Function at 0x41af60
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa92b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1858
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x1368]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x124], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
lea ebx, [ebp - 0x348]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x41b131
push edx
lea ecx, [ebp - 0x348]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x348]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x348]
push str.svchost__k_DcomLaunch
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b153
push 0x5147b4
jmp 0x41f098
lea ecx, [ebp - 0x348]
push str..exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b194
lea edx, [ebp - 0x348]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5168b0
jmp 0x41f098
lea ecx, [ebp - 0x348]
push str..Exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41b1c4
lea ecx, [ebp - 0x348]
push str..EXE_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b1fa
lea edx, [ebp - 0x348]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0xe56c84]
push 0x5168b0
inc esi
mov dword [0xe56c84], esi
jmp 0x41f098
lea ecx, [ebp - 0x348]
push 0x51688c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41b22a
lea edx, [ebp - 0x348]
push str.Rundll32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b237
mov esi, 1
mov dword [ebp - 0x13c], esi
jmp 0x41b23c
mov esi, 1
lea eax, [ebp - 0x348]
push 0x516878
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b257
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x348]
push str..Dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b272
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x348]
push str..DLL
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b28d
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x348]
push 0x516860
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b2ab
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x348]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b2c9
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x348]
push str..TMP
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b2e7
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x348]
push str._temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b305
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x348]
push str.Temp_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b323
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x348]
push str.TEMP_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b341
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x348]
push str.Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b35f
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x348]
push str.documents_and_settings_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b37d
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x348]
push str.Program_FilesCommon_Files
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b39b
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x348]
push str.program_Filescommon_Files
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41b3b9
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x348], al
jle 0x41b75e
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x8c8]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 0x8ba], 0
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41b4cc
lea edx, [ebp - 0x3c8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x3c6], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x41b49b
lea eax, [ecx - 0xe]
lea esi, [ebp - 0xb3a]
mov ecx, eax
lea edi, [ebp - 0xde8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xde8], 0
lea eax, [ebp - 0xde8]
lea ecx, [ebp - 0x3c8]
push eax
push ecx
lea edx, [ebp - 0x348]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x348], 0
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x8c8]
push str.Systemroot
push eax
mov byte [ebp - 0x8be], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41b5a8
lea ecx, [ebp - 0x3c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x41b560
lea eax, [ecx - 0xa]
lea esi, [ebp - 0xb3e]
mov ecx, eax
lea edi, [ebp - 0xde8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xde8], 0
lea eax, [ebp - 0xde8]
lea ecx, [ebp - 0x3c8]
push eax
push ecx
lea edx, [ebp - 0x348]
push 0x50e0ec
push edx
mov byte [ebp - 0x348], 0
call fcn.004f175f
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x348], al
lea eax, [ebp - 0x8c8]
push str.system32
push eax
mov byte [ebp - 0x8c0], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41b684
lea ecx, [ebp - 0x3c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x41b63c
lea eax, [ecx - 8]
lea esi, [ebp - 0xb40]
mov ecx, eax
lea edi, [ebp - 0xde8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xde8], 0
lea eax, [ebp - 0xde8]
lea ecx, [ebp - 0x3c8]
push eax
push ecx
lea edx, [ebp - 0x348]
push 0x50e0ec
push edx
mov byte [ebp - 0x348], 0
call fcn.004f175f
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x348], al
lea eax, [ebp - 0x8c8]
push str._Windir_
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41b759
lea ecx, [ebp - 0x3c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x41b711
lea eax, [ecx - 8]
lea esi, [ebp - 0xb40]
mov ecx, eax
lea edi, [ebp - 0xde8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xde8], 0
lea eax, [ebp - 0xde8]
lea ecx, [ebp - 0x3c8]
push eax
push ecx
lea edx, [ebp - 0x348]
push 0x50e0ec
push edx
mov byte [ebp - 0x348], 0
call fcn.004f175f
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x348], al
mov esi, 1
cmp byte [ebp - 0x348], 0x22
jne 0x41b7b4
xor ecx, ecx
test ebx, ebx
jle 0x41b786
lea edx, [ebp - 0xa48]
mov al, byte [ebp + ecx - 0x348]
cmp al, 0x22
je 0x41b781
mov byte [edx], al
inc edx
inc ecx
cmp ecx, ebx
jl 0x41b773
lea edi, [ebp - 0xa48]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x348]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov al, byte [ebp - 0x348]
xor ecx, ecx
cmp al, 0x25
jne 0x41b7c2
mov ecx, esi
lea edx, [ebx - 2]
test edx, edx
jle 0x41b7eb
mov al, byte [ebp + edx - 0x348]
cmp al, 0x3a
jne 0x41b7de
cmp byte [ebp + edx - 0x347], 0x5c
je 0x41b7eb
cmp ecx, esi
jne 0x41b7e6
cmp al, 0x5c
je 0x41b7ef
dec edx
test edx, edx
jg 0x41b7c9
cmp ecx, esi
jne 0x41b84d
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x41b817
mov ecx, ebx
lea esi, [ebp + edx - 0x347]
mov edx, ecx
lea edi, [ebp - 0xb48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xb48], 0
lea edi, [ebp - 0xb48]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x348]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b8fb
test edx, edx
je 0x41b8fb
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0xa48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x41b895
cmp byte [ebp + ebx - 0x348], 0x2e
je 0x41b895
dec ebx
test ebx, ebx
jg 0x41b886
sub ebx, edx
mov byte [ebp - 0x348], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x41b8c0
lea esi, [ebp + edx - 0xa49]
mov edx, ecx
lea edi, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x343], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41b8eb
cmp byte [ebp + ecx - 0x348], 0x2e
je 0x41b8eb
dec ecx
test ecx, ecx
jg 0x41b8dc
test ecx, ecx
mov byte [ebp + ecx - 0x344], 0
jne 0x41b9c1
lea eax, [ebp - 0x3c8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x1068]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x8c8]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41b99f
lea edx, [ebp - 0x8c8]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41b99f
lea eax, [ebp - 0x8c8]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41b99f
lea ecx, [ebp - 0x8c8]
lea edx, [ebp - 0x3c8]
push ecx
jmp 0x41b9ac
lea ecx, [ebp - 0x8c8]
lea edx, [ebp - 0x1068]
push ecx
push edx
lea eax, [ebp - 0x348]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41b9e4
cmp byte [ebp + ecx - 0x348], 0x2e
je 0x41b9e4
dec ecx
test ecx, ecx
jg 0x41b9d5
mov byte [ebp + ecx - 0x344], 0
lea ecx, [ebp - 0x948]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xf68]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x948]
lea ecx, [ebp - 0xc68]
push eax
push str._smswsock.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x348]
lea eax, [ebp - 0xc68]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41ba4c
push 0x5147b4
jmp 0x41f098
lea ecx, [ebp - 0x948]
lea edx, [ebp - 0xc68]
push ecx
push str._smsgina.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x348]
lea ecx, [ebp - 0xc68]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41ba88
push 0x5147b4
jmp 0x41f098
lea edx, [ebp - 0x948]
lea eax, [ebp - 0xc68]
push edx
push str._swsock32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0xc68]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bac4
push 0x5147b4
jmp 0x41f098
lea eax, [ebp - 0x948]
lea ecx, [ebp - 0xc68]
push eax
push str._sws2_32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x348]
lea eax, [ebp - 0xc68]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bb00
push 0x5147b4
jmp 0x41f098
lea ecx, [ebp - 0x948]
lea edx, [ebp - 0xc68]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x348]
lea ecx, [ebp - 0xc68]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bb3c
push 0x5147b4
jmp 0x41f098
lea edx, [ebp - 0x948]
lea eax, [ebp - 0xc68]
push edx
push str._ses.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0xc68]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bb78
push 0x5147b4
jmp 0x41f098
lea eax, [ebp - 0x948]
lea ecx, [ebp - 0xc68]
push eax
push str._sMSI.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x348]
lea eax, [ebp - 0xc68]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bbb4
push 0x5147b4
jmp 0x41f098
lea ecx, [ebp - 0x948]
lea edx, [ebp - 0xc68]
push ecx
push str._sSHELL32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x348]
lea ecx, [ebp - 0xc68]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bbf0
push 0x5147b4
jmp 0x41f098
lea edx, [ebp - 0x948]
lea eax, [ebp - 0xc68]
push edx
push str._s_netman.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0xc68]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41bc2c
push 0x5147b4
jmp 0x41f098
mov edi, str._SystemRoot__system32_rpcss.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xc68]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41bc78
push 0x5147b4
jmp 0x41f098
lea eax, [ebp - 0x348]
push eax
call fcn.004abe70
mov ebx, 1
add esp, 4
cmp eax, ebx
je 0x41bc9a
push 0x516500
jmp 0x41f098
lea ecx, [ebp - 0x1668]
lea edx, [ebp - 0x4c8]
push ecx
lea eax, [ebp - 0x348]
push edx
push eax
call fcn.004d9d40
lea ecx, [ebp - 0xfe8]
lea edx, [ebp - 0x12e8]
movsx esi, ax
push ecx
lea eax, [ebp - 0x348]
push edx
push eax
mov dword [ebp - 0x68], esi
call fcn.004ca130
add esp, 0x18
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x348]
push ecx
xor edi, edi
push edx
push eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x94], edi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x41bd08
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
je 0x41bd0e
mov dword [ebp - 0x94], ebx
lea edx, [ebp - 0x348]
mov dword [ebp - 4], 0xffffffff
push edx
call fcn.004ab3c0
add esp, 4
cmp eax, 0x100000
jle 0x41bd76
cmp esi, ebx
jge 0x41bd40
cmp eax, 0x200000
jle 0x41bd40
push 0x516a58
jmp 0x41f098
cmp esi, edi
jle 0x41bd76
lea eax, [ebp - 0x4c8]
lea ecx, [ebp - 0x6c8]
push eax
push 0x516a30
push ecx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x6c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 2
jle 0x41c3a3
lea edx, [ebp - 0x348]
push str.System32_smss.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41bda1
push 0x5147b4
jmp 0x41f098
lea eax, [ebp - 0x4c8]
push str.Beijing_Rising
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41be27
lea ecx, [ebp - 0xb48]
lea edx, [ebp - 0x348]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xb48]
push str.Beijing
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41be27
lea ecx, [ebp - 0xb48]
push str.Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41be27
mov edi, 0x51635c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Hewlett_Packard
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41bead
mov edi, 0x516a0c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Bidi_User_Mode
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xfe8]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41bead
mov edi, 0x5169e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x134], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41bf1b
lea edx, [ebp - 0xa48]
lea eax, [ebp - 0x348]
push edx
push eax
call fcn.004c23b0
lea ecx, [ebp - 0xa48]
push str.Jiangmin
push ecx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41bf1b
mov edi, 0x51633c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41bf89
lea edx, [ebp - 0xa48]
lea eax, [ebp - 0x348]
push edx
push eax
call fcn.004c23b0
lea ecx, [ebp - 0xa48]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41bf89
mov edi, 0x516320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c047
lea edx, [ebp - 0xa48]
lea eax, [ebp - 0x348]
push edx
push eax
call fcn.004c23b0
lea ecx, [ebp - 0xa48]
push str.Symantec
push ecx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41bffb
mov edi, 0x51630c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x348]
push str.SYMANT1Rtvscan.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c047
mov edi, 0x51630c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push ecx
jmp 0x41f098
lea edx, [ebp - 0x4c8]
push str.Network_Associates
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c0b5
lea eax, [ebp - 0xa48]
lea ecx, [ebp - 0x348]
push eax
push ecx
call fcn.004c23b0
lea edx, [ebp - 0xa48]
push str.Networks_Associates_Technology__Inc
push edx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c0b5
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c14b
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa48]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa48]
push 0x5162ac
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c14b
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c1e1
mov edi, 0x51629c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa48]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa48]
push str.Kingsoft
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c1e1
mov edi, 0x51629c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Panda_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c277
mov edi, 0x516280
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa48]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa48]
push str.Panda
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c277
mov edi, 0x516280
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c30d
mov edi, 0x516264
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa48]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa48]
push str.Kaspersky
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c30d
mov edi, 0x516264
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push 0x5156bc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c3a3
mov edi, 0x5169d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x348]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa48]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa48]
push 0x5156bc
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x41c3a3
mov edi, 0x5169d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c8]
push str.Microsoft
push ecx
mov dword [ebp - 0x3c], 0
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c3c5
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x34], edx
cmp ecx, edx
jle 0x41c3fd
lea esi, [ebp + ecx - 0x348]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0x1268], al
jne 0x41c3f7
cmp edx, 2
jge 0x41c3fd
inc edx
dec esi
cmp edx, ecx
jl 0x41c3e5
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x41c424
mov ebx, ecx
lea esi, [ebp - 0x348]
lea edi, [ebp - 0x1568]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x1568], 0
test edx, edx
jle 0x41c46e
mov edi, dword [ebp - 0xec]
lea esi, [ebp + eax - 0x347]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x41c44d
mov byte [ebp + ecx - 0x1268], al
cmp al, 0x2e
jne 0x41c452
inc edi
cmp al, 0x20
jne 0x41c457
inc edi
cmp al, 0x5c
jne 0x41c463
mov byte [ebp + ecx - 0x1268], 0
inc ecx
cmp ecx, edx
jl 0x41c43f
mov dword [ebp - 0xec], edi
mov al, byte [ebp - 0x1566]
mov byte [ebp + edx - 0x1268], 0
cmp al, 0x5c
je 0x41c48e
mov byte [ebp - 0x1566], 0x5c
mov byte [ebp - 0x1565], 0
lea edx, [ebp - 0x348]
push 0x100
lea eax, [ebp - 0x7c8]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x1268]
push 0x40
lea edx, [ebp - 0xca8]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x348]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x41c4e5
push 0x5144fc
jmp 0x41f098
cmp dword [ebp - 0x3c], ebx
jne 0x41c51b
mov eax, dword [0xe56be0]
test eax, eax
jle 0x41c51b
lea ecx, [ebp - 0x348]
push ecx
call fcn.004bd760
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41c51b
push 0x5144fc
jmp 0x41f098
lea edx, [ebp - 0x348]
push 0x515d14
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c536
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x348]
push str.application_data
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c551
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x348]
push str.Microsoft_SharedMSINFO
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c56c
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x348]
push str.microsoft_sharedmsinfo
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c587
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x348]
push str.Microsoft_SharedMSInfo
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c5a2
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x348]
push str.Documents_and_Settings
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c5bd
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x348]
push 0x80
lea eax, [ebp - 0xe68]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x348]
push 0x80
lea edx, [ebp - 0xee8]
push ecx
push edx
call fcn.004f27c0
lea edi, [ebp - 0xf68]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x948]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xe68], al
mov byte [ebp + ecx - 0xee8], al
lea eax, [ebp - 0xf68]
lea ecx, [ebp - 0xe68]
push eax
push ecx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x41c67e
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c64d
push esi
jmp 0x41f098
lea edi, [ebp - 0x348]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x50], ebx
test ecx, ecx
jle 0x41c67e
cmp byte [ebp + eax - 0x348], 0x5c
jne 0x41c671
inc edx
inc eax
cmp eax, ecx
jl 0x41c666
cmp edx, 2
jne 0x41c67e
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x948]
lea eax, [ebp - 0xee8]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c6b3
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c6b3
push esi
jmp 0x41f098
lea ecx, [ebp - 0x348]
push str.System32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c70c
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c6e6
push esi
jmp 0x41f098
lea edx, [ebp - 0x348]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41c70c
push edi
jmp 0x41f098
lea eax, [ebp - 0x348]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c765
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c73f
push esi
jmp 0x41f098
lea ecx, [ebp - 0x348]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41c765
push edi
jmp 0x41f098
lea edx, [ebp - 0x348]
push str.system
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41c7be
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41c798
push esi
jmp 0x41f098
lea eax, [ebp - 0x348]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41c7be
push esi
jmp 0x41f098
lea ecx, [ebp - 0x1268]
push str.smss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea edx, [ebp - 0x1268]
push str.winlogon.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea eax, [ebp - 0x1268]
push str.csrss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea ecx, [ebp - 0x1268]
push str.services.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea edx, [ebp - 0x1268]
push str.lsass.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea eax, [ebp - 0x1268]
push str.svchost.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea ecx, [ebp - 0x1268]
push str.taskmgr.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea edx, [ebp - 0x1268]
push str.spoolsv.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea eax, [ebp - 0x1268]
push str.explorer.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
lea ecx, [ebp - 0x1268]
push str.conime.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ef97
mov esi, 2
xor edi, edi
push 0xd53b20
mov dword [ebp - 4], esi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x60], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x348]
push 0xd53b20
push edx
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x41c94a
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x348]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x41d204
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 3
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x140], eax
mov eax, dword [0xd53b28]
push eax
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x41c9da
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], esi
mov edx, dword [0xd53b28]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x118], esi
jne 0x41d0bd
mov dword [ebp + 8], 6
jmp 0x41d1f2
mov dword [ebp - 0xe8], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41c9a2
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd53b28]
mov eax, dword [ebp - 0x140]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x30]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x30], ecx
call fcn.004f61e0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x118], eax
cmp esi, 0x69
jge 0x41cacf
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41cac9
cmp esi, 0xf
jle 0x41ca61
cmp esi, 0x12
jge 0x41ca61
mov dword [ebp - 0xa4], ebx
cmp esi, 0x1d
je 0x41ca70
cmp esi, 0x1e
je 0x41ca70
cmp esi, 0x39
jne 0x41ca76
mov dword [ebp - 0x8c], ebx
cmp esi, 0x1f
je 0x41ca80
cmp esi, 0x20
jne 0x41ca83
mov dword [ebp - 0x5c], ebx
cmp esi, 0x21
je 0x41ca8d
cmp esi, 0x22
jne 0x41ca90
mov dword [ebp - 0x74], ebx
cmp esi, 0x23
je 0x41ca9a
cmp esi, 0x24
jne 0x41ca9d
mov dword [ebp - 0x6c], ebx
cmp esi, 0x2c
jne 0x41caab
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x41ca2e
cmp esi, 0x2d
je 0x41cac6
cmp esi, 0x2e
jne 0x41cac1
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x41ca2e
cmp esi, 0x3d
jne 0x41cac9
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x41ca2e
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x100], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd53b28]
mov dword [ebp - 0x144], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0xe8]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x41cb17
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd53b28]
push eax
push edx
push esi
mov dword [ebp - 0x64], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41c9a2
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x41d001
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x41cba8
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xce8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xce8]
jmp 0x41cc29
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0x144]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41cbe4
xor ecx, ecx
lea edx, [ebp - 0xb68]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x41cc31
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xcc8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xcc8]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x41cfb8
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41cfb2
cmp esi, 0x45
jne 0x41cd00
lea ecx, [ebp - 0x1068]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x1068]
lea eax, [ebp - 0x3c8]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3c8]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x41ccda
lea edx, [ebp - 0x4c8]
lea eax, [ebp - 0xb48]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xb48]
jmp 0x41f097
lea ecx, [ebp - 0x4c8]
lea edx, [ebp - 0xb48]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xb48]
jmp 0x41f097
test esi, esi
jne 0x41cd0d
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x41cc33
cmp esi, edi
jne 0x41cd1a
mov dword [ebp - 0x78], edi
inc esi
jmp 0x41cc33
cmp esi, 2
je 0x41cfb2
cmp esi, 4
jne 0x41cd34
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x41cc33
cmp esi, 5
jne 0x41cd45
mov dword [ebp - 0x108], edi
inc esi
jmp 0x41cc33
cmp esi, 6
jne 0x41cd56
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x41cc33
cmp esi, 7
jne 0x41cd67
mov dword [ebp - 0x110], edi
inc esi
jmp 0x41cc33
cmp esi, 8
jne 0x41cd78
mov dword [ebp - 0x120], edi
inc esi
jmp 0x41cc33
cmp esi, 9
jne 0x41cd89
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x41cc33
cmp esi, 0xa
jne 0x41cd97
mov dword [ebp - 0x80], edi
inc esi
jmp 0x41cc33
cmp esi, 0xb
jle 0x41cda4
cmp esi, 0xf
jge 0x41cda7
mov dword [ebp - 0x54], edi
cmp esi, 0xf
jne 0x41cdb5
mov dword [ebp - 0x88], edi
inc esi
jmp 0x41cc33
jle 0x41cdc2
cmp esi, 0x12
jge 0x41cdc2
mov dword [ebp - 0xa4], edi
cmp esi, 0x1b
jne 0x41cdd3
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x41cc33
cmp esi, 0x1c
jne 0x41cde4
mov dword [ebp - 0x90], edi
inc esi
jmp 0x41cc33
cmp esi, 0x1d
je 0x41cdf3
cmp esi, 0x1e
je 0x41cdf3
cmp esi, 0x39
jne 0x41cdf9
mov dword [ebp - 0x8c], edi
cmp esi, 0x1f
je 0x41ce03
cmp esi, 0x20
jne 0x41ce06
mov dword [ebp - 0x5c], edi
cmp esi, 0x21
je 0x41ce10
cmp esi, 0x22
jne 0x41ce13
mov dword [ebp - 0x74], edi
cmp esi, 0x23
je 0x41ce1d
cmp esi, 0x24
jne 0x41ce20
mov dword [ebp - 0x6c], edi
cmp esi, 0x25
je 0x41ce2a
cmp esi, 0x26
jne 0x41ce30
mov dword [ebp - 0xe0], edi
cmp esi, 0x27
jne 0x41ce41
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x41cc33
cmp esi, 0x28
jne 0x41ce52
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x41cc33
cmp esi, 0x29
jne 0x41ce63
mov dword [ebp - 0x124], edi
inc esi
jmp 0x41cc33
cmp esi, 0x2c
jne 0x41ce74
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x41cc33
cmp esi, 0x2d
jne 0x41ce82
mov dword [ebp - 0x44], edi
inc esi
jmp 0x41cc33
cmp esi, 0x2e
jne 0x41ce93
mov dword [ebp - 0x98], edi
inc esi
jmp 0x41cc33
cmp esi, 0x2f
jne 0x41cea4
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x41cc33
cmp esi, 0x30
jne 0x41ceb5
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x41cc33
cmp esi, 0x31
jne 0x41cec6
mov dword [ebp - 0x128], edi
inc esi
jmp 0x41cc33
cmp esi, 0x32
jne 0x41ced7
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x41cc33
cmp esi, 0x34
jne 0x41cee8
mov dword [ebp - 0x84], edi
inc esi
jmp 0x41cc33
cmp esi, 0x35
jne 0x41cef9
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x41cc33
cmp esi, 0x36
jne 0x41cf07
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x41cc33
cmp esi, 0x37
jne 0x41cf1c
mov dword [ebp - 0xcc], 0
inc esi
jmp 0x41cc33
cmp esi, 0x38
jne 0x41cf2d
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x41cc33
cmp esi, 0x3a
je 0x41cf3c
cmp esi, 0x3b
je 0x41cf3c
cmp esi, 0x3c
jne 0x41cf42
mov dword [ebp - 0xf4], edi
cmp esi, 0x3d
jne 0x41cf50
mov dword [ebp - 0x44], edi
inc esi
jmp 0x41cc33
cmp esi, 0x3e
jne 0x41cf61
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x41cc33
cmp esi, 0x3f
jne 0x41cf72
mov dword [ebp - 0xac], edi
inc esi
jmp 0x41cc33
cmp esi, 0x40
jne 0x41cf80
mov dword [ebp - 0x78], edi
inc esi
jmp 0x41cc33
cmp esi, 0x41
jne 0x41cf91
mov dword [ebp - 0x114], edi
inc esi
jmp 0x41cc33
cmp esi, 0x42
jne 0x41cfa2
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x41cc33
cmp esi, 0x43
je 0x41cfac
cmp esi, 0x44
jne 0x41cfb2
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x41cc33
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x118]
inc ecx
cmp eax, edi
mov dword [ebp - 0x60], ecx
jne 0x41cfcf
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x60], 0xc350
jg 0x41d001
mov esi, dword [ebp - 0x100]
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x24]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x24], ecx
mov eax, ecx
jmp 0x41cb41
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x10c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x10c], eax
jmp 0x41c9e4
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x64], ebx
cmp bx, word [esi + 2]
jae 0x41d1f2
xor ecx, ecx
push str..asp
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov byte [ebp - 0xb0], cl
mov edx, dword [edi]
mov dword [ebp - 0xb8], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb4], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x41d11f
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0xb8]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41d13a
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0xb8]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41d155
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0xb8]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41d170
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0xb8]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41d18b
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0xb8]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41d1a6
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x64]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x64], eax
jg 0x41d1f2
mov esi, dword [ebp - 0x118]
add edi, 0x28
inc ebx
jmp 0x41d0d0
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x60]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x41d240
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x41d25b
push 0x515b6c
jmp 0x41f098
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x1c], edi
test esi, esi
mov dword [ebp - 0x24], edx
je 0x41d9b2
cmp edi, ebx
jge 0x41d9b2
lea eax, [ebp - 0x1568]
push eax
call fcn.004f2beb
jmp 0x41d295
lea ecx, [ebp - 0x1268]
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0xb48]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x41d2c6
push ebx
lea ecx, [ebp - 0x390]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x41d2f0
lea eax, [ebp - 0xb48]
push eax
call fcn.004f2ce2
add esp, 4
jmp 0x41d304
lea ecx, [ebp - 0x7c8]
push str.c:endpcachemonitor_procPath5.txt
push ecx
call fcn.00403af0
add esp, 8
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x390]
push edx
push ebx
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp + 8], 0
call fcn.004f0727
mov eax, dword [ebp - 0x390]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x38c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x41d38d
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x37c]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x37c]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x38c]
push 0xa
lea edx, [ebp - 0x8c8]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x38c], esi
call fcn.004f0ae9
lea edi, [ebp - 0x8c8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x41d947
lea eax, [ebp - 0x8c8]
push str.Summary
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41d3ea
mov dword [ebp - 0x130], ebx
lea ecx, [ebp - 0x8c8]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41d947
lea edx, [ebp - 0x8c8]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41d947
lea eax, [ebp - 0x8c8]
push str.Dump_of_file
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41d947
lea ecx, [ebp - 0x8c8]
push str.invalid_file
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41d95e
cmp dword [ebp - 0x70], ebx
jne 0x41d462
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x41d46a
inc dword [ebp - 0x24]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x41d944
lea edx, [esi + esi*2]
lea eax, [ebp - 0x8c8]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x41d93e
mov ecx, dword [ebp - 0x12c]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x12c], ecx
jne 0x41d54f
lea ecx, [ebp - 0x1068]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x1068]
lea eax, [ebp - 0xd68]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0xd68]
push ecx
call fcn.004f2beb
xor edx, edx
cmp eax, edi
sete dl
push str.c:endpcache
mov esi, edx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x41d528
lea eax, [ebp - 0x4c8]
lea ecx, [ebp - 0xa48]
push eax
push 0x5153f4
push ecx
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xa48]
push ecx
jmp 0x41d356
lea edx, [ebp - 0x4c8]
lea eax, [ebp - 0xa48]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xa48]
push ecx
jmp 0x41d356
cmp esi, 0x19
jne 0x41d5cf
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x30], edx
jle 0x41d56f
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0x8c8]
push str.KERNEL32
push edx
call fcn.004f2d80
mov edi, eax
lea eax, [ebp - 0x8c8]
push 0x5153ac
push eax
call fcn.004f2d80
lea ecx, [ebp - 0x8c8]
push str.Kernel32
push ecx
mov ebx, eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x41d647
test ebx, ebx
jne 0x41d647
test eax, eax
jne 0x41d647
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x41d46e
cmp esi, 0x1a
jne 0x41d65b
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x30], edx
jle 0x41d5f3
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0x8c8]
push str.KERNEL32
push edx
call fcn.004f2d80
mov edi, eax
lea eax, [ebp - 0x8c8]
push 0x5153ac
push eax
call fcn.004f2d80
lea ecx, [ebp - 0x8c8]
push str.Kernel32
push ecx
mov ebx, eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x41d647
test ebx, ebx
jne 0x41d647
test eax, eax
jne 0x41d647
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x41d46e
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x41d46e
cmp esi, 0x2a
jne 0x41d66f
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x41d46e
cmp esi, 0x2b
jne 0x41d683
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x41d46e
cmp esi, edi
jne 0x41d690
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x41d46e
cmp esi, ebx
jne 0x41d69d
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x41d46e
cmp esi, 2
je 0x41d93e
cmp esi, 4
jne 0x41d6b7
mov dword [ebp - 0x11c], ebx
inc esi
jmp 0x41d46e
cmp esi, 5
jne 0x41d6c8
mov dword [ebp - 0x108], ebx
inc esi
jmp 0x41d46e
cmp esi, 6
jne 0x41d6d9
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x41d46e
cmp esi, 7
jne 0x41d6ea
mov dword [ebp - 0x110], ebx
inc esi
jmp 0x41d46e
cmp esi, 8
jne 0x41d6fb
mov dword [ebp - 0x120], ebx
inc esi
jmp 0x41d46e
cmp esi, 9
jne 0x41d70c
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x41d46e
cmp esi, 0xa
jne 0x41d71a
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x41d46e
cmp esi, 0xb
jle 0x41d727
cmp esi, 0xf
jge 0x41d72a
mov dword [ebp - 0x54], ebx
cmp esi, 0xf
jne 0x41d738
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x41d46e
jle 0x41d745
cmp esi, 0x12
jge 0x41d745
mov dword [ebp - 0xa4], ebx
cmp esi, 0x11
jle 0x41d752
cmp esi, 0x19
jge 0x41d752
mov dword [ebp - 0x38], ebx
cmp esi, 0x1b
jne 0x41d763
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x1c
jne 0x41d774
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x1d
je 0x41d783
cmp esi, 0x1e
je 0x41d783
cmp esi, 0x39
jne 0x41d789
mov dword [ebp - 0x8c], ebx
cmp esi, 0x1f
je 0x41d793
cmp esi, 0x20
jne 0x41d796
mov dword [ebp - 0x5c], ebx
cmp esi, 0x21
je 0x41d7a0
cmp esi, 0x22
jne 0x41d7a3
mov dword [ebp - 0x74], ebx
cmp esi, 0x23
je 0x41d7ad
cmp esi, 0x24
jne 0x41d7b0
mov dword [ebp - 0x6c], ebx
cmp esi, 0x25
je 0x41d7ba
cmp esi, 0x26
jne 0x41d7c0
mov dword [ebp - 0xe0], ebx
cmp esi, 0x27
jne 0x41d7d1
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x28
jne 0x41d7e2
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x29
jne 0x41d7f3
mov dword [ebp - 0x124], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x2c
jne 0x41d804
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x2d
jne 0x41d812
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x2e
jne 0x41d823
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x2f
jne 0x41d834
mov dword [ebp - 0xc4], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x30
jne 0x41d845
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x31
jne 0x41d856
mov dword [ebp - 0x128], ebx
inc esi
jmp 0x41d46e
cmp esi, 0x32
jne 0x41d867
inc esi
jmp 0x41d46e
inc dword [ebp + 8]
mov edx, dword [ebp - 0x390]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x388], 1
je 0x41d38d
lea ecx, [ebp - 0x390]
call fcn.004f076e
mov eax, dword [ebp - 0x24]
mov ecx, 5
cmp eax, ecx
jle 0x41d97a
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x41d986
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x40]
test ecx, ecx
jne 0x41d998
cmp eax, 6
jle 0x41d998
sub eax, 6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x37c]
call fcn.004f05fb
mov eax, dword [ebp - 0x20]
mov edx, 1
xor ebx, ebx
cmp eax, edx
mov dword [ebp + 8], ebx
mov byte [ebp - 0x6c8], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], ebx
jne 0x41d9d2
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x12c], edx
jle 0x41da09
mov edi, 0x5169cc
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], edx
jne 0x41da46
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3c], edx
jne 0x41db0a
lea eax, [ebp - 0xa48]
lea ecx, [ebp - 0x348]
push eax
push ecx
call fcn.004c23b0
movsx eax, ax
add esp, 8
test eax, eax
je 0x41da84
lea edx, [ebp - 0xa48]
push 0x516158
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41dabc
mov edi, 0x51613c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x68], 7
jle 0x41db0a
lea eax, [ebp - 0xa48]
push 0x516138
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41db0a
mov edi, 0x51612c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x41db74
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x94]
mov dword [ebp + 8], ebx
cmp ecx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x138], eax
jne 0x41db74
cmp dword [ebp - 0x68], 1
jge 0x41db74
mov dword [ebp - 0x40], 1
mov al, byte [ebp - 0x1268]
cmp al, 0x30
je 0x41dba2
cmp al, 0x31
je 0x41dba2
cmp al, 0x32
je 0x41dba2
cmp al, 0x33
je 0x41dba2
cmp al, 0x34
je 0x41dba2
cmp al, 0x35
je 0x41dba2
cmp al, 0x36
je 0x41dba2
cmp al, 0x37
je 0x41dba2
cmp al, 0x38
je 0x41dba2
cmp al, 0x39
jne 0x41dbd6
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0x120]
mov eax, 1
cmp ecx, eax
jne 0x41dc1a
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x41dc58
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xd0], eax
jne 0x41dc99
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x108], eax
je 0x41dca9
cmp dword [ebp - 0xd8], eax
jne 0x41dcde
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x114], eax
jne 0x41dd1f
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xe0], eax
jne 0x41dd5c
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x110], eax
jne 0x41dd99
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], eax
jne 0x41ddde
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xbc], eax
jne 0x41de26
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x11c], eax
jne 0x41de67
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xf0], eax
jne 0x41dea8
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x124], eax
jne 0x41dee9
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x54], eax
jne 0x41df88
cmp dword [ebp - 0xf8], eax
je 0x41df0f
cmp dword [ebp - 0x128], eax
je 0x41df0f
lea edx, [ebp - 0x6c8]
mov edi, 0x515278
jmp 0x41df5a
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc0]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x6c8]
mov edi, 0x515258
je 0x41df5a
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xc4], eax
jne 0x41dfc9
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x88], eax
jne 0x41e017
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], eax
jne 0x41e00e
mov dword [ebp - 0x28], eax
inc ebx
mov eax, 1
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xa4], eax
jne 0x41e058
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x38], eax
jne 0x41e0da
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
cmp ecx, eax
mov dword [ebp + 8], ebx
jne 0x41e0df
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41e0df
mov eax, 1
cmp dword [ebp - 0x90], eax
jne 0x41e1a0
cmp dword [ebp - 0x84], eax
jne 0x41e1a0
cmp dword [ebp - 0xa8], eax
jne 0x41e1a0
cmp dword [ebp - 0x7c], eax
jne 0x41e150
mov ecx, dword [ebp - 0xac]
lea edx, [ebp - 0x6c8]
cmp ecx, eax
mov edi, 0x5151ec
je 0x41e122
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xcc], eax
jne 0x41e1a0
mov ecx, dword [ebp - 0xac]
lea edx, [ebp - 0x6c8]
cmp ecx, eax
mov edi, 0x5151c4
je 0x41e172
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xd4], eax
jne 0x41e20b
cmp dword [ebp - 0x90], eax
jne 0x41e1d2
cmp dword [ebp - 0x84], eax
jne 0x41e1d2
cmp dword [ebp - 0xa8], eax
jne 0x41e1d2
cmp dword [ebp - 0x7c], eax
jne 0x41e1d2
lea edx, [ebp - 0x6c8]
mov edi, 0x5160c0
jmp 0x41e1dd
lea edx, [ebp - 0x6c8]
mov edi, 0x5160b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xdc], eax
jne 0x41e248
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x8c], eax
jne 0x41e289
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xe4], eax
jne 0x41e2ca
mov edi, 0x5160a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x5c], eax
jne 0x41e310
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], eax
jne 0x41e30c
mov dword [ebp - 0x28], eax
inc ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x74], eax
jne 0x41e34e
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x6c], eax
jne 0x41e38c
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x41e3d6
mov ecx, dword [ebp - 0x130]
test ecx, ecx
jne 0x41e3d6
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xec], eax
jle 0x41e417
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xa0], eax
jne 0x41e458
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x44], eax
jne 0x41e496
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x98], eax
jne 0x41e4d3
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], eax
jne 0x41e514
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xfc], eax
jne 0x41e551
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
cmp ecx, eax
mov eax, 4
je 0x41e564
lea eax, [ecx*4]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
jl 0x41e572
cmp ecx, 7
jge 0x41e5c5
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x6c8]
cmp eax, 1
mov edi, 0x5150f8
je 0x41e58a
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x50]
mov ecx, edx
mov edx, 1
and ecx, 3
cmp eax, edx
mov dword [ebp - 0x14], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41e5c1
mov dword [ebp - 0x28], edx
inc ebx
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0x24]
mov edi, 1
cmp eax, edi
jle 0x41e617
cmp dword [ebp - 0x30], edi
jne 0x41e617
mov edi, 0x516090
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 3
mov edx, 1
rep movsb byte es:[edi], byte [esi]
inc ebx
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], ebx
mov edi, edx
cmp dword [ebp - 0x80], edi
jne 0x41e65c
cmp eax, 5
jge 0x41e65c
test eax, eax
jle 0x41e65c
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x6c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov esi, dword [ebp - 0x68]
cmp esi, 7
jge 0x41e779
cmp dword [ebp - 0x34], edi
jne 0x41e6f6
cmp esi, edi
lea ebx, [ebp - 0x6c8]
jge 0x41e6c2
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp + 8]
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x41e6b3
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x104], 1
jmp 0x41e770
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x54]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41e76d
jmp 0x41e766
cmp esi, edi
lea ebx, [ebp - 0x6c8]
jge 0x41e736
mov edi, 0x515078
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x104], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41e760
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], 1
jne 0x41e76d
mov dword [ebp - 0x14], 1
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x68]
inc ebx
mov edi, 1
cmp dword [ebp - 0x5c], edi
jne 0x41e7a2
cmp dword [ebp - 0x74], edi
jne 0x41e786
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x6c], edi
jne 0x41e78e
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x54], 0xb
jne 0x41e797
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x88], edi
jne 0x41e7a2
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x40], edi
jne 0x41e94c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7c8]
push eax
call esi
lea ecx, [ebp - 0x7c8]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x41e839
lea edx, [ebp - 0x7c8]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x7c8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x7c8]
push ecx
call esi
test eax, eax
jne 0x41e839
lea edx, [ebp - 0x7c8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x41e839
lea eax, [ebp - 0x7c8]
push eax
call fcn.004abcc0
add esp, 4
lea ecx, [ebp - 0x7c8]
push ecx
call fcn.004abbf0
add esp, 4
lea edx, [ebp - 0x6c8]
mov edi, 0x5169ac
jmp 0x41e844
lea edx, [ebp - 0x6c8]
mov edi, 0x51696c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebx, ebx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [0xe56c50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56c84]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xe56d20]
inc ecx
inc eax
cmp edx, ebx
mov dword [0xe56d20], ecx
mov dword [0xe56c84], eax
jle 0x41e8fc
shl edx, 8
lea ecx, [ebp - 0x348]
lea edx, [edx + 0xd70d90]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41e940
mov edx, dword [0xe56c50]
lea edi, [ebp - 0x348]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41e940
mov esi, edx
lea edi, [ebp - 0x348]
shl esi, 8
or ecx, 0xffffffff
xor eax, eax
add esi, 0xd70e90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0xe56c50], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41e940
mov dword [0xe56c50], ebx
lea ecx, [ebp - 0x6c8]
push ecx
jmp 0x41f098
cmp dword [ebp - 0x2c], edi
jne 0x41e958
test ebx, ebx
jle 0x41e958
mov dword [ebp - 0x14], edi
cmp esi, 6
jle 0x41e980
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x41e980
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x41e983
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x94]
test ecx, ecx
jne 0x41e9a9
cmp dword [ebp - 0x3c], edi
jne 0x41e9a9
test eax, eax
jne 0x41eac5
lea edx, [ebp - 0x7c8]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41efbe
lea eax, [ebp - 0x7c8]
push eax
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x7c8]
push ecx
call esi
lea edx, [ebp - 0x7c8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x41f02b
lea eax, [ebp - 0x7c8]
push eax
call fcn.004ab990
add esp, 4
lea ecx, [ebp - 0x7c8]
push ecx
call esi
test eax, eax
jne 0x41f02b
lea edx, [ebp - 0x7c8]
push edx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x41f02b
lea eax, [ebp - 0x7c8]
push eax
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x6c8]
mov edi, 0x516928
jmp 0x41f036
lea edx, [ebp - 0x6c8]
mov edi, 0x5168e4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c84]
mov dword [0xe56d20], eax
inc edi
or ecx, 0xffffffff
mov dword [0xe56c84], edi
lea edi, [ebp - 0x7c8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x6c8]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret