eax, [ebp - 0x428]
push str.MoreQuick
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436c04
push 0x49b9d8
jmp 0x439152
lea ecx, [ebp - 0x428]
push str.Opera_Software
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436c26
push 0x49b9d8
jmp 0x439152
lea edx, [ebp - 0x428]
push 0x49b99c
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436c48
push 0x49b978
jmp 0x439152
lea eax, [ebp - 0x428]
push str.Microsoft
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436c63
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x6a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xd08]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0xd08]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xe88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1188]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xe88]
mov byte [ebp - 0xe86], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x3a8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor esi, esi
cmp esi, ecx
jge 0x436d06
mov eax, ecx
sub eax, esi
mov al, byte [ebp + eax - 0x3a8]
cmp al, 0x5c
mov byte [ebp + esi - 0x1088], al
jne 0x436d03
cmp esi, 2
jge 0x436d06
inc esi
jmp 0x436ce4
sub ecx, esi
xor eax, eax
mov edi, ecx
cmp eax, edi
jge 0x436d21
mov cl, byte [ebp + eax - 0x3a8]
mov byte [ebp + eax - 0x1408], cl
inc eax
jmp 0x436d0c
lea edx, [ebp - 0x1408]
push str.temp_program
push edx
mov byte [ebp + edi - 0x1408], 0
call fcn.0047fde0
add esp, 8
xor ecx, ecx
cmp ecx, esi
jge 0x436d75
lea eax, [ecx + edi]
mov al, byte [ebp + eax - 0x3a7]
cmp al, 0x5c
je 0x436d58
mov byte [ebp + ecx - 0x1088], al
cmp al, 0x2e
jne 0x436d5f
inc dword [ebp - 0x4c]
cmp al, 0x20
jne 0x436d66
inc dword [ebp - 0x4c]
cmp al, 0x5c
jne 0x436d72
mov byte [ebp + ecx - 0x1088], 0
inc ecx
jmp 0x436d3f
mov al, byte [ebp - 0x1407]
mov byte [ebp + esi - 0x1088], 0
cmp al, 0x3a
je 0x436d91
push 0x49b790
jmp 0x439152
cmp byte [ebp - 0x1406], 0x5c
je 0x436da8
mov byte [ebp - 0x1406], 0x5c
mov byte [ebp - 0x1405], 0
lea ecx, [ebp - 0x1408]
push ecx
call fcn.004690b0
add esp, 4
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x3a8]
lea eax, [ebp - 0x9c8]
push 0x100
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x1088]
push 0x40
lea edx, [ebp - 0x1708]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x3a8]
push eax
call fcn.00483565
lea ecx, [ebp - 0x3a8]
mov dword [ebx], eax
push ecx
call fcn.00428d90
add esp, 0x20
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436e2c
cmp dword [ebp - 0x40], 1
jne 0x436f0f
push 0x49b774
jmp 0x439152
lea edx, [ebp - 0x3a8]
push str.Application_Data
push edx
call fcn.0047bec0
add esp, 8
mov ebx, 1
test eax, eax
je 0x436e4c
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x3a8]
push str.Microsoft_SharedMSINFO
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436e67
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x3a8]
push str.Microsoft_SharedMSInfo
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436e82
mov dword [ebp - 0x48], ebx
lea edx, [ebp - 0x3a8]
push 0x80
lea eax, [ebp - 0xe08]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x3a8]
push 0x80
lea edx, [ebp - 0xd88]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0xd08]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x6a8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xe08], al
mov dword [ebp - 0x34], eax
mov byte [ebp + ecx - 0xd88], al
lea eax, [ebp - 0xd08]
lea ecx, [ebp - 0xe08]
push eax
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x436f1c
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436f19
push 0x491c80
jmp 0x439152
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x6a8]
lea eax, [ebp - 0xd88]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436f55
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436f52
push 0x491c80
jmp 0x439152
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x3a8]
push 0x493e04
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436f8c
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436f89
push 0x491c80
jmp 0x439152
mov dword [ebp - 0x34], ebx
lea edx, [ebp - 0x3a8]
push str.system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x436fc3
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x436fc0
push 0x491c80
jmp 0x439152
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x1088]
push str.smss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea ecx, [ebp - 0x1088]
push str.winlogon.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea edx, [ebp - 0x1088]
push str.csrss.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea eax, [ebp - 0x1088]
push str.services.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea ecx, [ebp - 0x1088]
push str.lsass.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea edx, [ebp - 0x1088]
push str.svchost.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea eax, [ebp - 0x1088]
push str.taskmgr.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea ecx, [ebp - 0x1088]
push str.spoolsv.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea edx, [ebp - 0x1088]
push 0x48ba7c
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4370c3
lea eax, [ebp - 0x1088]
push str.conime.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4370c9
mov dword [ebp - 0x104], ebx
xor edi, edi
push 0x6309b0
mov byte [ebp - 4], 1
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x18], edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xf8], edi
call fcn.00404650
add esp, 4
lea ecx, [ebp - 0x3a8]
push 0x6309b0
push ecx
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x43713f
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea edx, [ebp - 0x3a8]
mov ecx, eax
push edx
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, ebx
jmp 0x4379dd
mov eax, dword [0x6309b8]
mov byte [ebp - 4], 2
push eax
call fcn.004046b0
mov ecx, dword [0x6309b8]
add esp, 4
mov dword [ebp - 0x128], eax
push ecx
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x10c], eax
jne 0x4371d0
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 2
mov edx, dword [0x6309b8]
mov dword [ebp - 4], 1
push edx
mov byte [ebp - 4], 6
call fcn.004046d0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x3c], esi
jne 0x437899
mov dword [ebp + 0xc], 6
jmp 0x4379cb
mov dword [ebp - 0xd8], edi
cmp dword [eax + 0x10], edi
je 0x43719b
mov edx, dword [eax + 0xc]
mov eax, dword [0x6309b8]
mov ecx, dword [ebp - 0x128]
push edx
push eax
push ecx
call fcn.00404730
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x1c], ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xf8]
inc eax
xor esi, esi
mov dword [ebp - 0xf8], eax
cmp esi, 0x66
jge 0x4372bf
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4372b9
cmp esi, 0xf
jle 0x43725a
cmp esi, 0x12
jge 0x43725a
mov dword [ebp - 0x84], ebx
cmp esi, 0x1d
je 0x437269
cmp esi, 0x1e
je 0x437269
cmp esi, 0x39
jne 0x43726c
mov dword [ebp - 0x70], ebx
cmp esi, 0x1f
je 0x437276
cmp esi, 0x20
jne 0x437279
mov dword [ebp - 0x54], ebx
cmp esi, 0x21
je 0x437283
cmp esi, 0x22
jne 0x437286
mov dword [ebp - 0x80], ebx
cmp esi, 0x23
je 0x437290
cmp esi, 0x24
jne 0x437293
mov dword [ebp - 0x60], ebx
cmp esi, 0x2c
jne 0x43729e
mov dword [ebp - 0x6c], ebx
inc esi
jmp 0x437227
cmp esi, 0x2d
je 0x4372b6
cmp esi, 0x2e
jne 0x4372b1
mov dword [ebp - 0x74], ebx
inc esi
jmp 0x437227
cmp esi, 0x3d
jne 0x4372b9
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x437227
mov eax, dword [0x6309b8]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x114], 0
call fcn.004046b0
mov ecx, dword [0x6309b8]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x124], esi
call fcn.004047a0
mov ecx, dword [ebp - 0xd8]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x437308
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x11c], eax
push eax
mov eax, dword [0x6309b8]
push eax
push esi
call fcn.00404730
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x43719b
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4377db
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x43739b
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xbe8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xbe8]
jmp 0x43741f
mov edx, dword [0x6309b8]
push eax
mov eax, dword [ebp - 0x124]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4373da
xor ecx, ecx
lea edx, [ebp - 0x7c8]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x9c], esi
jmp 0x43742a
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xc08]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0x9c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x43778f
mov eax, dword [ebp - 0x9c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x437789
cmp esi, 0x45
jne 0x4374ec
lea ecx, [ebp - 0x8c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x8c8]
lea eax, [ebp - 0x848]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x848]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x4374c5
lea edx, [ebp - 0x428]
lea eax, [ebp - 0xac8]
push edx
push 0x49b6c8
push eax
jmp 0x4374d8
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0xac8]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0xac8]
push eax
jmp 0x439152
test esi, esi
jne 0x4374f9
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x43742c
cmp esi, edi
jne 0x437506
mov dword [ebp - 0x50], edi
inc esi
jmp 0x43742c
cmp esi, 2
je 0x437789
cmp esi, 4
jne 0x437520
mov dword [ebp - 0x98], edi
inc esi
jmp 0x43742c
cmp esi, 5
jne 0x437531
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x43742c
cmp esi, 6
jne 0x437542
mov dword [ebp - 0x108], edi
inc esi
jmp 0x43742c
cmp esi, 7
jne 0x437553
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x43742c
cmp esi, 8
jne 0x437564
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x43742c
cmp esi, 9
jne 0x437575
mov dword [ebp - 0x94], edi
inc esi
jmp 0x43742c
cmp esi, 0xa
jne 0x437583
mov dword [ebp - 0x44], edi
inc esi
jmp 0x43742c
cmp esi, 0xb
jne 0x437594
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x43742c
jle 0x43759e
cmp esi, 0xf
jge 0x4375a1
mov dword [ebp - 0x38], edi
cmp esi, 0xf
jne 0x4375af
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x43742c
jle 0x4375bc
cmp esi, 0x12
jge 0x4375bc
mov dword [ebp - 0x84], edi
cmp esi, 0x1b
jne 0x4375cd
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x43742c
cmp esi, 0x1c
jne 0x4375de
mov dword [ebp - 0x118], edi
inc esi
jmp 0x43742c
cmp esi, 0x1d
je 0x4375ed
cmp esi, 0x1e
je 0x4375ed
cmp esi, 0x39
jne 0x4375f0
mov dword [ebp - 0x70], edi
cmp esi, 0x1f
je 0x4375fa
cmp esi, 0x20
jne 0x4375fd
mov dword [ebp - 0x54], edi
cmp esi, 0x21
je 0x437607
cmp esi, 0x22
jne 0x43760a
mov dword [ebp - 0x80], edi
cmp esi, 0x23
je 0x437614
cmp esi, 0x24
jne 0x437617
mov dword [ebp - 0x60], edi
cmp esi, 0x25
je 0x437621
cmp esi, 0x26
jne 0x437627
mov dword [ebp - 0xf0], edi
cmp esi, 0x27
jne 0x437638
mov dword [ebp - 0x100], edi
inc esi
jmp 0x43742c
cmp esi, 0x28
jne 0x437649
mov dword [ebp - 0x110], edi
inc esi
jmp 0x43742c
cmp esi, 0x2c
jne 0x437657
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x43742c
cmp esi, 0x2d
jne 0x437665
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x43742c
cmp esi, 0x2e
jne 0x437673
mov dword [ebp - 0x74], edi
inc esi
jmp 0x43742c
cmp esi, 0x2f
jne 0x437684
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x43742c
cmp esi, 0x30
jne 0x437695
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x43742c
cmp esi, 0x31
jne 0x4376a6
mov dword [ebp - 0xac], edi
inc esi
jmp 0x43742c
cmp esi, 0x32
jne 0x4376b7
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x43742c
cmp esi, 0x34
jne 0x4376c5
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x43742c
cmp esi, 0x35
jne 0x4376d3
mov dword [ebp - 0x64], edi
inc esi
jmp 0x43742c
cmp esi, 0x36
jne 0x4376e1
mov dword [ebp - 0x78], edi
inc esi
jmp 0x43742c
cmp esi, 0x37
jne 0x4376f6
mov dword [ebp - 0xcc], 0
inc esi
jmp 0x43742c
cmp esi, 0x38
jne 0x437707
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x43742c
cmp esi, 0x3a
je 0x437716
cmp esi, 0x3b
je 0x437716
cmp esi, 0x3c
jne 0x43771c
mov dword [ebp - 0xec], edi
cmp esi, 0x3d
jne 0x43772a
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x43742c
cmp esi, 0x3e
jne 0x43773b
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x43742c
cmp esi, 0x3f
jne 0x437749
mov dword [ebp - 0x68], edi
inc esi
jmp 0x43742c
cmp esi, 0x40
jne 0x437757
mov dword [ebp - 0x50], edi
inc esi
jmp 0x43742c
cmp esi, 0x41
jne 0x437768
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x43742c
cmp esi, 0x42
jne 0x437779
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x43742c
cmp esi, 0x43
je 0x437783
cmp esi, 0x44
jne 0x437789
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x43742c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x18], ecx
jne 0x4377a3
inc dword [ebp - 0xa0]
cmp dword [ebp - 0x18], 0xc350
jg 0x4377db
mov esi, dword [ebp - 0x114]
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x11c], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x437334
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0x114]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x10c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 2
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0x10c], eax
xor edi, edi
jmp 0x4371d6
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp + 8], ebx
cmp bx, word [esi + 2]
jae 0x4379cb
xor ecx, ecx
push str..asp
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 0x88], cl
mov edx, dword [edi]
mov dword [ebp - 0x90], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x8c], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4378fb
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x90]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x437916
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x90]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x437931
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x90]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43794c
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x90]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x437967
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x90]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x437982
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 8]
inc eax
cmp eax, 0x64
mov dword [ebp + 8], eax
jg 0x4379cb
mov esi, dword [ebp - 0x3c]
add edi, 0x28
inc ebx
jmp 0x4378ac
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov ebx, 1
mov ecx, dword [0x6309b8]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x437a19
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 3
push 0x6309b0
call fcn.00404650
add esp, 4
cmp esi, ebx
jne 0x437a34
push 0x49b598
jmp 0x439152
mov eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xa0]
test eax, eax
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x18], edx
jne 0x4380be
cmp edi, ebx
jge 0x4380be
lea eax, [ebp - 0x1408]
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.0047c0d3
push 0x5585b7a8
call fcn.006607e0
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 0x628], 0
cmp eax, ebx
jne 0x438101
mov edi, 0x49e304
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x49e2f8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x439152
cmp dword [ebp - 0xb0], ebx
jle 0x438138
mov edi, 0x49b3c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x108], ebx
jne 0x438170
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x4381bb
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x1088]
cmp al, 0x30
je 0x4381e9
cmp al, 0x31
je 0x4381e9
cmp al, 0x32
je 0x4381e9
cmp al, 0x33
je 0x4381e9
cmp al, 0x34
je 0x4381e9
cmp al, 0x35
je 0x4381e9
cmp al, 0x36
je 0x4381e9
cmp al, 0x37
je 0x4381e9
cmp al, 0x38
je 0x4381e9
cmp al, 0x39
jne 0x438220
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp + 8], 0
cmp eax, ebx
jne 0x438267
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x20], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], ebx
jne 0x4382a6
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x50], ebx
jne 0x4382e2
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe8], ebx
jne 0x438321
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc0], ebx
je 0x438331
cmp dword [ebp - 0x100], ebx
jne 0x438361
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], ebx
jne 0x4383a0
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf0], ebx
jne 0x4383d8
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], ebx
jne 0x438417
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x7c], ebx
jne 0x43845d
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x43845d
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x110], ebx
jne 0x43849f
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x98], ebx
jne 0x4384de
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x94], ebx
jne 0x43851d
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x44], ebx
jne 0x438559
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x38], ebx
jne 0x4385fb
cmp dword [ebp - 0xa4], ebx
je 0x43857f
cmp dword [ebp - 0xac], ebx
je 0x43857f
lea edx, [ebp - 0x628]
mov edi, 0x49b2d8
jmp 0x4385c9
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xb4]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x628]
mov edi, 0x49b2b8
je 0x4385c9
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4385f8
mov dword [ebp - 0x20], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0xbc], ebx
jne 0x43863a
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc4], ebx
jne 0x438683
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x438683
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x84], ebx
jne 0x4386cc
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x4386cc
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
jne 0x43874a
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x438712
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x40], ebx
jne 0x43874a
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x118]
cmp edx, ebx
jne 0x438807
cmp dword [ebp - 0x5c], ebx
jne 0x438807
cmp dword [ebp - 0x64], ebx
jne 0x438807
cmp dword [ebp - 0x78], ebx
jne 0x4387b7
mov eax, dword [ebp - 0x68]
mov edi, 0x49b24c
cmp eax, ebx
lea ebx, [ebp - 0x628]
je 0x438786
mov edi, 0x49e2e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xcc], ebx
jne 0x438807
mov eax, dword [ebp - 0x68]
mov edi, 0x49b224
cmp eax, ebx
lea ebx, [ebp - 0x628]
je 0x4387d6
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xd4], ebx
jne 0x438866
cmp edx, ebx
jne 0x43882f
cmp dword [ebp - 0x5c], ebx
jne 0x43882f
cmp dword [ebp - 0x64], ebx
jne 0x43882f
cmp dword [ebp - 0x78], ebx
jne 0x43882f
lea edx, [ebp - 0x628]
mov edi, 0x49b204
jmp 0x43883a
lea edx, [ebp - 0x628]
mov edi, 0x49b1f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xdc], ebx
jne 0x43889e
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], ebx
jne 0x4388da
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe4], ebx
jne 0x438919
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], ebx
jne 0x43895f
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x43895f
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x80], ebx
jne 0x43899b
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x60], ebx
jne 0x4389d7
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x6c], ebx
jne 0x438a13
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x438a51
mov edi, 0x49b17c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x4c], ebx
je 0x438a8d
mov edi, 0x49b16c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x2c], ebx
jne 0x438ac9
mov edi, 0x49b160
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x74], ebx
jne 0x438afe
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], ebx
jne 0x438b36
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], ebx
jne 0x438b6e
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x438b7c
mov eax, 6
jmp 0x438b7f
shl eax, 2
cmp dword [ebp + 0xc], eax
jge 0x438bca
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x628]
cmp eax, ebx
mov edi, 0x49b12c
je 0x438b9b
mov edi, 0x49b11c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jle 0x438c0c
cmp dword [ebp - 0x1c], ebx
jne 0x438c0c
mov edi, 0x49b108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x44], ebx
jne 0x438c4d
cmp eax, 5
jge 0x438c4d
test eax, eax
jle 0x438c4d
mov edi, 0x49b0ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x120]
cmp eax, 7
jge 0x438d35
cmp dword [ebp - 0x34], ebx
jne 0x438ced
cmp eax, ebx
lea edx, [ebp - 0x628]
jge 0x438ca8
mov edi, 0x49b0d4
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x438d66
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x438cdc
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x54], ebx
jne 0x438d30
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], ebx
inc eax
mov dword [ebp - 0x14], eax
jmp 0x438d66
cmp eax, ebx
lea edx, [ebp - 0x628]
mov edi, 0x49b0ac
jl 0x438d01
mov edi, 0x49b09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x438d30
mov dword [ebp + 8], ebx
inc dword [ebp - 0x14]
jmp 0x438d66
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.c:endpcache
mov dword [ebp - 4], 0
call fcn.0047c0d3
mov eax, dword [ebp - 0x20]
add esp, 4
test eax, eax
jne 0x438f38
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x438f38
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x438f38
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x438f38
mov eax, dword [ebp - 0xfc]
test eax, eax
jne 0x438f38
mov ecx, dword [ebp + 8]
mov eax, 1
cmp ecx, eax
je 0x438dc9
cmp dword [ebp - 0x14], eax
jle 0x438f38
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1088]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0xc88]
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + 0xc]
mov ebx, ecx
lea ecx, [ebp - 0x1a8]
push eax
push ecx
lea eax, [ebp - 0x1408]
push edx
push eax
mov dword [ebp + 0xc], 0
mov dword [ebp - 0x3c], esi
call fcn.0044a6e0
mov eax, dword [ebp + 0xc]
mov edi, 6
add esp, 0x10
cmp eax, edi
jge 0x438e43
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x8c8]
push ecx
lea eax, [ebp - 0x1088]
push edx
lea ecx, [ebp - 0x1408]
push eax
push ecx
call fcn.00455990
add esp, 0x10
test esi, esi
jle 0x438e85
cmp dword [ebp + 0xc], edi
jge 0x438e85
mov eax, dword [ebp - 0x120]
test eax, eax
jle 0x438e85
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x438e85
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x1088]
push eax
lea edx, [ebp - 0x1408]
push ecx
lea eax, [ebp - 0x428]
push edx
push eax
call fcn.00454740
add esp, 0x14
test ebx, ebx
jle 0x438ebd
cmp dword [ebp + 0xc], edi
jge 0x438ebd
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x438ebd
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x1a8]
push ecx
lea eax, [ebp - 0x1088]
push edx
lea ecx, [ebp - 0x1408]
push eax
lea edx, [ebp - 0xc88]
push ecx
push edx
call fcn.004553a0
add esp, 0x14
cmp dword [ebp + 0xc], 5
jle 0x438f38
mov edi, 0x49afc8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebx, 4
rep movsb byte es:[edi], byte [esi]
jle 0x438f0b
lea ecx, [ebp - 0xc88]
lea edx, [ebp - 0x628]
push ecx
push 0x49afb0
push edx
call fcn.0047a8f8
add esp, 0xc
cmp dword [ebp - 0x3c], 4
jle 0x438f2c
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x628]
push eax
push 0x49af98
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0x628]
push edx
jmp 0x439152
mov eax, dword [ebp - 0x1c]
mov esi, 1
test eax, eax
je 0x438fb5
cmp dword [ebp - 0x7c], esi
je 0x438fb5
cmp dword [ebp + 8], esi
je 0x438fb5
cmp dword [ebp - 0x20], esi
je 0x438fb5
cmp dword [ebp - 0x48], esi
je 0x438fb5
mov eax, dword [ebp - 0x14]
cmp eax, esi
lea eax, [ebp - 0x628]
push eax
jle 0x439152
lea ecx, [ebp - 0x1908]
push 0x49e29c
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x9c8]
push edx
call fcn.004299c0
add esp, 0x10
lea eax, [ebp - 0x9c8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x9c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x1908]
push edx
jmp 0x439152
lea ecx, [ebp - 0x9c8]
push 0x650adc
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x438fef
lea edx, [ebp - 0x9c8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x438fef
lea eax, [ebp - 0x9c8]
push eax
call fcn.00429e70
add esp, 4
mov eax, dword [ebp - 0x104]
test eax, eax
jne 0x439008
lea ecx, [ebp - 0x1088]
push ecx
call fcn.00424380
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x9c8]
push edx
call esi
lea eax, [ebp - 0x9c8]
push eax
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x439098
lea ecx, [ebp - 0x9c8]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0x9c8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x9c8]
push eax
call esi
test eax, eax
jne 0x439098
lea ecx, [ebp - 0x9c8]
push ecx
call fcn.00403f10
add esp, 4
lea edx, [ebp - 0x9c8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x439098
lea eax, [ebp - 0x9c8]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x628]
mov edi, 0x49e264
jmp 0x4390a3
lea edx, [ebp - 0x628]
mov edi, 0x49e22c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9c8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x628]
mov edx, ecx
mov esi, edi
mov edi, 0x650adc
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x439152
call fcn.00483565
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret