Function at 0x4471b0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb196
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x17b4
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x110], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x524]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xb44]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x524]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x447346
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x524]
cmp al, 0x5c
jne 0x447366
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
xor edi, edi
cmp al, 0x25
mov dword [ebp + 8], edx
jne 0x447376
mov edi, 1
lea esi, [ecx - 2]
test esi, esi
jle 0x4473a0
mov al, byte [ebp + esi - 0x524]
cmp al, 0x3a
jne 0x447392
cmp byte [ebp + esi - 0x523], 0x5c
je 0x4473a0
cmp edi, 1
jne 0x44739b
cmp al, 0x5c
je 0x4473a9
dec esi
test esi, esi
jg 0x44737d
cmp edi, 1
jne 0x447452
sub ecx, esi
xor edx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x4473d1
mov ecx, eax
lea esi, [ebp + esi - 0x523]
mov edx, ecx
lea edi, [ebp - 0xdc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xdc4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0xdc4], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x524]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1a4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x14c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x524]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0x14c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x524]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44749a
cmp esi, ecx
je 0x44749a
test ecx, ecx
mov edx, ecx
jle 0x44746b
cmp byte [ebp + edx - 0x524], 0x2e
je 0x44746b
dec edx
test edx, edx
jg 0x44745c
mov ecx, edx
xor eax, eax
sub ecx, esi
mov byte [ebp - 0x524], 0
add ecx, 5
test ecx, ecx
jle 0x447492
lea esi, [esi + ebx - 1]
mov bl, byte [esi + eax]
mov byte [ebp + eax - 0x524], bl
inc eax
cmp eax, ecx
jl 0x447483
mov byte [ebp + edx - 0x51f], 0
lea edi, [ebp - 0x524]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4474bd
cmp byte [ebp + ecx - 0x524], 0x2e
je 0x4474bd
dec ecx
test ecx, ecx
jg 0x4474ae
test edx, edx
mov byte [ebp + ecx - 0x520], 0
jne 0x4474e7
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x524]
push str.c:endpcache_newlsp.dll
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44751d
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x524]
push eax
call fcn.004ab3c0
mov esi, eax
mov ebx, 1
add esp, 4
cmp esi, ebx
jge 0x447555
push 0x515e70
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x9c4]
lea edx, [ebp - 0x524]
push ecx
push edx
mov dword [ebp - 0x118], esi
call fcn.004d9590
movsx eax, ax
add esp, 8
cmp eax, ebx
mov dword [ebp - 0x44], eax
jge 0x4475a1
cmp esi, 0x7d000
jle 0x4475f9
push 0x51f178
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x7d000
jle 0x4475f9
lea eax, [ebp - 0x9c4]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4475f9
lea ecx, [ebp - 0x9c4]
lea edx, [ebp - 0x14c4]
push ecx
push 0x51f160
push edx
call fcn.004f175f
lea eax, [ebp - 0x14c4]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x9c4]
push str.Microsoft
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x447614
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x524]
push str.WinRAR
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44764a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._smswsock.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44769a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._smsgina.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4476ea
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._swsock32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44773a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._sws2_32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44778a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4477da
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._sNETUI1.DLl
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44782a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._sMSI.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44787a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._sSHELL32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4478ca
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._ses.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44791a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._surlmon.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44796a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._smshtml.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4479ba
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._smfc42u.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447a0a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._smprapi.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447a5a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._scrypt32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447aaa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._scryptui.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447afa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._s_shlwapi.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447b4a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._sinetcomm.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447b9a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._s_rpcrt4.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447bea
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._scomdlg32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447c3a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._s_advapi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447c8a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._simagehlp.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447cda
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._skernel32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447d2a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._slz32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447d7a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._solecli32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447dca
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._soleaut32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447e1a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._solecnv32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447e6a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._solesvr32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447eba
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._solethk32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447f0a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._sole32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447f5a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._surl.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447faa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._swininet.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x447ffa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._swldap32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44804a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._s_version.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44809a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x2a4]
push eax
push str._suser32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x524]
lea eax, [ebp - 0x2a4]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4480ea
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x2a4]
push ecx
push str._sgdi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x524]
lea ecx, [ebp - 0x2a4]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44813a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
push edx
push str._smsvbvm60.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x524]
lea edx, [ebp - 0x2a4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x44818f
cmp dword [ebp - 0x28], ebx
jne 0x44818f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x524]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4481c3
lea esi, [ebp + ecx - 0x524]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x1244], dl
jne 0x4481bd
cmp eax, 2
jge 0x4481c3
inc eax
dec esi
cmp eax, ecx
jl 0x4481aa
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x4481ea
mov ebx, ecx
lea esi, [ebp - 0x524]
lea edi, [ebp - 0xfc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xfc4], 0
test eax, eax
jle 0x44821d
lea esi, [ebp + edx - 0x523]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x448210
mov byte [ebp + ecx - 0x1244], dl
jne 0x448218
mov byte [ebp + ecx - 0x1244], 0
inc ecx
cmp ecx, eax
jl 0x4481ff
mov byte [ebp + eax - 0x1244], 0
mov al, byte [ebp - 0xfc2]
cmp al, 0x5c
je 0x44823d
mov byte [ebp - 0xfc2], 0x5c
mov byte [ebp - 0xfc1], 0
cmp byte [ebp - 0xfc3], 0x3a
je 0x448302
lea edi, [ebp - 0xfc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x448270
cmp byte [ebp + eax - 0xfc4], 0x3a
je 0x448270
inc eax
cmp eax, ecx
jl 0x448261
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x4482a0
mov ecx, edi
lea esi, [ebp + eax - 0xfc5]
mov ebx, ecx
lea edi, [ebp - 0x1344]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x1343], 0
jne 0x4482d9
lea eax, [ebp - 0x324]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x324]
lea edx, [ebp - 0x1344]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x1344]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfc4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xfc2], 0x5c
je 0x448312
mov byte [ebp - 0xfc2], 0x5c
lea ecx, [ebp - 0x524]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
je 0x448343
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfc3], 0x3a
je 0x44836a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfc2], 0x5c
je 0x44837a
mov byte [ebp - 0xfc2], 0x5c
lea edi, [ebp - 0x1244]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4483a5
cmp byte [ebp + eax - 0x1244], 0x2e
jne 0x44839c
mov edx, ebx
inc eax
cmp eax, ecx
jl 0x448390
test edx, edx
jne 0x4483c3
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x1240], 0
jge 0x4483ee
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a4]
push 0x80
push edx
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xb44]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x524]
push 0x100
lea edx, [ebp - 0xac4]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x1244]
push 0x40
lea ecx, [ebp - 0x784]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x524]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
mov dword [ebp - 0x11c], esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x44848a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x524]
push 0x80
lea ecx, [ebp - 0xcc4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x524]
push 0x80
lea eax, [ebp - 0xbc4]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xb44]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x1a4]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xcc4], al
lea edx, [ebp - 0xcc4]
mov byte [ebp + ecx - 0xbc4], al
lea ecx, [ebp - 0xb44]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x448535
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448535
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0xbc4]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448582
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448582
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x524]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4485cd
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4485cd
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x524]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x448618
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448618
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x524]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x448663
push 0x5144fc
push esi
mov dword [ebp - 0x24], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448663
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xfc4]
push 0x20
lea eax, [ebp - 0xc44]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xc44]
push str.c:endpcache
push ecx
mov byte [ebp - 0xc3d], 0
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4486b5
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1244]
push str.cmd.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4486eb
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
push 0xd53b20
mov dword [ebp - 4], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x14], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea eax, [ebp - 0x524]
push 0xd53b20
push eax
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x44875a
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x524]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x448fee
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x120], eax
mov eax, dword [0xd53b28]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x90], eax
jne 0x4487ea
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd53b28]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x10c], esi
jne 0x448ec8
mov dword [ebp + 8], 6
jmp 0x448fdc
mov dword [ebp - 0x84], edi
cmp dword [eax + 0x10], edi
je 0x4487b6
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd53b28]
mov eax, dword [ebp - 0x120]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x10c], eax
cmp esi, 0x69
jge 0x4488cd
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4488c7
cmp esi, 0xf
jle 0x448868
cmp esi, 0x12
jge 0x448868
mov dword [ebp - 0x68], ebx
cmp esi, 0x1d
je 0x448877
cmp esi, 0x1e
je 0x448877
cmp esi, 0x39
jne 0x44887a
mov dword [ebp - 0x64], ebx
cmp esi, 0x1f
je 0x448884
cmp esi, 0x20
jne 0x448887
mov dword [ebp - 0x6c], ebx
cmp esi, 0x21
je 0x448891
cmp esi, 0x22
jne 0x448894
mov dword [ebp - 0x54], ebx
cmp esi, 0x23
je 0x44889e
cmp esi, 0x24
jne 0x4488a1
mov dword [ebp - 0x60], ebx
cmp esi, 0x2c
jne 0x4488ac
mov dword [ebp - 0x58], ebx
inc esi
jmp 0x448838
cmp esi, 0x2d
je 0x4488c4
cmp esi, 0x2e
jne 0x4488bf
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x448838
cmp esi, 0x3d
jne 0x4488c7
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x448838
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0xec], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd53b28]
mov dword [ebp - 0x124], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0x84]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x448915
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd53b28]
push eax
push edx
push esi
mov dword [ebp - 0x4c], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4487b6
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x448e0a
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x4489a6
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x8a4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x8a4]
jmp 0x448a2a
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0x124]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4489e5
xor ecx, ecx
lea edx, [ebp - 0x744]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x94], esi
jmp 0x448a35
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x8c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x8c4]
mov dword [ebp - 0x94], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x448dc1
mov eax, dword [ebp - 0x94]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x448dbb
cmp esi, 0x45
jne 0x448b0b
lea ecx, [ebp - 0x324]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x324]
lea eax, [ebp - 0x13c4]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x13c4]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x448ad0
lea edx, [ebp - 0x9c4]
lea eax, [ebp - 0xdc4]
push edx
push 0x5153f4
push eax
jmp 0x448ae3
lea ecx, [ebp - 0x9c4]
lea edx, [ebp - 0xdc4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xdc4]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x448b18
mov dword [ebp - 0x38], edi
inc esi
jmp 0x448a37
cmp esi, edi
jne 0x448b25
mov dword [ebp - 0x50], edi
inc esi
jmp 0x448a37
cmp esi, 2
je 0x448dbb
cmp esi, 4
jne 0x448b3f
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x448a37
cmp esi, 5
jne 0x448b50
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x448a37
cmp esi, 6
jne 0x448b61
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x448a37
cmp esi, 7
jne 0x448b72
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x448a37
cmp esi, 8
jne 0x448b83
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x448a37
cmp esi, 9
jne 0x448b94
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x448a37
cmp esi, 0xa
jne 0x448ba2
mov dword [ebp - 0x34], edi
inc esi
jmp 0x448a37
cmp esi, 0xb
jne 0x448bb3
mov dword [ebp - 0x104], edi
inc esi
jmp 0x448a37
jle 0x448bbd
cmp esi, 0xf
jge 0x448bc0
mov dword [ebp - 0x40], edi
cmp esi, 0xf
jne 0x448bce
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x448a37
jle 0x448bd8
cmp esi, 0x12
jge 0x448bd8
mov dword [ebp - 0x68], edi
cmp esi, 0x1b
jne 0x448be9
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x448a37
cmp esi, 0x1c
jne 0x448bfa
mov dword [ebp - 0xac], edi
inc esi
jmp 0x448a37
cmp esi, 0x1d
je 0x448c09
cmp esi, 0x1e
je 0x448c09
cmp esi, 0x39
jne 0x448c0c
mov dword [ebp - 0x64], edi
cmp esi, 0x1f
je 0x448c16
cmp esi, 0x20
jne 0x448c19
mov dword [ebp - 0x6c], edi
cmp esi, 0x21
je 0x448c23
cmp esi, 0x22
jne 0x448c26
mov dword [ebp - 0x54], edi
cmp esi, 0x23
je 0x448c30
cmp esi, 0x24
jne 0x448c33
mov dword [ebp - 0x60], edi
cmp esi, 0x25
je 0x448c3d
cmp esi, 0x26
jne 0x448c43
mov dword [ebp - 0xe0], edi
cmp esi, 0x27
jne 0x448c54
mov dword [ebp - 0x100], edi
inc esi
jmp 0x448a37
cmp esi, 0x28
jne 0x448c65
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x448a37
cmp esi, 0x29
jne 0x448c76
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x448a37
cmp esi, 0x2c
jne 0x448c84
mov dword [ebp - 0x58], edi
inc esi
jmp 0x448a37
cmp esi, 0x2d
jne 0x448c92
mov dword [ebp - 0x30], edi
inc esi
jmp 0x448a37
cmp esi, 0x2e
jne 0x448ca0
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x448a37
cmp esi, 0x2f
jne 0x448cb1
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x448a37
cmp esi, 0x30
jne 0x448cc2
mov dword [ebp - 0x108], edi
inc esi
jmp 0x448a37
cmp esi, 0x31
jne 0x448cd3
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x448a37
cmp esi, 0x32
jne 0x448ce1
mov dword [ebp - 0x80], edi
inc esi
jmp 0x448a37
cmp esi, 0x34
jne 0x448cf2
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x448a37
cmp esi, 0x35
jne 0x448d03
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x448a37
cmp esi, 0x36
jne 0x448d14
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x448a37
cmp esi, 0x37
jne 0x448d29
mov dword [ebp - 0xcc], 0
inc esi
jmp 0x448a37
cmp esi, 0x38
jne 0x448d3a
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x448a37
cmp esi, 0x3a
je 0x448d49
cmp esi, 0x3b
je 0x448d49
cmp esi, 0x3c
jne 0x448d4f
mov dword [ebp - 0xdc], edi
cmp esi, 0x3d
jne 0x448d5d
mov dword [ebp - 0x30], edi
inc esi
jmp 0x448a37
cmp esi, 0x3e
jne 0x448d6e
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x448a37
cmp esi, 0x3f
jne 0x448d7c
mov dword [ebp - 0x70], edi
inc esi
jmp 0x448a37
cmp esi, 0x40
jne 0x448d8a
mov dword [ebp - 0x50], edi
inc esi
jmp 0x448a37
cmp esi, 0x41
jne 0x448d9b
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x448a37
cmp esi, 0x46
je 0x448daa
cmp esi, 0x47
je 0x448daa
cmp esi, 0x48
jne 0x448db0
mov dword [ebp - 0xd0], edi
cmp esi, 0x49
jne 0x448dbb
mov dword [ebp - 0x98], edi
inc esi
jmp 0x448a37
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x14], ecx
jne 0x448dd8
inc dword [ebp - 0x88]
cmp dword [ebp - 0x14], 0xc350
jg 0x448e0a
mov esi, dword [ebp - 0xec]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xec], esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x44893f
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0xec]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x90], eax
xor edi, edi
jmp 0x4487f0
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x4c], ebx
cmp bx, word [esi + 2]
jae 0x448fdc
xor ecx, ecx
push str..asp
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x74], cl
mov edx, dword [edi]
mov dword [ebp - 0x7c], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x78], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x448f18
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x7c]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448f30
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x7c]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448f48
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x7c]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448f60
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x7c]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448f78
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x7c]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x448f90
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x4c]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x4c], eax
jg 0x448fdc
mov esi, dword [ebp - 0x10c]
add edi, 0x28
inc ebx
jmp 0x448edb
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x44902a
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x449059
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x14], edi
test esi, esi
mov dword [ebp - 0x18], edx
je 0x4497e2
cmp edi, ebx
jge 0x4497e2
lea eax, [ebp - 0xfc4]
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.004f2beb
jmp 0x449098
lea ecx, [ebp - 0x1244]
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0xdc4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x4490c9
push ebx
lea ecx, [ebp - 0x2ec]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x4490f3
lea eax, [ebp - 0xdc4]
push eax
call fcn.004f2ce2
add esp, 4
jmp 0x449107
lea ecx, [ebp - 0xac4]
push str.c:endpcachemonitor_procPath2.txt
push ecx
call fcn.00403af0
add esp, 8
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x2ec]
push edx
push ebx
push str.c:endpcachemonitor_procPath2.txt
mov dword [ebp + 8], esi
call fcn.004f0727
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x2e8]
cmp dword [eax + 0x30], 0xffffffff
jne 0x44917e
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
lea ecx, [ebp - 0x2d8]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x2d8]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2e8]
push 0xa
lea edx, [ebp - 0x884]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x2e8], esi
call fcn.004f0ae9
lea edi, [ebp - 0x884]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x449774
lea eax, [ebp - 0x884]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x449774
lea ecx, [ebp - 0x884]
push str.Dump_of
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x449774
lea edx, [ebp - 0x884]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x449774
lea eax, [ebp - 0x884]
push str.Summary
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44922f
mov dword [ebp - 0x114], ebx
lea ecx, [ebp - 0x884]
push str.EXEHDR_to_dump_it
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x449283
push 0x5147b4
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x2d8]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x2d8]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x48], ebx
jne 0x44928b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x2c], ebx
jne 0x449293
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x449771
lea edx, [esi + esi*2]
lea eax, [ebp - 0x884]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x44976b
mov ecx, dword [ebp - 0x110]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x110], ecx
jne 0x449378
lea ecx, [ebp - 0x13c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x13c4]
lea eax, [ebp - 0x1044]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1044]
push ecx
call fcn.004f2beb
xor edx, edx
cmp eax, edi
sete dl
push str.c:endpcache
mov esi, edx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x449351
lea eax, [ebp - 0x9c4]
lea ecx, [ebp - 0x14c4]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14c4]
push ecx
jmp 0x44924c
lea edx, [ebp - 0x9c4]
lea eax, [ebp - 0x14c4]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14c4]
push ecx
jmp 0x44924c
cmp esi, 0x19
jne 0x4493f8
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], edx
jle 0x449398
sub ecx, eax
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x884]
push str.KERNEL32
push edx
call fcn.004f2d80
mov edi, eax
lea eax, [ebp - 0x884]
push 0x5153ac
push eax
call fcn.004f2d80
lea ecx, [ebp - 0x884]
push str.Kernel32
push ecx
mov ebx, eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x449470
test ebx, ebx
jne 0x449470
test eax, eax
jne 0x449470
mov dword [ebp - 0x2c], eax
mov ebx, 1
inc esi
jmp 0x449297
cmp esi, 0x1a
jne 0x449484
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], edx
jle 0x44941c
sub ecx, eax
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x884]
push str.KERNEL32
push edx
call fcn.004f2d80
mov edi, eax
lea eax, [ebp - 0x884]
push 0x5153ac
push eax
call fcn.004f2d80
lea ecx, [ebp - 0x884]
push str.Kernel32
push ecx
mov ebx, eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x449470
test ebx, ebx
jne 0x449470
test eax, eax
jne 0x449470
mov dword [ebp - 0x2c], eax
mov ebx, 1
inc esi
jmp 0x449297
xor edi, edi
mov dword [ebp - 0x2c], 1
mov ebx, 1
inc esi
jmp 0x449297
cmp esi, 0x2a
jne 0x44949b
mov dword [ebp - 0x48], edi
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x449297
cmp esi, 0x2b
jne 0x4494b2
mov dword [ebp - 0x48], edi
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x449297
cmp esi, edi
jne 0x4494bf
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x449297
cmp esi, ebx
jne 0x4494cc
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x449297
cmp esi, 2
je 0x44976b
cmp esi, 4
jne 0x4494e6
mov dword [ebp - 0xc0], ebx
inc esi
jmp 0x449297
cmp esi, 5
jne 0x4494f7
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x449297
cmp esi, 6
jne 0x449508
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x449297
cmp esi, 7
jne 0x449519
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x449297
cmp esi, 8
jne 0x44952a
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x449297
cmp esi, 9
jne 0x44953b
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x449297
cmp esi, 0xa
jne 0x449549
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x449297
cmp esi, 0xb
jne 0x44955a
mov dword [ebp - 0x104], ebx
inc esi
jmp 0x449297
jle 0x449564
cmp esi, 0xf
jge 0x449567
mov dword [ebp - 0x40], ebx
cmp esi, 0xf
jne 0x449575
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x449297
jle 0x44957f
cmp esi, 0x12
jge 0x44957f
mov dword [ebp - 0x68], ebx
cmp esi, 0x11
jle 0x44958c
cmp esi, 0x19
jge 0x44958c
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x44959d
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x449297
cmp esi, 0x1c
jne 0x4495ae
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x449297
cmp esi, 0x1d
je 0x4495bd
cmp esi, 0x1e
je 0x4495bd
cmp esi, 0x39
jne 0x4495c0
mov dword [ebp - 0x64], ebx
cmp esi, 0x1f
je 0x4495ca
cmp esi, 0x20
jne 0x4495cd
mov dword [ebp - 0x6c], ebx
cmp esi, 0x21
je 0x4495d7
cmp esi, 0x22
jne 0x4495da
mov dword [ebp - 0x54], ebx
cmp esi, 0x23
je 0x4495e4
cmp esi, 0x24
jne 0x4495e7
mov dword [ebp - 0x60], ebx
cmp esi, 0x25
je 0x4495f1
cmp esi, 0x26
jne 0x4495f7
mov dword [ebp - 0xe0], ebx
cmp esi, 0x27
jne 0x449608
mov dword [ebp - 0x100], ebx
inc esi
jmp 0x449297
cmp esi, 0x28
jne 0x449619
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x449297
cmp esi, 0x29
jne 0x44962a
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x449297
cmp esi, 0x2c
jne 0x449638
mov dword [ebp - 0x58], ebx
inc esi
jmp 0x449297
cmp esi, 0x2d
jne 0x449646
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x449297
cmp esi, 0x2e
jne 0x449654
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x449297
cmp esi, 0x2f
jne 0x449665
inc esi
jmp 0x449297
inc dword [ebp + 8]
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x2e4], 1
je 0x44917e
lea ecx, [ebp - 0x2ec]
call fcn.004f076e
mov eax, dword [ebp - 0x14]
mov ecx, 5
cmp eax, ecx
jle 0x4497a7
sub eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x18]
cmp edx, ecx
jle 0x4497b3
sub edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0xfc]
test ecx, ecx
jne 0x4497c8
cmp eax, 6
jle 0x4497c8
sub eax, 6
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x2d8]
call fcn.004f05fb
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0x724], 0
cmp eax, ebx
jne 0x449856
mov edi, 0x51efec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jge 0x449838
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x19000
jle 0x44985f
push 0x51efd8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xd0], ebx
jne 0x449891
cmp eax, ebx
jge 0x449873
cmp ecx, 0x32000
jle 0x449891
push 0x51efc4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x98], ebx
jne 0x4498c3
cmp eax, ebx
jge 0x4498a5
cmp ecx, 0x32000
jle 0x4498c3
push 0x51efac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xf0]
xor ebx, ebx
cmp eax, 1
mov dword [ebp + 8], ebx
jne 0x449903
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x449944
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp + 8], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xa0]
mov eax, 1
cmp ecx, eax
jne 0x449988
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], eax
jne 0x4499c3
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x449a01
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
je 0x449a11
cmp dword [ebp - 0x100], eax
jne 0x449a46
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x449a84
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe0], eax
jne 0x449ac1
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x449aff
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x449b3a
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], eax
jne 0x449b7f
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc0], eax
jne 0x449bbd
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], eax
jne 0x449bfb
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], eax
jne 0x449c38
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
jne 0x449cd1
cmp dword [ebp - 0x108], eax
je 0x449c5e
cmp dword [ebp - 0x8c], eax
je 0x449c5e
lea edx, [ebp - 0x724]
mov edi, 0x515278
jmp 0x449ca6
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x80]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x724]
mov edi, 0x515258
je 0x449ca6
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x9c], eax
jne 0x449d0f
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa4], eax
jne 0x449d54
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x3c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x68], eax
jne 0x449d96
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x3c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x449e12
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, ecx
jne 0x449e17
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ecx
jmp 0x449e17
mov ecx, 1
cmp dword [ebp - 0xac], ecx
jne 0x449ecf
cmp dword [ebp - 0xb4], ecx
jne 0x449ecf
cmp dword [ebp - 0xbc], ecx
jne 0x449ecf
cmp dword [ebp - 0xc4], ecx
jne 0x449e85
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x724]
cmp eax, ecx
mov edi, 0x5151ec
je 0x449e5a
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xcc], ecx
jne 0x449ecf
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x724]
cmp eax, ecx
mov edi, 0x5151c4
je 0x449ea4
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd4], ecx
jne 0x449f0c
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x64], ecx
jne 0x449f51
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
mov ecx, 1
jne 0x449f50
mov dword [ebp - 0x3c], ecx
inc ebx
cmp dword [ebp - 0x6c], ecx
jne 0x449f8c
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x54], ecx
jne 0x449fc7
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x60], ecx
jne 0x44a002
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x44a049
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x44a049
mov edi, 0x516ba4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x58], ecx
jne 0x44a084
mov edi, str.PING
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x30], ecx
jne 0x44a0bf
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x5c], ecx
jne 0x44a0fa
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xdc], ecx
jne 0x44a138
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xe4], ecx
jne 0x44a175
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x44a183
mov eax, 4
jmp 0x44a186
lea eax, [eax + eax*2]
cmp dword [ebp - 0x14], eax
jge 0x44a1c4
mov edi, 0x516b88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ecx
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x44a209
cmp dword [ebp - 0x1c], ecx
jne 0x44a209
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x34], ecx
jne 0x44a250
cmp eax, 5
jge 0x44a250
test eax, eax
jle 0x44a250
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x724]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ecx
mov eax, dword [ebp - 0x44]
cmp eax, 7
jge 0x44a370
cmp dword [ebp - 0x24], ecx
jne 0x44a2f2
cmp eax, ecx
lea edx, [ebp - 0x724]
jge 0x44a2b3
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x44a2a4
mov dword [ebp + 8], 1
mov dword [ebp - 0xf4], 1
jmp 0x44a36f
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
je 0x44a36c
cmp dword [ebp - 0x28], eax
jne 0x44a36f
jmp 0x44a36c
cmp eax, ecx
lea edx, [ebp - 0x724]
jge 0x44a333
mov edi, 0x515078
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0xf4], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x44a362
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
je 0x44a36c
cmp dword [ebp - 0x28], eax
jne 0x44a36f
mov dword [ebp + 8], eax
inc ebx
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44a421
cmp dword [ebp + 8], 1
je 0x44a389
test ebx, ebx
jle 0x44a421
lea edi, [ebp - 0x9c4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], 0
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x44]
not ecx
dec ecx
test eax, eax
jle 0x44a3dc
test ecx, ecx
jle 0x44a3dc
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x44a3dc
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x1044]
push eax
lea edx, [ebp - 0x1244]
push ecx
lea eax, [ebp - 0xfc4]
push edx
lea ecx, [ebp - 0x9c4]
push eax
push ecx
call fcn.00491aa0
add esp, 0x14
jmp 0x44a3fd
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x1044]
push edx
lea ecx, [ebp - 0x1244]
push eax
lea edx, [ebp - 0xfc4]
push ecx
push edx
call fcn.004c80b0
add esp, 0x10
cmp dword [ebp - 0x34], 5
jle 0x44a421
push 0x51ef9c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x44], 6
jle 0x44a50c
cmp ebx, 3
jge 0x44a463
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x44a466
test esi, esi
jne 0x44a466
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x44a466
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
cmp dword [ebp - 0x28], 1
jne 0x44a49c
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x44a49c
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x44a49c
test esi, esi
jne 0x44a49c
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x14c4]
push eax
push ecx
call fcn.004c2af0
movsx eax, ax
add esp, 8
cmp eax, 7
jle 0x44a50f
lea edx, [ebp - 0x14c4]
push 0x516138
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44a50f
lea eax, [ebp - 0x14c4]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x44a50f
test esi, esi
jne 0x44a50f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44a551
cmp esi, 1
je 0x44a51f
test ebx, ebx
jle 0x44a551
lea ecx, [ebp + 8]
lea edx, [ebp - 0x1044]
push ecx
lea eax, [ebp - 0x1244]
push edx
lea ecx, [ebp - 0xfc4]
push eax
push ecx
mov dword [ebp + 8], 0
call fcn.004c80b0
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, 5
jle 0x44a551
xor esi, esi
or edi, 0xffffffff
push str.c:endpcache
mov dword [ebp - 4], edi
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x44a586
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44a5e5
mov ecx, dword [ebp - 0x38]
mov eax, 1
cmp ecx, eax
je 0x44a5e5
cmp esi, eax
je 0x44a5e5
cmp dword [ebp - 0x3c], eax
je 0x44a5e5
cmp ebx, eax
jle 0x44a568
lea edx, [ebp - 0x724]
lea eax, [ebp - 0x9c4]
push edx
push eax
lea ecx, [ebp - 0x17c4]
push 0x51ef6c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x17c4]
push edx
call fcn.004fa6c0
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea ecx, [ebp - 0x2ec]
call fcn.004f0653
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 4], 9
test eax, eax
jne 0x44a63b
lea eax, [ebp - 0x724]
lea ecx, [ebp - 0x9c4]
push eax
push ecx
lea edx, [ebp - 0x15c4]
push 0x51ef40
push edx
call fcn.004f175f
lea eax, [ebp - 0x15c4]
push eax
call fcn.004fa6c0
add esp, 0x14
mov esi, eax
mov dword [ebp - 4], edi
jmp 0x44a810
lea ecx, [ebp - 0xac4]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x44a676
lea edx, [ebp - 0xac4]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x44a676
lea eax, [ebp - 0xac4]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0xac4]
push ecx
call esi
lea edx, [ebp - 0xac4]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x44a6e8
lea eax, [ebp - 0xac4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xac4]
push ecx
call esi
test eax, eax
jne 0x44a6e8
lea edx, [ebp - 0xac4]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x44a6e8
lea edx, [ebp - 0x724]
mov edi, 0x51eeb0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebx, ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0xac4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [0xe56c50]
and ecx, 3
cmp edx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x44a7b4
shl edx, 8
lea eax, [ebp - 0x524]
lea ecx, [edx + 0xd70d90]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x44a7f8
mov esi, edx
lea edi, [ebp - 0x524]
shl esi, 8
or ecx, 0xffffffff
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x44a7f8
lea ecx, [ebp - 0x2d8]
call fcn.004f0714
lea ecx, [ebp - 0x2d8]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret