Function at 0x498290
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fba9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x185c
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x134], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x80
lea edx, [ebp - 0xa2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x49844d
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x54c]
cmp al, 0x5c
jne 0x49846d
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
xor edi, edi
cmp al, 0x25
mov dword [ebp + 8], edx
jne 0x49847d
mov edi, 1
lea esi, [ecx - 2]
test esi, esi
jle 0x4984a7
mov al, byte [ebp + esi - 0x54c]
cmp al, 0x3a
jne 0x498499
cmp byte [ebp + esi - 0x54b], 0x5c
je 0x4984a7
cmp edi, 1
jne 0x4984a2
cmp al, 0x5c
je 0x4984b0
dec esi
test esi, esi
jg 0x498484
cmp edi, 1
jne 0x498559
sub ecx, esi
xor edx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x4984d8
mov ecx, eax
lea esi, [ebp + esi - 0x54b]
mov edx, ecx
lea edi, [ebp - 0xfec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xfec]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0xfec], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1cc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x10ec]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x54c]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0x10ec]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4985a1
cmp esi, ecx
je 0x4985a1
test ecx, ecx
mov edx, ecx
jle 0x498572
cmp byte [ebp + edx - 0x54c], 0x2e
je 0x498572
dec edx
test edx, edx
jg 0x498563
mov ecx, edx
xor eax, eax
sub ecx, esi
mov byte [ebp - 0x54c], 0
add ecx, 5
test ecx, ecx
jle 0x498599
lea esi, [esi + ebx - 1]
mov bl, byte [esi + eax]
mov byte [ebp + eax - 0x54c], bl
inc eax
cmp eax, ecx
jl 0x49858a
mov byte [ebp + edx - 0x547], 0
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4985c4
cmp byte [ebp + ecx - 0x54c], 0x2e
je 0x4985c4
dec ecx
test ecx, ecx
jg 0x4985b5
test edx, edx
mov byte [ebp + ecx - 0x548], 0
jne 0x4985ee
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x54c]
push str.c:endpcache_newlsp.dll
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x498624
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push str.c:endpcachelockfile.dll
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49865a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x54c]
push ecx
call fcn.004ab3c0
mov esi, eax
add esp, 4
cmp esi, 0xa
jge 0x49876f
mov edx, dword [0xe56c50]
xor ebx, ebx
cmp edx, ebx
jle 0x49870d
shl edx, 8
lea eax, [ebp - 0x54c]
lea ecx, [edx + 0xd70d90]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x498751
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x54c]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x498751
push 0x515e70
mov dword [0xe56c50], ebx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, edx
lea edi, [ebp - 0x54c]
shl esi, 8
or ecx, 0xffffffff
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x498751
mov dword [0xe56c50], ebx
push 0x515e70
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x54c]
mov ebx, 1
xor edi, edi
push edx
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x4987a2
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
je 0x4987a7
mov edi, ebx
mov dword [ebp - 0x3c], edi
lea edx, [ebp - 0x166c]
lea eax, [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x54c]
push eax
push ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x128], esi
mov byte [ebp - 0x166c], 0
call fcn.004d8e30
movsx eax, ax
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jge 0x49880c
cmp esi, 0x64000
jle 0x4988c6
push 0x51f178
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x64000
jle 0x498864
lea edx, [ebp - 0x94c]
push str.Microsoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x498864
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0x10ec]
push eax
push 0x51f160
push ecx
call fcn.004f175f
lea edx, [ebp - 0x10ec]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x4988c6
lea eax, [ebp - 0x94c]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4988c6
cmp dword [ebp - 0x1c], 5
jle 0x4988c6
cmp esi, 0x64000
jle 0x4988c6
lea ecx, [ebp - 0x94c]
lea edx, [ebp - 0x10ec]
push ecx
push 0x526cd4
push edx
call fcn.004f175f
lea eax, [ebp - 0x10ec]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0xe56be4], ebx
jne 0x4989c2
mov eax, dword [ebp - 0x1c]
test eax, eax
jle 0x498918
cmp dword [0xe56bf0], ebx
jne 0x4989c2
mov esi, 0x510b24
lea ecx, [ebp - 0x94c]
push esi
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x49896c
add esi, 0x80
cmp esi, 0x510ba4
jl 0x4988ea
cmp dword [0xe56be4], ebx
jne 0x4989c2
cmp dword [0xe56bf0], ebx
jne 0x4989c2
mov esi, str.WBWSFHDLL.dll
lea edx, [ebp - 0x1cc]
push esi
push edx
lea eax, [ebp - 0x10ec]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x10ec]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x4989a4
add esi, 0x80
cmp esi, 0x510b24
jl 0x498929
jmp 0x4989c2
lea edx, [ebp - 0x94c]
lea eax, [ebp - 0x10ec]
push edx
push 0x526cbc
push eax
call fcn.004f175f
lea ecx, [ebp - 0x10ec]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x526ca4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0xe56bd8], ebx
jne 0x498a00
lea eax, [ebp - 0x54c]
push str.LenovoHOTKEYhkvolkey.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x498a00
push 0x526c70
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x94c]
push str.Microsoft
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x498a50
lea edx, [ebp - 0xa2c]
lea eax, [ebp - 0x2cc]
push edx
push str._sAppPatch
push eax
mov dword [ebp - 0x28], ebx
call fcn.004f175f
lea ecx, [ebp - 0x2cc]
lea edx, [ebp - 0x54c]
push ecx
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x498a50
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x54c]
push str.WinRAR
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x498a86
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498ad6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._swsock32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498b26
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sws2_32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498b76
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498bc6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sNETUI1.DLl
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498c16
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sMSI.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498c66
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sSHELL32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498cb6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._ses.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498d06
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._surlmon.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498d56
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._smshtml.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498da6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._smfc42u.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498df6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._smprapi.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498e46
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._scrypt32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498e96
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._scryptui.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498ee6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._s_shlwapi.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498f36
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sinetcomm.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498f86
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._s_rpcrt4.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x498fd6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._scomdlg32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499026
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._s_advapi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499076
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._simagehlp.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4990c6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._skernel32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499116
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._slz32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499166
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._solecli32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4991b6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._soleaut32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499206
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._solecnv32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499256
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._solesvr32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4992a6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._solethk32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4992f6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._solepro32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499346
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sole32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499396
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._surl.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4993e6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._swininet.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499436
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._swldap32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499486
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._s_version.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4994d6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._suser32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499526
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sgdi32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499576
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._soleacc.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4995ab
mov dword [ebp - 0x78], ebx
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4995df
lea esi, [ebp + ecx - 0x54c]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x156c], dl
jne 0x4995d9
cmp eax, 2
jge 0x4995df
inc eax
dec esi
cmp eax, ecx
jl 0x4995c6
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x499606
mov ebx, ecx
lea esi, [ebp - 0x54c]
lea edi, [ebp - 0xd6c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xd6c], 0
test eax, eax
jle 0x499639
lea esi, [ebp + edx - 0x54b]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x49962c
mov byte [ebp + ecx - 0x156c], dl
jne 0x499634
mov byte [ebp + ecx - 0x156c], 0
inc ecx
cmp ecx, eax
jl 0x49961b
mov byte [ebp + eax - 0x156c], 0
mov al, byte [ebp - 0xd6a]
cmp al, 0x5c
je 0x499659
mov byte [ebp - 0xd6a], 0x5c
mov byte [ebp - 0xd69], 0
cmp byte [ebp - 0xd6b], 0x3a
je 0x49971e
lea edi, [ebp - 0xd6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x49968c
cmp byte [ebp + eax - 0xd6c], 0x3a
je 0x49968c
inc eax
cmp eax, ecx
jl 0x49967d
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x4996bc
mov ecx, edi
lea esi, [ebp + eax - 0xd6d]
mov ebx, ecx
lea edi, [ebp - 0x136c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x136b], 0
jne 0x4996f5
lea ecx, [ebp - 0x34c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x34c]
lea eax, [ebp - 0x136c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x136c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd6c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xd6a], 0x5c
je 0x49972e
mov byte [ebp - 0xd6a], 0x5c
lea ecx, [ebp - 0x54c]
xor esi, esi
push ecx
mov dword [ebp - 0x108], esi
call fcn.004abe70
add esp, 4
cmp eax, ebx
je 0x499767
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xd6b], 0x3a
je 0x49978e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xd6a], 0x5c
je 0x49979e
mov byte [ebp - 0xd6a], 0x5c
lea edx, [ebp - 0x1cc]
push 0x80
push edx
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xa2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x54c]
push 0x100
lea edx, [ebp - 0x84c]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x156c]
push 0x40
lea ecx, [ebp - 0x9ac]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0xd6c]
push edx
call fcn.004cb750
add esp, 0x1c
cmp eax, 2
jne 0x499898
lea eax, [ebp - 0x84c]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x84c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x84c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x49986b
lea eax, [ebp - 0x84c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x49986b
lea ecx, [ebp - 0x84c]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x74c]
mov edi, 0x526c24
jmp 0x499876
lea edx, [ebp - 0x74c]
mov edi, 0x526be4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49c2e2
cmp eax, ebx
jne 0x499926
mov dword [ebp - 0x108], ebx
cmp dword [ebp - 0x28], esi
jne 0x499995
cmp dword [ebp - 0x3c], ebx
jne 0x499995
lea eax, [ebp - 0x156c]
push str.linkinfo.dll
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499995
lea ecx, [ebp - 0x84c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x84c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x499968
lea eax, [ebp - 0x84c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x499968
lea ecx, [ebp - 0x84c]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x74c]
mov edi, 0x526b90
jmp 0x499973
cmp eax, esi
jne 0x4998a6
lea edx, [ebp - 0x54c]
push str.KeyMask.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4998a6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x74c]
mov edi, 0x526b40
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49c2e2
lea edx, [ebp - 0x54c]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
mov dword [ebp - 0x140], esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4999d9
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push 0x80
lea ecx, [ebp - 0xeec]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x54c]
push 0x80
lea eax, [ebp - 0xdec]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xa2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x1cc]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xeec], al
lea edx, [ebp - 0xeec]
mov byte [ebp + ecx - 0xdec], al
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x499a84
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499a84
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0xdec]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499ad1
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499ad1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x54c]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x499b1c
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499b1c
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x499b67
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499b67
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x54c]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x499bb2
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x499bb2
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xa2c]
lea eax, [ebp - 0x10ec]
push edx
push str._s_fonts
push eax
call fcn.004f175f
lea ecx, [ebp - 0xd6c]
lea edx, [ebp - 0x10ec]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x499bea
mov dword [ebp - 0x100], ebx
xor esi, esi
xor edi, edi
push 0xd53b20
mov dword [ebp - 4], 2
mov dword [ebp - 0x58], edi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x48], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x7c], esi
call fcn.004a6b50
add esp, 4
lea eax, [ebp - 0x54c]
push 0xd53b20
push eax
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x499c3a
mov dword [ebp + 8], ebx
jmp 0x49a4b2
mov ecx, dword [0xd53b28]
mov byte [ebp - 4], 3
push ecx
call fcn.004a6bb0
mov edx, dword [0xd53b28]
add esp, 4
mov dword [ebp - 0x14c], eax
push edx
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x499ca8
mov dword [ebp + 8], 2
mov edx, dword [0xd53b28]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x40], esi
jne 0x49a35e
mov dword [ebp + 8], 6
jmp 0x49a4a0
mov dword [ebp - 0x18], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x499c73
mov eax, dword [eax + 0xc]
mov ecx, dword [0xd53b28]
mov edx, dword [ebp - 0x14c]
push eax
push ecx
push edx
call fcn.004a6c30
mov ecx, dword [ebp - 0x24]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x24], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x148], eax
call fcn.004f61e0
add esp, 0x10
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x144], eax
cmp esi, 0x69
jge 0x499dbc
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x499db6
cmp esi, 0xf
jle 0x499d45
cmp esi, 0x12
jge 0x499d45
mov dword [ebp - 0x98], ebx
cmp esi, 0x1d
je 0x499d54
cmp esi, 0x1e
je 0x499d54
cmp esi, 0x39
jne 0x499d5a
mov dword [ebp - 0x8c], ebx
cmp esi, 0x1f
je 0x499d64
cmp esi, 0x20
jne 0x499d6a
mov dword [ebp - 0x94], ebx
cmp esi, 0x21
je 0x499d74
cmp esi, 0x22
jne 0x499d7a
mov dword [ebp - 0x9c], ebx
cmp esi, 0x23
je 0x499d84
cmp esi, 0x24
jne 0x499d8a
mov dword [ebp - 0x88], ebx
cmp esi, 0x2c
jne 0x499d98
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x499d0f
cmp esi, 0x2d
je 0x499db3
cmp esi, 0x2e
jne 0x499dae
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x499d0f
cmp esi, 0x3d
jne 0x499db6
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x499d0f
mov ecx, dword [0xd53b28]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0x138], 0
call fcn.004a6bb0
mov edx, dword [0xd53b28]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x40], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x18]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x499dff
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd53b28]
push eax
push edx
push esi
mov dword [ebp - 0x74], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x499c73
mov eax, dword [eax]
test eax, eax
je 0x49a32f
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x499e89
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x96c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xb4c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xb4c]
jmp 0x499f09
mov ecx, dword [0xd53b28]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x499ec0
xor edx, edx
lea eax, [ebp - 0x96c]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x499f09
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x96c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xb6c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xb6c]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x49a2cb
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49a2c5
cmp esi, 0x45
jne 0x499fde
lea edx, [ebp - 0x34c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x34c]
lea ecx, [ebp - 0x126c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x126c]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x499fa3
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0xfec]
push eax
push 0x5153f4
push ecx
jmp 0x499fb6
lea edx, [ebp - 0x94c]
lea eax, [ebp - 0xfec]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xfec]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x499feb
mov dword [ebp - 0x54], edi
inc esi
jmp 0x499f10
cmp esi, edi
jne 0x499ff8
mov dword [ebp - 0x70], edi
inc esi
jmp 0x499f10
cmp esi, 2
je 0x49a2c5
cmp esi, 4
jne 0x49a012
mov dword [ebp - 0x124], edi
inc esi
jmp 0x499f10
cmp esi, 5
jne 0x49a023
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x499f10
cmp esi, 6
jne 0x49a034
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x499f10
cmp esi, 7
jne 0x49a045
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x499f10
cmp esi, 8
jne 0x49a056
mov dword [ebp - 0x120], edi
inc esi
jmp 0x499f10
cmp esi, 9
jne 0x49a067
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x499f10
cmp esi, 0xa
jne 0x49a078
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x499f10
cmp esi, 0xb
jne 0x49a089
mov dword [ebp - 0x110], edi
inc esi
jmp 0x499f10
jle 0x49a093
cmp esi, 0xf
jge 0x49a096
mov dword [ebp - 0x38], edi
cmp esi, 0xf
jne 0x49a0a4
mov dword [ebp - 0xec], edi
inc esi
jmp 0x499f10
jle 0x49a0b1
cmp esi, 0x12
jge 0x49a0b1
mov dword [ebp - 0x98], edi
cmp esi, 0x1b
jne 0x49a0c2
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x499f10
cmp esi, 0x1c
jne 0x49a0d3
mov dword [ebp - 0xac], edi
inc esi
jmp 0x499f10
cmp esi, 0x1d
je 0x49a0e2
cmp esi, 0x1e
je 0x49a0e2
cmp esi, 0x39
jne 0x49a0e8
mov dword [ebp - 0x8c], edi
cmp esi, 0x1f
je 0x49a0f2
cmp esi, 0x20
jne 0x49a0f8
mov dword [ebp - 0x94], edi
cmp esi, 0x21
je 0x49a102
cmp esi, 0x22
jne 0x49a108
mov dword [ebp - 0x9c], edi
cmp esi, 0x23
je 0x49a112
cmp esi, 0x24
jne 0x49a118
mov dword [ebp - 0x88], edi
cmp esi, 0x25
je 0x49a122
cmp esi, 0x26
jne 0x49a128
mov dword [ebp - 0xc4], edi
cmp esi, 0x27
jne 0x49a139
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x499f10
cmp esi, 0x28
jne 0x49a14a
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x499f10
cmp esi, 0x29
jne 0x49a15b
mov dword [ebp - 0x104], edi
inc esi
jmp 0x499f10
cmp esi, 0x2c
jne 0x49a169
mov dword [ebp - 0x80], edi
inc esi
jmp 0x499f10
cmp esi, 0x2d
jne 0x49a177
mov dword [ebp - 0x44], edi
inc esi
jmp 0x499f10
cmp esi, 0x2e
jne 0x49a188
mov dword [ebp - 0x90], edi
inc esi
jmp 0x499f10
cmp esi, 0x2f
jne 0x49a199
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x499f10
cmp esi, 0x30
jne 0x49a1aa
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x499f10
cmp esi, 0x31
jne 0x49a1bb
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x499f10
cmp esi, 0x32
jne 0x49a1cc
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x499f10
cmp esi, 0x34
jne 0x49a1dd
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x499f10
cmp esi, 0x35
jne 0x49a1ee
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x499f10
cmp esi, 0x36
jne 0x49a1ff
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x499f10
cmp esi, 0x37
jne 0x49a214
mov dword [ebp - 0xc8], 0
inc esi
jmp 0x499f10
cmp esi, 0x38
jne 0x49a225
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x499f10
cmp esi, 0x3a
je 0x49a234
cmp esi, 0x3b
je 0x49a234
cmp esi, 0x3c
jne 0x49a23a
mov dword [ebp - 0xd8], edi
cmp esi, 0x3d
jne 0x49a248
mov dword [ebp - 0x44], edi
inc esi
jmp 0x499f10
cmp esi, 0x3e
jne 0x49a259
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x499f10
cmp esi, 0x3f
jne 0x49a26a
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x499f10
cmp esi, 0x40
jne 0x49a278
mov dword [ebp - 0x70], edi
inc esi
jmp 0x499f10
cmp esi, 0x41
jne 0x49a289
inc esi
jmp 0x499f10
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x148]
inc ecx
cmp eax, edi
mov dword [ebp - 0x48], ecx
jne 0x49a2df
inc dword [ebp - 0x58]
cmp dword [ebp - 0x144], edi
jne 0x49a2ed
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x48], 0xc350
jg 0x49a32f
mov esi, dword [ebp - 0x138]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x138], esi
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x20], ecx
mov eax, ecx
jmp 0x499e1e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10c], eax
jmp 0x499caf
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x74], ebx
cmp bx, word [esi + 2]
jae 0x49a4a0
xor ecx, ecx
push str..asp
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x60], cl
mov edx, dword [edi]
mov dword [ebp - 0x68], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x49a3ae
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x68]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a3c6
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x68]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a3de
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x68]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a3f6
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x68]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a40e
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x68]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a426
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x68]
push str.upx0
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a43e
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0x68]
push str.upx1
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x49a456
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x68]
push 0x50dc3c
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49a46e
inc dword [ebp - 0x7c]
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x74], eax
jg 0x49a4a0
mov esi, dword [ebp - 0x40]
add edi, 0x28
inc ebx
jmp 0x49a371
mov edi, dword [ebp - 0x58]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x49a4cc
mov dword [ebp + 8], 3
push 0xd53b20
call fcn.004a6b50
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, ebx
jne 0x49a4fe
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18], esi
test eax, eax
mov dword [ebp - 0x20], edi
jne 0x49ac23
cmp esi, ebx
jge 0x49ac23
lea edx, [ebp - 0xd6c]
xor esi, esi
push edx
mov dword [ebp - 0x24], esi
call fcn.004f2beb
jmp 0x49a53d
lea eax, [ebp - 0x156c]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xfec]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x49a56e
push ebx
lea ecx, [ebp - 0x314]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x49a598
lea edx, [ebp - 0xfec]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x49a5ac
lea eax, [ebp - 0x84c]
push str.c:endpcachemonitor_procPath2.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp - 0x7c], esi
push ecx
push ebx
push str.c:endpcachemonitor_procPath2.txt
lea ecx, [ebp - 0x314]
call fcn.004f0727
mov edx, dword [ebp - 0x314]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x310]
cmp dword [eax + 0x30], 0xffffffff
jne 0x49a5f9
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x49a7b2
mov esi, dword [ebp - 0x310]
push 0xa
lea ecx, [ebp - 0xb2c]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x310], esi
call fcn.004f0ae9
lea edi, [ebp - 0xb2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x49abaf
lea edx, [ebp - 0xb2c]
push str.Bound_to
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49abaf
lea eax, [ebp - 0xb2c]
push str.Dump_of
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49abaf
lea ecx, [ebp - 0xb2c]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x49abaf
lea edx, [ebp - 0xb2c]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49a6aa
mov dword [ebp - 0x13c], ebx
lea eax, [ebp - 0xb2c]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49a6cc
push 0x5147b4
jmp 0x49a7aa
cmp dword [ebp - 0x6c], ebx
jne 0x49a6d4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x14], ebx
jne 0x49a6dc
inc dword [ebp - 0x20]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x49abac
lea ecx, [esi + esi*2]
lea edx, [ebp - 0xb2c]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x49aba6
mov ecx, dword [ebp - 0x134]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x134], ecx
jne 0x49a7e1
lea eax, [ebp - 0x126c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x126c]
lea edx, [ebp - 0xe6c]
push ecx
push str._sMicrosoft.NETFramework
push edx
call fcn.004f175f
lea eax, [ebp - 0xe6c]
push eax
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x49a788
lea edx, [ebp - 0x94c]
lea eax, [ebp - 0x10ec]
push edx
push 0x5153f4
push eax
jmp 0x49a79b
lea ecx, [ebp - 0x94c]
lea edx, [ebp - 0x10ec]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x10ec]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x300]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x300]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x49a7fe
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x24], edx
jle 0x49a820
jmp 0x49a81d
cmp esi, 0x1a
jne 0x49a888
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x24], edx
jle 0x49a820
sub dword [ebp - 0x18], eax
lea ecx, [ebp - 0xb2c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0xb2c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0xb2c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x49a874
test ebx, ebx
jne 0x49a874
test eax, eax
jne 0x49a874
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x49a6e0
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x49a6e0
cmp esi, 0x2a
jne 0x49a89f
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x49a6e0
cmp esi, 0x2b
jne 0x49a8b6
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x49a6e0
cmp esi, edi
jne 0x49a8c3
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x49a6e0
cmp esi, ebx
jne 0x49a8d0
mov dword [ebp - 0x70], ebx
inc esi
jmp 0x49a6e0
cmp esi, 2
je 0x49aba6
cmp esi, 4
jne 0x49a8ea
mov dword [ebp - 0x124], ebx
inc esi
jmp 0x49a6e0
cmp esi, 5
jne 0x49a8fb
mov dword [ebp - 0xf4], ebx
inc esi
jmp 0x49a6e0
cmp esi, 6
jne 0x49a90c
mov dword [ebp - 0x12c], ebx
inc esi
jmp 0x49a6e0
cmp esi, 7
jne 0x49a91d
mov dword [ebp - 0xfc], ebx
inc esi
jmp 0x49a6e0
cmp esi, 8
jne 0x49a92e
mov dword [ebp - 0x120], ebx
inc esi
jmp 0x49a6e0
cmp esi, 9
jne 0x49a93f
mov dword [ebp - 0xd4], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0xa
jne 0x49a950
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0xb
jne 0x49a961
mov dword [ebp - 0x110], ebx
inc esi
jmp 0x49a6e0
jle 0x49a96b
cmp esi, 0xf
jge 0x49a96e
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x49a97c
mov dword [ebp - 0xec], ebx
inc esi
jmp 0x49a6e0
jle 0x49a989
cmp esi, 0x12
jge 0x49a989
mov dword [ebp - 0x98], ebx
cmp esi, 0x11
jle 0x49a996
cmp esi, 0x19
jge 0x49a996
mov dword [ebp - 0x30], ebx
cmp esi, 0x1b
jne 0x49a9a7
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0x1c
jne 0x49a9b8
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0x1d
je 0x49a9c7
cmp esi, 0x1e
je 0x49a9c7
cmp esi, 0x39
jne 0x49a9cd
mov dword [ebp - 0x8c], ebx
cmp esi, 0x1f
je 0x49a9d7
cmp esi, 0x20
jne 0x49a9dd
mov dword [ebp - 0x94], ebx
cmp esi, 0x21
je 0x49a9e7
cmp esi, 0x22
jne 0x49a9ed
mov dword [ebp - 0x9c], ebx
cmp esi, 0x23
je 0x49a9f7
cmp esi, 0x24
jne 0x49a9fd
mov dword [ebp - 0x88], ebx
cmp esi, 0x25
je 0x49aa07
cmp esi, 0x26
jne 0x49aa0d
mov dword [ebp - 0xc4], ebx
cmp esi, 0x27
jne 0x49aa1e
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0x28
jne 0x49aa2f
mov dword [ebp - 0xcc], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0x29
jne 0x49aa40
mov dword [ebp - 0x104], ebx
inc esi
jmp 0x49a6e0
cmp esi, 0x2c
jne 0x49aa4e
inc esi
jmp 0x49a6e0
inc dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x30c], 1
je 0x49a5f9
lea ecx, [ebp - 0x314]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jle 0x49abe2
sub eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x20]
cmp edx, ecx
jle 0x49abee
sub edx, ecx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0xf0]
test ecx, ecx
jne 0x49ac03
cmp eax, 6
jle 0x49ac03
sub eax, 6
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x300]
call fcn.004f05fb
mov edi, dword [ebp - 0x58]
mov esi, dword [ebp - 0x48]
cmp dword [ebp + 8], 2
jne 0x49ac61
mov eax, dword [ebp - 0x84]
test eax, eax
jle 0x49ac61
test esi, esi
jne 0x49ac61
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x49ac61
cmp dword [ebp - 0x28], ebx
jne 0x49ac61
push 0x526b20
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
mov byte [ebp - 0x74c], 0
cmp eax, ebx
jne 0x49acd6
mov edi, 0x51efec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jge 0x49acb5
cmp dword [ebp - 0x128], 0x19000
jle 0x49acd3
push 0x51efd8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x58]
cmp dword [ebp - 0x118], ebx
jne 0x49ad10
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jge 0x49acf2
mov eax, dword [ebp - 0x128]
cmp eax, 0x32000
jle 0x49ad19
push 0x51efc4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x130], ebx
jne 0x49ad4a
cmp ecx, ebx
jge 0x49ad2c
cmp eax, 0x32000
jle 0x49ad4a
push 0x51efac
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x57800
jle 0x49addf
cmp dword [ebp - 0xa4], 0x3c
jle 0x49ad9b
cmp edi, 0x3c
jle 0x49ad9b
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0x74c]
push eax
push 0x526038
push ecx
call fcn.004f175f
lea edx, [ebp - 0x74c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x46
jle 0x49addf
cmp eax, 0x64000
jle 0x49addf
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0x74c]
push eax
push 0x526038
push ecx
call fcn.004f175f
lea edx, [ebp - 0x74c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, ebx
jle 0x49ae75
cmp eax, 0x3e800
jle 0x49ae75
cmp dword [ebp - 0xa4], 0x3c
jle 0x49ae38
cmp edi, 0x3c
jle 0x49ae38
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0x74c]
push eax
push 0x526038
push ecx
call fcn.004f175f
lea edx, [ebp - 0x74c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x50
jle 0x49ae75
lea eax, [ebp - 0x94c]
lea ecx, [ebp - 0x74c]
push eax
push 0x526038
push ecx
call fcn.004f175f
lea edx, [ebp - 0x74c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x12c]
xor ebx, ebx
cmp eax, 1
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
jne 0x49aeb8
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x49aefc
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp + 8], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 0x14], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x120]
mov eax, 1
cmp ecx, eax
jne 0x49af40
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], eax
jne 0x49af7e
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xb4], eax
jne 0x49afbf
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xf4], eax
je 0x49afcf
cmp dword [ebp - 0xbc], eax
jne 0x49b004
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x114], eax
jne 0x49b045
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xc4], eax
jne 0x49b082
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xfc], eax
jne 0x49b0c3
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x54], eax
jne 0x49b13b
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
inc ebx
cmp eax, 1
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
jne 0x49b13b
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xcc]
mov eax, 1
cmp ecx, eax
jne 0x49b18a
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x124], eax
jne 0x49b1cb
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xd4], eax
jne 0x49b20c
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x104], eax
jne 0x49b249
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x49b2e8
cmp dword [ebp - 0xdc], eax
je 0x49b26f
cmp dword [ebp - 0x11c], eax
je 0x49b26f
lea edx, [ebp - 0x74c]
mov edi, 0x515278
jmp 0x49b2ba
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe4]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x74c]
mov edi, 0x515258
je 0x49b2ba
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xa8], eax
jne 0x49b329
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xec], eax
jne 0x49b371
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x4c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x98], eax
jne 0x49b3b9
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x4c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x30], eax
jne 0x49b438
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ebx
cmp eax, ecx
jne 0x49b43d
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x49b43d
mov ecx, 1
cmp dword [ebp - 0xac], ecx
jne 0x49b501
cmp dword [ebp - 0xb0], ecx
jne 0x49b501
cmp dword [ebp - 0xb8], ecx
jne 0x49b501
cmp dword [ebp - 0xc0], ecx
jne 0x49b4b1
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x74c]
cmp eax, ecx
mov edi, 0x5151ec
je 0x49b483
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0xc8], ecx
jne 0x49b501
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x74c]
cmp eax, ecx
mov edi, 0x5151c4
je 0x49b4d3
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0xd0], ecx
jne 0x49b53e
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x8c], ecx
jne 0x49b589
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
mov ecx, 1
jne 0x49b585
mov dword [ebp - 0x4c], ecx
inc ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x94], ecx
jne 0x49b5ca
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0x9c], ecx
jne 0x49b60b
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0x88], ecx
jne 0x49b64c
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x49b696
mov eax, dword [ebp - 0x13c]
test eax, eax
jne 0x49b696
mov edi, 0x516ba4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0x80], ecx
jne 0x49b6d4
mov edi, str.PING
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0x44], ecx
jne 0x49b712
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0x90], ecx
jne 0x49b753
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0xd8], ecx
jne 0x49b794
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0xe0], ecx
jne 0x49b7d1
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x24]
cmp eax, ecx
jne 0x49b7df
mov eax, 4
jmp 0x49b7e2
lea eax, [eax + eax*2]
cmp dword [ebp - 0x18], eax
jge 0x49b823
mov edi, 0x516b88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x49b86b
cmp dword [ebp - 0x24], ecx
jne 0x49b86b
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, 1
cmp dword [ebp - 0xe8], ecx
jne 0x49b8b8
cmp eax, 5
jge 0x49b8b8
test eax, eax
jle 0x49b8b8
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 7
jge 0x49b9dd
cmp dword [ebp - 0x34], ecx
jne 0x49b959
cmp eax, ecx
lea edx, [ebp - 0x74c]
jge 0x49b918
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
mov ecx, 1
jle 0x49b90d
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xf8], ecx
jmp 0x49b9d6
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, ecx
je 0x49b9d3
cmp dword [ebp - 0x28], ecx
jne 0x49b9d6
cmp eax, ecx
lea edx, [ebp - 0x74c]
jge 0x49b99a
mov edi, 0x515078
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0xf8], ecx
jmp 0x49b9c9
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x38], ecx
je 0x49b9d3
cmp dword [ebp - 0x28], ecx
jne 0x49b9d6
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
inc ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x2c], ecx
jne 0x49bb59
test ebx, ebx
jle 0x49bb59
cmp dword [ebp - 0x3c], ecx
je 0x49b9fb
cmp eax, ecx
jge 0x49bb59
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x84c]
push eax
call esi
lea ecx, [ebp - 0x84c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x49ba6d
cmp dword [ebp - 0x100], 1
jne 0x49bb70
test ebx, ebx
jle 0x49bb70
mov esi, 1
mov dword [ebp - 0x14], esi
jmp 0x49bb73
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x49bc38
mov eax, dword [ebp - 0x108]
test eax, eax
jne 0x49bc38
cmp dword [ebp - 0x1c], 5
jle 0x49bd69
lea ecx, [ebp - 0x74c]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret