Function at 0x44f590
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483d1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1b24
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1534]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x954]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 8], ecx
jge 0x44f778
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
push 0x49bbd4
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x3d4]
push str.rundll32.exe
push edx
call fcn.0047bec0
lea eax, [ebp - 0x3d4]
push str.rundll32.
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
jne 0x44f7d5
lea ecx, [ebp - 0x3d4]
push str.RUNDLL32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44f7d5
lea edx, [ebp - 0x3d4]
push str.Rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f865
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x44f835
cmp byte [ebp + eax - 0x5d4], 0x33
jne 0x44f830
cmp byte [ebp + eax - 0x5d3], 0x32
jne 0x44f830
cmp byte [ebp + eax - 0x5d2], 0x2e
je 0x44f835
inc eax
cmp eax, ecx
jl 0x44f812
mov edx, ecx
sub edx, eax
lea ecx, [edx - 7]
test ecx, ecx
jle 0x44f85d
lea eax, [ebp + eax - 0x5cd]
lea edi, [ebp - 0x3d4]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + edx - 0x3db], 0
lea ecx, [ebp - 0x3d4]
push str..dll
push ecx
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x44f885
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x3d4]
push str..DLL
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f8a0
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x3d4]
push str..Dll
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f8bb
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x3d4]
push str..tmp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f8d9
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x3d4]
push str..Tmp
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f8f7
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x3d4]
push str..TMP
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f915
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x3d4]
push str._temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f933
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x3d4]
push str.Temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f951
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x3d4]
push str.TEMP_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f96f
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x3d4]
push str.RECYCLER_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f993
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x94], esi
lea edx, [ebp - 0x3d4]
push str.Documents_and_Settings_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f9b7
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x9c], esi
lea eax, [ebp - 0x3d4]
push str.Program_FilesCommon_Files
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f9d5
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x3d4]
push str.documents_and_settings_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44f9f9
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x9c], esi
lea edx, [ebp - 0x3d4]
push str.program_filescommon_Files
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fa17
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x3d4]
push 0x492024
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44fce6
lea ecx, [ebp - 0x3d4]
push 0x492288
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x44fce6
lea edx, [ebp - 0x3d4]
push str.SystemRoot_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fb2c
lea eax, [ebp - 0x1cc]
push 0x80
push eax
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fad1
mov cl, byte [ebp + eax - 0x4d4]
cmp cl, 0x53
je 0x44fad1
cmp cl, 0x73
je 0x44fad1
inc eax
cmp eax, edx
jl 0x44fabb
sub esi, eax
xor ecx, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fafb
mov ecx, edx
lea esi, [ebp + eax - 0x4ca]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0x5d4], 0
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push str.systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fc09
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fbae
mov cl, byte [ebp + eax - 0x4d4]
cmp cl, 0x53
je 0x44fbae
cmp cl, 0x73
je 0x44fbae
inc eax
cmp eax, edx
jl 0x44fb98
sub esi, eax
xor ecx, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fbd8
mov ecx, edx
lea esi, [ebp + eax - 0x4ca]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0x5d4], 0
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push str.Systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fce6
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fc8b
mov cl, byte [ebp + eax - 0x4d4]
cmp cl, 0x53
je 0x44fc8b
cmp cl, 0x73
je 0x44fc8b
inc eax
cmp eax, edx
jl 0x44fc75
sub esi, eax
xor ecx, ecx
lea edx, [esi - 0xa]
test edx, edx
jle 0x44fcb5
mov ecx, edx
lea esi, [ebp + eax - 0x4ca]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0x5d4], 0
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push 0x48b2f4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fdba
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x44fd5f
cmp byte [ebp + eax - 0x4d4], 0x25
je 0x44fd5f
inc eax
cmp eax, edx
jl 0x44fd50
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x44fd89
mov ecx, edx
lea esi, [ebp + eax - 0x4c8]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp + esi - 0x5d4], 0
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push 0x49bba4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44fe8e
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x44fe33
cmp byte [ebp + eax - 0x4d4], 0x25
je 0x44fe33
inc eax
cmp eax, edx
jl 0x44fe24
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x44fe5d
mov ecx, edx
lea esi, [ebp + eax - 0x4c8]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp + esi - 0x5d4], 0
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push str._windir
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44ff62
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x44ff07
cmp byte [ebp + eax - 0x4d4], 0x25
je 0x44ff07
inc eax
cmp eax, edx
jl 0x44fef8
sub ecx, eax
xor esi, esi
lea edx, [ecx - 8]
test edx, edx
jle 0x44ff31
mov ecx, edx
lea esi, [ebp + eax - 0x4cc]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp + esi - 0x5d4], 0
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3d4]
push 0x49f688
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x450036
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x44ffdb
cmp byte [ebp + eax - 0x4d4], 0x25
je 0x44ffdb
inc eax
cmp eax, edx
jl 0x44ffcc
sub ecx, eax
xor esi, esi
lea edx, [ecx - 8]
test edx, edx
jle 0x450005
mov ecx, edx
lea esi, [ebp + eax - 0x4cc]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp + esi - 0x5d4], 0
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x3d4], al
jle 0x4503c6
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x5d4]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x5d4]
mov byte [ebp - 0x5c6], 0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x450145
lea edx, [ebp - 0x1cc]
push 0x80
push edx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1ca], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x450114
lea eax, [ecx - 0xe]
lea esi, [ebp - 0x4c6]
mov ecx, eax
lea edi, [ebp - 0xbf4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xbf4], 0
lea eax, [ebp - 0xbf4]
lea ecx, [ebp - 0x1cc]
push eax
push ecx
lea edx, [ebp - 0x3d4]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x5d4]
push str.Systemroot
push eax
mov byte [ebp - 0x5ca], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45021d
lea ecx, [ebp - 0x1cc]
push 0x80
push ecx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x4501d5
lea eax, [ecx - 0xa]
lea esi, [ebp - 0x4ca]
mov ecx, eax
lea edi, [ebp - 0xbf4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xbf4], 0
lea eax, [ebp - 0xbf4]
lea ecx, [ebp - 0x1cc]
push eax
push ecx
lea edx, [ebp - 0x3d4]
push str._s_s
push edx
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3d4], al
lea eax, [ebp - 0x5d4]
push str.system32
push eax
mov byte [ebp - 0x5cc], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4502f5
lea ecx, [ebp - 0x1cc]
push 0x80
push ecx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x4502ad
lea eax, [ecx - 8]
lea esi, [ebp - 0x4cc]
mov ecx, eax
lea edi, [ebp - 0xbf4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xbf4], 0
lea eax, [ebp - 0xbf4]
lea ecx, [ebp - 0x1cc]
push eax
push ecx
lea edx, [ebp - 0x3d4]
push str._s_s
push edx
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3d4], al
lea eax, [ebp - 0x5d4]
push str._Windir_
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4503c6
lea ecx, [ebp - 0x1cc]
push 0x80
push ecx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x45037e
lea eax, [ecx - 8]
lea esi, [ebp - 0x4cc]
mov ecx, eax
lea edi, [ebp - 0xbf4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xbf4], 0
lea eax, [ebp - 0xbf4]
lea ecx, [ebp - 0x1cc]
push eax
push ecx
lea edx, [ebp - 0x3d4]
push str._s_s
push edx
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3d4], al
lea eax, [ebp - 0x3d4]
push str..RECYCLER
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4504aa
lea ecx, [ebp - 0x1cc]
push 0x80
push ecx
call ebx
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1ca], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xc]
test esi, esi
jle 0x450446
cmp byte [ebp + eax - 0x4d4], 0x5c
je 0x450446
inc eax
cmp eax, esi
jl 0x450437
mov edx, ecx
xor esi, esi
sub edx, eax
test edx, edx
jle 0x45046f
mov ecx, edx
lea esi, [ebp + eax - 0x4d4]
mov eax, ecx
lea edi, [ebp - 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x1cc]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push str._s_s
push eax
mov byte [ebp + esi - 0x5d4], 0
mov byte [ebp - 0x3d4], 0
call fcn.0047a8f8
add esp, 0x10
mov dword [ebp - 0x94], 1
cmp byte [ebp - 0x3d4], 0x22
jne 0x4504fe
mov esi, dword [ebp + 8]
xor ecx, ecx
test esi, esi
jle 0x4504d5
lea edx, [ebp - 0x13b4]
mov al, byte [ebp + ecx - 0x3d4]
cmp al, 0x22
je 0x4504d0
mov byte [edx], al
inc edx
inc ecx
cmp ecx, esi
jl 0x4504c2
lea edi, [ebp - 0x13b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3d4]
push 0x48b7ec
push ecx
call fcn.0047bec0
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
lea ebx, [edx - 2]
test ebx, ebx
jle 0x450546
cmp byte [ebp + ebx - 0x3d4], 0x3a
jne 0x45053f
cmp byte [ebp + ebx - 0x3d3], 0x5c
je 0x450544
dec ebx
test ebx, ebx
jg 0x45052b
test ebx, ebx
je 0x4505f0
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x13b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
jle 0x45058e
cmp byte [ebp + eax - 0x3d4], 0x2e
je 0x45058e
dec eax
test eax, eax
jg 0x45057f
sub eax, ebx
mov byte [ebp - 0x3d4], 0
lea ecx, [eax + 5]
test ecx, ecx
jle 0x4505bb
lea ebx, [ebp + ebx - 0x13b5]
mov edx, ecx
mov esi, ebx
lea edi, [ebp - 0x3d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x3cf], 0
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
test ebx, ebx
jle 0x4505e8
cmp byte [ebp + ebx - 0x3d4], 0x2e
je 0x4505e8
dec ebx
test ebx, ebx
jg 0x4505d9
mov byte [ebp + ebx - 0x3d0], 0
lea eax, [ebp - 0x9d4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test ebx, ebx
jne 0x4506d7
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45068a
lea edx, [ebp - 0x1cc]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45068a
lea eax, [ebp - 0x1cc]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45068a
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x954]
push ecx
jmp 0x450697
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x9d4]
push ecx
push edx
lea eax, [ebp - 0x3d4]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4506cf
cmp byte [ebp + ecx - 0x3d4], 0x2e
je 0x4506cf
dec ecx
test ecx, ecx
jg 0x4506c0
mov byte [ebp + ecx - 0x3d0], 0
lea ecx, [ebp - 0x3d4]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x3d4]
push eax
call fcn.00429f20
add esp, 8
cmp eax, 1
je 0x4507f9
mov edx, dword [0x65cd64]
test edx, edx
jle 0x450797
shl edx, 8
lea ecx, [ebp - 0x3d4]
lea edx, [edx + 0x62a3e4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4507db
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x3d4]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4507db
push 0x49e7e4
mov dword [0x65cd64], 0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edx
lea edi, [ebp - 0x3d4]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4507db
mov dword [0x65cd64], 0
push 0x49e7e4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3d4]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x3d4]
push str..sys
push edx
mov edi, eax
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x450981
lea eax, [ebp - 0x3d4]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xc74]
mov ebx, eax
lea edx, [ebp - 0xb74]
push ecx
lea eax, [ebp - 0x1cc]
push edx
lea ecx, [ebp - 0x3d4]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0xc74]
lea eax, [ebp - 0xb74]
push edx
lea ecx, [ebp - 0x1cc]
push eax
push ecx
push ebx
lea edx, [ebp - 0x14b4]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1cc]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x450961
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x4d4]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x4d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x4d4], al
lea ecx, [ebp - 0x9d4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x450961
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x450961
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x554]
push eax
lea edx, [ebp - 0x3d4]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x450961
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x14b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x14b4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3d4]
push str..SYS
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x450afb
lea edx, [ebp - 0x3d4]
push edx
call fcn.00428d90
mov ebx, eax
lea eax, [ebp - 0xb74]
lea ecx, [ebp - 0xc74]
push eax
lea edx, [ebp - 0x1cc]
push ecx
lea eax, [ebp - 0x3d4]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0xb74]
lea edx, [ebp - 0xc74]
push ecx
lea eax, [ebp - 0x1cc]
push edx
push eax
push ebx
lea ecx, [ebp - 0x14b4]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1cc]
push 0x491b90
push edx
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x450adb
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x4d4]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x4d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x4d4], al
lea ecx, [ebp - 0x9d4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x450adb
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x450adb
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x554]
push eax
lea edx, [ebp - 0x3d4]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x450adb
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x14b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x14b4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3d4]
push str..Sys
push ecx
call fcn.0047bec0
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x450c77
lea edx, [ebp - 0x3d4]
push edx
call fcn.00428d90
mov ebx, eax
lea eax, [ebp - 0xb74]
lea ecx, [ebp - 0xc74]
push eax
lea edx, [ebp - 0x1cc]
push ecx
lea eax, [ebp - 0x3d4]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0xb74]
lea edx, [ebp - 0xc74]
push ecx
lea eax, [ebp - 0x1cc]
push edx
push eax
push ebx
lea ecx, [ebp - 0x14b4]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1cc]
push 0x491b90
push edx
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x450c57
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x4d4]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x4d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x4d4], al
lea ecx, [ebp - 0x9d4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x450c57
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x450c57
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x554]
push eax
lea edx, [ebp - 0x3d4]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x450c57
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x14b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x14b4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x954]
lea edx, [ebp - 0xd74]
push ecx
push str._swinlogon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3d4]
lea ecx, [ebp - 0xd74]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450cc7
push 0x49bab4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x954]
lea eax, [ebp - 0xd74]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3d4]
lea edx, [ebp - 0xd74]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450d17
push 0x49bab4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x954]
lea ecx, [ebp - 0xd74]
push eax
push str._s_services.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3d4]
lea eax, [ebp - 0xd74]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450d67
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x954]
lea edx, [ebp - 0xd74]
push ecx
push str._slsass.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3d4]
lea ecx, [ebp - 0xd74]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450db7
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x954]
lea eax, [ebp - 0xd74]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3d4]
lea edx, [ebp - 0xd74]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450e07
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x954]
lea ecx, [ebp - 0xd74]
push eax
push str._sctfmon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3d4]
lea eax, [ebp - 0xd74]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450e57
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x954]
lea edx, [ebp - 0xd74]
push ecx
push str._s_rundll32.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3d4]
lea ecx, [ebp - 0xd74]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x450ea7
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x3d4]
push eax
push ecx
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x450eda
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
cmp edx, eax
je 0x450ee5
mov ebx, 1
mov dword [ebp - 0x114], ebx
lea eax, [ebp - 0x1634]
lea ecx, [ebp - 0x6d4]
push eax
lea edx, [ebp - 0x3d4]
push ecx
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.0046de70
movsx esi, ax
lea eax, [ebp - 0xeb4]
lea ecx, [ebp - 0x12b4]
push eax
lea edx, [ebp - 0x3d4]
push ecx
push edx
mov dword [ebp - 0x110], esi
call fcn.00455090
add esp, 0x18
cmp edi, 0x100000
jle 0x450f9c
cmp esi, 1
jge 0x450f5f
cmp edi, 0x200000
jle 0x450f5f
push 0x49f674
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x450f9c
lea eax, [ebp - 0xeb4]
lea ecx, [ebp - 0x6d4]
push eax
push ecx
lea edx, [ebp - 0x8d4]
push 0x49f64c
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x8d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6d4]
push str.Microsoft
push eax
mov dword [ebp - 0x68], 0
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451054
lea edi, [ebp - 0x1634]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x450ff5
lea ecx, [ebp - 0x1634]
push str.Microsoft
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x450ff5
mov dword [ebp - 0x68], 1
jmp 0x451024
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x54], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 1
jne 0x451054
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x54], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Hewlett_Packard
push ecx
mov dword [ebp - 0x14c], 0
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4510c3
mov edi, 0x49f62c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Bidi_User_Mode
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xeb4]
push ecx
call fcn.0047bec0
add esp, 8
mov ebx, 1
test eax, eax
je 0x4510c8
mov dword [ebp - 0x14c], ebx
jmp 0x4510c8
mov ebx, 1
lea edx, [ebp - 0x6d4]
push 0x49b940
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4510fe
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3d4]
push str.32A6Wizard_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451134
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x6d4]
push str.Beijing_Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451177
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Trend_Micro_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4511ba
mov edi, 0x49f60c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Jiangmin_Co
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4511fd
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Symantec_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451240
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Eset
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451283
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Network_Associates
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4512c6
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.McAfee_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451309
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Kingsoft_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45134c
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Panda_Software
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45138f
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6d4]
push str.Kaspersky_Lab
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4513d2
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x954]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9d4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x9d4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1034]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xfb4]
mov byte [ebp - 0xfb2], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebx, ebx
test ecx, ecx
jle 0x451476
lea edx, [ebp + ecx - 0x3d4]
mov al, byte [edx]
cmp al, 0x5c
mov byte [ebp + ebx - 0x1234], al
jne 0x451470
cmp ebx, 2
jge 0x451476
inc ebx
dec edx
cmp ebx, ecx
jl 0x45145e
sub ecx, ebx
cmp ecx, 4
mov dword [ebp + 8], ecx
jge 0x45148e
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x120], eax
test ecx, ecx
jle 0x4514ac
mov eax, ecx
lea esi, [ebp - 0x3d4]
lea edi, [ebp - 0x1834]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1834]
lea edx, [ebp - 0x1034]
push ecx
push edx
mov byte [ebp + esi - 0x1834], 0
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x4514d9
mov dword [ebp - 0x18], edi
xor ecx, ecx
test ebx, ebx
jle 0x45151b
lea edx, [ebp + esi - 0x3d3]
mov esi, dword [ebp - 0xf8]
mov al, byte [ecx + edx]
cmp al, 0x5c
je 0x4514fa
mov byte [ebp + ecx - 0x1234], al
cmp al, 0x2e
jne 0x4514ff
inc esi
cmp al, 0x20
jne 0x451504
inc esi
cmp al, 0x5c
jne 0x451510
mov byte [ebp + ecx - 0x1234], 0
inc ecx
cmp ecx, ebx
jl 0x4514ec
mov dword [ebp - 0xf8], esi
mov al, byte [ebp - 0x1833]
mov byte [ebp + ebx - 0x1234], 0
cmp al, 0x3a
je 0x45154b
push 0x49b790
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x1832], 0x5c
je 0x451562
mov byte [ebp - 0x1832], 0x5c
mov byte [ebp - 0x1831], 0
lea eax, [ebp - 0x3d4]
push 0x100
lea ecx, [ebp - 0xad4]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x1234]
push 0x40
lea eax, [ebp - 0x1934]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x3d4]
push str.LOCALS1Temp
push ecx
call fcn.0047bec0
add esp, 0x20
test eax, eax
je 0x4515aa
mov dword [ebp - 0x5c], edi
lea edx, [ebp - 0x3d4]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4515c5
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x3d4]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4515e0
mov dword [ebp - 0x5c], edi
lea ecx, [ebp - 0x3d4]
push str.Application_Data
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4515fb
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x3d4]
push str.Microsoft_SharedMSINFO
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451616
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x3d4]
push str.Microsoft_SharedMSInfo
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451631
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x3d4]
push str.Documents_and_Settings
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45164c
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x3d4]
push 0x80
lea eax, [ebp - 0xe34]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x3d4]
push 0x80
lea edx, [ebp - 0xf34]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0x9d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x954]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xe34], al
mov byte [ebp + ecx - 0xf34], al
lea eax, [ebp - 0x3d4]
push eax
call fcn.00483565
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x3d4]
push edx
mov dword [ecx], eax
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x28
test eax, eax
jne 0x4516ff
cmp dword [ebp - 0x68], 1
jne 0x451732
push 0x49b774
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x9d4]
lea ecx, [ebp - 0xe34]
push eax
push ecx
mov dword [ebp - 0x3c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x451788
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x451750
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x3d4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, 1
test ecx, ecx
mov dword [ebp - 0x60], ebx
jle 0x45178d
cmp byte [ebp + eax - 0x3d4], 0x5c
jne 0x451779
inc edx
inc eax
cmp eax, ecx
jl 0x45176e
cmp edx, 2
jne 0x45178d
mov dword [ebp - 0x30], ebx
jmp 0x45178d
mov ebx, 1
lea edx, [ebp - 0x954]
lea eax, [ebp - 0xf34]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4517da
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4517d7
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x3d4]
push str.System
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451825
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x451822
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x3c], ebx
lea edx, [ebp - 0x3d4]
push str._system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451870
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45186d
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x3d4]
push str.SYSTEM
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4518bb
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4518b8
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x1234]
push str.smss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea edx, [ebp - 0x1234]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea eax, [ebp - 0x1234]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea ecx, [ebp - 0x1234]
push str.services.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea edx, [ebp - 0x1234]
push str.lsass.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea eax, [ebp - 0x1234]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea ecx, [ebp - 0x1234]
push str.taskmgr.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea edx, [ebp - 0x1234]
push str.spoolsv.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea eax, [ebp - 0x1234]
push 0x48ba7c
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4519bb
lea ecx, [ebp - 0x1234]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4519be
mov dword [ebp - 0x54], ebx
mov esi, 2
xor edi, edi
push 0x62a450
mov dword [ebp - 4], esi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x70], edi
mov dword [ebp + 8], edi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x3d4]
push 0x62a450
push edx
call fcn.004045b0
add esp, 8
test eax, eax
jne 0x451a32
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x3d4]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, ebx
jmp 0x452324
mov edx, dword [0x62a458]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x1d0], eax
mov eax, dword [0x62a458]
push eax
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x108], eax
test eax, eax
jne 0x451ac2
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], esi
mov edx, dword [0x62a458]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004046d0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x148], esi
jne 0x4521dd
mov dword [ebp + 8], 6
jmp 0x452312
mov dword [ebp - 0xf4], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x451a8a
mov ecx, dword [eax + 0xc]
mov edx, dword [0x62a458]
mov eax, dword [ebp - 0x1d0]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x2c], ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x148], eax
cmp esi, 0x66
jge 0x451bba
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x451bb4
cmp esi, 0xf
jle 0x451b49
cmp esi, 0x12
jge 0x451b49
mov dword [ebp - 0xa4], ebx
cmp esi, 0x1d
je 0x451b58
cmp esi, 0x1e
je 0x451b58
cmp esi, 0x39
jne 0x451b5e
mov dword [ebp - 0x90], ebx
cmp esi, 0x1f
je 0x451b68
cmp esi, 0x20
jne 0x451b6b
mov dword [ebp - 0x64], ebx
cmp esi, 0x21
je 0x451b75
cmp esi, 0x22
jne 0x451b78
mov dword [ebp - 0x80], ebx
cmp esi, 0x23
je 0x451b82
cmp esi, 0x24
jne 0x451b88
mov dword [ebp - 0x98], ebx
cmp esi, 0x2c
jne 0x451b96
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x451b16
cmp esi, 0x2d
je 0x451bb1
cmp esi, 0x2e
jne 0x451bac
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x451b16
cmp esi, 0x3d
jne 0x451bb4
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x451b16
mov edx, dword [0x62a458]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x130], 0
call fcn.004046b0
add esp, 4
mov esi, eax
mov eax, dword [0x62a458]
mov dword [ebp - 0x1d4], esi
push eax
call fcn.004047a0
mov ecx, dword [ebp - 0xf4]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x451c02
mov eax, dword [ecx + 0x10]
mov edx, dword [0x62a458]
push eax
push edx
push esi
mov dword [ebp - 0x78], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x451a8a
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x452121
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x451c93
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xaf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xdb4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xdb4]
jmp 0x451d14
mov edx, dword [0x62a458]
push eax
mov eax, dword [ebp - 0x1d4]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x451ccf
xor ecx, ecx
lea edx, [ebp - 0xaf4]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x451d1c
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xaf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd94]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x4520d8
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4520d2
cmp esi, 0x45
jne 0x451e15
lea ecx, [ebp - 0xb74]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0xb74]
lea eax, [ebp - 0xc74]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xc74]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x451dda
lea edx, [ebp - 0x6d4]
lea eax, [ebp - 0x4d4]
push edx
push 0x49b6c8
push eax
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x4d4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x6d4]
lea edx, [ebp - 0x4d4]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x4d4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x451e25
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x451d1e
cmp esi, edi
jne 0x451e32
mov dword [ebp - 0x74], edi
inc esi
jmp 0x451d1e
cmp esi, 2
je 0x4520d2
cmp esi, 4
jne 0x451e4c
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x451d1e
cmp esi, 5
jne 0x451e5d
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x451d1e
cmp esi, 6
jne 0x451e6e
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x451d1e
cmp esi, 7
jne 0x451e7f
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x451d1e
cmp esi, 8
jne 0x451e90
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x451d1e
cmp esi, 9
jne 0x451ea1
mov dword [ebp - 0x138], edi
inc esi
jmp 0x451d1e
cmp esi, 0xa
jne 0x451eaf
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x451d1e
cmp esi, 0xb
jne 0x451ec0
mov dword [ebp - 0x140], edi
inc esi
jmp 0x451d1e
jle 0x451eca
cmp esi, 0xf
jge 0x451ecd
mov dword [ebp - 0x48], edi
cmp esi, 0xf
jne 0x451edb
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x451d1e
jle 0x451ee8
cmp esi, 0x12
jge 0x451ee8
mov dword [ebp - 0xa4], edi
cmp esi, 0x1b
jne 0x451ef9
mov dword [ebp - 0x134], edi
inc esi
jmp 0x451d1e
cmp esi, 0x1c
jne 0x451f0a
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x451d1e
cmp esi, 0x1d
je 0x451f19
cmp esi, 0x1e
je 0x451f19
cmp esi, 0x39
jne 0x451f1f
mov dword [ebp - 0x90], edi
cmp esi, 0x1f
je 0x451f29
cmp esi, 0x20
jne 0x451f2c
mov dword [ebp - 0x64], edi
cmp esi, 0x21
je 0x451f36
cmp esi, 0x22
jne 0x451f39
mov dword [ebp - 0x80], edi
cmp esi, 0x23
je 0x451f43
cmp esi, 0x24
jne 0x451f49
mov dword [ebp - 0x98], edi
cmp esi, 0x25
je 0x451f53
cmp esi, 0x26
jne 0x451f59
mov dword [ebp - 0x144], edi
cmp esi, 0x27
jne 0x451f6a
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x451d1e
cmp esi, 0x28
jne 0x451f7b
mov dword [ebp - 0x124], edi
inc esi
jmp 0x451d1e
cmp esi, 0x2c
jne 0x451f8c
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x451d1e
cmp esi, 0x2d
jne 0x451f9a
mov dword [ebp - 0x38], edi
inc esi
jmp 0x451d1e
cmp esi, 0x2e
jne 0x451fab
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x451d1e
cmp esi, 0x2f
jne 0x451fbc
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x451d1e
cmp esi, 0x30
jne 0x451fcd
mov dword [ebp - 0x104], edi
inc esi
jmp 0x451d1e
cmp esi, 0x31
jne 0x451fde
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x451d1e
cmp esi, 0x32
jne 0x451fef
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x451d1e
cmp esi, 0x34
jne 0x452000
mov dword [ebp - 0xac], edi
inc esi
jmp 0x451d1e
cmp esi, 0x35
jne 0x452011
mov dword [ebp - 0x88], edi
inc esi
jmp 0x451d1e
cmp esi, 0x36
jne 0x452022
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x451d1e
cmp esi, 0x37
jne 0x452037
mov dword [ebp - 0xd8], 0
inc esi
jmp 0x451d1e
cmp esi, 0x38
jne 0x452048
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x451d1e
cmp esi, 0x3a
je 0x452057
cmp esi, 0x3b
je 0x452057
cmp esi, 0x3c
jne 0x45205d
mov dword [ebp - 0x100], edi
cmp esi, 0x3d
jne 0x45206b
mov dword [ebp - 0x38], edi
inc esi
jmp 0x451d1e
cmp esi, 0x3e
jne 0x452079
mov dword [ebp - 0x40], edi
inc esi
jmp 0x451d1e
cmp esi, 0x3f
jne 0x45208a
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x451d1e
cmp esi, 0x40
jne 0x452098
inc esi
jmp 0x451d1e
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x148]
inc ecx
cmp eax, edi
mov dword [ebp - 0x70], ecx
jne 0x4520ef
inc dword [ebp - 0x84]
cmp dword [ebp - 0x70], 0xc350
jg 0x452121
mov esi, dword [ebp - 0x130]
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x20]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x20], ecx
mov eax, ecx
jmp 0x451c2c
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x108]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x108], eax
jmp 0x451acc
mov eax, dword [0x62a458]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x78], ebx
cmp bx, word [esi + 2]
jae 0x452312
xor ecx, ecx
push str..asp
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov byte [ebp - 0xbc], cl
mov edx, dword [edi]
mov dword [ebp - 0xc4], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc0], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x45223f
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0xc4]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45225a
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0xc4]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x452275
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0xc4]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x452290
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0xc4]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4522ab
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0xc4]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4522c6
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x78]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x78], eax
jg 0x452312
mov esi, dword [ebp - 0x148]
add edi, 0x28
inc ebx
jmp 0x4521f0
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x70]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0x62a458]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x452360
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 3
push 0x62a450
call fcn.00404650
add esp, 4
cmp esi, ebx
jne 0x45238f
push 0x49b598
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x1c], edi
test esi, esi
mov dword [ebp - 0x20], edx
je 0x452aec
cmp edi, ebx
jge 0x452aec
lea eax, [ebp - 0x1834]
xor esi, esi
push eax
mov dword [ebp - 0x2c], esi
call fcn.0047c0d3
push 0x5585c1e5
call fcn.00660efb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], 0
cmp eax, ebx
jne 0x452afd
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x13c]
mov byte [ebp - 0x8d4], 0
cmp eax, ebx
jle 0x452b42
mov edi, 0x49e558
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x140], ebx
jne 0x452b7f
mov edi, 0x49e474
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], ebx
jne 0x452bb7
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x452c27
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
mov eax, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x114]
inc edx
cmp ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x128], eax
jne 0x452c27
cmp dword [ebp - 0x110], 1
jge 0x452c27
mov dword [ebp - 0x4c], 1
mov al, byte [ebp - 0x1234]
cmp al, 0x30
je 0x452c55
cmp al, 0x31
je 0x452c55
cmp al, 0x32
je 0x452c55
cmp al, 0x33
je 0x452c55
cmp al, 0x34
je 0x452c55
cmp al, 0x35
je 0x452c55
cmp al, 0x36
je 0x452c55
cmp al, 0x37
je 0x452c55
cmp al, 0x38
je 0x452c55
cmp al, 0x39
jne 0x452c8c
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x54]
mov esi, 1
cmp eax, esi
mov dword [ebp + 8], 0
jne 0x452cdc
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
mov dword [ebp + 8], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x30], eax
mov esi, eax
cmp dword [ebp - 0x68], esi
jne 0x452d4b
lea eax, [ebp - 0x13b4]
lea ecx, [ebp - 0x3d4]
push eax
push ecx
call fcn.004294c0
movsx eax, ax
add esp, 8
test eax, eax
je 0x452d16
lea edx, [ebp - 0x13b4]
push 0x49e4a8
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x452d4b
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x452d88
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x74], esi
jne 0x452dc9
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x134], esi
jne 0x452e0d
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xe4], esi
je 0x452e1d
cmp dword [ebp - 0x11c], esi
jne 0x452e52
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xec], esi
jne 0x452e96
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x144], esi
jne 0x452ed3
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xc8], esi
jne 0x452f10
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x8c], esi
jne 0x452f5b
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x30], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x124], esi
jne 0x452fa6
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xfc], esi
jne 0x452fea
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x138], esi
jne 0x45302e
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x7c], esi
jne 0x453068
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x48], esi
jne 0x45310a
cmp dword [ebp - 0x104], esi
je 0x45308e
cmp dword [ebp - 0x12c], esi
je 0x45308e
lea edx, [ebp - 0x8d4]
mov edi, 0x49b2d8
jmp 0x4530d9
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10c]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x8d4]
mov edi, 0x49b2b8
je 0x4530d9
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xcc], esi
jne 0x45314e
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xd0], esi
jne 0x45319e
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x60]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x4531a3
mov dword [ebp - 0x30], ebx
jmp 0x4531a3
mov ebx, 1
cmp dword [ebp - 0xa4], ebx
jne 0x4531e2
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x34], ebx
jne 0x45325b
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x30], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x68]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x45325b
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], ebx
jne 0x45331b
cmp dword [ebp - 0xac], ebx
jne 0x45331b
cmp dword [ebp - 0x88], ebx
jne 0x45331b
cmp dword [ebp - 0xb4], ebx
jne 0x4532cd
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0x8d4]
cmp eax, ebx
mov edi, 0x49b24c
je 0x4532a1
mov edi, 0x49b23c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd8], ebx
jne 0x45331b
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0x8d4]
cmp eax, ebx
mov edi, 0x49b224
je 0x4532ef
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe0], ebx
jne 0x453387
cmp dword [ebp - 0xb8], ebx
jne 0x453350
cmp dword [ebp - 0xac], ebx
jne 0x453350
cmp dword [ebp - 0x88], ebx
jne 0x453350
cmp dword [ebp - 0xb4], ebx
jne 0x453350
lea edx, [ebp - 0x8d4]
mov edi, 0x49b204
jmp 0x45335b
lea edx, [ebp - 0x8d4]
mov edi, 0x49b1f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe8], ebx
jne 0x4533bf
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], ebx
jne 0x4533fe
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf0], ebx
jne 0x45343d
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x64], ebx
jne 0x453483
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x60]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x453483
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x80], ebx
jne 0x4534bf
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x98], ebx
jne 0x4534fe
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa8], ebx
jne 0x45353d
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x45357b
mov edi, 0x49b17c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf8], ebx
je 0x4535ba
mov edi, 0x49b16c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x38], ebx
jne 0x4535f6
mov edi, 0x49b160
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa0], ebx
jne 0x45362e
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x100], ebx
jne 0x453666
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], ebx
jne 0x45369b
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
jne 0x4536a9
mov eax, 6
jmp 0x4536ac
shl eax, 2
cmp dword [ebp - 0x1c], eax
jge 0x4536fd
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x8d4]
cmp eax, ebx
mov edi, 0x49b12c
je 0x4536c8
mov edi, 0x49b11c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x60]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4536fa
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jle 0x45373f
cmp dword [ebp - 0x2c], ebx
jne 0x45373f
cmp dword [ebp - 0x7c], ebx
jne 0x453780