Function at 0x46e050
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb5eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x15e0
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xbf0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x3b0]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [ebp - 0x3b0]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
cmp edx, 3
jge 0x46e1e2
push ebx
lea ecx, [ebp - 0x3b0]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x3b0]
xor ecx, ecx
cmp al, 0x25
jne 0x46e1f3
mov ecx, 1
lea ebx, [edx - 2]
test ebx, ebx
jle 0x46e21d
mov al, byte [ebp + ebx - 0x3b0]
cmp al, 0x3a
jne 0x46e20f
cmp byte [ebp + ebx - 0x3af], 0x5c
je 0x46e21d
cmp ecx, 1
jne 0x46e218
cmp al, 0x5c
je 0x46e222
dec ebx
test ebx, ebx
jg 0x46e1fa
cmp ecx, 1
jne 0x46e27e
sub edx, ebx
xor eax, eax
dec edx
test edx, edx
jle 0x46e248
mov ecx, edx
lea esi, [ebp + ebx - 0x3af]
mov eax, ecx
lea edi, [ebp - 0x830]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x830], 0
lea edi, [ebp - 0x830]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x3b0]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x46e44e
test ebx, ebx
je 0x46e44e
lea edi, [ebp - 0x3b0]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x12f0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
jle 0x46e3e8
mov cl, 0x54
mov al, byte [ebp + edx - 0x3b0]
cmp al, 0x2e
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x65
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x45
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x64
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x44
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x6f
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x4f
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x63
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x43
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x73
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x53
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x70
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x50
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x62
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x42
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], 0x74
je 0x46e3e8
cmp al, al
jne 0x46e3df
cmp byte [ebp + edx - 0x3af], cl
je 0x46e3e8
cmp al, al
je 0x46e3e8
dec edx
test edx, edx
jg 0x46e2bd
sub edx, ebx
mov byte [ebp - 0x3b0], 0
lea ecx, [edx + 5]
test ecx, ecx
jle 0x46e413
mov eax, ecx
lea esi, [ebp + ebx - 0x12f1]
lea edi, [ebp - 0x3b0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3b0]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0x3ab], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x46e43e
cmp byte [ebp + ecx - 0x3b0], 0x2e
je 0x46e43e
dec ecx
test ecx, ecx
jg 0x46e42f
test ecx, ecx
mov byte [ebp + ecx - 0x3ac], 0
jne 0x46e514
lea ecx, [ebp - 0xef0]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xe70]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3b0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x830]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x830]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46e4f2
lea edx, [ebp - 0x830]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46e4f2
lea eax, [ebp - 0x830]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46e4f2
lea ecx, [ebp - 0x830]
lea edx, [ebp - 0xef0]
push ecx
jmp 0x46e4ff
lea ecx, [ebp - 0x830]
lea edx, [ebp - 0xe70]
push ecx
push edx
lea eax, [ebp - 0x3b0]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x3b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x46e5cd
mov al, byte [ebp + ecx - 0x3b0]
cmp al, 0x2e
jne 0x46e5c4
mov dl, byte [ebp + ecx - 0x3af]
cmp dl, 0x65
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x45
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x64
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x44
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x6f
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x4f
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x63
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x43
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x73
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x53
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x70
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x50
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x62
je 0x46e5cd
cmp al, al
jne 0x46e5c4
cmp dl, 0x42
je 0x46e5cd
cmp al, al
je 0x46e5cd
dec ecx
test ecx, ecx
jg 0x46e52c
mov byte [ebp + ecx - 0x3ac], 0
lea ecx, [ebp - 0x3b0]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x46e5f3
push 0x515844
jmp 0x470c32
lea edx, [ebp - 0x1b0]
lea eax, [ebp - 0x3b0]
push edx
push eax
call fcn.004d9590
movsx ebx, ax
lea ecx, [ebp - 0xb70]
lea edx, [ebp - 0x3b0]
push ecx
push edx
mov dword [ebp - 0x8c], ebx
call fcn.004da170
lea eax, [ebp - 0xb70]
push eax
push str.PowerWord
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x46e644
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x1b0]
push str.Maxthon_International
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e666
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x1b0]
push str.MoreQuick
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e688
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x1b0]
push str.Opera_Software
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e6aa
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x1b0]
push str.Beijing_Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e6ea
mov edi, 0x5157e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Trend_Micro_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e72a
mov edi, 0x5157c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e76a
mov edi, 0x5157ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e7aa
mov edi, 0x515790
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e7ea
mov edi, 0x515764
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Network_Associates
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e82a
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e86a
mov edi, 0x515740
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e8aa
mov edi, 0x51570c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Panda_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e8ea
mov edi, 0x5156ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e92a
mov edi, 0x5156c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b0]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e96a
mov edi, 0x5156ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3b0]
push 0x5156a4
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e98c
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x3b0]
push str.java
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e9ae
push 0x5147b4
jmp 0x470c32
cmp ebx, 2
jle 0x46ea3f
lea eax, [ebp - 0x3b0]
push str.Network_Associates
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e9d9
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x3b0]
push str.kav.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46e9fb
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x3b0]
push str.Kav.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46ea1d
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x3b0]
push str.System32_smss.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46ea3f
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x1b0]
xor esi, esi
push str.Microsoft
push ecx
mov dword [ebp - 0x58], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46ea63
mov dword [ebp - 0x58], 1
lea edx, [ebp - 0x3b0]
push str.CCManager
push edx
call fcn.004f2d80
add esp, 8
cmp eax, esi
je 0x46ea85
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x9f0]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._swinlogon.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46eae5
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._scsrss.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46eb21
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x430]
lea edx, [ebp - 0x530]
push ecx
push str._s_services.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46eb5d
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._slsass.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46eb99
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._s_svchost.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ebd5
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x430]
lea edx, [ebp - 0x530]
push ecx
push str._suserinit.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ec11
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._s_taskmgr.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ec4d
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._s_spoolsv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ec89
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x9f0]
lea edx, [ebp - 0x530]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ecc5
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x3b0]
push edx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46ece7
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._sctfmon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ed23
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x430]
lea edx, [ebp - 0x530]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ed5f
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ed9b
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._swsock32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46edd7
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x430]
lea edx, [ebp - 0x530]
push ecx
push str._sws2_32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ee13
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ee4f
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x530]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ee8b
push 0x5147b4
jmp 0x470c32
lea ecx, [ebp - 0x430]
lea edx, [ebp - 0x530]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b0]
lea ecx, [ebp - 0x530]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46eec7
push 0x5147b4
jmp 0x470c32
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x530]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3b0]
lea edx, [ebp - 0x530]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ef03
push 0x5147b4
jmp 0x470c32
lea eax, [ebp - 0x9f0]
lea ecx, [ebp - 0x530]
push eax
push str._s_anotherlockfile.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3b0]
lea eax, [ebp - 0x530]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46ef3f
push 0x5147b4
jmp 0x470c32
lea edi, [ebp - 0x3b0]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x20], esi
cmp ecx, esi
jle 0x46ef77
lea esi, [ebp + ecx - 0x3b0]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xdf0], al
jne 0x46ef71
cmp edx, 2
jge 0x46ef77
inc edx
dec esi
cmp edx, ecx
jl 0x46ef5f
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x46ef99
mov ebx, ecx
lea esi, [ebp - 0x3b0]
lea edi, [ebp - 0x11f0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov ebx, 1
test edx, edx
mov byte [ebp + eax - 0x11f0], 0
jle 0x46efe2
mov edi, dword [ebp - 0x38]
lea esi, [ebp + eax - 0x3af]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x46efc4
mov byte [ebp + ecx - 0xdf0], al
cmp al, 0x2e
jne 0x46efc9
inc edi
cmp al, 0x20
jne 0x46efce
inc edi
cmp al, 0x5c
jne 0x46efda
mov byte [ebp + ecx - 0xdf0], 0
inc ecx
cmp ecx, edx
jl 0x46efb6
mov dword [ebp - 0x38], edi
mov al, byte [ebp - 0x11ee]
mov byte [ebp + edx - 0xdf0], 0
cmp al, 0x5c
je 0x46f002
mov byte [ebp - 0x11ee], 0x5c
mov byte [ebp - 0x11ed], 0
lea ecx, [ebp - 0x11f0]
lea edx, [ebp - 0xbf0]
push ecx
push edx
call fcn.004f61e0
lea eax, [ebp - 0x11f0]
push str.LOCALS1Temp
push eax
call fcn.004f61e0
lea ecx, [ebp - 0x3b0]
push 0x100
lea edx, [ebp - 0x930]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0xdf0]
push 0x40
lea ecx, [ebp - 0x970]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x3b0]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x34
test eax, eax
jne 0x46f07d
push 0x5144fc
jmp 0x470c32
lea eax, [ebp - 0x3b0]
push 0x80
lea ecx, [ebp - 0xa70]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x3b0]
push 0x80
lea eax, [ebp - 0xaf0]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0x9f0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x430]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xa70], al
lea edx, [ebp - 0xa70]
mov byte [ebp + ecx - 0xaf0], al
lea ecx, [ebp - 0x9f0]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x46f10d
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f10d
push esi
jmp 0x470c32
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0xaf0]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f142
push 0x5144fc
push esi
mov dword [ebp - 0x20], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f142
push esi
jmp 0x470c32
lea edx, [ebp - 0x3b0]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46f19b
push 0x5144fc
push esi
mov dword [ebp - 0x20], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f175
push esi
jmp 0x470c32
lea eax, [ebp - 0x3b0]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x46f19b
push edi
jmp 0x470c32
lea ecx, [ebp - 0x3b0]
push str.system32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46f1f4
push 0x5144fc
push esi
mov dword [ebp - 0x20], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f1ce
push esi
jmp 0x470c32
lea edx, [ebp - 0x3b0]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x46f1f4
push edi
jmp 0x470c32
lea eax, [ebp - 0x3b0]
push str.system
push eax
call fcn.004f2d80
xor edi, edi
add esp, 8
cmp eax, edi
je 0x46f24f
push 0x5144fc
push esi
mov dword [ebp - 0x20], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46f229
push esi
jmp 0x470c32
lea ecx, [ebp - 0x3b0]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x46f24f
push esi
jmp 0x470c32
lea edx, [ebp - 0xdf0]
push str.smss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea eax, [ebp - 0xdf0]
push str.winlogon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea ecx, [ebp - 0xdf0]
push str.csrss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea edx, [ebp - 0xdf0]
push str.services.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea eax, [ebp - 0xdf0]
push str.lsass.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea ecx, [ebp - 0xdf0]
push str.svchost.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea edx, [ebp - 0xdf0]
push str.taskmgr.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea eax, [ebp - 0xdf0]
push str.spoolsv.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea ecx, [ebp - 0xdf0]
push str.explorer.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea edx, [ebp - 0xdf0]
push str.userinit.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea eax, [ebp - 0xdf0]
push str.ctfmon.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x470b3e
lea ecx, [ebp - 0x11f0]
push ecx
call fcn.004f2beb
jmp 0x46f3a1
lea edx, [ebp - 0xdf0]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0xff0]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x46f3d2
push ebx
lea ecx, [ebp - 0x12c]
call fcn.004f0653
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
call fcn.004abd90
cmp eax, ebx
jne 0x46f3ff
lea ecx, [ebp - 0xff0]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x46f413
lea edx, [ebp - 0x930]
push str.c:endpcachemonitor_procPath5.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x12c]
push eax
push ebx
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp + 8], edi
call fcn.004f0727
mov ecx, dword [ebp - 0x12c]
or edi, 0xffffffff
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x128]
cmp dword [eax + 0x30], edi
jne 0x46f474
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov dword [ebp - 4], edi
jmp 0x4708dc
mov ebx, dword [ebp - 0x130]
mov esi, 1
mov eax, dword [ebp - 0x128]
push 0xa
inc eax
push 0x100
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004f0ae9
lea edi, [ebp - 0x830]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x46fa47
lea ecx, [ebp - 0x830]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46f4d9
mov dword [ebp - 0x64], esi
lea edx, [ebp - 0x830]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46f4fb
push 0x5147b4
jmp 0x470a9b
lea eax, [ebp - 0x830]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46fa47
lea ecx, [ebp - 0x830]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46fa47
lea edx, [ebp - 0x830]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x46fa47
cmp dword [ebp - 0x1c], esi
jne 0x46f557
inc dword [ebp - 0x18]
cmp dword [ebp - 0x24], esi
jne 0x46f55f
inc dword [ebp - 0x2c]
cmp ebx, esi
jne 0x46f566
inc dword [ebp - 0x3c]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x46fa3b
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x830]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46fa35
mov ecx, dword [ebp - 0x4c]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x4c], ecx
jne 0x46f645
lea edx, [ebp - 0xe70]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xe70]
lea ecx, [ebp - 0xef0]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0xef0]
push edx
call fcn.004f2beb
xor ecx, ecx
push str.c:endpcache
test eax, eax
sete cl
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x46f61f
lea edx, [ebp - 0x1b0]
lea eax, [ebp - 0x12f0]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x12f0]
jmp 0x470a9a
lea ecx, [ebp - 0x1b0]
lea edx, [ebp - 0x12f0]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x12f0]
jmp 0x470a9a
cmp esi, 0x19
jne 0x46f6b0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edx
jle 0x46f665
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x830]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x46f71d
test ebx, ebx
jne 0x46f71d
test eax, eax
mov dword [ebp - 0x24], ebx
je 0x46f724
jmp 0x46f71d
cmp esi, 0x1a
jne 0x46f782
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edx
jle 0x46f6d4
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x830]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x46f71d
test ebx, ebx
jne 0x46f71d
test eax, eax
mov dword [ebp - 0x24], ebx
je 0x46f724
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x830]
push str.gdi32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x830]
push str.Gdi32
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x830]
push str.GDI32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x46f775
test ebx, ebx
jne 0x46f775
test eax, eax
jne 0x46f775
mov edi, 1
inc esi
jmp 0x46f56d
mov ebx, 1
inc esi
mov edi, ebx
jmp 0x46f56d
cmp esi, 0x2a
jne 0x46f798
xor ebx, ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x46f56d
cmp esi, 0x2b
jne 0x46f7ae
xor ebx, ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x46f56d
test esi, esi
jne 0x46f7bb
mov dword [ebp - 0x30], edi
inc esi
jmp 0x46f56d
cmp esi, edi
jne 0x46f7c8
mov dword [ebp - 0x44], edi
inc esi
jmp 0x46f56d
cmp esi, 2
je 0x46fa35
cmp esi, 4
jne 0x46f7e2
mov dword [ebp - 0x88], edi
inc esi
jmp 0x46f56d
cmp esi, 5
jne 0x46f7f0
mov dword [ebp - 0x70], edi
inc esi
jmp 0x46f56d
cmp esi, 6
jne 0x46f801
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x46f56d
cmp esi, 7
jne 0x46f80f
mov dword [ebp - 0x80], edi
inc esi
jmp 0x46f56d
cmp esi, 8
jne 0x46f81d
mov dword [ebp - 0x68], edi
inc esi
jmp 0x46f56d
cmp esi, 9
jne 0x46f82e
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x46f56d
cmp esi, 0xa
jne 0x46f83c
mov dword [ebp - 0x50], edi
inc esi
jmp 0x46f56d
cmp esi, 0xb
jne 0x46f84d
mov dword [ebp - 0xac], edi
inc esi
jmp 0x46f56d
jle 0x46f857
cmp esi, 0xf
jge 0x46f85a
mov dword [ebp - 0x34], edi
cmp esi, 0xf
jne 0x46f868
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x46f56d
jle 0x46f875
cmp esi, 0x12
jge 0x46f875
mov dword [ebp - 0xd4], edi
cmp esi, 0x11
jle 0x46f882
cmp esi, 0x19
jge 0x46f882
mov dword [ebp - 0x5c], edi
cmp esi, 0x1b
jne 0x46f893
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x46f56d
cmp esi, 0x1c
jne 0x46f8a4
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x46f56d
cmp esi, 0x1d
je 0x46f8b3
cmp esi, 0x1e
je 0x46f8b3
cmp esi, 0x39
jne 0x46f8b9
mov dword [ebp - 0x98], edi
cmp esi, 0x1f
je 0x46f8c3
cmp esi, 0x20
jne 0x46f8c9
mov dword [ebp - 0xa0], edi
cmp esi, 0x21
je 0x46f8d3
cmp esi, 0x22
jne 0x46f8d9
mov dword [ebp - 0xa8], edi
cmp esi, 0x23
je 0x46f8e3
cmp esi, 0x24
jne 0x46f8e6
mov dword [ebp - 0x60], edi
cmp esi, 0x25
je 0x46f8f0
cmp esi, 0x26
jne 0x46f8f6
mov dword [ebp - 0xc8], edi
cmp esi, 0x27
jne 0x46f907
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x46f56d
cmp esi, 0x28
jne 0x46f918
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x46f56d
cmp esi, 0x29
jne 0x46f929
mov dword [ebp - 0x90], edi
inc esi
jmp 0x46f56d
cmp esi, 0x2c
jne 0x46f937
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x46f56d
cmp esi, 0x2d
jne 0x46f945
mov dword [ebp - 0x40], edi
inc esi
jmp 0x46f56d
cmp esi, 0x2e
jne 0x46f953
mov dword [ebp - 0x74], edi
inc esi
jmp 0x46f56d
cmp esi, 0x2f
jne 0x46f964
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x46f56d
cmp esi, 0x30
jne 0x46f975
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x46f56d
cmp esi, 0x31
jne 0x46f986
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x46f56d
cmp esi, 0x32
jne 0x46f997
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x46f56d
cmp esi, 0x34
jne 0x46f9a8
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x46f56d
cmp esi, 0x35
jne 0x46f9b9
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x46f56d
cmp esi, 0x36
jne 0x46f9ca
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x46f56d
cmp esi, 0x37
je 0x46fa35
cmp esi, 0x38
jne 0x46f9e0
mov dword [ebp - 0x94], edi
inc esi
jmp 0x46f56d
cmp esi, 0x3a
je 0x46f9ef
cmp esi, 0x3b
je 0x46f9ef
cmp esi, 0x3c
jne 0x46f9f2
mov dword [ebp - 0x7c], edi
cmp esi, 0x3d
jne 0x46fa00
mov dword [ebp - 0x40], edi
inc esi
jmp 0x46f56d
cmp esi, 0x3e
jne 0x46fa11
inc esi
jmp 0x46f56d
mov eax, dword [ebp + 8]
mov esi, 1
inc eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x124], 1
je 0x46f47f
lea ecx, [ebp - 0x12c]
call fcn.004f076e
cmp dword [ebp - 0xac], esi
jne 0x46faa4
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.004f0714
lea ecx, [ebp - 0x118]
call fcn.004f05fb
mov eax, 0x51536c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x3c]
cmp eax, 5
jle 0x46faaf
sub eax, 5
cmp eax, 3
jle 0x46fac3
cmp dword [ebp - 0x20], esi
je 0x46fac3
push 0x515350
jmp 0x47083f
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x730], 0
cmp eax, esi
mov dword [ebp + 8], 0
jle 0x46fb0c
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xb0], esi
jne 0x46fb49
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x46fb96
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x68], esi
jne 0x46fbd0
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x44], esi
jne 0x46fc11
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xb8], esi
jne 0x46fc55
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x70], esi
je 0x46fc62
cmp dword [ebp - 0xc0], esi
jne 0x46fc97
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x78], esi
jne 0x46fcd8
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xc8], esi
jne 0x46fd15
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x80], esi
jne 0x46fd4f
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x30], esi
jne 0x46fd90
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xd0], esi
jne 0x46fddb
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x88], esi
jne 0x46fe1f
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x46fe63
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x90], esi
jne 0x46fea7
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x34], esi
jne 0x46ff49
cmp dword [ebp - 0xe4], esi
je 0x46fecd
cmp dword [ebp - 0xd8], esi
je 0x46fecd
lea edx, [ebp - 0x730]
mov edi, 0x515278
jmp 0x46ff18
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9c]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x730]
mov edi, 0x515258
je 0x46ff18
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xc4], esi
jne 0x46ff8d
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xa4], esi
jne 0x46ffd1
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xd4], esi
jne 0x470015
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x5c], esi
jne 0x470092
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x58]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x470097
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x470097
mov ebx, 1
cmp dword [ebp - 0xcc], ebx
jne 0x47014f
cmp dword [ebp - 0xb4], ebx
jne 0x47014f
cmp dword [ebp - 0xe0], ebx
jne 0x47014f
cmp dword [ebp - 0xbc], ebx
jne 0x470106
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x730]
cmp eax, ebx
mov edi, 0x5151ec
je 0x4700da
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp eax, ebx
jne 0x47014f
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x730]
cmp eax, ebx
mov edi, 0x5151c4
je 0x470123
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x94], ebx
jne 0x470187
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], ebx
jne 0x4701c6
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa0], ebx
jne 0x470205
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa8], ebx
jne 0x470244
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x60], ebx
jne 0x470280
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x4702ca
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x4702ca
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x38], ebx
jle 0x47030b
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x6c], ebx
jne 0x47034c
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x40], ebx
jne 0x47038d
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x74], ebx
jne 0x4703c7
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], ebx
jne 0x470408
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x84], ebx
jne 0x470445
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2c]
mov esi, 5
cmp eax, esi
jle 0x470456
sub eax, esi
mov dword [ebp - 0x2c], eax
cmp edx, ebx
mov eax, 4
je 0x470466
lea eax, [edx*4]
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
jle 0x470472
sub ecx, esi
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x48]
test edx, edx
jne 0x470484
cmp ecx, 6
jle 0x470484
sub ecx, 6
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
cmp ecx, eax
mov dword [ebp - 0x1c], ebx
jl 0x470495
cmp ecx, 7
jge 0x4704e3
mov eax, dword [ebp - 0x50]
mov ebx, 1
cmp eax, ebx
lea edx, [ebp - 0x730]
mov edi, 0x5150f8
je 0x4704b1
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x2c]
cmp edx, 1
jle 0x470533
cmp dword [ebp - 0x28], 1
jne 0x470533
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
mov ebx, 1
inc eax
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x50], 1
jne 0x47057a
cmp edx, 5
jge 0x47057a
test edx, edx
jle 0x47057a
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp - 0x1c], ebx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x8c]
cmp eax, 7
jge 0x470658
cmp dword [ebp - 0x20], 1
jne 0x47060e
cmp eax, 1
lea edx, [ebp - 0x730]
jge 0x4705d8
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x470655
mov dword [ebp + 8], 1
jmp 0x470655
mov edi, 0x515084
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x470655
jmp 0x470652
cmp eax, 1
lea edx, [ebp - 0x730]
mov edi, 0x515078
jl 0x470623
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x470655
mov dword [ebp + 8], eax
inc dword [ebp - 0x14]
lea eax, [ebp - 0x3b0]
push eax
call fcn.004d9260
movsx edx, ax
add esp, 4
test edx, edx
jne 0x4706aa
mov edi, 0x51505c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x730]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x4706b3
cmp edx, 1
jg 0x47083a
mov eax, dword [ebp - 0x8c]
cmp eax, 6
jle 0x4706d9
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x30]
test ecx, ecx
jne 0x4706dc
test edi, edi
jne 0x4706dc
test ebx, ebx
jne 0x4706dc
test edx, edx
jle 0x4706dc
jmp 0x47083a
mov edi, dword [ebp - 0x30]
cmp edx, 0xfffffffe
je 0x4706eb
cmp edx, 0xffffffff
je 0x4706eb
cmp edx, 0xfffffffd
jne 0x470708
cmp eax, 6
jle 0x470708
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x470708
test edi, edi
jne 0x470807
test ebx, ebx
jne 0x470710
jmp 0x47083a
test edi, edi
jne 0x470807
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x470807
cmp eax, 6
jle 0x470807
cmp dword [ebp - 0x58], 1
jne 0x47083a
push str.c:endpcache
mov dword [ebp - 4], 0
call fcn.004f2beb
mov eax, dword [ebp - 0x14]
add esp, 4
test eax, eax
jne 0x470879
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5147b4
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x118]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004f0714
lea ecx, [ebp - 0x118]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x470905
cmp edi, 1
je 0x470905
lea ecx, [ebp - 0x118]
call fcn.004f0714
lea ecx, [ebp - 0x118]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x730]
lea ecx, [ebp - 0x13f0]
push eax
push 0x514fd8
push ecx
call fcn.004f175f
lea edx, [ebp - 0x930]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x470958
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x118]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004f0714
lea ecx, [ebp - 0x118]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x930]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x470b65
lea edx, [ebp - 0x930]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x930]
push eax
call esi
lea ecx, [ebp - 0x930]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x470bd2
lea edx, [ebp - 0x930]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x930]
push eax
call esi
test eax, eax
jne 0x470bd2
lea ecx, [ebp - 0x930]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x470bd2
lea edx, [ebp - 0x930]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x730]
mov edi, 0x514f5c
jmp 0x470bdd
lea edx, [ebp - 0x730]
mov edi, 0x514f2c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x930]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x730]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret