Function at 0x4503b0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb20b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1bc8
call fcn.004f2630
push ebx
push esi
xor eax, eax
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x180], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x1398]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x910]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x45062f
push edx
lea ecx, [ebp - 0x910]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x910]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push 0x520bd4
push eax
call fcn.004f2d80
add esp, 8
mov esi, 1
test eax, eax
je 0x450652
mov dword [ebp - 0x1d4], esi
cmp dword [0xe56be4], esi
jne 0x4506fa
lea ecx, [ebp - 0x910]
push str.LOCALS1TempGLJ
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4506ac
lea edx, [ebp - 0x910]
push 0x516860
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4506ac
push 0x520bac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push str.LOCALS1TempGLJ
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4506fa
lea ecx, [ebp - 0x910]
push 0x516860
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4506fa
push 0x520bac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push str.Documents_and_Settings_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45072d
lea eax, [ebp - 0x910]
push str.Application_Data_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45072d
mov dword [ebp - 0x70], esi
lea ecx, [ebp - 0x910]
push str.documents_and_settings_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450760
lea edx, [ebp - 0x910]
push str.Application_Data_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450760
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x910]
push str.Program_Files_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45077e
mov dword [ebp - 0x1c8], esi
mov al, byte [ebp - 0x910]
xor ecx, ecx
cmp al, 0x25
jne 0x45078c
mov ecx, esi
lea edx, [ebx - 2]
test edx, edx
jle 0x4507b5
mov al, byte [ebp + edx - 0x910]
cmp al, 0x3a
jne 0x4507a8
cmp byte [ebp + edx - 0x90f], 0x5c
je 0x4507b5
cmp ecx, esi
jne 0x4507b0
cmp al, 0x5c
je 0x4507b9
dec edx
test edx, edx
jg 0x450793
cmp ecx, esi
jne 0x450817
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x4507e1
mov ecx, ebx
lea esi, [ebp + edx - 0x90f]
mov edx, ecx
lea edi, [ebp - 0xc48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc48], 0
lea edi, [ebp - 0xc48]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x910]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4508c5
test edx, edx
je 0x4508c5
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x12a0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x45085f
cmp byte [ebp + ebx - 0x910], 0x2e
je 0x45085f
dec ebx
test ebx, ebx
jg 0x450850
sub ebx, edx
mov byte [ebp - 0x910], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x45088a
lea esi, [ebp + edx - 0x12a1]
mov edx, ecx
lea edi, [ebp - 0x910]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x90b], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4508b5
cmp byte [ebp + ecx - 0x910], 0x2e
je 0x4508b5
dec ecx
test ecx, ecx
jg 0x4508a6
test ecx, ecx
mov byte [ebp + ecx - 0x90c], 0
jne 0x45098b
lea eax, [ebp - 0x710]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x14d8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa10]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x450969
lea edx, [ebp - 0xa10]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x450969
lea eax, [ebp - 0xa10]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x450969
lea ecx, [ebp - 0xa10]
lea edx, [ebp - 0x710]
push ecx
jmp 0x450976
lea ecx, [ebp - 0xa10]
lea edx, [ebp - 0x14d8]
push ecx
push edx
lea eax, [ebp - 0x910]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4509ae
cmp byte [ebp + ecx - 0x910], 0x2e
je 0x4509ae
dec ecx
test ecx, ecx
jg 0x45099f
mov byte [ebp + ecx - 0x90c], 0
lea ecx, [ebp - 0x910]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x4509e8
push 0x515844
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push edx
call fcn.004ab3c0
mov esi, eax
lea eax, [ebp - 0x17d8]
lea ecx, [ebp - 0x310]
push eax
lea edx, [ebp - 0x910]
push ecx
push edx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x44], esi
call fcn.004d9d40
movsx edi, ax
lea eax, [ebp - 0x1120]
lea ecx, [ebp - 0x1658]
push eax
lea edx, [ebp - 0x910]
push ecx
push edx
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x1120], 0
call fcn.004ca130
add esp, 0x1c
cmp esi, 0xc8000
jle 0x450aa5
cmp edi, 1
jle 0x450a6d
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x12a0]
push ecx
push 0x515e38
push edx
call fcn.004f175f
lea eax, [ebp - 0x12a0]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x78]
lea edx, [ebp - 0x84]
push ecx
lea eax, [ebp - 0x910]
mov esi, 1
xor ebx, ebx
push edx
push eax
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x188], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x450ae4
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
je 0x450aea
mov dword [ebp - 0x188], esi
xor edi, edi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
lea edx, [esi + str.CMBPB]
lea eax, [ebp - 0x1120]
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450b48
lea ecx, [esi + str.PersonalBankPortal.exe]
lea edx, [ebp - 0x1398]
push ecx
push edx
lea eax, [ebp - 0xc48]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xc48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x450ba2
add esi, 0x100
inc edi
cmp esi, 0x200
jl 0x450af5
xor edi, edi
mov esi, str.watchclient.exe
lea edx, [ebp - 0x1398]
push esi
push edx
lea eax, [ebp - 0xc48]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xc48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x450bdd
add esi, 0x100
inc edi
cmp esi, 0x50eba4
jl 0x450b5e
jmp 0x450c18
shl edi, 8
add edi, str.CMBPB
lea eax, [ebp - 0xc48]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50eba4
lea eax, [ebp - 0xc48]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0xe56be4], 1
jne 0x450d3c
xor edi, edi
mov esi, str.olelink.exe
lea edx, [ebp - 0x1398]
push esi
push edx
lea eax, [ebp - 0xc48]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xc48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x450cc6
add esi, 0x100
inc edi
cmp esi, 0x510124
jl 0x450c2c
cmp dword [0xe56bf0], 1
jne 0x450d3c
xor edi, edi
mov esi, str.WBWA.exe
lea edx, [ebp - 0x1398]
push esi
push edx
lea eax, [ebp - 0xc48]
push str._s_system32_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xc48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x450d01
add esi, 0x100
inc edi
cmp esi, 0x510724
jl 0x450c82
jmp 0x450d3c
shl edi, 8
add edi, 0x510124
lea eax, [ebp - 0xc48]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x510724
lea eax, [ebp - 0xc48]
push edi
push 0x520b90
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push str.DOCUME1_
push edx
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x450d5c
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x910]
push str.LOCALS1Temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450da7
mov eax, dword [0xe56be4]
mov dword [ebp - 0x18], edi
cmp eax, edi
jne 0x450da7
mov esi, str.Sleep.exe
lea ecx, [ebp - 0x910]
push esi
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x450dfa
add esi, 0x80
cmp esi, 0x510e24
jl 0x450d85
lea edx, [ebp - 0x910]
push str.Program_FilesCommon_FilesSystem
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450dc2
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x1658]
push eax
push str.PowerWord
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x450e18
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x520b38
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x310]
push str.Maxthon_International
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450e50
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x310]
push str.MoreQuick
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x451266
lea eax, [ebp - 0x310]
push str.Opera_Software
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450ea4
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push str.Microsoft.NETFramework_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450edc
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push str.jre_binjre
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x451266
lea eax, [ebp - 0x310]
push 0x515dc8
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450f2e
push 0x515dbc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push str.32A6Wizard_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450f64
push 0x515dbc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push 0x5156a4
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450f9c
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push str.java
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x451266
lea eax, [ebp - 0x910]
push str.Microsoft.NETFramework_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x450ff0
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push str.microsoft.net_framework_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451028
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x310]
push str.Microsoft
push ecx
mov dword [ebp - 0x28], ebx
call fcn.004f2d80
add esp, 8
cmp eax, ebx
je 0x451092
lea edx, [ebp - 0x17d8]
push str.Microsoft
push edx
call fcn.004f2d80
add esp, 8
cmp eax, ebx
je 0x451060
mov dword [ebp - 0x28], edi
jmp 0x451092
mov edi, 0x515e60
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xa8], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x690]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x1418]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x690]
lea ecx, [ebp - 0xb48]
push eax
push str._swinlogon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x910]
lea eax, [ebp - 0xb48]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451108
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x690]
lea eax, [ebp - 0xb48]
push edx
push str._scsrss.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xb48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45115a
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0xb48]
push ecx
push str._s_services.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x910]
lea ecx, [ebp - 0xb48]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x451266
lea eax, [ebp - 0x690]
lea ecx, [ebp - 0xb48]
push eax
push str._slsass.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x910]
lea eax, [ebp - 0xb48]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4511e2
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x690]
lea eax, [ebp - 0xb48]
push edx
push str._s_svchost.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xb48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451234
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0xb48]
push ecx
push str._suserinit.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x910]
lea ecx, [ebp - 0xb48]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451286
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x690]
lea ecx, [ebp - 0xb48]
push eax
push str._s_taskmgr.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x910]
lea eax, [ebp - 0xb48]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4512d8
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x690]
lea eax, [ebp - 0xb48]
push edx
push str._s_spoolsv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xb48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45132a
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1418]
lea edx, [ebp - 0xb48]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x910]
lea ecx, [ebp - 0xb48]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x45137c
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push eax
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4513b4
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x690]
lea eax, [ebp - 0xb48]
push edx
push str._sctfmon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xb48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451406
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1418]
lea edx, [ebp - 0xb48]
push ecx
push str._s_anotherlockfile.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x910]
lea ecx, [ebp - 0xb48]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451456
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x690]
lea eax, [ebp - 0xb48]
push edx
push str._sServerNT.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0x910]
lea edx, [ebp - 0xb48]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x451526
lea eax, [ebp - 0x690]
lea ecx, [ebp - 0x12a0]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x12a0]
push edx
call fcn.004abe70
mov esi, eax
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0xc48]
push str._sAlertService.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xc48]
push edx
call fcn.004abe70
mov edi, eax
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0xa10]
push str._sServerNT.EXE
push ecx
call fcn.004f175f
lea edx, [ebp - 0xa10]
push edx
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x451526
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x690]
lea ecx, [ebp - 0xb48]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x910]
lea eax, [ebp - 0xb48]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4515f6
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0x12a0]
push ecx
push str._sU8SMSSrv.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x12a0]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0xc48]
push ecx
push str._sAlertService.exe
push edx
mov esi, eax
call fcn.004f175f
lea eax, [ebp - 0xc48]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0xa10]
push ecx
push str._sServerNT.EXE
push edx
mov edi, eax
call fcn.004f175f
lea eax, [ebp - 0xa10]
push eax
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x4515f6
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0xb48]
push ecx
push str._sAlertService.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x910]
lea ecx, [ebp - 0xb48]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4516c6
lea edx, [ebp - 0x690]
lea eax, [ebp - 0x12a0]
push edx
push str._sU8SMSSrv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x12a0]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x690]
mov esi, eax
push edx
lea eax, [ebp - 0xc48]
push str._sAlertService.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x690]
mov edi, eax
push edx
lea eax, [ebp - 0xa10]
push str._sServerNT.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0xa10]
push ecx
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x4516c6
push 0x5165f0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x910]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], edx
cmp ecx, edx
mov dword [ebp - 0xe4], ebx
jle 0x451709
lea esi, [ebp + ecx - 0x910]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xea0], al
jne 0x451703
cmp edx, 2
jge 0x451709
inc edx
dec esi
cmp edx, ecx
jl 0x4516f1
sub ecx, edx
xor eax, eax
mov edi, ecx
test edi, edi
jle 0x451732
mov cl, byte [ebp + eax - 0x910]
cmp cl, 0x5c
mov byte [ebp + eax - 0x10a0], cl
jne 0x451727
inc ebx
inc eax
cmp eax, edi
jl 0x451713
mov dword [ebp - 0xe4], ebx
xor esi, esi
mov byte [ebp + edi - 0x10a0], 0
test edx, edx
jle 0x45177c
mov ecx, dword [ebp - 0x17c]
lea edi, [ebp + edi - 0x90f]
mov al, byte [edi + esi]
cmp al, 0x5c
je 0x45175b
mov byte [ebp + esi - 0xea0], al
cmp al, 0x2e
jne 0x451760
inc ecx
cmp al, 0x20
jne 0x451765
inc ecx
cmp al, 0x5c
jne 0x451771
mov byte [ebp + esi - 0xea0], 0
inc esi
cmp esi, edx
jl 0x45174d
mov dword [ebp - 0x17c], ecx
mov al, byte [ebp - 0x109e]
mov byte [ebp + edx - 0xea0], 0
cmp al, 0x5c
je 0x45179c
mov byte [ebp - 0x109e], 0x5c
mov byte [ebp - 0x109d], 0
lea edi, [ebp - 0xea0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xea0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x516860
push edx
mov dword [ebp - 0x1f0], ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4517e2
lea eax, [ebp - 0xea0]
push str..Tmp
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4517ef
mov esi, 1
mov dword [ebp - 0x1cc], esi
jmp 0x4517f4
mov esi, 1
lea ecx, [ebp - 0x10a0]
lea edx, [ebp - 0x1398]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451811
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x10a0]
lea ecx, [ebp - 0x690]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45182e
mov dword [ebp + 8], esi
lea edx, [ebp - 0x910]
push 0x100
lea eax, [ebp - 0x610]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xea0]
push 0x40
lea edx, [ebp - 0x1318]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x10a0]
push eax
call fcn.004cb750
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x19c], eax
jne 0x451922
lea ecx, [ebp - 0x610]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x610]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x610]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4518da
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, esi
jne 0x4518da
lea edx, [ebp - 0x610]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x520ab8
jmp 0x4518e5
lea edx, [ebp - 0x510]
mov edi, 0x520a7c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, esi
jne 0x451929
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x10a0]
push edx
call fcn.004db090
mov ebx, eax
lea eax, [ebp - 0x910]
push eax
mov dword [ebp - 0x20c], ebx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x45197b
push 0x5144fc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push 0x80
lea edx, [ebp - 0x15d8]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x910]
push 0x80
lea ecx, [ebp - 0x1558]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0x1418]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x690]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x15d8], al
lea edx, [ebp - 0x1418]
mov byte [ebp + ecx - 0x1558], al
lea eax, [ebp - 0x15d8]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x451a26
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451a1f
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x690]
lea edx, [ebp - 0x1558]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451a73
push 0x5144fc
push esi
mov dword [ebp - 0x20], 1
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451a73
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push str.System
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451af8
push 0x5144fc
push esi
mov dword [ebp - 0x20], 1
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451abe
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x451af8
push edi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push str._system
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451b7d
push 0x5144fc
push esi
mov dword [ebp - 0x20], 1
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451b43
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x451b7d
push edi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x910]
push str.SYSTEM
push ecx
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x451c03
push 0x5144fc
push esi
mov dword [ebp - 0x20], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x451bc9
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x910]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x451c03
push esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x910]
push 0x515d14
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451c1e
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x910]
push str.Microsoft_SharedMSINFO
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451c39
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x910]
push str.Microsoft_SharedMSInfo
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451c54
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x451f65
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x451f65
cmp dword [ebp - 0x24], 2
jle 0x451f65
lea eax, [ebp - 0x310]
push str.Beijing_Rising
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451cb4
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451cf4
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451d34
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451d74
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451db4
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451df4
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451e34
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451e74
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451eb4
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451ef4
mov edi, 0x5156ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x310]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x310]
push str.F_Secure_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451f2a
push 0x515dec
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x310]
push str.Avira_GmbH
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x451f60
push 0x515dd0
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, dword [ebp + 8]
test eax, eax
jne 0x452262
lea eax, [ebp - 0xea0]
push str.smss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea ecx, [ebp - 0xea0]
push str.winlogon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea edx, [ebp - 0xea0]
push str.csrss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea eax, [ebp - 0xea0]
push str.services.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea ecx, [ebp - 0xea0]
push str.lsass.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea edx, [ebp - 0xea0]
push str.svchost.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea eax, [ebp - 0xea0]
push str.taskmgr.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea ecx, [ebp - 0xea0]
push str.spoolsv.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea edx, [ebp - 0xea0]
push str.explorer.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea eax, [ebp - 0xea0]
push str.userinit.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea ecx, [ebp - 0xea0]
push str.ctfmon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea edx, [ebp - 0xea0]
push str.cmd.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea eax, [ebp - 0xea0]
push str.logo1_.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea ecx, [ebp - 0xea0]
push str.net.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x452170
lea edx, [ebp - 0xea0]
push 0x520a60
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x452170
lea eax, [ebp - 0xea0]
push str.Rundll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x452170
lea ecx, [ebp - 0xea0]
push str.RUNDLL
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x452170
lea edx, [ebp - 0xea0]
push 0x520a48
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x452170
lea eax, [ebp - 0xea0]
push 0x520a40
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x452262
lea ecx, [ebp - 0x610]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x452197
lea edx, [ebp - 0x610]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x610]
push eax
call esi
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x452204
lea edx, [ebp - 0x610]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x610]
push eax
call esi
test eax, eax
jne 0x452204
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x452204
lea edx, [ebp - 0x610]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x5158dc
jmp 0x45220f
lea edx, [ebp - 0x510]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x610]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x456755
lea ecx, [ebp - 0xea0]
push str.iexplore.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x452388
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x452388
lea edx, [ebp - 0x610]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4522b0
lea eax, [ebp - 0x610]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x610]
push ecx
call esi
lea edx, [ebp - 0x610]
push edx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x45231d
lea eax, [ebp - 0x610]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x610]
push ecx
call esi
test eax, eax
jne 0x45231d
lea edx, [ebp - 0x610]
push edx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x45231d
lea eax, [ebp - 0x610]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x5209ec
jmp 0x452328
lea edx, [ebp - 0x510]
mov edi, 0x520998
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c98]
mov dword [0xe56d20], eax
inc edi
or ecx, 0xffffffff
mov dword [0xe56c98], edi
lea edi, [ebp - 0x610]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x456755
lea edi, [ebp - 0x310]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x24]
not ecx
dec ecx
cmp eax, 3
jle 0x4523f0
mov esi, dword [ebp - 0x74]
cmp esi, 0xc800
jle 0x4523fa
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x4523fa
test ebx, ebx
jne 0x4523fa
mov ebx, 1
cmp ecx, ebx
je 0x4523ff
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4523ff
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4523ff
lea ecx, [ebp - 0x310]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x74]
mov ebx, 1
jmp 0x4523ff
mov ebx, 1
lea edi, [ebp - 0xea0]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0xd8a430
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x204], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x50], edx
mov dword [ebp + 8], edx
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x184], edx
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x910]
push 0xd8a430
push edx
call fcn.004a6ab0
xor edi, edi
add esp, 8
cmp eax, edi
jne 0x4524cd
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x910]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], ebx
jmp 0x45319b
mov edx, dword [0xd8a438]
mov byte [ebp - 4], 3
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x210], eax
mov eax, dword [0xd8a438]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x150], eax
jne 0x4525b2
cmp esi, 0x19000
jle 0x452577
lea ecx, [ebp + 8]
lea edx, [ebp - 0x14d8]
push ecx
lea eax, [ebp - 0xea0]
push edx
lea ecx, [ebp - 0x10a0]
push eax
push ecx
mov dword [ebp + 8], edi
call fcn.004ca490
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, esi
jge 0x452538
mov dword [ebp + 8], esi
lea edx, [ebp - 0x14d8]
push 0x520994
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x452577
cmp dword [ebp + 8], 0x32000
jle 0x452577
push 0x520984
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], 2
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
add esp, 4
mov dword [ebp - 0x1c4], eax
test eax, eax
jne 0x452ff7
mov dword [ebp + 8], 6
jmp 0x45318f
mov dword [ebp - 0x1c], edi
xor esi, esi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45257e
mov eax, dword [eax + 0xc]
mov ecx, dword [0xd8a438]
mov edx, dword [ebp - 0x210]
push eax
push ecx
push edx
call fcn.004a6c30
mov edx, dword [ebp - 0x30]
add esp, 0xc
mov edi, eax
inc edx
push 0x515c98
push edi
mov dword [ebp - 0x30], edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4525fb
mov dword [ebp - 0x18c], ebx
jmp 0x45260f
cmp esi, ebx
jne 0x452605
inc dword [ebp - 0x1e0]
mov dword [ebp - 0x18c], 0
push str.user32.dll
push edi
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push edi
mov dword [ebp - 0x200], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc71.dll
inc eax
push edi
mov dword [ebp - 0x208], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.comdlg32.dll
inc eax
push edi
mov dword [ebp - 0x1f4], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push 0x516b00
inc eax
push edi
mov dword [ebp - 0x1ec], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.wtsapi32.dll
inc eax
push edi
mov dword [ebp - 0x1fc], eax
call fcn.004f61e0
add esp, 0x30
test eax, eax
jne 0x452695
mov dword [ebp - 0xc0], ebx
push str.rasapi32.dll
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4526ad
mov dword [ebp - 0x1b0], ebx
push str.PBVM90.dll
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4526c5
mov dword [ebp - 0x1a0], ebx
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x19c]
inc ecx
test eax, eax
mov dword [ebp - 0xcc], ecx
jne 0x45271a
lea eax, [ebp - 0x10a0]
push edi
push eax
lea ecx, [ebp - 0x12d8]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x12d8]
push edx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x45271a
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x68]
inc edx
add ecx, eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x34], ebx
jne 0x452760
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x452760
cmp dword [ebp - 0xe4], 2
jle 0x4527ac
lea eax, [ebp - 0x10a0]
push edi
push eax
lea ecx, [ebp - 0xc80]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0xc80]
push edx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x4527ac
jmp 0x45279d
cmp dword [ebp - 0x20], ebx
jne 0x4527ac
cmp dword [ebp - 0xe4], 3
jle 0x4527ac
lea eax, [ebp - 0x10a0]
push edi
push eax
lea ecx, [ebp - 0xa48]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0xa48]
push edx
call fcn.004ab3c0
add esp, 0x14
cmp eax, 0x400
jle 0x4527ac
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x68]
inc edx
add ecx, eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x68], ecx
xor esi, esi
mov ebx, 1
cmp esi, 0x69
jge 0x452863
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45285d
cmp esi, 0xf
jle 0x4527e9
cmp esi, 0x12
jge 0x4527e9
mov dword [ebp - 0x10c], ebx
cmp esi, 0x1d
je 0x4527f8
cmp esi, 0x1e
je 0x4527f8
cmp esi, 0x39
jne 0x4527fe
mov dword [ebp - 0xd8], ebx
cmp esi, 0x1f
je 0x452808
cmp esi, 0x20
jne 0x45280e
mov dword [ebp - 0x100], ebx
cmp esi, 0x21
je 0x452818
cmp esi, 0x22
jne 0x45281e
mov dword [ebp - 0xe0], ebx
cmp esi, 0x23
je 0x452828
cmp esi, 0x24
jne 0x45282e
mov dword [ebp - 0xf8], ebx
cmp esi, 0x2c
jne 0x45283f
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x4527b3
cmp esi, 0x2d
je 0x45285a
cmp esi, 0x2e
jne 0x452855
mov dword [ebp - 0x108], ebx
inc esi
jmp 0x4527b3
cmp esi, 0x3d
jne 0x45285d
mov dword [ebp - 0x58], ebx
inc esi
jmp 0x4527b3
mov ecx, dword [0xd8a438]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0x1dc], 0
call fcn.004a6bb0
mov edx, dword [0xd8a438]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x1c4], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x1c]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x4528a9
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x54], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x45257e
mov eax, dword [eax]
test eax, eax
je 0x452f99
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x452933
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xca0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1438]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x1438]
jmp 0x4529b3
mov ecx, dword [0xd8a438]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45296a
xor edx, edx
lea eax, [ebp - 0xca0]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x4529b3
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xca0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1458]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x1458]
push str.SetupCopyOEMInf
push ebx
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x4529d0
mov dword [ebp - 0x1c0], edi
push str.WTSEnumerateSessions
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4529e5
mov dword [ebp - 0x74], edi
xor esi, esi
cmp esi, 0x69
jge 0x452ed6
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x452ed0
cmp esi, 0x45
jne 0x452ab5
lea edx, [ebp - 0x14d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x14d8]
lea ecx, [ebp - 0x710]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x710]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x452a7a
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0xc48]
push eax
push 0x5153f4
push ecx
jmp 0x452a8d
lea edx, [ebp - 0x310]
lea eax, [ebp - 0xc48]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x452ac2
mov dword [ebp - 0x80], edi
inc esi
jmp 0x4529e7
cmp esi, edi
jne 0x452ad2
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x4529e7
cmp esi, 2
je 0x452ed0
cmp esi, 4
jne 0x452aec
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x4529e7
cmp esi, 5
jne 0x452afd
mov dword [ebp - 0x190], edi
inc esi
jmp 0x4529e7
cmp esi, 6
jne 0x452b0e
mov dword [ebp - 0x140], edi
inc esi
jmp 0x4529e7
cmp esi, 7
jne 0x452b1f
mov dword [ebp - 0x198], edi
inc esi
jmp 0x4529e7
cmp esi, 8
jne 0x452b30
mov dword [ebp - 0x1a8], edi
inc esi
jmp 0x4529e7
cmp esi, 9
jne 0x452b41
mov dword [ebp - 0x124], edi
inc esi
jmp 0x4529e7
cmp esi, 0xa
jne 0x452b52
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x4529e7
cmp esi, 0xb
jne 0x452b63
mov dword [ebp - 0xec], edi
inc esi
jmp 0x4529e7
jle 0x452b70
cmp esi, 0xf
jge 0x452b73
mov dword [ebp - 0xd4], edi
cmp esi, 0xf
jne 0x452b81
mov dword [ebp - 0x154], edi
inc esi
jmp 0x4529e7
jle 0x452b8e
cmp esi, 0x12
jge 0x452b8e
mov dword [ebp - 0x10c], edi
cmp esi, 0x1b
jne 0x452b9f
mov dword [ebp - 0x158], edi
inc esi
jmp 0x4529e7
cmp esi, 0x1c
jne 0x452bb0
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4529e7
cmp esi, 0x1d
je 0x452bbf
cmp esi, 0x1e
je 0x452bbf
cmp esi, 0x39
jne 0x452bc5
mov dword [ebp - 0xd8], edi
cmp esi, 0x1f
je 0x452bcf
cmp esi, 0x20
jne 0x452bd5
mov dword [ebp - 0x100], edi
cmp esi, 0x21
je 0x452bdf
cmp esi, 0x22
jne 0x452be5
mov dword [ebp - 0xe0], edi
cmp esi, 0x23
je 0x452bef
cmp esi, 0x24
jne 0x452bf5
mov dword [ebp - 0xf8], edi
cmp esi, 0x25
je 0x452bff
cmp esi, 0x26
jne 0x452c05
mov dword [ebp - 0x168], edi
cmp esi, 0x27
jne 0x452c16
mov dword [ebp - 0x160], edi
inc esi
jmp 0x4529e7
cmp esi, 0x28
jne 0x452c27
mov dword [ebp - 0x114], edi
inc esi
jmp 0x4529e7
cmp esi, 0x29
jne 0x452c38
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x4529e7
cmp esi, 0x2c
jne 0x452c49
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x4529e7
cmp esi, 0x2d
jne 0x452c57
mov dword [ebp - 0x58], edi
inc esi
jmp 0x4529e7
cmp esi, 0x2e
jne 0x452c68
mov dword [ebp - 0x108], edi
inc esi
jmp 0x4529e7
cmp esi, 0x2f
jne 0x452c79
mov dword [ebp - 0x14c], edi
inc esi
jmp 0x4529e7
cmp esi, 0x30
jne 0x452c8a
mov dword [ebp - 0x134], edi
inc esi
jmp 0x4529e7
cmp esi, 0x31
jne 0x452c9b
mov dword [ebp - 0x110], edi
inc esi
jmp 0x4529e7
cmp esi, 0x32
jne 0x452cac
inc esi
jmp 0x4529e7
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x50], ecx
jne 0x452eea
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x200], edi
jne 0x452ef8
inc dword [ebp - 0xac]
cmp dword [ebp - 0x208], edi
jne 0x452f06
inc dword [ebp - 0x120]
cmp dword [ebp - 0x1f4], edi
jne 0x452f14
inc dword [ebp - 0xf4]
cmp dword [ebp - 0x1ec], edi
jne 0x452f22
inc dword [ebp - 0x1bc]
cmp dword [ebp - 0x1fc], edi
jne 0x452f30
inc dword [ebp - 0x1e8]
cmp dword [ebp - 0x50], 0x1388
jg 0x452f99
mov esi, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x2c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x1dc], esi
mov esi, dword [ebp - 0x1c4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x2c], ecx
mov eax, ecx
jmp 0x4528c8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov esi, dword [ebp - 0x18c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x150], eax
mov ebx, 1
jmp 0x4525b7
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x54], ebx
mov ecx, dword [ebp - 0x1c4]
cmp bx, word [ecx + 2]
jae 0x45318f
xor edx, edx
push str..asp
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], edx
mov byte [ebp - 0x90], dl
mov eax, dword [edi]
mov dword [ebp - 0x98], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x98]
mov dword [ebp - 0x94], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x453061
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x98]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45307c
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x98]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x453097
mov dword [ebp - 0x48], esi
lea edx, [ebp - 0x98]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4530b2
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x98]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4530cd
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x98]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4530e8
mov dword [ebp - 0x48], esi
lea edx, [ebp - 0x98]
push str.upx0
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x453103
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x98]
push str.upx1
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x45311e
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x98]
push 0x50dc3c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x45313c
inc dword [ebp - 0x184]
mov esi, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x54]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x54], eax
jg 0x45318f
add edi, 0x28
inc ebx
jmp 0x45300c
mov dword [ebp - 4], 2
mov ebx, 1
mov edx, dword [0xd8a438]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x4531d9
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 3
push 0xd8a430
call fcn.004a6b50
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, ebx
jne 0x45320b
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xdc]
xor esi, esi
mov dword [ebp - 0x1c], edi
cmp eax, esi
jne 0x453c1f
cmp edi, ebx
jge 0x453c1f
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 0x30], esi
push ecx
call fcn.004f2beb
jmp 0x453250
lea edx, [ebp - 0xea0]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0xc48]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x453281
push ebx
lea ecx, [ebp - 0x6d8]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x4532ab
lea ecx, [ebp - 0xc48]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x4532bf
lea edx, [ebp - 0x610]
push str.c:endpcachemonitor_procPath5.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x6d8]
push eax
push ebx
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp - 0x54], esi
call fcn.004f0727
mov ecx, dword [ebp - 0x6d8]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x6d4]
cmp dword [eax + 0x30], 0xffffffff
jne 0x453311
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
jmp 0x45353a
mov edi, dword [ebp - 0x6d4]
push 0xa
lea eax, [ebp - 0xa10]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 0x6d4], edi
call fcn.004f0ae9
lea edi, [ebp - 0xa10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x453b96
lea ecx, [ebp - 0xa10]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45336e
mov dword [ebp - 0x1d0], ebx
lea edx, [ebp - 0xa10]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x453390
push 0x5147b4
jmp 0x45353a
lea eax, [ebp - 0xa10]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x453b96
lea ecx, [ebp - 0xa10]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x453b96
lea edx, [ebp - 0xa10]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x453b96
lea eax, [ebp - 0xa10]
push str.SetupCopyOEMInf
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x453407
mov dword [ebp - 0x1c0], ebx
jmp 0x453b96
lea ecx, [ebp - 0xa10]
push str.WTSEnumerateSessions
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x453427
mov dword [ebp - 0x74], ebx
jmp 0x453b96
lea edx, [ebp - 0xa10]
push str.PBVM90.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x45344a
mov dword [ebp - 0x1a0], ebx
jmp 0x453b96
cmp dword [ebp - 0xb0], ebx
jne 0x453455
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x6c], ebx
jne 0x45345d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x64], ebx
jne 0x453468
inc dword [ebp - 0x8c]
xor ebx, ebx
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x453b8a
lea eax, [esi + esi*2]
lea ecx, [ebp - 0xa10]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, ebx
je 0x453b84
mov ecx, dword [ebp - 0x180]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x180], ecx
jne 0x453571
lea edx, [ebp - 0x14d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x14d8]
lea ecx, [ebp - 0x16d8]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x16d8]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, ebx
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x453518
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x12a0]
push edx
push 0x5153f4
push eax
jmp 0x45352b
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x12a0]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x12a0]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x6c4]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x6c4]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x453648
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x30], edx
jle 0x453598
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa10]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa10]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa10]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4535e1
test ebx, ebx
jne 0x4535e1
test eax, eax
mov dword [ebp - 0x6c], ebx
je 0x4535e8
mov dword [ebp - 0x6c], 1
lea ecx, [ebp - 0xa10]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa10]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa10]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x453713
test ebx, ebx
jne 0x453713
test eax, eax
jne 0x453713
mov dword [ebp - 0x64], eax
mov edi, 1
inc esi
jmp 0x453471
cmp esi, 0x1a
jne 0x453727
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x30], edx
jle 0x45366f
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa10]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa10]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa10]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4536b8
test ebx, ebx
jne 0x4536b8
test eax, eax
mov dword [ebp - 0x6c], ebx
je 0x4536bf
mov dword [ebp - 0x6c], 1
lea ecx, [ebp - 0xa10]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xa10]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xa10]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x453713
test ebx, ebx
jne 0x453713
test eax, eax
jne 0x453713
mov dword [ebp - 0x64], eax
mov edi, 1
inc esi
jmp 0x453471
xor ebx, ebx
mov dword [ebp - 0x64], 1
mov edi, 1
inc esi
jmp 0x453471
cmp esi, 0x2a
je 0x453731
cmp esi, 0x2b
jne 0x453749
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
inc esi
jmp 0x453471
cmp esi, ebx
jne 0x453756
mov dword [ebp - 0x80], edi
inc esi
jmp 0x453471
cmp esi, edi
jne 0x453766
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x453471
cmp esi, 2
je 0x453b84
cmp esi, 4
jne 0x453780
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x453471
cmp esi, 5
jne 0x453791
mov dword [ebp - 0x190], edi
inc esi
jmp 0x453471
cmp esi, 6
jne 0x4537a2
mov dword [ebp - 0x140], edi
inc esi
jmp 0x453471
cmp esi, 7
jne 0x4537b3
mov dword [ebp - 0x198], edi
inc esi
jmp 0x453471
cmp esi, 8
jne 0x4537c4
mov dword [ebp - 0x1a8], edi
inc esi
jmp 0x453471
cmp esi, 9
jne 0x4537d5
mov dword [ebp - 0x124], edi
inc esi
jmp 0x453471
cmp esi, 0xa
jne 0x4537e6
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x453471
cmp esi, 0xb
jne 0x4537f7
mov dword [ebp - 0xec], edi
inc esi
jmp 0x453471
jle 0x453804
cmp esi, 0xf
jge 0x453807
mov dword [ebp - 0xd4], edi
cmp esi, 0xf
jne 0x453815
mov dword [ebp - 0x154], edi
inc esi
jmp 0x453471
jle 0x453822
cmp esi, 0x12
jge 0x453822
mov dword [ebp - 0x10c], edi
cmp esi, 0x11
jle 0x45382f
cmp esi, 0x19
jge 0x45382f
mov dword [ebp - 0x48], edi
cmp esi, 0x1b
jne 0x453840
mov dword [ebp - 0x158], edi
inc esi
jmp 0x453471
cmp esi, 0x1c
jne 0x453851
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x453471
cmp esi, 0x1d
je 0x453860
cmp esi, 0x1e
je 0x453860
cmp esi, 0x39
jne 0x453866
mov dword [ebp - 0xd8], edi
cmp esi, 0x1f
je 0x453870
cmp esi, 0x20
jne 0x453876
mov dword [ebp - 0x100], edi
cmp esi, 0x21
je 0x453880
cmp esi, 0x22
jne 0x453886
mov dword [ebp - 0xe0], edi
cmp esi, 0x23
je 0x453890
inc esi
jmp 0x453471
mov eax, dword [ebp - 0x54]
mov ebx, 1
inc eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x6d8]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x6d0], 1
je 0x453311
lea ecx, [ebp - 0x6d8]
call fcn.004f076e
mov eax, dword [ebp - 0x2c]
mov ecx, 5
cmp eax, ecx
jle 0x453bc9
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x453bd5
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x13c]
test edx, edx
jne 0x453bea
cmp eax, 6
jle 0x453bea
sub eax, 6
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x8c]
cmp eax, ecx
jle 0x453bfc
sub eax, ecx
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x6c4]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x6c4]
call fcn.004f05fb
mov eax, dword [ebp - 0xdc]
mov edi, dword [ebp - 0x50]
cmp dword [ebp + 8], 5
jne 0x453d35
test edi, edi
jne 0x453d37
test eax, eax
jle 0x453e0a
mov esi, dword [ebp - 0x44]
cmp esi, 0xc800
jge 0x453e0d
cmp esi, 0x400
jle 0x453e0d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x610]
push eax
call esi
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea edx, [ebp - 0x610]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x610]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x610]
push ecx
call esi
test eax, eax
jne 0x453cd5
lea edx, [ebp - 0x610]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea eax, [ebp - 0x610]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x515b34
jmp 0x453ce0
lea edx, [ebp - 0x510]
mov edi, 0x5159c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56c98]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xe56d20]
inc ecx
inc eax
mov dword [0xe56d20], ecx
lea ecx, [ebp - 0x510]
push ecx
mov dword [0xe56c98], eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x453e0a
cmp edi, 0xa
jge 0x453e0a
mov ecx, dword [ebp - 0x184]
test ecx, ecx
jle 0x453e0a
dec eax
cmp ecx, eax
jg 0x453d5f
jne 0x453e0a
mov esi, dword [ebp - 0x44]
cmp esi, 0xa000
jge 0x453e0d
cmp esi, 0x400
jle 0x453e0d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x610]
push edx
call esi
lea eax, [ebp - 0x610]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea ecx, [ebp - 0x610]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x610]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x610]
push eax
call esi
test eax, eax
jne 0x453cd5
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea edx, [ebp - 0x610]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x515b34
jmp 0x453ce0
mov esi, dword [ebp - 0x44]
cmp dword [ebp - 0xe4], 3
jle 0x453e4f
lea edx, [ebp - 0x10a0]
push 0x520950
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x453e4f
lea eax, [ebp - 0x10a0]
push str.:Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x453e4f
mov dword [ebp - 0x18], 0
jmp 0x453e5a
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x45402f
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x45402f
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x45402f
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x11a0]
push edx
lea ecx, [ebp - 0xea0]
push eax
lea edx, [ebp - 0x10a0]
push ecx
push edx
call fcn.004cb380
mov eax, dword [ebp - 0x9c]
add esp, 0x14
cmp eax, ebx
jne 0x453f8b
cmp dword [ebp - 0x4c], 7
jge 0x453f8b
cmp edi, 0x1a
jge 0x453f8b
mov eax, dword [ebp - 0xec]
test eax, eax
jne 0x453f8b
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x453f8b
lea eax, [edi + edi*4]
shl eax, 0xb
cmp esi, eax
jle 0x453f8b
cmp dword [ebp - 0x3c], ebx
jne 0x453f8b
cmp dword [ebp - 0x24], ebx
jge 0x453f8b
cmp dword [ebp - 0x1c8], ebx
jne 0x453f8b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x610]
push ecx
call esi
lea edx, [ebp - 0x610]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea eax, [ebp - 0x610]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x610]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x610]
push edx
call esi
test eax, eax
jne 0x453cd5
lea eax, [ebp - 0x610]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x510]
mov edi, 0x515b34
jmp 0x453ce0
lea edx, [ebp - 0x910]
xor esi, esi
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x453fa3
mov esi, 1
cmp dword [ebp - 0x3c], 1
jne 0x45402f
cmp esi, 1
jne 0x45402f
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x610]
push eax
call esi
lea ecx, [ebp - 0x610]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea edx, [ebp - 0x610]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x610]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x610]
push ecx
call esi
test eax, eax
jne 0x453cd5
lea edx, [ebp - 0x610]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x453cd5
lea eax, [ebp - 0x610]
push eax
jmp 0x453df2
mov eax, dword [ebp - 0xec]
mov edi, 1
cmp eax, edi
mov dword [ebp - 0x5c], 0
jne 0x4540e5
mov edi, 0x515b20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jge 0x4540a8
cmp dword [ebp - 0x44], 0x4b000
jle 0x4540e0
push 0x515b0c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0x510]
push eax
push 0x515af0
push ecx
call fcn.004f175f
lea edx, [ebp - 0x510]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
cmp dword [ebp - 0x1ac], edi
jne 0x454176
mov ecx, dword [ebp - 0x24]
cmp ecx, edi
jge 0x454121
mov esi, dword [ebp - 0x44]
cmp esi, 0x4b000
jle 0x45417c
push 0x515adc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], edi
jne 0x45413b
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0x510]
push eax
push 0x515ac4
push ecx
jmp 0x45414e
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515aa8
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
cmp esi, 0x32000
jle 0x4543a4
mov edx, dword [ebp - 0xac]
mov ebx, dword [ebp - 0x4c]
cmp edx, 0x64
jle 0x45419e
cmp ebx, 0x64
jmp 0x454280
cmp ebx, 0x64
jle 0x4542ba
cmp esi, 0x3e800
jle 0x4541eb
cmp ecx, edi
jle 0x4541eb
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 0x50
jle 0x454230
cmp esi, 0x37000
jle 0x454230
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x70800
jle 0x454270
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x64000
jle 0x4542ba
mov eax, dword [ebp - 0x1bc]
test eax, eax
jle 0x4542ba
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, edi
jle 0x45430f
cmp dword [ebp - 0xf4], 0x96
jle 0x45435b
cmp dword [ebp - 0x50], 0x12c
jle 0x45430f
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xf4], 0x96
jle 0x45435b
cmp esi, 0x64000
jle 0x45435b
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x50], 0x15e
jle 0x4543ad
cmp esi, 0x64000
jle 0x4543ad
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x60]
test eax, eax
jle 0x4544cb
cmp eax, edi
jle 0x4543f4
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x68]
cmp eax, 0x400
jbe 0x4544cb
add eax, esi
cmp eax, 0x64000
jle 0x454443
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x3c
jle 0x454487
cmp eax, 0x4b000
jle 0x454487
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x64
jle 0x4544cb
cmp eax, 0x32000
jle 0x4544cb
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xcc], 0x16
jle 0x45450c
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a74
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x118], edi
jne 0x4545a2
test ecx, ecx
jle 0x454554
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a8c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc8], edi
jne 0x4545a2
cmp dword [ebp - 0x88], 2
jle 0x4545a2
cmp ebx, 0x28
jle 0x4545a2
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a8c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1b4], edi
jne 0x45460c
cmp ecx, edi
jge 0x4545d4
cmp esi, 0x4b000
jle 0x45460c
push 0x515a5c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515a3c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x510]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x170], edi
jne 0x45463a
cmp esi, 0x57800
jle 0x45463a
push 0x515a2c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x120], 0x8c
jg 0x45464f
cmp edx, 0x64
jle 0x454738
mov eax, dword [ebp - 0x1b0]
cmp ecx, edi
jge 0x4546d3
cmp eax, edi
push 0x514ba8
jne 0x454670
lea edx, [ebp - 0x510]
push 0x520934
push edx
jmp 0x45467c
lea eax, [ebp - 0x510]
push 0x515aa8
push eax
call fcn.004f175f
mov eax, dword [ebp - 0xfc]
add esp, 0xc
cmp eax, edi
jne 0x4546a7
push 0x514ba8
lea ecx, [ebp - 0x510]
push 0x520910
push ecx
call fcn.004f175f
add esp, 0xc
cmp esi, 0x4b000
jle 0x454738
lea edx, [ebp - 0x510]
push edx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, edi
jne 0x4546ec
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0x510]
push eax
push 0x520934
push ecx
jmp 0x4546ff
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x510]
push edx
push 0x515aa8
push eax
call fcn.004f175f
mov eax, dword [ebp - 0xfc]
add esp, 0xc
cmp eax, edi
jne 0x45472c
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x520910
push edx
call fcn.004f175f
add esp, 0xc
cmp esi, 0x28000
jg 0x456755
cmp dword [ebp - 0xc0], edi
jne 0x45478d
cmp esi, 0xc800
jle 0x45478d
cmp ebx, 0x3c
jle 0x45478d
cmp dword [0xe56be4], edi
jne 0x45478d
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x516174
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc8], edi
jne 0x454846
lea ecx, [ebp - 0xea0]
push str.WiseCustom
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4547ec
cmp esi, 0x64
jle 0x4547ec
cmp ebx, 0x19
jle 0x4547ec
lea edx, [ebp - 0x510]
push 0x5208e8
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x128], edi
jne 0x454846
cmp dword [ebp - 0x178], edi
jne 0x454846
cmp dword [ebp - 0x130], edi
jne 0x454846
cmp ebx, 0x19
jle 0x454846
cmp esi, 0x64
jle 0x454846
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x515a74
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1a0], edi
jne 0x454917
lea ecx, [ebp - 0x310]
push 0x5208e0
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x45499e
lea edx, [ebp - 0x310]
push str.sybase
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x45499e
lea eax, [ebp - 0x1120]
push str.PowerBuilder
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4548da
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x515a74
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x1e
jle 0x454917
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x515a74
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x88], 2
jle 0x454977
cmp esi, 0xa000
jg 0x45492d
cmp ebx, 0x28
jle 0x454977
mov eax, dword [ebp - 0xa0]
test eax, eax
jg 0x45493f
cmp dword [ebp - 0xa4], edi
jle 0x454977
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x515a74
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x64
jle 0x4549d6
cmp dword [ebp - 0xac], 0x50
jle 0x4549d6
cmp dword [ebp - 0x50], 0xc8
jle 0x4549d6
cmp esi, 0x32000
jle 0x4549d6
cmp dword [ebp - 0x138], edi
jne 0x4549d6
lea ecx, [ebp - 0x310]
lea edx, [ebp - 0x510]
push ecx
push 0x515a74
push edx
call fcn.004f175f
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x8c], 3
jle 0x454a02
cmp dword [ebp - 0x20], edi
je 0x454a02
push 0x515350
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x180]
mov byte [ebp - 0x510], 0
cmp eax, edi
mov dword [ebp + 8], 0
jle 0x454a49
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
jmp 0x454a4c
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x140], 1
jne 0x454a85
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], 1
jne 0x454ac5
mov edi, 0x5208b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x910]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x454b11
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov al, byte [ebp - 0xea0]
mov dword [ebp - 0xc0], 0
cmp al, 0x30
je 0x454b4d
cmp al, 0x31
je 0x454b4d
cmp al, 0x32
je 0x454b4d
cmp al, 0x33
je 0x454b4d
cmp al, 0x34
je 0x454b4d
cmp al, 0x35
je 0x454b4d
cmp al, 0x36
je 0x454b4d
cmp al, 0x37
je 0x454b4d
cmp al, 0x38
je 0x454b4d
cmp al, 0x39
jne 0x454bd4
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x204]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, 5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc0], ecx
jne 0x454bca
mov al, byte [ebp - 0xe9f]
cmp al, 0x30
je 0x454bc5
cmp al, 0x31
je 0x454bc5
cmp al, 0x32
je 0x454bc5
cmp al, 0x33
je 0x454bc5
cmp al, 0x34
je 0x454bc5
cmp al, 0x35
je 0x454bc5
cmp al, 0x36
je 0x454bc5
cmp al, 0x37
je 0x454bc5
cmp al, 0x38
je 0x454bc5
cmp al, 0x39
jne 0x454bd9
mov dword [ebp - 0x18], ecx
jmp 0x454bd9
cmp eax, 4
jne 0x454bd9
mov dword [ebp - 0x18], ecx
jmp 0x454bd9
mov ecx, 1
cmp dword [ebp - 0x1d4], ecx
jne 0x454c1d
mov edi, 0x5208ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x1c0], ecx
jne 0x454c5b
lea eax, [ebp - 0xea0]
push str.AegisI5.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x454c5b
push 0x516100
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x148]
mov esi, 1
cmp eax, esi
jne 0x454cb0
cmp dword [ebp - 0x7c], esi
jne 0x454cb0
cmp dword [ebp - 0x188], esi
jne 0x454cb0
mov edi, 0x5208a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x74], esi
jne 0x454ceb
lea eax, [ebp - 0xea0]
push str.wltrysvc.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x454ceb
push str.Broadcom
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1a8], esi
jne 0x454d28
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xb4], esi
jne 0x454d69
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x158], esi
jne 0x454daa
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x190], esi
je 0x454dba
cmp dword [ebp - 0x160], esi
jne 0x454def
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x1b8], esi
jne 0x454e30
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x168], esi
jne 0x454e6d
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x198], esi
jne 0x454eaa
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x80], esi
jne 0x454ee8
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x114], esi
jne 0x454f30
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x11c], esi
jne 0x454f71
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x510]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov esi, 1
cmp dword [ebp - 0x124], esi
jne 0x454fb2
lea eax, [ebp - 0x510]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret