Function at 0x44b170
Capabilities:
Delete file
Encode data using base64
Get common file path
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1b0c
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x18], eax
mov eax, 1
cmp ecx, eax
jne 0x44b318
mov dword [ebp - 0x2c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x161c]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x9cc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x614]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 0x10], ecx
jge 0x44b3a4
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
mov eax, 0x49bbd4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x614]
push 0x491cf4
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44b3d4
lea eax, [ebp - 0x614]
push 0x491cf0
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44b3db
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x614]
push str.userinit.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44b4e9
lea edx, [ebp - 0x614]
push str.rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44b443
lea eax, [ebp - 0x614]
push str.RUNDLL32.
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44b443
lea ecx, [ebp - 0x614]
push str.Rundll32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44b4e9
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x914]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x914]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
xor ecx, ecx
cmp eax, esi
jge 0x44b492
cmp byte [ebp + eax - 0x914], 0x2e
jne 0x44b48f
inc ecx
inc eax
jmp 0x44b480
cmp ecx, 1
jle 0x44b4e9
xor eax, eax
cmp eax, esi
jge 0x44b4be
cmp byte [ebp + eax - 0x914], 0x33
jne 0x44b4bb
cmp byte [ebp + eax - 0x913], 0x32
jne 0x44b4bb
cmp byte [ebp + eax - 0x912], 0x2e
je 0x44b4be
inc eax
jmp 0x44b499
xor edx, edx
mov ecx, esi
sub ecx, eax
sub ecx, 7
cmp edx, ecx
jge 0x44b4df
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0x90d]
mov byte [ebp + edx - 0x615], cl
jmp 0x44b4c0
sub esi, eax
mov byte [ebp + esi - 0x61b], 0
lea edx, [ebp - 0x614]
push 0x48b2f4
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44b5b4
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esi - 0xc]
cmp eax, ecx
jge 0x44b562
cmp byte [ebp + eax - 0xacc], 0x25
je 0x44b562
inc eax
jmp 0x44b54e
xor edx, edx
mov ecx, esi
sub ecx, eax
sub ecx, 0xc
cmp edx, ecx
jge 0x44b583
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0xac0]
mov byte [ebp + edx - 0x915], cl
jmp 0x44b564
mov byte [ebp + edx - 0x914], 0
lea edx, [ebp - 0x914]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
add esp, 0x10
lea edx, [ebp - 0x614]
push 0x49bba4
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44b67f
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esi - 0xc]
cmp eax, ecx
jge 0x44b62d
cmp byte [ebp + eax - 0xacc], 0x25
je 0x44b62d
inc eax
jmp 0x44b619
xor edx, edx
mov ecx, esi
sub ecx, eax
sub ecx, 0xc
cmp edx, ecx
jge 0x44b64e
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0xac0]
mov byte [ebp + edx - 0x915], cl
jmp 0x44b62f
mov byte [ebp + edx - 0x914], 0
lea edx, [ebp - 0x914]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
add esp, 0x10
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x614], al
jle 0x44ba03
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x914]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x914]
mov byte [ebp - 0x906], 0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44b78b
lea edx, [ebp - 0x214]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x212], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
mov esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, 0xe
cmp eax, ecx
jge 0x44b75a
lea ecx, [eax + edx]
inc eax
mov cl, byte [ebp + ecx - 0xabe]
mov byte [ebp + eax - 0xca5], cl
jmp 0x44b73b
mov byte [ebp + eax - 0xca4], 0
lea edx, [ebp - 0xca4]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._sProgram_Files_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
add esp, 0x10
lea edx, [ebp - 0x914]
push str.Systemroot
push edx
mov byte [ebp - 0x90a], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44b860
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
mov esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, 0xa
cmp eax, ecx
jge 0x44b818
lea ecx, [eax + edx]
inc eax
mov cl, byte [ebp + ecx - 0xac2]
mov byte [ebp + eax - 0xca5], cl
jmp 0x44b7f9
mov byte [ebp + eax - 0xca4], 0
lea edx, [ebp - 0xca4]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x614], al
lea edx, [ebp - 0x914]
push str.system32
push edx
mov byte [ebp - 0x90c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44b935
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
mov esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, 8
cmp eax, ecx
jge 0x44b8ed
lea ecx, [eax + edx]
inc eax
mov cl, byte [ebp + ecx - 0xac4]
mov byte [ebp + eax - 0xca5], cl
jmp 0x44b8ce
mov byte [ebp + eax - 0xca4], 0
lea edx, [ebp - 0xca4]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x614], al
lea edx, [ebp - 0x914]
push str._Windir_
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44ba03
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
mov esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, 8
cmp eax, ecx
jge 0x44b9bb
lea ecx, [eax + edx]
inc eax
mov cl, byte [ebp + ecx - 0xac4]
mov byte [ebp + eax - 0xca5], cl
jmp 0x44b99c
mov byte [ebp + eax - 0xca4], 0
lea edx, [ebp - 0xca4]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x614], al
lea edx, [ebp - 0x614]
push str..RECYCLER
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44badc
lea eax, [ebp - 0x214]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xacc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x212], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xacc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esi - 0xc]
cmp eax, ecx
jge 0x44ba83
cmp byte [ebp + eax - 0xacc], 0x5c
je 0x44ba83
inc eax
jmp 0x44ba6f
xor edx, edx
mov ecx, esi
sub ecx, eax
cmp edx, ecx
jge 0x44baa1
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0xacc]
mov byte [ebp + edx - 0x915], cl
jmp 0x44ba85
mov byte [ebp + edx - 0x914], 0
lea edx, [ebp - 0x914]
lea eax, [ebp - 0x214]
push edx
push eax
lea ecx, [ebp - 0x614]
push str._s_s
push ecx
mov byte [ebp - 0x614], 0
call fcn.0047a8f8
add esp, 0x10
mov dword [ebp - 0x140], 1
cmp byte [ebp - 0x614], 0x22
jne 0x44bb2f
mov esi, dword [ebp + 0x10]
xor edx, edx
xor ecx, ecx
cmp ecx, esi
jge 0x44bb06
mov al, byte [ebp + ecx - 0x614]
cmp al, 0x22
je 0x44bb03
mov byte [ebp + edx - 0x1564], al
inc edx
inc ecx
jmp 0x44baec
lea edi, [ebp - 0x1564]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x614]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
push 0x492024
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [ebp - 0x614]
push ecx
mov dword [ebp + 0x10], esi
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44bb7a
cmp eax, esi
jge 0x44bb6d
cmp byte [ebp + eax - 0x614], 0x2e
je 0x44bb6d
inc eax
jmp 0x44bb5c
mov byte [ebp + eax - 0x610], 0
jmp 0x44bcae
mov edx, dword [ebp + 0x10]
lea ebx, [edx - 2]
test ebx, ebx
jle 0x44bb9d
cmp byte [ebp + ebx - 0x614], 0x3a
jne 0x44bb98
cmp byte [ebp + ebx - 0x613], 0x5c
je 0x44bb9b
dec ebx
jmp 0x44bb80
test ebx, ebx
je 0x44bcae
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1564]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x491a04
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x614]
xor esi, esi
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44bbeb
mov esi, 1
lea edx, [ebp - 0x614]
push 0x491a00
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44bc08
mov esi, 1
mov eax, dword [ebp + 0x10]
mov dl, 0x65
test eax, eax
jle 0x44bc4e
mov cl, byte [ebp + eax - 0x614]
cmp esi, 1
jne 0x44bc3c
cmp cl, 0x2e
jne 0x44bc4b
cmp byte [ebp + eax - 0x613], dl
je 0x44bc4e
cmp cl, cl
jne 0x44bc4b
cmp byte [ebp + eax - 0x613], 0x45
je 0x44bc4e
dec eax
jmp 0x44bc0d
cmp cl, 0x2e
jne 0x44bc4b
cmp byte [ebp + eax - 0x613], 0x2e
jne 0x44bc4e
dec eax
jmp 0x44bc0d
mov byte [ebp - 0x614], 0
xor ecx, ecx
mov edx, eax
sub edx, ebx
add edx, 5
cmp ecx, edx
jge 0x44bc76
lea edx, [ecx + ebx]
inc ecx
mov dl, byte [ebp + edx - 0x1565]
mov byte [ebp + ecx - 0x615], dl
jmp 0x44bc57
sub eax, ebx
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
mov byte [ebp + eax - 0x60f], 0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x44bc9e
cmp byte [ebp + ecx - 0x614], 0x2e
jne 0x44bc8f
test ecx, ecx
mov byte [ebp + ecx - 0x610], 0
jne 0x44bd62
lea eax, [ebp - 0x1464]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x214]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44bd40
lea edx, [ebp - 0x214]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44bd40
lea eax, [ebp - 0x214]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44bd40
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x9cc]
push ecx
jmp 0x44bd4d
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x1464]
push ecx
push edx
lea eax, [ebp - 0x614]
push 0x4966e0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x614]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x614]
push eax
call fcn.00429f20
mov esi, 1
add esp, 8
cmp eax, esi
je 0x44bd95
push 0x49e37c
jmp 0x44f56b
lea ecx, [ebp - 0x614]
push str.Temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44bdb0
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0x614]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44bdcb
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x614]
push str.Documents_and_Settings_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44bde9
mov dword [ebp - 0x148], esi
lea ecx, [ebp - 0x614]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x9cc]
mov dword [ebp - 0x50], eax
push edx
lea eax, [ebp - 0xda4]
push str._swinlogon.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x614]
lea edx, [ebp - 0xda4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x44be34
push 0x49bab4
jmp 0x44f56b
lea eax, [ebp - 0x9cc]
lea ecx, [ebp - 0xda4]
push eax
push str._scsrss.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x614]
lea eax, [ebp - 0xda4]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44be70
push 0x49bab4
jmp 0x44f56b
lea ecx, [ebp - 0x9cc]
lea edx, [ebp - 0xda4]
push ecx
push str._s_services.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0xda4]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44beac
push 0x49ba7c
jmp 0x44f56b
lea edx, [ebp - 0x9cc]
lea eax, [ebp - 0xda4]
push edx
push str._slsass.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x614]
lea edx, [ebp - 0xda4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44bee8
push 0x49ba7c
jmp 0x44f56b
lea eax, [ebp - 0x9cc]
lea ecx, [ebp - 0xda4]
push eax
push str._s_svchost.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x614]
lea eax, [ebp - 0xda4]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44bf24
push 0x49ba7c
jmp 0x44f56b
lea ecx, [ebp - 0x9cc]
lea edx, [ebp - 0xda4]
push ecx
push str._sctfmon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0xda4]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44bf60
push 0x49ba7c
jmp 0x44f56b
lea edx, [ebp - 0x9cc]
lea eax, [ebp - 0xda4]
push edx
push str._s_rundll32.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x614]
lea edx, [ebp - 0xda4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44bf9c
push 0x49ba7c
jmp 0x44f56b
lea eax, [ebp - 0x181c]
lea ecx, [ebp - 0x814]
push eax
lea edx, [ebp - 0x614]
push ecx
push edx
call fcn.0046de70
add esp, 0xc
lea ecx, [ebp - 0x169c]
movsx edi, ax
lea eax, [ebp - 0xba4]
lea edx, [ebp - 0x614]
push eax
push ecx
push edx
mov dword [ebp + 0x10], edi
call fcn.00455090
add esp, 0xc
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], esi
push eax
lea edx, [ebp - 0x614]
xor esi, esi
push ecx
push edx
mov dword [ebp - 0x5c], esi
xor ebx, ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x44c009
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
cmp eax, ecx
je 0x44c00e
mov ebx, 1
mov ecx, dword [0x65cd60]
mov eax, 1
cmp ecx, eax
mov dword [ebp - 4], esi
jne 0x44c08f
cmp dword [ebp - 0x18], eax
jne 0x44c08f
cmp edi, eax
jle 0x44c08f
lea ecx, [ebp - 0x814]
push 0x49f568
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c04b
push 0x49f558
jmp 0x44f56b
lea edx, [ebp - 0xba4]
push str.WestoneRepairFile
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c06d
push 0x49f558
jmp 0x44f56b
lea eax, [ebp - 0xba4]
push str.WestoneStartService
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c08f
push 0x49f558
jmp 0x44f56b
lea ecx, [ebp - 0x814]
push str.Microsoft
push ecx
mov dword [ebp + 8], esi
call fcn.0047bec0
add esp, 8
cmp eax, esi
je 0x44c134
lea edx, [ebp - 0x181c]
push str.Microsoft
push edx
call fcn.0047bec0
add esp, 8
cmp eax, esi
je 0x44c0cf
mov dword [ebp + 8], 1
jmp 0x44c101
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x814]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xac], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 1
jne 0x44c134
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x814]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xac], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x814]
push str.Maxthon_International
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c156
push 0x49b9d8
jmp 0x44f56b
lea edx, [ebp - 0x814]
push str.Mozilla_Corporation
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c178
push 0x49b9d8
jmp 0x44f56b
lea eax, [ebp - 0x814]
push str.MoreQuick
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c19a
push 0x49b9d8
jmp 0x44f56b
lea ecx, [ebp - 0x814]
push str.Opera_Software
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c1bc
push 0x49b9d8
jmp 0x44f56b
lea edx, [ebp - 0x9cc]
push 0x80
push edx
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xe64]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0xe64]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x10e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x171c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10e4]
mov byte [ebp - 0x10e2], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x614]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor esi, esi
cmp esi, ecx
jge 0x44c266
mov eax, ecx
sub eax, esi
mov al, byte [ebp + eax - 0x614]
cmp al, 0x5c
mov byte [ebp + esi - 0x1064], al
jne 0x44c263
cmp esi, 2
jge 0x44c266
inc esi
jmp 0x44c244
mov edi, ecx
mov ebx, 1
sub edi, esi
cmp edi, 4
jge 0x44c27d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x150], ebx
xor eax, eax
cmp eax, edi
jge 0x44c29c
mov cl, byte [ebp + eax - 0x614]
cmp cl, 0x5c
mov byte [ebp + eax - 0x13e4], cl
jne 0x44c299
inc dword [ebp - 0x28]
inc eax
jmp 0x44c27f
lea ecx, [ebp - 0x13e4]
push str.temp_program
push ecx
mov byte [ebp + edi - 0x13e4], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c2bf
mov dword [ebp - 0x2c], ebx
xor ecx, ecx
cmp ecx, esi
jge 0x44c2f7
lea edx, [ecx + edi]
mov al, byte [ebp + edx - 0x613]
cmp al, 0x5c
je 0x44c2da
mov byte [ebp + ecx - 0x1064], al
cmp al, 0x2e
jne 0x44c2e1
inc dword [ebp - 0x74]
cmp al, 0x20
jne 0x44c2e8
inc dword [ebp - 0x74]
cmp al, 0x5c
jne 0x44c2f4
mov byte [ebp + ecx - 0x1064], 0
inc ecx
jmp 0x44c2c1
mov al, byte [ebp - 0x13e3]
mov byte [ebp + esi - 0x1064], 0
cmp al, 0x3a
je 0x44c313
push 0x49b790
jmp 0x44f56b
cmp byte [ebp - 0x13e2], 0x5c
je 0x44c32a
mov byte [ebp - 0x13e2], 0x5c
mov byte [ebp - 0x13e1], 0
lea eax, [ebp - 0x614]
push 0x100
lea ecx, [ebp - 0x714]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x1064]
push 0x40
lea eax, [ebp - 0x191c]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x13e4]
push ecx
call fcn.00470cf0
add esp, 0x1c
lea edx, [ebp - 0x13e4]
mov dword [ebp - 0x178], eax
push edx
call fcn.004688e0
add esp, 4
cmp eax, 2
mov dword [ebp - 0x184], eax
jne 0x44c439
lea eax, [ebp - 0x714]
push eax
call fcn.004299c0
add esp, 4
lea ecx, [ebp - 0x714]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x714]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x44c3f9
lea eax, [ebp - 0x714]
push eax
call fcn.00429f20
add esp, 4
cmp eax, ebx
jne 0x44c3f9
lea ecx, [ebp - 0x714]
push ecx
call fcn.00429e70
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, ebx
lea edx, [ebp - 0x414]
jne 0x44c3f2
mov edi, 0x49f4ec
jmp 0x44c410
mov edi, 0x49b05c
jmp 0x44c410
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, ebx
mov edi, 0x49f4ec
je 0x44c410
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
jmp 0x44f56b
cmp eax, ebx
jne 0x44c440
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x614]
push edx
call fcn.00483565
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x614]
push edx
mov dword [ecx], eax
call fcn.00428d90
add esp, 8
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c487
cmp dword [ebp + 8], ebx
jne 0x44c567
push 0x49b774
jmp 0x44f56b
lea eax, [ebp - 0x614]
push str.Application_Data
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c4a2
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x614]
push str.Microsoft_SharedMSINFO
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c4bd
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x614]
push str.Microsoft_SharedMSInfo
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c4d8
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x614]
push 0x80
lea ecx, [ebp - 0x1164]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x614]
push 0x80
lea eax, [ebp - 0x11e4]
push edx
push eax
call fcn.0047b120
lea edi, [ebp - 0xe64]
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x9cc]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x1164], al
lea edx, [ebp - 0x1164]
mov dword [ebp - 0x44], ebx
mov byte [ebp + ecx - 0x11e4], al
lea ecx, [ebp - 0xe64]
push ecx
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x44c578
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c571
push 0x491c80
jmp 0x44f56b
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x9cc]
lea ecx, [ebp - 0x11e4]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c5b6
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c5ae
push 0x491c80
jmp 0x44f56b
mov ebx, 1
mov dword [ebp - 0x44], ebx
lea edx, [ebp - 0x614]
push 0x493e04
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c5f2
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c5ea
push 0x491c80
jmp 0x44f56b
mov ebx, 1
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x614]
push str.system
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44c62e
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c626
push 0x491c80
jmp 0x44f56b
mov ebx, 1
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x1064]
push str.smss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea edx, [ebp - 0x1064]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea eax, [ebp - 0x1064]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea ecx, [ebp - 0x1064]
push str.services.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea edx, [ebp - 0x1064]
push str.lsass.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea eax, [ebp - 0x1064]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea ecx, [ebp - 0x1064]
push str.taskmgr.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea edx, [ebp - 0x1064]
push str.spoolsv.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea eax, [ebp - 0x1064]
push 0x48ba7c
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44c72e
lea ecx, [ebp - 0x1064]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44c738
mov dword [ebp - 0x158], 1
xor esi, esi
xor edi, edi
push 0x6309b0
mov byte [ebp - 4], 3
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x84], esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xd4], esi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x614]
push 0x6309b0
push edx
call fcn.004045b0
add esp, 8
test eax, eax
jne 0x44c7d3
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x614]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 1
jmp 0x44d2a5
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 4
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x18c], eax
mov eax, dword [0x6309b8]
push eax
call fcn.004047a0
add esp, 4
mov dword [ebp - 0xd0], eax
test eax, eax
jne 0x44c863
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 2
mov edx, dword [0x6309b8]
mov dword [ebp - 4], 3
push edx
mov byte [ebp - 4], 8
call fcn.004046d0
add esp, 4
mov dword [ebp - 0x170], eax
test eax, eax
jne 0x44d124
mov dword [ebp + 0xc], 6
jmp 0x44d292
mov dword [ebp - 0x130], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44c82f
mov ecx, dword [ebp - 0xd0]
mov eax, dword [0x6309b8]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x18c]
push edx
push eax
push ecx
call fcn.00404730
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov edi, eax
inc edx
push 0x49b730
push edi
mov dword [ebp - 0x30], edx
call fcn.0047fde0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x190], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push edi
mov dword [ebp - 0x188], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.rasapi32.dll
inc eax
push edi
mov dword [ebp - 0x194], eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x44c8fa
mov dword [ebp - 0x174], 1
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x184]
inc ecx
test eax, eax
mov dword [ebp - 0xb4], ecx
jne 0x44c94f
lea edx, [ebp - 0x13e4]
push edi
push edx
lea eax, [ebp - 0x159c]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x159c]
push ecx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x44c94f
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x48]
inc edx
add ecx, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x1c], 1
jne 0x44c990
test ebx, ebx
jne 0x44c990
cmp dword [ebp - 0x28], 2
jle 0x44c9d9
lea edx, [ebp - 0x13e4]
push edi
push edx
lea eax, [ebp - 0xb04]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xb04]
push ecx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x44c9d9
jmp 0x44c9ca
cmp ebx, 1
jne 0x44c9d9
cmp dword [ebp - 0x28], 3
jle 0x44c9d9
lea edx, [ebp - 0x13e4]
push edi
push edx
lea eax, [ebp - 0x94c]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x94c]
push ecx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x44c9d9
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x48]
inc edx
add ecx, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], ecx
xor esi, esi
mov ebx, 1
cmp esi, 0x66
jge 0x44ca91
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44ca8b
cmp esi, 0xf
jle 0x44ca17
cmp esi, 0x12
jge 0x44ca17
mov dword [ebp - 0xa0], ebx
cmp esi, 0x1d
je 0x44ca26
cmp esi, 0x1e
je 0x44ca26
cmp esi, 0x39
jne 0x44ca2c
mov dword [ebp - 0xc8], ebx
cmp esi, 0x1f
je 0x44ca36
cmp esi, 0x20
jne 0x44ca3c
mov dword [ebp - 0x90], ebx
cmp esi, 0x21
je 0x44ca46
cmp esi, 0x22
jne 0x44ca4c
mov dword [ebp - 0xb8], ebx
cmp esi, 0x23
je 0x44ca56
cmp esi, 0x24
jne 0x44ca5c
mov dword [ebp - 0xd8], ebx
cmp esi, 0x2c
jne 0x44ca6d
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x44c9e0
cmp esi, 0x2d
je 0x44ca88
cmp esi, 0x2e
jne 0x44ca83
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x44c9e0
cmp esi, 0x3d
jne 0x44ca8b
mov dword [ebp - 0x40], ebx
inc esi
jmp 0x44c9e0
mov eax, dword [0x6309b8]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x180], 0
call fcn.004046b0
mov ecx, dword [0x6309b8]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x170], esi
call fcn.004047a0
mov ecx, dword [ebp - 0x130]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x44cada
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x3c], eax
push eax
mov eax, dword [0x6309b8]
push eax
push esi
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x24], eax
test eax, eax
je 0x44c82f
mov eax, dword [eax]
test eax, eax
je 0x44d0c8
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x44cb63
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xde4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xde4]
jmp 0x44cbe3
mov ecx, dword [0x6309b8]
push eax
push ecx
push esi
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x44cb9a
xor edx, edx
lea eax, [ebp - 0xb24]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x44cbe3
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xdc4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xdc4]
xor esi, esi
mov edi, 1
cmp esi, 0x66
jge 0x44d026
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44d020
cmp esi, 0x45
jne 0x44ccb6
lea edx, [ebp - 0x1464]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1464]
lea ecx, [ebp - 0x214]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x214]
push edx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x44cc8f
lea eax, [ebp - 0x814]
lea ecx, [ebp - 0xacc]
push eax
push 0x49b6c8
push ecx
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0xacc]
push ecx
jmp 0x44f56b
lea edx, [ebp - 0x814]
lea eax, [ebp - 0xacc]
push edx
push 0x49b698
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0xacc]
push ecx
jmp 0x44f56b
test esi, esi
jne 0x44ccc6
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x44cbea
cmp esi, edi
jne 0x44ccd3
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x44cbea
cmp esi, 2
je 0x44d020
cmp esi, 4
jne 0x44cced
mov dword [ebp - 0x124], edi
inc esi
jmp 0x44cbea
cmp esi, 5
jne 0x44ccfe
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x44cbea
cmp esi, 6
jne 0x44cd0f
mov dword [ebp - 0x154], edi
inc esi
jmp 0x44cbea
cmp esi, 7
jne 0x44cd20
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x44cbea
cmp esi, 8
jne 0x44cd31
mov dword [ebp - 0x104], edi
inc esi
jmp 0x44cbea
cmp esi, 9
jne 0x44cd42
mov dword [ebp - 0x164], edi
inc esi
jmp 0x44cbea
cmp esi, 0xa
jne 0x44cd50
mov dword [ebp - 0x60], edi
inc esi
jmp 0x44cbea
cmp esi, 0xb
jne 0x44cd61
mov dword [ebp - 0x168], edi
inc esi
jmp 0x44cbea
jle 0x44cd6b
cmp esi, 0xf
jge 0x44cd6e
mov dword [ebp - 0x78], edi
cmp esi, 0xf
jne 0x44cd7c
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x44cbea
jle 0x44cd89
cmp esi, 0x12
jge 0x44cd89
mov dword [ebp - 0xa0], edi
cmp esi, 0x1b
jne 0x44cd9a
mov dword [ebp - 0x15c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x1c
jne 0x44cdab
mov dword [ebp - 0x17c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x1d
je 0x44cdba
cmp esi, 0x1e
je 0x44cdba
cmp esi, 0x39
jne 0x44cdc0
mov dword [ebp - 0xc8], edi
cmp esi, 0x1f
je 0x44cdca
cmp esi, 0x20
jne 0x44cdd0
mov dword [ebp - 0x90], edi
cmp esi, 0x21
je 0x44cdda
cmp esi, 0x22
jne 0x44cde0
mov dword [ebp - 0xb8], edi
cmp esi, 0x23
je 0x44cdea
cmp esi, 0x24
jne 0x44cdf0
mov dword [ebp - 0xd8], edi
cmp esi, 0x25
je 0x44cdfa
cmp esi, 0x26
jne 0x44ce00
mov dword [ebp - 0x16c], edi
cmp esi, 0x27
jne 0x44ce11
mov dword [ebp - 0x144], edi
inc esi
jmp 0x44cbea
cmp esi, 0x28
jne 0x44ce22
mov dword [ebp - 0x14c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x2c
jne 0x44ce33
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x2d
jne 0x44ce41
mov dword [ebp - 0x40], edi
inc esi
jmp 0x44cbea
cmp esi, 0x2e
jne 0x44ce52
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x44cbea
cmp esi, 0x2f
jne 0x44ce63
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x44cbea
cmp esi, 0x30
jne 0x44ce74
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x31
jne 0x44ce85
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x44cbea
cmp esi, 0x32
jne 0x44ce96
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x44cbea
cmp esi, 0x34
jne 0x44cea7
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x44cbea
cmp esi, 0x35
jne 0x44ceb8
mov dword [ebp - 0x98], edi
inc esi
jmp 0x44cbea
cmp esi, 0x36
jne 0x44cec9
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x44cbea
cmp esi, 0x37
jne 0x44cede
mov dword [ebp - 0x100], 0
inc esi
jmp 0x44cbea
cmp esi, 0x38
jne 0x44ceef
mov dword [ebp - 0x110], edi
inc esi
jmp 0x44cbea
cmp esi, 0x3a
je 0x44cefe
cmp esi, 0x3b
je 0x44cefe
cmp esi, 0x3c
jne 0x44cf04
mov dword [ebp - 0x120], edi
cmp esi, 0x3d
jne 0x44cf12
mov dword [ebp - 0x40], edi
inc esi
jmp 0x44cbea
cmp esi, 0x3e
jne 0x44cf23
mov dword [ebp - 0x128], edi
inc esi
jmp 0x44cbea
cmp esi, 0x3f
jne 0x44cf34
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x44cbea
cmp esi, 0x40
jne 0x44cf42
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x41
jne 0x44cf53
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x44cbea
cmp esi, 0x42
jne 0x44cf64
mov dword [ebp - 0x108], edi
inc esi
jmp 0x44cbea
cmp esi, 0x43
je 0x44cf6e
cmp esi, 0x44
jne 0x44cf74
mov dword [ebp - 0x118], edi
cmp esi, 0x46
je 0x44cf83
cmp esi, 0x47
je 0x44cf83
cmp esi, 0x48
jne 0x44cf89
mov dword [ebp - 0xec], edi
cmp esi, 0x49
jne 0x44cf9a
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x44cbea
cmp esi, 0x50
jne 0x44cfab
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x44cbea
cmp esi, 0x51
jne 0x44cfbc
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x44cbea
cmp esi, 0x55
jne 0x44cfcd
mov dword [ebp - 0x138], edi
inc esi
jmp 0x44cbea
cmp esi, 0x5c
jne 0x44cfe5
mov eax, dword [ebp - 0x8c]
inc eax
inc esi
mov dword [ebp - 0x8c], eax
jmp 0x44cbea
cmp esi, 0x5d
jne 0x44cffd
mov eax, dword [ebp - 0x94]
inc eax
inc esi
mov dword [ebp - 0x94], eax
jmp 0x44cbea
cmp esi, 0x5e
jne 0x44d015
mov eax, dword [ebp - 0x88]
inc eax
inc esi
mov dword [ebp - 0x88], eax
jmp 0x44cbea
cmp esi, 0x5f
jne 0x44d020
inc dword [ebp - 0xc4]
inc esi
jmp 0x44cbea
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x190]
inc ecx
cmp eax, edi
mov dword [ebp - 0x84], ecx
jne 0x44d040
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x188], edi
jne 0x44d04e
inc dword [ebp - 0xf4]
cmp dword [ebp - 0x194], edi
jne 0x44d05c
inc dword [ebp - 0x134]
cmp dword [ebp - 0x84], 0x2710
jg 0x44d0c8
mov esi, dword [ebp - 0x180]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x24]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x180], esi
mov esi, dword [ebp - 0x170]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], ecx
mov eax, ecx
jmp 0x44caf8
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0xd0]
mov ebx, dword [ebp - 0x44]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 4
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0xd0], eax
jmp 0x44c86d
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebp - 0x170]
cmp bx, word [ecx + 2]
jae 0x44d292
xor edx, edx
push str..asp
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov byte [ebp - 0x68], dl
mov eax, dword [edi]
mov dword [ebp - 0x70], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x70]
mov dword [ebp - 0x6c], ecx
push edx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x44d17c
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x70]
push str..upx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d194
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x70]
push str..upack
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d1ac
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0x70]
push str.upx0
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d1c4
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x70]
push str.upx1
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d1dc
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x70]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d1f4
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0x70]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d20c
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x70]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44d224
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x70]
push 0x48b7ec
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44d23f
inc dword [ebp - 0xd4]
mov esi, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x3c]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0x3c], eax
jg 0x44d292
add edi, 0x28
inc ebx
jmp 0x44d139
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 4], 3
mov edx, dword [0x6309b8]
push edx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x44d2e3
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 3
push 0x6309b0
call fcn.00404650
mov eax, dword [ebp + 0xc]
add esp, 4
cmp eax, 1
jne 0x44d302
push 0x49b598
jmp 0x44f56b
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x13e4]
mov ebx, esi
push ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
call fcn.0047c0d3
add esp, 4
test edi, edi
jne 0x44db11
cmp esi, 1
jge 0x44db11
xor esi, esi
mov dword [ebp - 0x30], esi
push 0x5585b1c2
call fcn.004749bb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xd4]
cmp eax, 5
jne 0x44dc34
test esi, esi
jne 0x44dc36
test edi, edi
jle 0x44dd5b
mov ebx, dword [ebp - 0x50]
cmp ebx, 0xc800
jge 0x44dd5e
cmp ebx, 0x400
jle 0x44dd5e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x714]
push eax
call esi
lea ecx, [ebp - 0x714]
push ecx
call fcn.00429f20
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x44dbf4
lea edx, [ebp - 0x714]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0x714]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x714]
push ecx
call esi
test eax, eax
jne 0x44dbe0
lea edx, [ebp - 0x714]
push edx
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x44dbe0
lea eax, [ebp - 0x714]
push eax
call fcn.00429e70
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, edi
lea edx, [ebp - 0x414]
jne 0x44dbd9
mov edi, 0x49f4ec
jmp 0x44dc0b
mov edi, 0x49b05c
jmp 0x44dc0b
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
jne 0x44dc06
mov edi, 0x49f4ec
jmp 0x44dc0b
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
mov edi, 0x49f4ec
je 0x44dc0b
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
jmp 0x44f56b
test esi, esi
jle 0x44dd5b
cmp esi, 0xa
jge 0x44dd5b
test ecx, ecx
jle 0x44dd5b
lea eax, [edi - 1]
cmp ecx, eax
jg 0x44dc5a
jne 0x44dd5b
mov ebx, dword [ebp - 0x50]
cmp ebx, 0xa000
jge 0x44dd5e
cmp ebx, 0x400
jle 0x44dd5e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x714]
push edx
call esi
lea eax, [ebp - 0x714]
push eax
call fcn.00429f20
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x44dd1b
lea ecx, [ebp - 0x714]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0x714]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x714]
push eax
call esi
test eax, eax
jne 0x44dd07
lea ecx, [ebp - 0x714]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x44dd07
lea edx, [ebp - 0x714]
push edx
call fcn.00429e70
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, edi
lea edx, [ebp - 0x414]
jne 0x44dd00
mov edi, 0x49f4ec
jmp 0x44dd32
mov edi, 0x49b05c
jmp 0x44dd32
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
jne 0x44dd2d
mov edi, 0x49f4ec
jmp 0x44dd32
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
mov edi, 0x49f4ec
je 0x44dd32
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
jmp 0x44f56b
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x160]
mov edx, 1
cmp eax, edx
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x414], 0
jle 0x44ddae
mov edi, 0x49b3c0
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x154], edx
jne 0x44ddeb
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x168], edx
jne 0x44de7d
mov edi, 0x49e304
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x10]
mov ecx, edx
mov edx, 1
and ecx, 3
cmp eax, edx
rep movsb byte es:[edi], byte [esi]
jge 0x44de45
cmp ebx, 0x4b000
jle 0x44de7d
push 0x49b4a4
jmp 0x44f56b
lea eax, [ebp - 0x814]
push eax
push 0x49b468
lea ecx, [ebp - 0x414]
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xac]
xor eax, eax
cmp ecx, edx
jne 0x44dea3
cmp dword [ebp - 0x38], edx
jne 0x44de90
mov eax, edx
cmp dword [ebp - 0x60], edx
jne 0x44dea3
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jle 0x44dea3
cmp ecx, 5
jge 0x44dea3
mov eax, edx
cmp dword [ebp - 0xec], edx
jne 0x44ded7
test eax, eax
jne 0x44ded7
cmp dword [ebp + 0x10], edx
jge 0x44dec6
cmp ebx, 0x4b000
jle 0x44ded7
push 0x49b43c
jmp 0x44f56b
lea eax, [ebp - 0x814]
push eax
push 0x49b400
jmp 0x44de51
cmp dword [ebp - 0x134], 0x8c
jg 0x44def5
cmp dword [ebp - 0xf4], 0x64
jle 0x44dfd3
mov edx, 1
mov eax, dword [ebp + 0x10]
cmp eax, edx
mov eax, dword [ebp - 0x174]
jge 0x44df65
cmp eax, edx
push 0x491b90
jne 0x44df19
lea eax, [ebp - 0x414]
push 0x49f4b4
push eax
jmp 0x44df25
lea ecx, [ebp - 0x414]
push 0x49b400
push ecx
call fcn.0047a8f8
mov eax, dword [ebp - 0xdc]
add esp, 0xc
cmp eax, 1
jne 0x44df51
push 0x491b90
lea edx, [ebp - 0x414]
push 0x49f490
push edx
call fcn.0047a8f8
add esp, 0xc
cmp ebx, 0x4b000
jle 0x44dfd3
lea eax, [ebp - 0x414]
push eax
jmp 0x44f56b
cmp eax, edx
jne 0x44df7e
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x414]
push ecx
push 0x49f4b4
push edx
jmp 0x44df91
lea eax, [ebp - 0x814]
lea ecx, [ebp - 0x414]
push eax
push 0x49b400
push ecx
call fcn.0047a8f8
mov eax, dword [ebp - 0xdc]
add esp, 0xc
cmp eax, 1
jne 0x44dfbf
lea edx, [ebp - 0x814]
lea eax, [ebp - 0x414]
push edx
push 0x49f490
push eax
call fcn.0047a8f8
add esp, 0xc
cmp ebx, 0x28000
jle 0x44dfd3
lea ecx, [ebp - 0x414]
push ecx
jmp 0x44f56b
mov eax, dword [ebp - 0x54]
mov esi, 1
test eax, eax
jle 0x44e055
cmp eax, esi
jle 0x44dff4
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
mov eax, dword [ebp - 0x48]
cmp eax, 0x400
jbe 0x44e055
add eax, ebx
cmp eax, 0x64000
jle 0x44e018
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x3c
jle 0x44e038
cmp eax, 0x4b000
jle 0x44e038
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
cmp ecx, 0x64
jle 0x44e055
cmp eax, 0x32000
jle 0x44e055
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
cmp dword [ebp - 0xb4], 0x20
jle 0x44e06f
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
cmp dword [ebp - 0xfc], esi
jne 0x44e09f
cmp dword [ebp + 0x10], esi
jge 0x44e08e
cmp ebx, 0x4b000
jle 0x44e09f
push 0x49b3e8
jmp 0x44f56b
lea edx, [ebp - 0x814]
push edx
push 0x49b3c8
jmp 0x44f0fc
cmp dword [ebp - 0x13c], esi
jne 0x44e0bf
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x44e0bf
lea edx, [ebp - 0x814]
push edx
push 0x49f45c
jmp 0x44f0fc
cmp dword [ebp - 0x8c], 2
jle 0x44e0f6
cmp ebx, 0x28
jg 0x44e0d3
cmp dword [ebp - 0x4c], 0x28
jle 0x44e0f6
mov eax, dword [ebp - 0x94]
test eax, eax
jg 0x44e0e5
cmp dword [ebp - 0x88], esi
jle 0x44e0f6
lea edx, [ebp - 0x814]
push edx
push 0x49f478
jmp 0x44f0fc
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x44e14a
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
mov al, byte [ebp - 0x1064]
cmp al, 0x30
je 0x44e178
cmp al, 0x31
je 0x44e178
cmp al, 0x32
je 0x44e178
cmp al, 0x33
je 0x44e178
cmp al, 0x34
je 0x44e178
cmp al, 0x35
je 0x44e178
cmp al, 0x36
je 0x44e178
cmp al, 0x37
je 0x44e178
cmp al, 0x38
je 0x44e178
cmp al, 0x39
jne 0x44e1b4
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
mov eax, dword [ebp - 0x158]
mov dword [ebp + 0xc], 0
cmp eax, esi
jne 0x44e202
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
mov dword [ebp + 0xc], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x20], eax
mov esi, eax
cmp dword [ebp - 0x104], esi
jne 0x44e246
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x7c], esi
jne 0x44e287
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x15c], esi
jne 0x44e2cb
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x10c], esi
je 0x44e2db
cmp dword [ebp - 0x144], esi
jne 0x44e310
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xe0], esi
jne 0x44e354
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x16c], esi
jne 0x44e391
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x11c], esi
jne 0x44e3d5
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xbc], esi
jne 0x44e425
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x44e42a
mov dword [ebp - 0x20], ebx
jmp 0x44e42a
mov ebx, 1
cmp dword [ebp - 0x14c], ebx
jne 0x44e46c
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x124], ebx
jne 0x44e4ab
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x164], ebx
jne 0x44e4ea
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x60], ebx
jne 0x44e526
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x78], ebx
jne 0x44e5c8
cmp dword [ebp - 0x12c], ebx
je 0x44e54c
cmp dword [ebp - 0xe4], ebx
je 0x44e54c
lea edx, [ebp - 0x414]
mov edi, 0x49b2d8
jmp 0x44e596
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe8]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x414]
mov edi, 0x49b2b8
je 0x44e596
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x44e5c5
mov dword [ebp - 0x20], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0xf0], ebx
jne 0x44e607
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf8], ebx
jne 0x44e650
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x44e650
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xa0], ebx
jne 0x44e699
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x44e699
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x38], ebx
jne 0x44e717
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x44e6df
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 8], ebx
jne 0x44e717
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x17c]
cmp edx, ebx
jne 0x44e7e3
cmp dword [ebp - 0xa8], ebx
jne 0x44e7e3
cmp dword [ebp - 0x98], ebx
jne 0x44e7e3
cmp dword [ebp - 0xb0], ebx
jne 0x44e790
mov eax, dword [ebp - 0xc0]
mov edi, 0x49b24c
cmp eax, ebx
lea ebx, [ebp - 0x414]
je 0x44e75f
mov edi, 0x49e2e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x100], ebx
jne 0x44e7e3
mov eax, dword [ebp - 0xc0]
mov edi, 0x49b224
cmp eax, ebx
lea ebx, [ebp - 0x414]
je 0x44e7b2
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x108], ebx
jne 0x44e84b
cmp edx, ebx
jne 0x44e814
cmp dword [ebp - 0xa8], ebx
jne 0x44e814
cmp dword [ebp - 0x98], ebx
jne 0x44e814
cmp dword [ebp - 0xb0], ebx
jne 0x44e814
lea edx, [ebp - 0x414]
mov edi, 0x49b204
jmp 0x44e81f
lea edx, [ebp - 0x414]
mov edi, 0x49b1f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x110], ebx
jne 0x44e883
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], ebx
jne 0x44e8c2
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x118], ebx
jne 0x44e901
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x90], ebx
jne 0x44e94a
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x44e94a
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xb8], ebx
jne 0x44e989
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd8], ebx
jne 0x44e9c8
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x9c], ebx
jne 0x44ea07
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x44ea45
mov edi, 0x49b17c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x74], ebx
je 0x44ea81
mov edi, 0x49b16c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x40], ebx
jne 0x44eabd
mov edi, 0x49b160
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa4], ebx
jne 0x44eb63
push 0x49f450
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xac]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x44eb31
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xb4], 2
jge 0x44eb63
cmp dword [ebp - 0x178], ebx
jne 0x44eb4c
mov eax, dword [ebp + 8]
test eax, eax
jne 0x44eb4c
mov dword [ebp - 0x50], ebx
lea edi, [ebp - 0x814]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jne 0x44eb63
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x120], ebx
jne 0x44eb9b
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x128], ebx
jne 0x44ebd3
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
mov eax, 6
cmp ecx, ebx
je 0x44ebe6
lea eax, [ecx*4]
cmp dword [ebp - 0x28], eax
jge 0x44ec34
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x414]
cmp eax, ebx
mov edi, 0x49b12c
je 0x44ec02
mov edi, 0x49b11c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jle 0x44ec75
cmp ecx, ebx
jne 0x44ec75
mov edi, 0x49b108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], ebx
jne 0x44ecb6
cmp eax, 5
jge 0x44ecb6
test eax, eax
jle 0x44ecb6
mov edi, 0x49b0ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x10]
cmp eax, 7
jge 0x44ed9e
cmp dword [ebp - 0x44], ebx
jne 0x44ed56
cmp eax, ebx
lea edx, [ebp - 0x414]
jge 0x44ed0e
mov edi, 0x49b0d4
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x44edcf
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x78]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x44ed42
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x90], ebx
jne 0x44ed99
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], ebx
inc eax
mov dword [ebp - 0x14], eax
jmp 0x44edcf
cmp eax, ebx
lea edx, [ebp - 0x414]
mov edi, 0x49b0ac
jl 0x44ed6a
mov edi, 0x49b09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x78]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x44ed99
mov dword [ebp + 0xc], ebx
inc dword [ebp - 0x14]
jmp 0x44edcf
lea edi, [ebp - 0x814]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], ebx
jne 0x44eeb9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x714]
push eax
call esi
lea ecx, [ebp - 0x714]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, ebx
jne 0x44ee79
lea edx, [ebp - 0x714]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0x714]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x714]
push ecx
call esi
test eax, eax
jne 0x44ee65
lea edx, [ebp - 0x714]
push edx
call fcn.00429f20
add esp, 4
cmp eax, ebx
jne 0x44ee65
lea eax, [ebp - 0x714]
push eax
call fcn.00429e70
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, ebx
lea edx, [ebp - 0x414]
jne 0x44ee5e
mov edi, 0x49f4ec
jmp 0x44ee90
mov edi, 0x49f40c
jmp 0x44ee90
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, ebx
jne 0x44ee8b
mov edi, 0x49f4ec
jmp 0x44ee90
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, ebx
mov edi, 0x49f4ec
je 0x44ee90
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
jmp 0x44f56b
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44efda
cmp dword [ebp - 0x14], ebx
jle 0x44efda
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x44efda
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44efda
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x44efda
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x44efda
mov eax, dword [ebp - 0x148]
test eax, eax
jne 0x44efda
mov eax, dword [ebp - 0x150]
test eax, eax
jne 0x44efda
lea edi, [ebp - 0x814]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], 0
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x10]
not ecx
dec ecx
test eax, eax
mov esi, ecx
jle 0x44ef6d
test esi, esi
jle 0x44ef6d
mov eax, dword [ebp + 8]
test eax, eax
jne 0x44ef6d
lea edx, [ebp - 0x34]
lea eax, [ebp - 0xc24]
push edx
lea ecx, [ebp - 0x1064]
push eax
lea edx, [ebp - 0x13e4]
push ecx
lea eax, [ebp - 0x814]
push edx
push eax
call fcn.00454740
add esp, 0x14
jmp 0x44ef8e
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0xc24]
push ecx
lea eax, [ebp - 0x1064]
push edx
lea ecx, [ebp - 0x13e4]
push eax
push ecx
call fcn.0044a6e0
add esp, 0x10
cmp dword [ebp - 0x34], 5
jle 0x44efda
test esi, esi
jle 0x44efd0
lea edx, [ebp - 0x814]
lea eax, [ebp - 0x1564]
push edx
push 0x49af98
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x1564]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x49afc8
jmp 0x44f56b
cmp dword [ebp - 0x44], ebx
jne 0x44f0cd
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x44f0cd
lea edi, [ebp - 0x13e4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x44f012
cmp byte [ebp + eax - 0x13e4], 0x5c
jne 0x44f00f
inc edx
inc eax
jmp 0x44f000
cmp edx, 2
jle 0x44f0cd
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x44f0cd
lea edi, [ebp - 0x814]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], 0
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x10]
not ecx
dec ecx
test eax, eax
mov esi, ecx
jle 0x44f07b
test esi, esi
jle 0x44f07b
mov eax, dword [ebp + 8]
test eax, eax
jne 0x44f07b
lea edx, [ebp - 0x34]
lea eax, [ebp - 0xc24]
push edx
lea ecx, [ebp - 0x1064]
push eax
lea edx, [ebp - 0x13e4]
push ecx
lea eax, [ebp - 0x814]
push edx
push eax
call fcn.00454740
add esp, 0x14
jmp 0x44f09c
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0xc24]
push ecx
lea eax, [ebp - 0x1064]
push edx
lea ecx, [ebp - 0x13e4]
push eax
push ecx
call fcn.0044a6e0
add esp, 0x10
cmp dword [ebp - 0x34], 0xa
jle 0x44f0cd
test esi, esi
jle 0x44efd0
lea edx, [ebp - 0x814]
lea eax, [ebp - 0x1564]
push edx
push 0x49af98
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x1564]
jmp 0x44efb6
cmp dword [ebp - 0x138], ebx
jne 0x44f128
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44f128
cmp dword [ebp - 0x4c], 0x50
jle 0x44f128
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44f128
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44f128
lea edx, [ebp - 0x814]
push edx
push 0x49afd8
lea eax, [ebp - 0x414]
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x414]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.c:endpcache
mov dword [ebp - 4], 0
call fcn.0047c0d3
mov eax, dword [ebp - 0x20]
add esp, 4
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x148]
test eax, eax
jne 0x44f319
mov eax, dword [ebp - 0x150]
test eax, eax
jne 0x44f319
mov ecx, dword [ebp + 0xc]
mov eax, 1
cmp ecx, eax
je 0x44f1a7
cmp dword [ebp - 0x14], eax
jle 0x44f319
lea edi, [ebp - 0x814]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0xba4]
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x214]
mov ebx, ecx
push edx
lea ecx, [ebp - 0x1064]
push eax
lea edx, [ebp - 0x13e4]
push ecx
push edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x178], esi
call fcn.0044a6e0
mov eax, dword [ebp - 0x1c]
mov edi, 6
add esp, 0x10
cmp eax, edi
jge 0x44f224
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0xc24]
push eax
lea edx, [ebp - 0x1064]
push ecx
lea eax, [ebp - 0x13e4]
push edx
push eax
call fcn.00455990
add esp, 0x10
test esi, esi
jle 0x44f263
cmp dword [ebp - 0x1c], edi
jge 0x44f263
test ebx, ebx
jle 0x44f29b
mov eax, dword [ebp - 0x30]
mov esi, 1
test eax, eax
je 0x44f399
cmp dword [ebp - 0xbc], esi
je 0x44f399
cmp dword [ebp + 0xc], esi
je 0x44f399
cmp dword [ebp - 0x20], esi
je 0x44f399
cmp dword [ebp - 0x2c], esi
je 0x44f399
mov eax, dword [ebp - 0x14]
cmp eax, esi
lea eax, [ebp - 0x414]
push eax
jle 0x44f56b
lea ecx, [ebp - 0x1b1c]
push 0x49e29c
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x714]
push edx
call fcn.004299c0
add esp, 0x10
lea eax, [ebp - 0x714]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x714]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x1b1c]
push edx
jmp 0x44f56b
lea ecx, [ebp - 0x714]
push 0x650adc
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44f3d3
lea edx, [ebp - 0x714]
push edx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x44f3d3
lea eax, [ebp - 0x714]
push eax
call fcn.00429e70
add esp, 4
mov eax, dword [ebp - 0x158]
test eax, eax
jne 0x44f3ec
lea ecx, [ebp - 0x1064]
push ecx
call fcn.00424380
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x714]
push edx
call esi
lea eax, [ebp - 0x714]
push eax
call fcn.00429f20
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x44f4a5
lea ecx, [ebp - 0x714]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0x714]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x714]
push eax
call esi
test eax, eax
jne 0x44f491
lea ecx, [ebp - 0x714]
push ecx
call fcn.00403f10
add esp, 4
lea edx, [ebp - 0x714]
push edx
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x44f491
lea eax, [ebp - 0x714]
push eax
call fcn.00429e70
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, edi
lea edx, [ebp - 0x414]
jne 0x44f48a
mov edi, 0x49f4ec
jmp 0x44f4bc
mov edi, 0x49b05c
jmp 0x44f4bc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
jne 0x44f4b7
mov edi, 0x49f4ec
jmp 0x44f4bc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x414]
cmp eax, edi
mov edi, 0x49f4ec
je 0x44f4bc
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x714]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x414]
mov edx, ecx
mov esi, edi
mov edi, 0x650adc
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44f56b
call fcn.00483565
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret