Function at 0x4c71e0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f79d1
mov eax, dword fs:[0]
push eax
mov eax, 0x17e4
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x17e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x17f8]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x1800], ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 1
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 2
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 3
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 4
push 0x5027e0
lea eax, [esp + 0x180c]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x1800], 5
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1800], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [0x103a97c]
cmp eax, 0x555
je 0x4c72c5
cmp eax, 0x55
je 0x4c72c5
cmp eax, 0x51
jne 0x4c72d9
mov edx, dword [esp + 0x24]
push edx
push str.ScanDisk__s_
push 1
call fcn.0043d500
add esp, 0xc
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xb4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [esp + 0x40], edi
cmp edi, 0xffffffff
jne 0x4c7351
mov eax, dword [0x103a97c]
cmp eax, 0x555
je 0x4c7311
cmp eax, 0x55
je 0x4c7311
cmp eax, 0x51
jne 0x4c7f12
lea edx, [esp + 0x1c]
push edx
call fcn.00491540
mov byte [esp + 0x1804], 6
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push str.PASS_scan_FindFirstFile_INVALID_HANDLE_VALUE__s___s_
push 1
call fcn.0043d500
add esp, 0x14
mov byte [esp + 0x1800], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4c7f12
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [ecx]
inc ebp
test dword [0x1038f38], 0x80000000
mov dword [esp + 0x1c], ebp
je 0x4c7396
call fcn.004b27b0
test al, al
je 0x4c73b3
lea ebx, [ebx]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004b27b0
test al, al
jne 0x4c7380
jmp 0x4c73b3
mov eax, 0xcccccccd
mul ebp
shr edx, 3
lea edx, [edx + edx*4]
add edx, edx
mov eax, ebp
sub eax, edx
jne 0x4c73b3
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0xe0], 0x24
jne 0x4c7404
mov eax, dword [0x103a97c]
cmp eax, 0x555
je 0x4c73d8
cmp eax, 0x55
je 0x4c73d8
cmp eax, 0x51
je 0x4c73d8
cmp eax, 0x76
jne 0x4c73f7
mov edx, dword [esp + 0x1808]
lea ecx, [esp + 0xe0]
push ecx
push edx
push str.PASS_scan____s_s_
push 1
call fcn.0043d500
add esp, 0x10
lea eax, [esp + 0xb4]
push eax
jmp 0x4c7f00
push 0x4ff418
lea ecx, [esp + 0x180c]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.00402a60
mov byte [esp + 0x180c], 7
lea ecx, [esp + 0xec]
push ecx
push eax
lea edx, [esp + 0x64]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0x1800], 8
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1800], 7
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 4
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test byte [esp + 0xb4], 0x10
je 0x4c75ed
cmp byte [esp + 0xe0], 0x2e
jne 0x4c7495
lea eax, [esp + 0xb4]
push eax
jmp 0x4c7f00
push 0x4ff418
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x1800], 9
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1800], 4
lea ecx, [esp + 0x58]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [0x10da072], 0
jne 0x4c74f8
mov eax, dword [esp + 0x30]
push eax
push 0x10d59d0
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4c74f8
mov byte [0x10da072], 1
cmp byte [0x10d7c6f], 0
je 0x4c754a
mov ecx, dword [esp + 0x1814]
mov edx, dword [esp + 0x1810]
mov eax, dword [esp + 0x180c]
push 1
push ecx
push edx
push eax
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x1814], 0xa
mov byte [esp + 0x1814], 4
call fcn.004c71e0
add esp, 0x14
jmp 0x4c7ef8
cmp byte [0x10d7c6e], 0
jne 0x4c756f
test dword [0x10430dc], 0x8000
jne 0x4c756f
cmp dword [0x10d7c4c], 0xff75
jne 0x4c7ef8
cmp byte [esp + 0xe0], 0x2e
je 0x4c7ef8
mov eax, dword [esp + 0x14]
push 0x103a370
push eax
call ebx
test eax, eax
jne 0x4c7ef8
mov ecx, dword [esp + 0x14]
push 0x103a570
push ecx
call ebx
test eax, eax
jne 0x4c7ef8
mov edx, dword [esp + 0x1814]
mov ecx, dword [esp + 0x180c]
push eax
mov eax, dword [esp + 0x1814]
push edx
push eax
push ecx
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x1814], 0xb
mov byte [esp + 0x1814], 4
call fcn.004c71e0
add esp, 0x14
jmp 0x4c7ef8
cmp byte [0x10da072], 0
jne 0x4c7614
mov eax, dword [esp + 0x14]
push eax
push 0x10d59d0
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4c7614
mov byte [0x10da072], 1
xor ebp, ebp
mov dword [esp + 0x20], ebp
cmp dword [esp + 0x1818], ebp
jne 0x4c76a6
cmp byte [0x10d7c6e], 0
je 0x4c76a6
cmp byte [0x10da072], 0
je 0x4c76a6
mov ecx, dword [esp + 0x14]
push str.Recycle.Bin
push ecx
call ebx
test eax, eax
jne 0x4c76a6
mov edx, dword [esp + 0x14]
push str..tmp
push edx
call ebx
test eax, eax
jne 0x4c76a6
mov eax, dword [esp + 0x14]
push str..lnk
push eax
call ebx
test eax, eax
jne 0x4c76a6
cmp byte [esp + 0x180c], al
je 0x4c7683
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004987c0
add esp, 4
test al, al
jne 0x4c769d
cmp byte [esp + 0x1810], 0
je 0x4c76a6
mov edx, dword [esp + 0x14]
push 0x104fa76
push edx
call ebx
test eax, eax
je 0x4c76a6
mov ebp, 1
mov dword [esp + 0x20], ebp
cmp byte [0x10d7c6f], 0
je 0x4c775c
mov eax, dword [esp + 0x14]
push str.Recycle.Bin
push eax
call ebx
test eax, eax
jne 0x4c775c
mov ecx, dword [esp + 0x14]
push str..exe
push ecx
call ebx
mov edx, dword [esp + 0x14]
mov ecx, edx
mov esi, eax
lea edi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c76e0
sub ecx, edi
lea eax, [ecx + edx - 4]
cmp esi, eax
jne 0x4c76fa
mov ebp, 2
mov dword [esp + 0x20], ebp
push str..com
push edx
call ebx
mov edx, dword [esp + 0x14]
mov ecx, edx
mov esi, eax
lea edi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7710
sub ecx, edi
lea ecx, [ecx + edx - 4]
cmp esi, ecx
jne 0x4c772a
mov ebp, 2
mov dword [esp + 0x20], ebp
push str..scr
push edx
call ebx
mov edx, dword [esp + 0x14]
mov ecx, edx
mov esi, eax
lea edi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7740
sub ecx, edi
lea eax, [ecx + edx - 4]
cmp esi, eax
jne 0x4c7760
mov ebp, 2
mov dword [esp + 0x20], ebp
jmp 0x4c7760
mov edx, dword [esp + 0x14]
mov eax, dword [0x10430dc]
test eax, 0x8000
je 0x4c77a9
cmp dword [0x10d7c4c], 0xff75
je 0x4c7bfd
and eax, 0x10000
jne 0x4c7bc6
cmp byte [esp + 0x1810], al
jne 0x4c7bd4
push edx
call fcn.00498940
add esp, 4
test al, al
jne 0x4c7bf9
mov edx, dword [esp + 0x14]
mov eax, dword [0x103a97c]
cmp eax, 0x55
je 0x4c77bd
cmp eax, 0x51
je 0x4c77bd
cmp eax, 0x76
jne 0x4c7814
push 0x104fa76
push edx
mov esi, edx
call ebx
movzx ecx, byte [esp + 0x1810]
push eax
push ecx
push esi
call fcn.004987c0
movzx ecx, byte [0x10da072]
add esp, 4
movzx edx, al
movzx eax, byte [esp + 0x1814]
push edx
movzx edx, byte [0x10d7c6e]
push eax
mov eax, dword [esp + 0x1828]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
push ebp
push ecx
push str.fname__s_bOKTarget__d_bOnlySvrAgent__d_g_bGoBackUp1st__d_g_bScanFoundB4__d_isTargetAllDrv__d_isTargetRansom__d_isTargetSpecFolder__d_StrStrI_fname__theApp.m_Config.Client.tc_BackUpFolder___d_
push 1
call fcn.0043d500
add esp, 0x2c
test ebp, ebp
je 0x4c7eea
push 0x1ff
lea edx, [esp + 0x1f9]
push 0
push edx
mov byte [esp + 0x200], 0
call sub.MSVCR90.dll_memset
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.MSVCR90.dll__time64]
lea ecx, [esp + 0xa8]
push ecx
call dword [sym.imp.MSVCR90.dll__localtime64]
add esp, 0x14
test eax, eax
je 0x4c7877
push eax
push str._Y__m__d__H:_M:_S
lea edx, [esp + 0x1fc]
push 0x200
push edx
call dword [sym.imp.MSVCR90.dll_strftime]
add esp, 0x10
push 0x3ff
lea eax, [esp + 0xbf9]
push 0
push eax
mov byte [esp + 0xc00], 0
call sub.MSVCR90.dll_memset
push 0x7ff
lea ecx, [esp + 0x405]
push 0
push ecx
mov byte [esp + 0x40c], 0
call sub.MSVCR90.dll_memset
push 0x7ff
lea edx, [esp + 0x1011]
push 0
push edx
mov byte [esp + 0x1018], 0
call sub.MSVCR90.dll_memset
add esp, 0x24
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 0xc
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 0xd
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
lea eax, [esp + 0x74]
push eax
push 0
push ecx
mov dword [esp + 0x80], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edx, dword [esp + 0x90]
push 1
push 0
push 0
push edx
call fcn.004e0460
mov esi, eax
mov eax, dword [esp + 0x94]
xor ecx, ecx
add esi, eax
mov edi, edx
adc edi, ecx
and ebp, 1
je 0x4c7a21
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
push edi
push esi
push edx
push 1
push 0x200
lea eax, [esp + 0x208]
push eax
lea ecx, [esp + 0x40c]
push str._s_d_d_s_I64d
push ecx
call ebx
mov eax, dword [esp + 0x34]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4c79a5
sub eax, ecx
lea edx, [esp + 0xa0]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.00466670
add esp, 0x10
mov byte [esp + 0x1800], 0xe
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1800], 0xd
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0xbf8]
push 0x501180
push eax
call ebx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x400]
push ecx
push edx
push str.SoftWareTrojanCut_tc_FileB
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x1c
mov ebx, dword [esp + 0x20]
and ebx, 2
je 0x4c7b0b
push 0
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x1808], 0xf
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x180c], 0xd
call fcn.00447e60
add esp, 0xc
mov byte [esp + 0x1800], 0x10
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1800], 0xd
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0xa8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx eax, word [esp + 0x68]
movzx ecx, word [esp + 0x66]
movzx edx, word [esp + 0x64]
push eax
movzx eax, word [esp + 0x66]
push ecx
movzx ecx, word [esp + 0x66]
push edx
movzx edx, word [esp + 0x68]
push eax
push ecx
push edx
lea eax, [esp + 0x20c]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [esp + 0x34]
push ecx
push edi
push esi
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x1024]
push str.0_s_I64d_s
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x38
mov ecx, dword [0x10db8f0]
inc ecx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul edx, edx, 0x64
mov eax, ecx
sub eax, edx
mov dword [0x10db8f0], ecx
jne 0x4c7cc4
push eax
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
push 0x50281c
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edx
call fcn.00409400
mov byte [esp + 0x1800], 0x11
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x1800], 0x12
cmp byte [0x10d7c6f], 0
mov ecx, 0x2710
je 0x4c7b81
mov ecx, 0x7d0
mov eax, dword [0x10db8f0]
imul eax, eax, 0x64
xor edx, edx
div ecx
mov esi, eax
cmp esi, 0x5a
jle 0x4c7c09
cmp esi, 0x64
jge 0x4c7c0e
push 0
lea ecx, [esp + 0x180c]
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x63
je 0x4c7bbf
push 0
lea ecx, [esp + 0x180c]
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x43
jne 0x4c7c09
mov esi, 0x58
jmp 0x4c7c3e
cmp byte [esp + 0x1810], 0
je 0x4c77a9
test eax, eax
je 0x4c77a9
cmp byte [0x1056af2], 0
je 0x4c77a9
push 0x1056af2
push edx
call ebx
test eax, eax
je 0x4c77a5
mov edx, dword [esp + 0x14]
or ebp, 4
mov dword [esp + 0x20], ebp
jmp 0x4c77a9
cmp esi, 0x64
jl 0x4c7c3e
push 0
lea ecx, [esp + 0x180c]
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x63
je 0x4c7c39
push 0
lea ecx, [esp + 0x180c]
call dword [sym.imp.mfc90.dll_Ordinal_899]
mov esi, 0x63
cmp al, 0x43
jne 0x4c7c3e
mov esi, 0x59
mov edx, dword [esp + 0x3c]
push esi
push edx
lea eax, [esp + 0x34]
push str._ss__d__
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov esi, dword [esp + 0x1828]
add esp, 0x10
cmp esi, 2
je 0x4c7c98
mov ecx, dword [esp + 0x2c]
push ecx
push str.tc_ScanTime
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x3c]
push edx
push str.tc_ScanTimePer
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x20
mov byte [esp + 0x1800], 0x11
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 0xd
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [0x10db8f0]
jmp 0x4c7ccb
mov esi, dword [esp + 0x1818]
mov eax, dword [0x103a97c]
cmp eax, 0x55
je 0x4c7cda
cmp eax, 0x51
jne 0x4c7d03
mov eax, dword [esp + 0x14]
mov edx, dword [0x53ee58]
push eax
mov eax, dword [0x53ee3c]
push edx
mov edx, dword [0x53f320]
push eax
push edx
push ecx
push str.j._tAddBackUpList_scan:___d___d__d__d__s
push 1
call fcn.0043d500
add esp, 0x1c
test ebp, ebp
je 0x4c7d5e
cmp dword [0x53f320], 0x2710
jge 0x4c7d5e
push 1
push 0
push ecx
lea eax, [esp + 0x400]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x180c], 0x13
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x5c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x1810], 0x14
mov byte [esp + 0x1810], 0xd
call fcn.004b4740
add esp, 0x10
test ebx, ebx
je 0x4c7e31
mov eax, dword [esp + 0x18]
push 0x51eb30
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4c7dfa
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xff4]
push ecx
push edx
push str.SoftWareTrojanCut_tc_FileSA
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea eax, [esp + 0xff4]
push eax
push ecx
mov ecx, 0x53f2c8
call fcn.0042f720
mov ecx, eax
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [0x103a97c]
cmp eax, 0x55
je 0x4c7dcb
cmp eax, 0x51
jne 0x4c7de4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push eax
push str.GetHashFile_OK:___s___s_
push 1
call fcn.0043d500
add esp, 0x10
cmp esi, 2
jne 0x4c7e31
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push edx
push str.GetHashFile_OK:___s___s_
jmp 0x4c7e27
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push str.GetHashFile_Error__s___s_
push 1
call fcn.0043d500
add esp, 0x10
cmp esi, 2
jne 0x4c7e31
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push eax
push str.GetHashFile_Error:___s___s_
push 8
call fcn.0043d500
add esp, 0x10
test byte [esp + 0x20], 4
je 0x4c7e7c
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Scan
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x1804], 0x15
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x1808], 0x16
mov byte [esp + 0x1808], 0xd
call fcn.00498d60
add esp, 8
cmp byte [esp + 0x1810], 0
jne 0x4c7ec0
cmp esi, 2
je 0x4c7ec0
mov eax, dword [esp + 0x14]
push eax
push str.tc_Scanned
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x24]
push ecx
push str.tc_ScannedPer
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x20
mov byte [esp + 0x1800], 0xc
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 4
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x40]
lea edx, [esp + 0xb4]
push edx
push edi
call esi
test eax, eax
jne 0x4c7360
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x1800], 3
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 2
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 1
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1800], 0
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x1800], 0xffffffff
lea ecx, [esp + 0x1808]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x17f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x17e0]
xor ecx, esp
call fcn.004e0148
add esp, 0x17f0
ret