Function at 0x4246e0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48383b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1d14
call fcn.0047bda0
push ebx
push esi
push edi
lea eax, [ebp - 0x14a4]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x80
push eax
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x8c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 8], ecx
jge 0x42489d
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
mov eax, 0x49bbd4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x3c4]
push str.rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4248e9
lea eax, [ebp - 0x3c4]
push str.RUNDLL32.
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4248e9
lea ecx, [ebp - 0x3c4]
push str.Rundll32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x424979
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xcc4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xcc4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x424949
cmp byte [ebp + eax - 0xcc4], 0x33
jne 0x424944
cmp byte [ebp + eax - 0xcc3], 0x32
jne 0x424944
cmp byte [ebp + eax - 0xcc2], 0x2e
je 0x424949
inc eax
cmp eax, ecx
jl 0x424926
mov edx, ecx
sub edx, eax
lea ecx, [edx - 7]
cmp ecx, ebx
jle 0x424971
lea eax, [ebp + eax - 0xcbd]
lea edi, [ebp - 0x3c4]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + edx - 0x3cb], 0
lea ecx, [ebp - 0x3c4]
push 0x48b2f4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x424a53
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x4249f6
cmp byte [ebp + eax - 0x5c4], 0x25
je 0x4249f6
inc eax
cmp eax, edx
jl 0x4249e7
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x424a22
lea eax, [ebp + eax - 0x5b8]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xcc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0xcc4]
lea edx, [ebp - 0x1c4]
push ecx
push edx
lea eax, [ebp - 0x3c4]
push str._s_s
push eax
mov byte [ebp + esi - 0xcc4], 0
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x3c4]
push 0x49bba4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x424b2d
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x424ad0
cmp byte [ebp + eax - 0x5c4], 0x25
je 0x424ad0
inc eax
cmp eax, edx
jl 0x424ac1
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x424afc
lea eax, [ebp + eax - 0x5b8]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xcc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0xcc4]
lea edx, [ebp - 0x1c4]
push ecx
push edx
lea eax, [ebp - 0x3c4]
push str._s_s
push eax
mov byte [ebp + esi - 0xcc4], 0
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
add esp, 0x10
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x3c4], al
jle 0x424ecd
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0xcc4]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xcc4]
mov byte [ebp - 0xcb6], 0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x424c40
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1c2], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x424c0f
lea eax, [ecx - 0xe]
lea esi, [ebp - 0x5b6]
mov ecx, eax
lea edi, [ebp - 0x9c4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x9c4], 0
lea eax, [ebp - 0x9c4]
lea ecx, [ebp - 0x1c4]
push eax
push ecx
lea edx, [ebp - 0x3c4]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xcc4]
push str.Systemroot
push eax
mov byte [ebp - 0xcba], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x424d1c
lea ecx, [ebp - 0x1c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x424cd4
lea eax, [ecx - 0xa]
lea esi, [ebp - 0x5ba]
mov ecx, eax
lea edi, [ebp - 0x9c4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x9c4], 0
lea eax, [ebp - 0x9c4]
lea ecx, [ebp - 0x1c4]
push eax
push ecx
lea edx, [ebp - 0x3c4]
push str._s_s
push edx
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3c4], al
lea eax, [ebp - 0xcc4]
push str.system32
push eax
mov byte [ebp - 0xcbc], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x424df8
lea ecx, [ebp - 0x1c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x424db0
lea eax, [ecx - 8]
lea esi, [ebp - 0x5bc]
mov ecx, eax
lea edi, [ebp - 0x9c4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x9c4], 0
lea eax, [ebp - 0x9c4]
lea ecx, [ebp - 0x1c4]
push eax
push ecx
lea edx, [ebp - 0x3c4]
push str._s_s
push edx
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3c4], al
lea eax, [ebp - 0xcc4]
push str._Windir_
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x424ecd
lea ecx, [ebp - 0x1c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x424e85
lea eax, [ecx - 8]
lea esi, [ebp - 0x5bc]
mov ecx, eax
lea edi, [ebp - 0x9c4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x9c4], 0
lea eax, [ebp - 0x9c4]
lea ecx, [ebp - 0x1c4]
push eax
push ecx
lea edx, [ebp - 0x3c4]
push str._s_s
push edx
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x3c4], al
lea eax, [ebp - 0x3c4]
push str.system32_
push eax
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x425420
lea ecx, [ebp - 0x3c4]
push str..sys
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4250a2
cmp byte [ebp - 0x3c3], 0x3a
je 0x4250a2
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
lea esi, [ebp + ecx - 0x3c4]
cmp edx, ecx
jge 0x424f48
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xdc4], al
jne 0x424f44
cmp edx, 2
jge 0x424f48
inc edx
dec esi
jmp 0x424f2e
sub ecx, edx
xor eax, eax
mov esi, ecx
cmp eax, esi
jge 0x424f63
mov cl, byte [ebp + eax - 0x3c4]
mov byte [ebp + eax - 0xbc4], cl
inc eax
jmp 0x424f4e
mov byte [ebp + esi - 0xbc4], 0
xor ecx, ecx
cmp ecx, edx
jge 0x424f93
lea eax, [ecx + esi]
mov al, byte [ebp + eax - 0x3c3]
cmp al, 0x5c
je 0x424f88
mov byte [ebp + ecx - 0xdc4], al
jne 0x424f90
mov byte [ebp + ecx - 0xdc4], 0
inc ecx
jmp 0x424f6d
lea edi, [ebp - 0xdc4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0xdc4], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xdc5]
mov cl, byte [ebp + ecx - 0xdc5]
cmp cl, 0x22
jne 0x424fc1
mov byte [eax], 0
lea edi, [ebp - 0xbc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x424fe4
cmp byte [ebp + eax - 0xbc4], 0x3a
je 0x424fe4
inc eax
jmp 0x424fd3
mov esi, edi
xor edx, edx
sub esi, eax
lea ecx, [esi + 1]
cmp edx, ecx
jge 0x425005
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0xbc5]
mov byte [ebp + edx - 0x5c5], cl
jmp 0x424fea
cmp eax, edi
mov byte [ebp + esi - 0x5c3], 0
jne 0x42503e
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x5c4]
push eax
push str._s_system32drivers
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xdc4]
push edx
call fcn.00483565
add esp, 4
push eax
lea eax, [ebp - 0x5c4]
push eax
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0xac4]
push eax
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edi, [ebp - 0xac4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x3c4]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 4], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3c4]
push str..SYS
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425261
cmp byte [ebp - 0x3c3], 0x3a
je 0x425261
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ebp + ecx - 0x3c4]
cmp eax, ecx
jge 0x425104
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0xdc4], dl
jne 0x425100
cmp eax, 2
jge 0x425104
inc eax
dec esi
jmp 0x4250e9
sub ecx, eax
mov esi, ecx
xor ecx, ecx
cmp ecx, esi
jge 0x42511f
mov dl, byte [ebp + ecx - 0x3c4]
mov byte [ebp + ecx - 0xbc4], dl
inc ecx
jmp 0x42510a
mov byte [ebp + esi - 0xbc4], 0
xor edx, edx
cmp edx, eax
jge 0x425150
lea ecx, [edx + esi]
mov cl, byte [ebp + ecx - 0x3c3]
cmp cl, 0x5c
je 0x425145
mov byte [ebp + edx - 0xdc4], cl
jne 0x42514d
mov byte [ebp + edx - 0xdc4], 0
inc edx
jmp 0x425129
mov byte [ebp + eax - 0xdc4], 0
lea edi, [ebp - 0xdc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xdc5]
mov cl, byte [ebp + ecx - 0xdc5]
cmp cl, 0x22
jne 0x42517e
mov byte [eax], 0
lea edi, [ebp - 0xbc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x4251a1
cmp byte [ebp + eax - 0xbc4], 0x3a
je 0x4251a1
inc eax
jmp 0x425190
mov esi, edi
xor edx, edx
sub esi, eax
lea ecx, [esi + 1]
cmp edx, ecx
jge 0x4251c4
lea ebx, [edx + eax]
inc edx
mov bl, byte [ebp + ebx - 0xbc5]
mov byte [ebp + edx - 0x5c5], bl
xor ebx, ebx
jmp 0x4251aa
cmp eax, edi
mov byte [ebp + esi - 0x5c3], 0
jne 0x4251fd
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x5c4]
push eax
push str._s_system32drivers
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xdc4]
push edx
call fcn.00483565
add esp, 4
push eax
lea eax, [ebp - 0x5c4]
push eax
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0xac4]
push eax
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edi, [ebp - 0xac4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x3c4]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 4], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3c4]
push str..Sys
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425420
cmp byte [ebp - 0x3c3], 0x3a
je 0x425420
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ebp + ecx - 0x3c4]
cmp eax, ecx
jge 0x4252c3
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0xdc4], dl
jne 0x4252bf
cmp eax, 2
jge 0x4252c3
inc eax
dec esi
jmp 0x4252a8
sub ecx, eax
mov esi, ecx
xor ecx, ecx
cmp ecx, esi
jge 0x4252de
mov dl, byte [ebp + ecx - 0x3c4]
mov byte [ebp + ecx - 0xbc4], dl
inc ecx
jmp 0x4252c9
mov byte [ebp + esi - 0xbc4], 0
xor edx, edx
cmp edx, eax
jge 0x42530f
lea ecx, [edx + esi]
mov cl, byte [ebp + ecx - 0x3c3]
cmp cl, 0x5c
je 0x425304
mov byte [ebp + edx - 0xdc4], cl
jne 0x42530c
mov byte [ebp + edx - 0xdc4], 0
inc edx
jmp 0x4252e8
mov byte [ebp + eax - 0xdc4], 0
lea edi, [ebp - 0xdc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xdc5]
mov cl, byte [ebp + ecx - 0xdc5]
cmp cl, 0x22
jne 0x42533d
mov byte [eax], 0
lea edi, [ebp - 0xbc4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x425360
cmp byte [ebp + eax - 0xbc4], 0x3a
je 0x425360
inc eax
jmp 0x42534f
mov esi, edi
xor edx, edx
sub esi, eax
lea ecx, [esi + 1]
cmp edx, ecx
jge 0x425383
lea ebx, [edx + eax]
inc edx
mov bl, byte [ebp + ebx - 0xbc5]
mov byte [ebp + edx - 0x5c5], bl
xor ebx, ebx
jmp 0x425369
cmp eax, edi
mov byte [ebp + esi - 0x5c3], 0
jne 0x4253bc
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x5c4]
push eax
push str._s_system32drivers
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xdc4]
push edx
call fcn.00483565
add esp, 4
push eax
lea eax, [ebp - 0x5c4]
push eax
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0xac4]
push eax
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edi, [ebp - 0xac4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x3c4]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 4], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3c4]
push str..RECYCLER
push ecx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x425500
lea edx, [ebp - 0x1c4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1c2], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xc]
cmp esi, ebx
jle 0x4254a4
cmp byte [ebp + eax - 0x5c4], 0x5c
je 0x4254a4
inc eax
cmp eax, esi
jl 0x425495
mov edx, ecx
xor esi, esi
sub edx, eax
cmp edx, ebx
jle 0x4254cf
lea eax, [ebp + eax - 0x5c4]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xcc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0xcc4]
lea edx, [ebp - 0x1c4]
push ecx
push edx
lea eax, [ebp - 0x3c4]
push str._s_s
push eax
mov byte [ebp + esi - 0xcc4], 0
mov byte [ebp - 0x3c4], 0
call fcn.0047a8f8
add esp, 0x10
cmp byte [ebp - 0x3c4], 0x22
jne 0x425554
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp esi, ebx
jle 0x42552b
lea edx, [ebp - 0xac4]
mov al, byte [ebp + ecx - 0x3c4]
cmp al, 0x22
je 0x425526
mov byte [edx], al
inc edx
inc ecx
cmp ecx, esi
jl 0x425518
lea edi, [ebp - 0xac4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3c4]
push 0x48b7ec
push ecx
call fcn.0047bec0
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], ecx
lea ebx, [ecx - 2]
test ebx, ebx
jle 0x42559d
cmp byte [ebp + ebx - 0x3c4], 0x3a
jne 0x425596
cmp byte [ebp + ebx - 0x3c3], 0x5c
je 0x42559b
dec ebx
test ebx, ebx
jg 0x425582
test ebx, ebx
je 0x4256b5
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xac4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x491a04
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3c4]
xor esi, esi
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4255eb
mov esi, 1
lea edx, [ebp - 0x3c4]
push 0x491a00
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425608
mov esi, 1
mov eax, dword [ebp + 8]
test eax, eax
jle 0x42564f
mov dl, 0x65
mov cl, byte [ebp + eax - 0x3c4]
cmp esi, 1
jne 0x42563b
cmp cl, 0x2e
jne 0x42564a
cmp byte [ebp + eax - 0x3c3], dl
je 0x42564f
cmp cl, cl
jne 0x42564a
cmp byte [ebp + eax - 0x3c3], 0x45
je 0x42564f
jmp 0x42564a
cmp cl, 0x2e
jne 0x42564a
cmp byte [ebp + eax - 0x3c3], 0x2e
jne 0x42564f
dec eax
test eax, eax
jg 0x425611
sub eax, ebx
mov byte [ebp - 0x3c4], 0
lea ecx, [eax + 5]
test ecx, ecx
jle 0x42567a
mov edx, ecx
lea esi, [ebp + ebx - 0xac5]
lea edi, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x3bf], 0
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4256a5
cmp byte [ebp + ecx - 0x3c4], 0x2e
je 0x4256a5
dec ecx
test ecx, ecx
jg 0x425696
test ecx, ecx
mov byte [ebp + ecx - 0x3c0], 0
jne 0x425794
lea eax, [ebp - 0x844]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x425747
lea edx, [ebp - 0x1c4]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x425747
lea eax, [ebp - 0x1c4]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x425747
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x8c4]
push ecx
jmp 0x425754
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x844]
push ecx
push edx
lea eax, [ebp - 0x3c4]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x42578c
cmp byte [ebp + ecx - 0x3c4], 0x2e
je 0x42578c
dec ecx
test ecx, ecx
jg 0x42577d
mov byte [ebp + ecx - 0x3c0], 0
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
push str..sys
mov dword [edx], eax
lea eax, [ebp - 0x3c4]
push eax
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x425833
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.00428d90
mov esi, eax
lea edx, [ebp - 0x844]
lea eax, [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x944]
push eax
lea edx, [ebp - 0x3c4]
push ecx
push edx
call fcn.004456c0
lea eax, [ebp - 0x844]
lea ecx, [ebp - 0x1c4]
push eax
lea edx, [ebp - 0x944]
push ecx
push edx
push esi
lea eax, [ebp - 0xbc4]
push 0x49bafc
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xbc4]
push ecx
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x3c4]
push str..SYS
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4258c1
lea eax, [ebp - 0x3c4]
push eax
call fcn.00428d90
lea ecx, [ebp - 0x944]
mov esi, eax
lea edx, [ebp - 0x844]
push ecx
lea eax, [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x3c4]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0x944]
lea eax, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x1c4]
push eax
push ecx
push esi
lea edx, [ebp - 0xbc4]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0xbc4]
push eax
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3c4]
push str..Sys
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x42594f
lea edx, [ebp - 0x3c4]
push edx
call fcn.00428d90
mov esi, eax
lea eax, [ebp - 0x944]
lea ecx, [ebp - 0x844]
push eax
lea edx, [ebp - 0x1c4]
push ecx
lea eax, [ebp - 0x3c4]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0x944]
lea edx, [ebp - 0x844]
push ecx
lea eax, [ebp - 0x1c4]
push edx
push eax
push esi
lea ecx, [ebp - 0xbc4]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xbc4]
push edx
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c4]
push eax
call fcn.00429f20
mov esi, 1
add esp, 4
cmp eax, esi
je 0x425971
push 0x49badc
jmp 0x428d6f
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x8c4]
mov dword [ebp - 0x118], eax
push edx
lea eax, [ebp - 0xfe4]
push str._swinlogon.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3c4]
lea edx, [ebp - 0xfe4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x4259bf
push 0x49bab4
jmp 0x428d6f
lea eax, [ebp - 0x8c4]
lea ecx, [ebp - 0xfe4]
push eax
push str._scsrss.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3c4]
lea eax, [ebp - 0xfe4]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4259fb
push 0x49bab4
jmp 0x428d6f
lea ecx, [ebp - 0x8c4]
lea edx, [ebp - 0xfe4]
push ecx
push str._s_services.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3c4]
lea ecx, [ebp - 0xfe4]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x425a37
push 0x49ba7c
jmp 0x428d6f
lea edx, [ebp - 0x8c4]
lea eax, [ebp - 0xfe4]
push edx
push str._slsass.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3c4]
lea edx, [ebp - 0xfe4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x425a73
push 0x49ba7c
jmp 0x428d6f
lea eax, [ebp - 0x8c4]
lea ecx, [ebp - 0xfe4]
push eax
push str._s_svchost.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x3c4]
lea eax, [ebp - 0xfe4]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x425aaf
push 0x49ba7c
jmp 0x428d6f
lea ecx, [ebp - 0x8c4]
lea edx, [ebp - 0xfe4]
push ecx
push str._sctfmon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x3c4]
lea ecx, [ebp - 0xfe4]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x425aeb
push 0x49ba7c
jmp 0x428d6f
lea edx, [ebp - 0x8c4]
lea eax, [ebp - 0xfe4]
push edx
push str._s_rundll32.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x3c4]
lea edx, [ebp - 0xfe4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x425b27
push 0x49ba7c
jmp 0x428d6f
lea eax, [ebp - 0x1824]
lea ecx, [ebp - 0x4c4]
push eax
lea edx, [ebp - 0x3c4]
push ecx
push edx
call fcn.0046de70
movsx eax, ax
lea ecx, [ebp - 0x1064]
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x1524]
push ecx
lea eax, [ebp - 0x3c4]
push edx
push eax
call fcn.00455090
lea ecx, [ebp - 0x4c4]
push str.Microsoft
push ecx
mov dword [ebp - 0x28], 0
call fcn.0047bec0
add esp, 0x20
test eax, eax
je 0x425bd1
lea edx, [ebp - 0x1824]
push str.Microsoft
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425b9d
mov dword [ebp - 0x28], esi
jmp 0x425bd1
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x40], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea ecx, [ebp - 0x3c4]
push str.Program_Files_
push ecx
mov dword [ebp - 0x100], 0
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425bf9
mov dword [ebp - 0x100], esi
lea edx, [ebp - 0x3c4]
push str.program_files_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425c17
mov dword [ebp - 0x100], esi
lea eax, [ebp - 0x3c4]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425c35
mov dword [ebp - 0x110], esi
lea ecx, [ebp - 0x3c4]
push str._temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425c53
mov dword [ebp - 0x110], esi
lea edx, [ebp - 0x4c4]
push str.Maxthon_International
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425c75
push 0x49b9d8
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
push str.Mozilla_Corporation
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425c97
push 0x49b9d8
jmp 0x428d6f
lea ecx, [ebp - 0x4c4]
push str.MoreQuick
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425cb9
push 0x49b9d8
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Opera_Software
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425cdb
push 0x49b9d8
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
push 0x49b99c
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425cfd
push 0x49b978
jmp 0x428d6f
lea ecx, [ebp - 0x4c4]
push str.Microsoft
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425d18
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x4c4]
push str.Beijing_Rising
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425da7
mov edi, 0x49b958
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x5c4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x5c4]
push str.Beijing
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x425da7
lea ecx, [ebp - 0x5c4]
push str.Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425da7
lea edx, [ebp - 0x4c4]
push edx
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
push 0x49b940
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425dc9
push 0x49b934
jmp 0x428d6f
lea ecx, [ebp - 0x3c4]
push str.32A6Wizard_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425deb
push 0x49b934
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Trend_Micro_Inc
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425e7a
mov edi, 0x49b914
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x5c4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x5c4]
push str.Trend
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x425e7a
lea ecx, [ebp - 0x5c4]
push str.Trend
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425e7a
lea edx, [ebp - 0x4c4]
push edx
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
push str.Jiangmin_Co
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425f08
mov edi, 0x49b8f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Jiangmin
push eax
call fcn.0047bec0
lea ecx, [ebp - 0x3c4]
push str..kxp
push ecx
mov esi, eax
call fcn.0047bec0
add esp, 0x18
test esi, esi
je 0x425f08
test eax, eax
je 0x425f08
lea edx, [ebp - 0x4c4]
push edx
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
push str.Symantec_Corporation
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425f7f
mov edi, 0x49b8b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x425f7f
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Eset
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x425ff6
mov edi, 0x49b88c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x425ff6
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Network_Associates
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x42606d
mov edi, 0x49b868
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Networks_Associates_Technology__Inc
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x42606d
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.McAfee_Inc
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4260e4
mov edi, 0x49b868
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push 0x49b830
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x4260e4
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Kingsoft_Corporation
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x42615b
mov edi, 0x49b808
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Kingsoft
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x42615b
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Panda_Software
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4261d2
mov edi, 0x49b7dc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Panda
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x4261d2
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x4c4]
push str.Kaspersky_Lab
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x426249
mov edi, 0x49b7b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x3c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xac4]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xac4]
push str.Kaspersky
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x426249
lea ecx, [ebp - 0x4c4]
push ecx
jmp 0x428d6f
lea edx, [ebp - 0x3c4]
push str..sys
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4262d7
lea eax, [ebp - 0x3c4]
push eax
call fcn.00428d90
lea ecx, [ebp - 0x944]
mov esi, eax
lea edx, [ebp - 0x844]
push ecx
lea eax, [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x3c4]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0x944]
lea eax, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x1c4]
push eax
push ecx
push esi
lea edx, [ebp - 0xbc4]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0xbc4]
push eax
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3c4]
push str..SYS
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x426365
lea edx, [ebp - 0x3c4]
push edx
call fcn.00428d90
mov esi, eax
lea eax, [ebp - 0x944]
lea ecx, [ebp - 0x844]
push eax
lea edx, [ebp - 0x1c4]
push ecx
lea eax, [ebp - 0x3c4]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0x944]
lea edx, [ebp - 0x844]
push ecx
lea eax, [ebp - 0x1c4]
push edx
push eax
push esi
lea ecx, [ebp - 0xbc4]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xbc4]
push edx
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c4]
push str..Sys
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4263f3
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.00428d90
mov esi, eax
lea edx, [ebp - 0x944]
lea eax, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x1c4]
push eax
lea edx, [ebp - 0x3c4]
push ecx
push edx
call fcn.004456c0
lea eax, [ebp - 0x944]
lea ecx, [ebp - 0x844]
push eax
lea edx, [ebp - 0x1c4]
push ecx
push edx
push esi
lea eax, [ebp - 0xbc4]
push 0x49bafc
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xbc4]
push ecx
call fcn.00483565
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8c4]
push 0x80
push edx
mov dword [ebp - 0x138], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x11a4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x3c4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x426456
lea esi, [ebp + ecx - 0x3c4]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0x13a4], al
jne 0x426450
cmp edx, 2
jge 0x426456
inc edx
dec esi
cmp edx, ecx
jl 0x42643e
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x426482
mov ebx, ecx
lea esi, [ebp - 0x3c4]
lea edi, [ebp - 0x1724]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x6c]
jmp 0x42648a
mov edi, dword [ebp - 0x6c]
mov ebx, 1
xor ecx, ecx
mov byte [ebp + eax - 0x1724], 0
test edx, edx
jle 0x428d6a
lea esi, [ebp + eax - 0x3c3]
mov al, byte [ecx + esi]
cmp al, 0x5c
je 0x4264b1
mov byte [ebp + ecx - 0x13a4], al
cmp al, 0x2e
jne 0x4264b6
inc edi
cmp al, 0x20
jne 0x4264bb
inc edi
cmp al, 0x5c
jne 0x4264c7
mov byte [ebp + ecx - 0x13a4], 0
inc ecx
cmp ecx, edx
jl 0x4264a3
cmp edi, ebx
mov dword [ebp - 0x6c], edi
jg 0x428d6a
test edi, edi
je 0x428d6a
mov al, byte [ebp - 0x1723]
mov byte [ebp + edx - 0x13a4], 0
cmp al, 0x3a
je 0x4264fb
push 0x49b790
jmp 0x428d6f
cmp byte [ebp - 0x1722], 0x5c
je 0x426512
mov byte [ebp - 0x1722], 0x5c
mov byte [ebp - 0x1721], 0
lea ecx, [ebp - 0x1724]
push ecx
call fcn.00470cf0
mov dword [ebp - 0x13c], eax
lea edx, [ebp - 0x3c4]
push 0x100
lea eax, [ebp - 0xee4]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x13a4]
push 0x40
lea edx, [ebp - 0x1924]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x3c4]
push eax
call fcn.00483565
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x3c4]
push edx
mov dword [ecx], eax
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x2c
test eax, eax
jne 0x426595
cmp dword [ebp - 0x28], ebx
jne 0x426622
push 0x49b774
jmp 0x428d6f
lea eax, [ebp - 0x3c4]
push 0x80
lea ecx, [ebp - 0x1424]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x3c4]
push 0x80
lea eax, [ebp - 0x1124]
push edx
push eax
call fcn.0047b120
lea edi, [ebp - 0x11a4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x8c4]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x1424], al
lea edx, [ebp - 0x1424]
mov dword [ebp - 0x3c], eax
mov byte [ebp + ecx - 0x1124], al
lea ecx, [ebp - 0x11a4]
push ecx
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x426632
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42662c
push 0x491c80
jmp 0x428d6f
mov dword [ebp - 0x138], ebx
lea eax, [ebp - 0x8c4]
lea ecx, [ebp - 0x1124]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42666b
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x426668
push 0x491c80
jmp 0x428d6f
mov dword [ebp - 0x3c], ebx
lea edx, [ebp - 0x3c4]
push str.System32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4266a2
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42669f
push 0x491c80
jmp 0x428d6f
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x3c4]
push str.system32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4266d9
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4266d6
push 0x491c80
jmp 0x428d6f
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x3c4]
push str.system
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x426710
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42670d
push 0x491c80
jmp 0x428d6f
mov dword [ebp - 0x3c], ebx
lea edx, [ebp - 0x13a4]
push str.smss.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea eax, [ebp - 0x13a4]
push str.winlogon.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea ecx, [ebp - 0x13a4]
push str.csrss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea edx, [ebp - 0x13a4]
push str.services.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea eax, [ebp - 0x13a4]
push str.lsass.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea ecx, [ebp - 0x13a4]
push str.svchost.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea edx, [ebp - 0x13a4]
push str.taskmgr.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea eax, [ebp - 0x13a4]
push str.spoolsv.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea ecx, [ebp - 0x13a4]
push 0x48ba7c
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x426810
lea edx, [ebp - 0x13a4]
push str.conime.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x426816
mov dword [ebp - 0xa4], ebx
xor edi, edi
push 0x6309b0
mov dword [ebp - 4], 6
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x18], edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xe8], edi
call fcn.00404650
add esp, 4
lea eax, [ebp - 0x3c4]
push 0x6309b0
push eax
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x42685a
mov esi, ebx
jmp 0x42712e
mov ecx, dword [0x6309b8]
mov byte [ebp - 4], 7
push ecx
call fcn.004046b0
mov edx, dword [0x6309b8]
add esp, 4
mov dword [ebp - 0x144], eax
push edx
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x120], eax
jne 0x4268e9
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], 2
mov edx, dword [0x6309b8]
mov esi, 6
mov dword [ebp - 4], esi
push edx
mov byte [ebp - 4], 0xb
call fcn.004046d0
mov ebx, eax
xor edi, edi
add esp, 4
cmp ebx, edi
mov dword [ebp - 0x54], ebx
jne 0x426fea
mov dword [ebp + 0xc], esi
jmp 0x42711c
mov dword [ebp - 0xac], edi
cmp dword [eax + 0x10], edi
je 0x4268b7
mov eax, dword [eax + 0xc]
mov ecx, dword [0x6309b8]
mov edx, dword [ebp - 0x144]
push eax
push ecx
push edx
call fcn.00404730
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x1c], ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xe8]
inc eax
xor esi, esi
mov dword [ebp - 0xe8], eax
cmp esi, 0x66
jge 0x4269db
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4269d5
cmp esi, 0xf
jle 0x426973
cmp esi, 0x12
jge 0x426973
mov dword [ebp - 0x90], ebx
cmp esi, 0x1d
je 0x426982
cmp esi, 0x1e
je 0x426982
cmp esi, 0x39
jne 0x426985
mov dword [ebp - 0x70], ebx
cmp esi, 0x1f
je 0x42698f
cmp esi, 0x20
jne 0x426992
mov dword [ebp - 0x44], ebx
cmp esi, 0x21
je 0x42699c
cmp esi, 0x22
jne 0x4269a2
mov dword [ebp - 0x84], ebx
cmp esi, 0x23
je 0x4269ac
cmp esi, 0x24
jne 0x4269af
mov dword [ebp - 0x60], ebx
cmp esi, 0x2c
jne 0x4269ba
mov dword [ebp - 0x64], ebx
inc esi
jmp 0x426941
cmp esi, 0x2d
je 0x4269d2
cmp esi, 0x2e
jne 0x4269cd
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x426941
cmp esi, 0x3d
jne 0x4269d5
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x426941
mov ecx, dword [0x6309b8]
mov byte [ebp - 4], 8
push ecx
mov dword [ebp - 0x130], 0
call fcn.004046b0
mov edx, dword [0x6309b8]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x140], esi
call fcn.004047a0
mov ecx, dword [ebp - 0xac]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x426a24
mov eax, dword [ecx + 0x10]
mov edx, dword [0x6309b8]
push eax
push edx
push esi
mov dword [ebp - 0x134], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x4268b7
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x426f2c
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x426ab8
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xde4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x10a4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x10a4]
jmp 0x426b3c
mov edx, dword [0x6309b8]
push eax
mov eax, dword [ebp - 0x140]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x426af7
xor ecx, ecx
lea edx, [ebp - 0xde4]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x10c], esi
jmp 0x426b47
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xde4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1084]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x10c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x426ee3
mov eax, dword [ebp - 0x10c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x426edd
cmp esi, 0x45
jne 0x426c09
lea ecx, [ebp - 0x944]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x944]
lea eax, [ebp - 0x844]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x844]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x426be2
lea edx, [ebp - 0x4c4]
lea eax, [ebp - 0x5c4]
push edx
push 0x49b6c8
push eax
jmp 0x426bf5
lea ecx, [ebp - 0x4c4]
lea edx, [ebp - 0x5c4]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
jmp 0x428d6f
test esi, esi
jne 0x426c19
mov dword [ebp - 0x88], edi
inc esi
jmp 0x426b49
cmp esi, edi
jne 0x426c26
mov dword [ebp - 0x50], edi
inc esi
jmp 0x426b49
cmp esi, 2
je 0x426edd
cmp esi, 4
jne 0x426c40
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x426b49
cmp esi, 5
jne 0x426c51
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x426b49
cmp esi, 6
jne 0x426c62
mov dword [ebp - 0x114], edi
inc esi
jmp 0x426b49
cmp esi, 7
jne 0x426c73
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x426b49
cmp esi, 8
jne 0x426c84
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x426b49
cmp esi, 9
jne 0x426c95
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x426b49
cmp esi, 0xa
jne 0x426ca3
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x426b49
cmp esi, 0xb
jne 0x426cb4
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x426b49
jle 0x426cbe
cmp esi, 0xf
jge 0x426cc1
mov dword [ebp - 0x48], edi
cmp esi, 0xf
jne 0x426ccf
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x426b49
jle 0x426cdc
cmp esi, 0x12
jge 0x426cdc
mov dword [ebp - 0x90], edi
cmp esi, 0x1b
jne 0x426ced
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x426b49
cmp esi, 0x1c
jne 0x426cfb
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x426b49
cmp esi, 0x1d
je 0x426d0a
cmp esi, 0x1e
je 0x426d0a
cmp esi, 0x39
jne 0x426d0d
mov dword [ebp - 0x70], edi
cmp esi, 0x1f
je 0x426d17
cmp esi, 0x20
jne 0x426d1a
mov dword [ebp - 0x44], edi
cmp esi, 0x21
je 0x426d24
cmp esi, 0x22
jne 0x426d2a
mov dword [ebp - 0x84], edi
cmp esi, 0x23
je 0x426d34
cmp esi, 0x24
jne 0x426d37
mov dword [ebp - 0x60], edi
cmp esi, 0x25
je 0x426d41
cmp esi, 0x26
jne 0x426d47
mov dword [ebp - 0x104], edi
cmp esi, 0x27
jne 0x426d58
mov dword [ebp - 0x124], edi
inc esi
jmp 0x426b49
cmp esi, 0x28
jne 0x426d69
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x426b49
cmp esi, 0x2c
jne 0x426d77
mov dword [ebp - 0x64], edi
inc esi
jmp 0x426b49
cmp esi, 0x2d
jne 0x426d85
mov dword [ebp - 0x34], edi
inc esi
jmp 0x426b49
cmp esi, 0x2e
jne 0x426d93
mov dword [ebp - 0x78], edi
inc esi
jmp 0x426b49
cmp esi, 0x2f
jne 0x426da4
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x426b49
cmp esi, 0x30
jne 0x426db5
mov dword [ebp - 0xec], edi
inc esi
jmp 0x426b49
cmp esi, 0x31
jne 0x426dc6
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x426b49
cmp esi, 0x32
jne 0x426dd7
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x426b49
cmp esi, 0x34
jne 0x426de5
mov dword [ebp - 0x68], edi
inc esi
jmp 0x426b49
cmp esi, 0x35
jne 0x426df6
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x426b49
cmp esi, 0x36
jne 0x426e04
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x426b49
cmp esi, 0x37
jne 0x426e19
mov dword [ebp - 0xc8], 0
inc esi
jmp 0x426b49
cmp esi, 0x38
jne 0x426e2a
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x426b49
cmp esi, 0x3a
je 0x426e39
cmp esi, 0x3b
je 0x426e39
cmp esi, 0x3c
jne 0x426e3f
mov dword [ebp - 0xf0], edi
cmp esi, 0x3d
jne 0x426e4d
mov dword [ebp - 0x34], edi
inc esi
jmp 0x426b49
cmp esi, 0x3e
jne 0x426e5e
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x426b49
cmp esi, 0x3f
jne 0x426e6c
mov dword [ebp - 0x74], edi
inc esi
jmp 0x426b49
cmp esi, 0x40
jne 0x426e7a
mov dword [ebp - 0x50], edi
inc esi
jmp 0x426b49
cmp esi, 0x41
jne 0x426e8b
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x426b49
cmp esi, 0x42
jne 0x426e9c
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x426b49
cmp esi, 0x43
je 0x426ea6
cmp esi, 0x44
jne 0x426eac
mov dword [ebp - 0xe0], edi
cmp esi, 0x46
je 0x426ebb
cmp esi, 0x47
je 0x426ebb
cmp esi, 0x48
jne 0x426ec1
mov dword [ebp - 0xb4], edi
cmp esi, 0x49
jne 0x426ed2
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x426b49
cmp esi, 0x55
jne 0x426edd
mov dword [ebp - 0x108], edi
inc esi
jmp 0x426b49
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
inc ecx
cmp eax, edi
mov dword [ebp - 0x18], ecx
jne 0x426ef4
inc dword [ebp - 0x80]
cmp dword [ebp - 0x18], 0x2710
jg 0x426f2c
mov esi, dword [ebp - 0x130]
mov edx, dword [ebp - 0x134]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x426a51
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x120]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 7
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x120], eax
xor edi, edi
jmp 0x4268ef
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
mov esi, eax
mov dword [ebp + 8], edi
cmp di, word [ebx + 2]
jae 0x42711c
xor ecx, ecx
push str..asp
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov byte [ebp - 0x94], cl
mov edx, dword [esi]
mov dword [ebp - 0x9c], edx
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x98], eax
push ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
test eax, eax
jne 0x42704c
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x9c]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x427067
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x9c]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x427082
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x9c]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42709d
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x9c]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4270b8
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x9c]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4270d3
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp + 8]
inc eax
cmp eax, 0x64
mov dword [ebp + 8], eax
jg 0x42711c
mov ebx, dword [ebp - 0x54]
add esi, 0x28
inc edi
jmp 0x426ffd
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 6
mov ebx, 1
mov ecx, dword [0x6309b8]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x42716a
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 3
push 0x6309b0
call fcn.00404650
add esp, 4
cmp esi, ebx
jne 0x427185
push 0x49b598
jmp 0x428d6f
mov edx, dword [ebp - 0x80]
mov dword [ebp + 8], edi
test esi, esi
mov dword [ebp - 0x18], edx
je 0x427845
cmp edi, ebx
jge 0x427845
lea eax, [ebp - 0x1724]
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.0047c0d3
push 0x5585bd5d
call fcn.00660efb
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1724]
xor ebx, ebx
push eax
push ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x20], ebx
call fcn.00477bd0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x30]
mov esi, 1
add esp, 8
cmp eax, esi
mov byte [ebp - 0x7c4], bl
jne 0x4278e3
cmp ecx, esi
jge 0x4278a2
mov eax, dword [ebp - 0x118]
cmp eax, 0x4b000
jle 0x4278e9
cmp dword [ebp - 0x20], esi
jne 0x427898
push 0x49b4b8
jmp 0x428d6f
push 0x49b4a4
jmp 0x428d6f
cmp dword [ebp - 0x20], esi
jne 0x4278bc
lea edx, [ebp - 0x4c4]
lea eax, [ebp - 0x7c4]
push edx
push 0x49b484
push eax
jmp 0x4278cf
lea ecx, [ebp - 0x4c4]
lea edx, [ebp - 0x7c4]
push ecx
push 0x49b468
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x7c4]
push eax
jmp 0x428d6f
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xb4], esi
jne 0x427956
cmp ecx, esi
jge 0x427915
cmp eax, 0x4b000
jle 0x427956
cmp dword [ebp - 0x20], esi
jne 0x42790b
push 0x49b450
jmp 0x428d6f
push 0x49b43c
jmp 0x428d6f
cmp dword [ebp - 0x20], esi
jne 0x42792f
lea ecx, [ebp - 0x4c4]
lea edx, [ebp - 0x7c4]
push ecx
push 0x49b41c
push edx
jmp 0x427942
lea eax, [ebp - 0x4c4]
lea ecx, [ebp - 0x7c4]
push eax
push 0x49b400
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0x7c4]
push edx
jmp 0x428d6f
cmp dword [ebp - 0xf4], esi
jne 0x4279ab
cmp ecx, esi
jge 0x427973
cmp eax, 0x4b000
jle 0x4279ab
push 0x49b3e8
jmp 0x428d6f
lea eax, [ebp - 0x4c4]
lea ecx, [ebp - 0x7c4]
push eax
push 0x49b3c8
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x7c4]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xbc]
mov dword [ebp + 0xc], ebx
cmp eax, esi
jle 0x4279ec
mov edi, 0x49b3c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x114], esi
jne 0x427a29
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea eax, [ebp - 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x427a76
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dl, byte [ebp - 0x13a4]
cmp dl, 0x30
je 0x427aae
cmp dl, 0x31
je 0x427aae
cmp dl, 0x32
je 0x427aae
cmp dl, 0x33
je 0x427aae
cmp dl, 0x34
je 0x427aae
cmp dl, 0x35
je 0x427aae
cmp dl, 0x36
je 0x427aae
cmp dl, 0x37
je 0x427aae
cmp dl, 0x38
je 0x427aae
cmp dl, 0x39
jne 0x427aed
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov ebx, dword [ebp - 0x54]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc eax
mov esi, 1
mov dword [ebp - 0x14], eax
cmp dl, 0x30
je 0x427b1f
cmp dl, 0x31
je 0x427b1f
cmp dl, 0x32
je 0x427b1f
cmp dl, 0x33
je 0x427b1f
cmp dl, 0x34
je 0x427b1f
cmp dl, 0x35
je 0x427b1f
cmp dl, 0x36
je 0x427b1f
cmp dl, 0x37
je 0x427b1f
cmp dl, 0x38
je 0x427b1f
cmp dl, 0x39
jne 0x427b5b
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xa4], esi
jne 0x427ba0
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp + 0xc], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x40], eax
mov esi, eax
cmp dword [ebp - 0xc4], esi
jne 0x427bdd
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x50], esi
jne 0x427c1e
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xfc], esi
jne 0x427c62
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xcc], esi
je 0x427c72
cmp dword [ebp - 0x124], esi
jne 0x427ca7
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xd4], esi
jne 0x427ceb
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x104], esi
jne 0x427d28
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x427d65
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x88], esi
jne 0x427da9
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x11c], esi
jne 0x427df4
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0xc], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xe4], esi
jne 0x427e38
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xa0], esi
jne 0x427e7c
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x4c], esi
jne 0x427eb6
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x48], esi
jne 0x427f58
cmp dword [ebp - 0xec], esi
je 0x427edc
cmp dword [ebp - 0xa8], esi
je 0x427edc
lea edx, [ebp - 0x7c4]
mov edi, 0x49b2d8
jmp 0x427f27
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xb0]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x7c4]
mov edi, 0x49b2b8
je 0x427f27
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xb8], esi
jne 0x427f9c
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xc0], esi
jne 0x427fe0
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x90], esi
jne 0x428024
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x2c], esi
jne 0x4280ad
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, edx
and ecx, 3
mov edx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, edx
mov dword [ebp - 0x14], ecx
jne 0x4280b2
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x40], edx
jmp 0x4280b2
mov edx, 1
cmp dword [ebp - 0x7c], edx
jne 0x42816d
cmp dword [ebp - 0x68], edx
jne 0x42816d
cmp dword [ebp - 0x8c], edx
jne 0x42816d
cmp dword [ebp - 0x5c], edx
jne 0x42811d
mov eax, dword [ebp - 0x74]
mov edi, 0x49b24c
cmp eax, edx
lea edx, [ebp - 0x7c4]
je 0x4280ec
mov edi, 0x49b23c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0xc8], edx
jne 0x42816d
mov eax, dword [ebp - 0x74]
mov edi, 0x49b224
cmp eax, edx
lea edx, [ebp - 0x7c4]
je 0x42813c
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0xd0], edx
jne 0x4281d5
cmp dword [ebp - 0x7c], edx
jne 0x428199
cmp dword [ebp - 0x68], edx
jne 0x428199
cmp dword [ebp - 0x8c], edx
jne 0x428199
cmp dword [ebp - 0x5c], edx
jne 0x428199
lea edx, [ebp - 0x7c4]
mov edi, 0x49b204
jmp 0x4281a4
lea edx, [ebp - 0x7c4]
mov edi, 0x49b1f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0xd8], edx
jne 0x428212
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], edx
jne 0x428253
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0xe0], edx
jne 0x428297
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x44], edx
jne 0x4282d8
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x84], edx
jne 0x42831c
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x60], edx
jne 0x42835d
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x64], edx
jne 0x42839e
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4283e1
mov edi, 0x49b17c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x6c], edx
je 0x428422
mov edi, 0x49b16c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x34], edx
jne 0x428463
mov edi, 0x49b160
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, 1
cmp dword [ebp - 0x78], edx
jne 0x4284de
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x40]
mov ecx, edx
mov edx, 1
and ecx, 3
cmp eax, edx
rep movsb byte es:[edi], byte [esi]
jne 0x4284ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe8], 2
jge 0x4284de
cmp dword [ebp - 0x13c], edx
jne 0x4284c8
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4284c8
mov ebx, edx
lea edi, [ebp - 0x4c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jne 0x4284de
mov ebx, edx
cmp dword [ebp - 0xf0], edx
jne 0x42851b
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], edx
jne 0x428558
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x428566
mov eax, 6
jmp 0x428569
shl eax, 2
cmp dword [ebp + 8], eax
jge 0x4285b9
mov eax, dword [ebp - 0x4c]
mov edi, 0x49b12c
cmp eax, edx
lea edx, [ebp - 0x7c4]
je 0x428585
mov edi, 0x49b11c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
mov edx, 1
inc eax
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
jle 0x428600
cmp dword [ebp - 0x1c], edx
jne 0x428600
mov edi, 0x49b108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
mov edx, 1
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0x4c], edx
jne 0x428646
cmp eax, 5
jge 0x428646
test eax, eax
jle 0x428646
mov edi, 0x49b0ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
mov dword [ebp + 0xc], edx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x30]
cmp eax, 7
jge 0x428735
cmp dword [ebp - 0x3c], edx
jne 0x4286ea
cmp eax, edx
lea edx, [ebp - 0x7c4]
jge 0x42869f
mov edi, 0x49b0d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp + 0xc], eax
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 0x14]
jmp 0x42876b
mov edi, 0x49b0b8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x48], eax
jne 0x4286d6
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x44], eax
jne 0x428730
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
inc ecx
mov dword [ebp - 0x14], ecx
jmp 0x42876b
cmp eax, edx
lea edx, [ebp - 0x7c4]
mov edi, 0x49b0ac
jl 0x4286fe
mov edi, 0x49b09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x48], eax
jne 0x428730
mov dword [ebp + 0xc], eax
inc dword [ebp - 0x14]
jmp 0x42876b
lea edi, [ebp - 0x4c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, eax
jne 0x428828
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xee4]
push eax
call esi
lea ecx, [ebp - 0xee4]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x4287f4
lea edx, [ebp - 0xee4]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xee4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xee4]
push ecx
call esi
test eax, eax
jne 0x4287f4
lea edx, [ebp - 0xee4]
push edx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x4287f4
lea eax, [ebp - 0xee4]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x7c4]
mov edi, 0x49b05c
jmp 0x4287ff
lea edx, [ebp - 0x7c4]
mov edi, 0x49b01c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x7c4]
push ecx
jmp 0x428d6f
cmp dword [ebp - 0x30], eax
jle 0x4288ff
cmp dword [ebp - 0x100], 1
jne 0x4288ff
lea edi, [ebp - 0x4c4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], 0
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x30]
not ecx
dec ecx
test eax, eax
jle 0x428891
test ecx, ecx
jle 0x428891
lea ecx, [ebp + 8]
lea edx, [ebp - 0x944]
push ecx
lea eax, [ebp - 0x13a4]
push edx
lea ecx, [ebp - 0x1724]
push eax
push ecx
call fcn.0044a6e0
add esp, 0x10
mov ecx, dword [ebp + 8]
mov eax, 1
cmp ecx, eax
jle 0x4288ff
cmp dword [ebp - 0x108], 1
jne 0x42894d
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x42894d
cmp dword [ebp - 0x80], 0x32
jle 0x42894d
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.0047c0d3
mov eax, dword [ebp - 0x138]
add esp, 4
test eax, eax
mov dword [ebp - 0x24], 0
jne 0x428b40
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x428b40
mov eax, dword [ebp - 0x1c]
mov edi, 1
test eax, eax
je 0x428b9c
push 0x49ae7c
call fcn.00483565
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret