Function at 0x4560d0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483e16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x185c
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x134], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x110], eax
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xb6c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 3
jge 0x456298
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x54c], 0x5c
jne 0x4562b7
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push str..tmp
push eax
call fcn.0047bec0
add esp, 8
mov edi, 1
test eax, eax
je 0x4562d7
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x54c]
push str..Tmp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4562f2
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x54c]
push str..TMP
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45630d
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x54c]
push str._temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x456328
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x54c]
push str.Temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x456343
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x54c]
push str.TEMP_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45635e
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x54c]
push str.Documents_and_Settings_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x456379
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x54c]
push str..dll_temp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4563c1
lea ecx, [ebp - 0x54c]
push str..Dll_temp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4563c1
lea ecx, [ebp - 0x54c]
push str..DLL_temp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4563fe
lea edx, [ebp - 0x54c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x49feec
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x54c]
xor edx, edx
cmp al, 0x25
mov dword [ebp + 8], 0
jne 0x456413
mov edx, edi
lea eax, [esi - 2]
test eax, eax
jle 0x45643e
mov cl, byte [ebp + eax - 0x54c]
cmp cl, 0x3a
jne 0x456430
cmp byte [ebp + eax - 0x54b], 0x5c
je 0x45643e
cmp edx, edi
jne 0x456439
cmp cl, 0x5c
je 0x456446
dec eax
test eax, eax
jg 0x45641a
cmp edx, edi
jne 0x4564f0
sub esi, eax
xor ecx, ecx
lea edx, [esi - 1]
test edx, edx
jle 0x456472
lea eax, [ebp + eax - 0x54b]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xc6c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0xc6c], 0
lea edi, [ebp - 0xc6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1cc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x116c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x54c]
push ecx
push edx
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x116c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x54c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45653e
cmp eax, esi
je 0x45653e
mov edx, esi
test esi, esi
mov dword [ebp + 8], edx
jle 0x45650f
cmp byte [ebp + edx - 0x54c], 0x2e
je 0x45650c
dec edx
test edx, edx
jg 0x4564fd
mov dword [ebp + 8], edx
mov esi, edx
xor ecx, ecx
sub esi, eax
mov byte [ebp - 0x54c], 0
add esi, 5
test esi, esi
jle 0x456536
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x54c], al
inc ecx
cmp ecx, esi
jl 0x456527
mov byte [ebp + edx - 0x547], 0
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x456561
cmp byte [ebp + ecx - 0x54c], 0x2e
je 0x456561
dec ecx
test ecx, ecx
jg 0x456552
mov eax, dword [ebp + 8]
mov byte [ebp + ecx - 0x548], 0
test eax, eax
jne 0x45658e
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x15ec]
lea edx, [ebp - 0x8ac]
push ecx
lea eax, [ebp - 0x54c]
push edx
push eax
call fcn.0046de70
lea ecx, [ebp - 0xdec]
lea edx, [ebp - 0x106c]
movsx ebx, ax
push ecx
lea eax, [ebp - 0x54c]
push edx
push eax
mov dword [ebp - 0x8c], ebx
call fcn.00455090
lea ecx, [ebp - 0x54c]
push ecx
call fcn.004246a0
add esp, 0x1c
mov dword [ebp - 0x80], eax
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x54c]
mov esi, 1
xor edi, edi
push eax
push ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x45660d
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
je 0x45660f
mov edi, esi
mov eax, dword [ebp - 0x80]
cmp ebx, esi
mov dword [ebp - 4], 0xffffffff
jge 0x456646
cmp eax, 0x200000
jle 0x4566b9
push 0x49fbb8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x100000
jle 0x4566b9
test edi, edi
jne 0x4566b9
lea eax, [ebp - 0x8ac]
push str.Microsoft
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45667e
lea ecx, [ebp - 0x8ac]
lea edx, [ebp - 0xc6c]
push ecx
push 0x49fed0
push edx
jmp 0x456691
lea eax, [ebp - 0x8ac]
lea ecx, [ebp - 0xc6c]
push eax
push 0x49fba0
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xc6c]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8ac]
xor ebx, ebx
push str.Microsoft
push eax
mov dword [ebp - 0x24], ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4566db
mov ebx, esi
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x8ac]
push str.Hewlett_Packard
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x456756
mov edi, 0x49f62c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Bidi_User_Mode
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xdec]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x456751
push 0x49feb4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 1
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._s_ntdll.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4567a6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sKERNEL32.DLL
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4567f6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._s_advapi32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456846
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sWS2_32.DLL
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456896
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._swsock32.DLL
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4568e6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sWINMM.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456936
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._smswsock.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456986
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._smsgina.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4569d6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._swsock32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456a26
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sws2_32.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456a76
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sCOMCTL32.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456ac6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456b16
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sNETUI1.DLl
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456b66
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sMSI.DLL
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456bb6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sSHELL32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456c06
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._ses.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456c56
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._surlmon.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456ca6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._smshtml.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456cf6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._smfc42u.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456d46
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._smprapi.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456d96
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sole32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456de6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._scrypt32.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456e36
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._scryptui.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456e86
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._s_shlwapi.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456ed6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sinetcomm.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456f26
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._smsvbvm60.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456f7a
cmp ebx, esi
jne 0x456f7a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._soleaut32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x456fce
cmp ebx, esi
jne 0x456fce
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._swinsrv.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457022
cmp ebx, esi
jne 0x457022
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sCLBCATQ.DLL
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457076
cmp ebx, esi
jne 0x457076
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._smsv1_0.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4570ca
cmp ebx, esi
jne 0x4570ca
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sole32.DLL
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45711e
cmp ebx, esi
jne 0x45711e
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._scomdlg32.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457172
cmp ebx, esi
jne 0x457172
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._s_netapi32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4571c6
cmp ebx, esi
jne 0x4571c6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._s_sfc.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45721a
cmp ebx, esi
jne 0x45721a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._s_sfc_os.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45726e
cmp ebx, esi
jne 0x45726e
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._siphlpapi.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4572c2
cmp ebx, esi
jne 0x4572c2
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sWMI.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457316
cmp ebx, esi
jne 0x457316
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sCOMRes.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45736a
cmp ebx, esi
jne 0x45736a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._smsgina.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4573be
cmp ebx, esi
jne 0x4573be
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._smsvcrt.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457412
cmp ebx, esi
jne 0x457412
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._s_advapi32.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457466
cmp ebx, esi
jne 0x457466
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._suser32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4574ba
cmp ebx, esi
jne 0x4574ba
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sgdi32.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45750e
cmp ebx, esi
jne 0x45750e
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x2cc]
push eax
push str._sWINSTA.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x457562
cmp ebx, esi
jne 0x457562
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x2cc]
push ecx
push str._sUSERENV.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x54c]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4575b6
cmp ebx, esi
jne 0x4575b6
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x2cc]
push edx
push str._sUxTheme.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45760a
cmp ebx, esi
jne 0x45760a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x54c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45763e
lea edi, [ebp + ecx - 0x54c]
mov dl, byte [edi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x14ec], dl
jne 0x457638
cmp eax, 2
jge 0x45763e
inc eax
dec edi
cmp eax, ecx
jl 0x457625
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x457665
mov ebx, ecx
lea esi, [ebp - 0x54c]
lea edi, [ebp - 0xfec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
xor ecx, ecx
mov byte [ebp + edx - 0xfec], 0
test eax, eax
jle 0x457698
lea edi, [ebp + edx - 0x54b]
mov dl, byte [edi + ecx]
cmp dl, 0x5c
je 0x45768b
mov byte [ebp + ecx - 0x14ec], dl
jne 0x457693
mov byte [ebp + ecx - 0x14ec], 0
inc ecx
cmp ecx, eax
jl 0x45767a
mov byte [ebp + eax - 0x14ec], 0
mov al, byte [ebp - 0xfea]
cmp al, 0x5c
je 0x4576b8
mov byte [ebp - 0xfea], 0x5c
mov byte [ebp - 0xfe9], 0
cmp byte [ebp - 0xfeb], 0x3a
je 0x45777d
lea edi, [ebp - 0xfec]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x4576eb
cmp byte [ebp + eax - 0xfec], 0x3a
je 0x4576eb
inc eax
cmp eax, ecx
jl 0x4576dc
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x457716
mov ecx, edi
lea esi, [ebp + eax - 0xfed]
mov ebx, ecx
lea edi, [ebp - 0x126c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x126b], 0
jne 0x45774f
lea eax, [ebp - 0x34c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x34c]
lea edx, [ebp - 0x126c]
push ecx
push 0x48b2f4
push edx
call fcn.0047a8f8
add esp, 0xc
lea edi, [ebp - 0x126c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp byte [ebp - 0xfea], 0x5c
je 0x45778d
mov byte [ebp - 0xfea], 0x5c
lea ecx, [ebp - 0x54c]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, esi
je 0x457873
mov edx, dword [0x65cd64]
test edx, edx
jle 0x457811
shl edx, 8
lea eax, [ebp - 0x54c]
lea ecx, [edx + 0x62a3e4]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x457855
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x54c]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x457855
jmp 0x45784b
mov ebx, edx
lea edi, [ebp - 0x54c]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x457855
mov dword [0x65cd64], 0
push 0x49f958
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfeb], 0x3a
je 0x45789a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfea], 0x5c
je 0x4578aa
mov byte [ebp - 0xfea], 0x5c
lea ecx, [ebp - 0x1cc]
push 0x80
push ecx
mov dword [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xb6c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x54c]
push 0x100
lea ecx, [ebp - 0xacc]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x14ec]
push 0x40
lea eax, [ebp - 0x7ac]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0xfec]
push ecx
call fcn.004688e0
add esp, 0x1c
cmp eax, 2
jne 0x4579c3
lea edx, [ebp - 0xacc]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xacc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xacc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x45797b
lea edx, [ebp - 0xacc]
push edx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x45797b
lea eax, [ebp - 0xacc]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x74c]
mov edi, 0x49f4ec
jmp 0x457986
lea edx, [ebp - 0x74c]
mov edi, 0x49fd38
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x74c]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x54c]
push edx
call fcn.00428d90
mov ebx, eax
push 0x491c80
push ebx
mov dword [ebp - 0x144], ebx
call fcn.0047fde0
add esp, 0xc
test eax, eax
jne 0x457a07
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push 0x80
lea ecx, [ebp - 0xd6c]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x54c]
push 0x80
lea eax, [ebp - 0xcec]
push edx
push eax
call fcn.0047b120
lea edi, [ebp - 0xb6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x1cc]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xd6c], al
lea edx, [ebp - 0xd6c]
mov byte [ebp + ecx - 0xcec], al
lea ecx, [ebp - 0xb6c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x457ab2
push 0x491c80
push ebx
mov dword [ebp - 0x40], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457ab2
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0xcec]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457b05
push 0x491c80
push ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x130], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457b05
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x54c]
push str.System32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x457b50
push 0x491c80
push ebx
mov dword [ebp - 0x40], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457b50
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54c]
push str.system32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x457b9b
push 0x491c80
push ebx
mov dword [ebp - 0x40], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457b9b
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x54c]
push str.system
push ecx
call fcn.0047bec0
xor edi, edi
add esp, 8
cmp eax, edi
je 0x457be8
push 0x491c80
push ebx
mov dword [ebp - 0x40], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457be8
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 2
push 0x62a450
mov dword [ebp - 4], ebx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp + 8], edi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x54c]
push 0x62a450
push edx
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x457c5a
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x54c]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov edi, esi
jmp 0x4585c3
mov edx, dword [0x62a458]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x148], eax
mov eax, dword [0x62a458]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x128], eax
jne 0x457ce7
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], ebx
mov edx, dword [0x62a458]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004046d0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x60], esi
jne 0x458482
mov dword [ebp + 8], 6
jmp 0x4585b4
mov dword [ebp - 0x118], edi
cmp dword [eax + 0x10], edi
je 0x457cb2
mov ecx, dword [eax + 0xc]
mov edx, dword [0x62a458]
mov eax, dword [ebp - 0x148]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x20], ecx
call fcn.0047fde0
neg eax
sbb eax, eax
push str.HKCommand.dll
inc eax
push edi
mov dword [ebp - 0x60], eax
call fcn.0047fde0
add esp, 0x10
mov ebx, 1
test eax, eax
jne 0x457d45
mov dword [ebp - 0x138], ebx
push str.HTHW.dll
push edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x457d5d
mov dword [ebp - 0x140], ebx
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x457d94
lea ecx, [ebp - 0x14ec]
lea edx, [ebp - 0xfec]
push ecx
push edx
call fcn.00477d70
add esp, 8
cmp eax, 0x800
jle 0x457d94
cmp eax, 0x4b000
mov eax, dword [ebp - 0x68]
jle 0x457d90
add eax, 2
jmp 0x457d91
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x110]
inc eax
xor esi, esi
mov dword [ebp - 0x110], eax
cmp esi, 0x66
jge 0x457e43
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x457e3d
cmp esi, 0xf
jle 0x457dd5
cmp esi, 0x12
jge 0x457dd5
mov dword [ebp - 0x98], ebx
cmp esi, 0x1d
je 0x457de4
cmp esi, 0x1e
je 0x457de4
cmp esi, 0x39
jne 0x457de7
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1f
je 0x457df1
cmp esi, 0x20
jne 0x457df7
mov dword [ebp - 0x90], ebx
cmp esi, 0x21
je 0x457e01
cmp esi, 0x22
jne 0x457e07
mov dword [ebp - 0x88], ebx
cmp esi, 0x23
je 0x457e11
cmp esi, 0x24
jne 0x457e14
mov dword [ebp - 0x74], ebx
cmp esi, 0x2c
jne 0x457e1f
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x457da3
cmp esi, 0x2d
je 0x457e3a
cmp esi, 0x2e
jne 0x457e35
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x457da3
cmp esi, 0x3d
jne 0x457e3d
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x457da3
mov ecx, dword [0x62a458]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0xec], 0
call fcn.004046b0
mov edx, dword [0x62a458]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x14c], esi
call fcn.004047a0
mov ecx, dword [ebp - 0x118]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x457e8c
mov eax, dword [ecx + 0x10]
mov edx, dword [0x62a458]
push eax
push edx
push esi
mov dword [ebp - 0x6c], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x457cb2
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4583c4
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x457f1d
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x76c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xaec]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xaec]
jmp 0x457f9e
mov edx, dword [0x62a458]
push eax
mov eax, dword [ebp - 0x14c]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x457f59
xor ecx, ecx
lea edx, [ebp - 0x76c]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x457fa6
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x76c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9cc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x9cc]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x45837e
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x458378
cmp esi, 0x45
jne 0x458079
lea ecx, [ebp - 0x34c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x34c]
lea eax, [ebp - 0x12ec]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x12ec]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x45803e
lea edx, [ebp - 0x8ac]
lea eax, [ebp - 0xc6c]
push edx
push 0x49b6c8
push eax
jmp 0x458051
lea ecx, [ebp - 0x8ac]
lea edx, [ebp - 0xc6c]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0xc6c]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x458086
mov dword [ebp - 0x48], edi
inc esi
jmp 0x457fa8
cmp esi, edi
jne 0x458093
mov dword [ebp - 0x50], edi
inc esi
jmp 0x457fa8
cmp esi, 2
je 0x458378
cmp esi, 4
jne 0x4580ad
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x457fa8
cmp esi, 5
jne 0x4580be
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x457fa8
cmp esi, 6
jne 0x4580cf
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x457fa8
cmp esi, 7
jne 0x4580e0
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x457fa8
cmp esi, 8
jne 0x4580f1
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x457fa8
cmp esi, 9
jne 0x458102
mov dword [ebp - 0x104], edi
inc esi
jmp 0x457fa8
cmp esi, 0xa
jne 0x458113
mov dword [ebp - 0x108], edi
inc esi
jmp 0x457fa8
cmp esi, 0xb
jle 0x458120
cmp esi, 0xf
jge 0x458123
mov dword [ebp - 0x54], edi
cmp esi, 0xf
jne 0x458131
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x457fa8
jle 0x45813e
cmp esi, 0x12
jge 0x45813e
mov dword [ebp - 0x98], edi
cmp esi, 0x1b
jne 0x45814f
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x457fa8
cmp esi, 0x1c
jne 0x458160
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x457fa8
cmp esi, 0x1d
je 0x45816f
cmp esi, 0x1e
je 0x45816f
cmp esi, 0x39
jne 0x458172
mov dword [ebp - 0x7c], edi
cmp esi, 0x1f
je 0x45817c
cmp esi, 0x20
jne 0x458182
mov dword [ebp - 0x90], edi
cmp esi, 0x21
je 0x45818c
cmp esi, 0x22
jne 0x458192
mov dword [ebp - 0x88], edi
cmp esi, 0x23
je 0x45819c
cmp esi, 0x24
jne 0x45819f
mov dword [ebp - 0x74], edi
cmp esi, 0x25
je 0x4581a9
cmp esi, 0x26
jne 0x4581af
mov dword [ebp - 0xfc], edi
cmp esi, 0x27
jne 0x4581c0
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x457fa8
cmp esi, 0x28
jne 0x4581d1
mov dword [ebp - 0x114], edi
inc esi
jmp 0x457fa8
cmp esi, 0x29
jne 0x4581e2
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x457fa8
cmp esi, 0x2c
jne 0x4581f0
mov dword [ebp - 0x78], edi
inc esi
jmp 0x457fa8
cmp esi, 0x2d
jne 0x4581fe
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x457fa8
cmp esi, 0x2e
jne 0x45820f
mov dword [ebp - 0x84], edi
inc esi
jmp 0x457fa8
cmp esi, 0x2f
jne 0x458220
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x457fa8
cmp esi, 0x30
jne 0x458231
mov dword [ebp - 0x124], edi
inc esi
jmp 0x457fa8
cmp esi, 0x31
jne 0x458242
inc esi
jmp 0x457fa8
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
inc ecx
cmp eax, edi
mov dword [ebp - 0x5c], ecx
jne 0x458392
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x5c], 0xc350
jg 0x4583c4
mov esi, dword [ebp - 0xec]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xec], esi
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x457eb6
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0xec]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x128]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x128], eax
xor edi, edi
jmp 0x457ced
mov eax, dword [0x62a458]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x6c], ebx
cmp bx, word [esi + 2]
jae 0x4585b4
xor ecx, ecx
push str..asp
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov byte [ebp - 0xa0], cl
mov edx, dword [edi]
mov dword [ebp - 0xa8], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa4], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4584e4
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0xa8]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4584ff
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0xa8]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45851a
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0xa8]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x458535
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0xa8]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x458550
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0xa8]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45856b
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x6c]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x6c], eax
jg 0x4585b4
mov esi, dword [ebp - 0x60]
add edi, 0x28
inc ebx
jmp 0x458495
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov esi, 1
mov ecx, dword [0x62a458]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x4585ff
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov edi, 3
push 0x62a450
call fcn.00404650
add esp, 4
cmp edi, esi
jne 0x45862e
push 0x49b598
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x9c]
test edi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
je 0x458e63
cmp ebx, esi
jge 0x458e63
lea edx, [ebp - 0xfec]
xor edi, edi
push edx
mov dword [ebp - 0x20], edi
call fcn.0047c0d3
push 0x55972c55
call fcn.004749f7
rcr dx, cl
neg dh
adc dl, 0xef
mov edx, dword [ebp + 4]
pushal
pushal
cmp dh, cl
cmp esp, edi
add ebp, 8
push 0xf3bf6e5b
push dword [esp]
jmp fcn.006610f0
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x80]
cmp edx, 2
jle 0x458ebe
cmp eax, 0xa000
jg 0x458e7a
cmp ecx, 0x28
jle 0x458ebe
mov edi, dword [ebp - 0x44]
test edi, edi
jg 0x458e86
cmp dword [ebp - 0x38], esi
jle 0x458ebe
lea eax, [ebp - 0x8ac]
lea ecx, [ebp - 0x74c]
push eax
push 0x49fd04
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x74c]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x120], esi
jne 0x458f28
cmp eax, 0x9c00
jg 0x458ed2
cmp ecx, 0x27
jle 0x458edd
cmp dword [ebp - 0x44], esi
jg 0x458ef0
cmp dword [ebp - 0x38], 2
jg 0x458ef0
mov edi, dword [ebp - 0x4c]
test edi, edi
jle 0x458f28
cmp edx, 2
jle 0x458f28
cmp eax, 0xa000
jle 0x458f28
lea eax, [ebp - 0x8ac]
lea ecx, [ebp - 0x74c]
push eax
push 0x49fd04
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x74c]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x138], esi
jne 0x458f97
cmp dword [ebp - 0x140], esi
jne 0x458f65
cmp dword [ebp - 0x8c], esi
jge 0x458fa3
cmp eax, 0x19000
jle 0x458f65
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x50
jle 0x458f97
cmp ebx, 0x96
jle 0x458f97
cmp eax, 0xc800
jle 0x458f97
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x68], esi
jle 0x458fc1
cmp eax, 0xc800
jle 0x458fc1
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov edx, 1
xor ebx, ebx
cmp eax, edx
mov byte [ebp - 0x74c], 0
mov dword [ebp + 8], ebx
je 0x459006
lea edi, [ebp - 0x8ac]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x60], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x10c], edx
jne 0x45903e
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x45907f
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 0x14], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xbc]
mov eax, 1
cmp ecx, eax
jne 0x4590c3
mov edi, 0x49ed54
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], eax
jne 0x4590fe
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], eax
jne 0x45913c
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc4], eax
je 0x45914c
cmp dword [ebp - 0x11c], eax
jne 0x459181
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcc], eax
jne 0x4591bf
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xfc], eax
jne 0x4591fc
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], eax
jne 0x45923a
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x48], eax
jne 0x45927c
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x114], eax
jne 0x4592c0
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xdc], eax
jne 0x4592fe
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x104], eax
jne 0x45933c
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe4], eax
jne 0x459379
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], eax
jne 0x45941c
cmp dword [ebp - 0x124], eax
je 0x45939f
cmp dword [ebp - 0xac], eax
je 0x45939f
lea edx, [ebp - 0x74c]
mov edi, 0x49b2d8
jmp 0x4593ea
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xb0]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x74c]
mov edi, 0x49b2b8
je 0x4593ea
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x45945a
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc0], eax
jne 0x45949f
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], eax
jne 0x4594e4
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x28], eax
jne 0x459563
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jne 0x459568
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp + 8], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x459568
mov eax, 1
cmp dword [ebp - 0xc8], eax
jne 0x459620
cmp dword [ebp - 0xd0], eax
jne 0x459620
cmp dword [ebp - 0xd8], eax
jne 0x459620
cmp dword [ebp - 0xe0], eax
jne 0x4595d6
mov ecx, dword [ebp - 0x70]
lea edx, [ebp - 0x74c]
cmp ecx, eax
mov edi, 0x49b24c
je 0x4595ab
mov edi, 0x49b23c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], eax
jne 0x459620
mov ecx, dword [ebp - 0x70]
lea edx, [ebp - 0x74c]
cmp ecx, eax
mov edi, 0x49b224
je 0x4595f5
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
jne 0x45965d
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], eax
jne 0x4596a2
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
mov eax, 1
jne 0x4596a1
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [ebp - 0x12c], eax
jne 0x4596e0
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], eax
jne 0x459721
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
inc ebx
cmp dword [ebp - 0x88], eax
jne 0x45975f
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], eax
jne 0x45979a
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x4597e1
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
jne 0x4597e1
mov edi, 0x49f92c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x45981c
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x2c], eax
jne 0x459857
mov edi, 0x49f920
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x84], eax
jne 0x459898
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x74c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
inc ebx
cmp dword [ebp - 0xf8], eax
jne 0x4598d6