Function at 0x424ae0
Capabilities:
Encode data using base64
Get common file path
Get file attributes
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa98b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16a4
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0xfc], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x10c], eax
lea edx, [ebp - 0x594]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xa34]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or ecx, 0xffffffff
lea edi, [ebp - 0x594]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x424c64
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x594]
cmp al, 0x5c
jne 0x424c84
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp al, 0x25
jne 0x424c8f
mov esi, 1
lea eax, [ecx - 2]
test eax, eax
jle 0x424cbb
mov dl, byte [ebp + eax - 0x594]
cmp dl, 0x3a
jne 0x424cac
cmp byte [ebp + eax - 0x593], 0x5c
je 0x424cbb
cmp esi, 1
jne 0x424cb6
cmp dl, 0x5c
je 0x424cc4
dec eax
test eax, eax
jg 0x424c96
cmp esi, 1
jne 0x424d6e
sub ecx, eax
xor esi, esi
lea edx, [ecx - 1]
test edx, edx
jle 0x424cf0
lea eax, [ebp + eax - 0x593]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xcb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0xcb4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + esi - 0xcb4], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x594]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1134]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x594]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0x1134]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x594]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x424db4
cmp eax, ecx
je 0x424db4
test ecx, ecx
jle 0x424d85
cmp byte [ebp + ecx - 0x594], 0x2e
je 0x424d85
dec ecx
test ecx, ecx
jg 0x424d76
mov esi, ecx
xor edx, edx
sub esi, eax
mov byte [ebp - 0x594], 0
add esi, 5
test esi, esi
jle 0x424dac
lea edi, [eax + ebx - 1]
mov al, byte [edi + edx]
mov byte [ebp + edx - 0x594], al
inc edx
cmp edx, esi
jl 0x424d9d
mov byte [ebp + ecx - 0x58f], 0
lea edi, [ebp - 0x594]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x424dd7
cmp byte [ebp + ecx - 0x594], 0x2e
je 0x424dd7
dec ecx
test ecx, ecx
jg 0x424dc8
mov byte [ebp + ecx - 0x590], 0
lea ecx, [ebp - 0x594]
push ecx
call fcn.004ab3c0
mov esi, eax
add esp, 4
cmp esi, 1
jge 0x424e13
push 0x516d88
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x394]
push edx
push ebx
call fcn.004d9590
movsx edi, ax
add esp, 8
cmp edi, 1
mov dword [ebp - 0x104], edi
jge 0x424e57
cmp esi, 0xc8000
jle 0x424eaf
push 0x515e50
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xc8000
jle 0x424eaf
lea eax, [ebp - 0x394]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x424eaf
lea ecx, [ebp - 0x394]
lea edx, [ebp - 0x1134]
push ecx
push 0x515e38
push edx
call fcn.004f175f
lea eax, [ebp - 0x1134]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x394]
xor esi, esi
push str.Microsoft
push ecx
mov dword [ebp - 0x108], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424eda
mov esi, 1
mov dword [ebp - 0x108], esi
lea edx, [ebp - 0x974]
lea eax, [ebp - 0x594]
push edx
push eax
call fcn.004c9790
add esp, 8
cmp esi, 1
jne 0x424f66
cmp edi, 5
jle 0x424f66
lea ecx, [ebp - 0x974]
push str.Visual_C
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424f30
push 0x516d70
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x974]
push str.Visual_Studio
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424f66
push 0x516d70
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x394]
push str.NMGameX
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424fcc
lea ecx, [ebp - 0x974]
push str.XEngine
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424fcc
lea edx, [ebp - 0x594]
push str.NMGameX
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x424fcc
push 0x516d34
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x394]
push str.EnterSafe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42501a
lea ecx, [ebp - 0x974]
push str.PKI_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42501a
push 0x516cf8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x394]
push str.Morrowsoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x425055
cmp edi, 5
jle 0x425055
push 0x516cd8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x394]
push 0x515dc8
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42508b
push 0x516cc8
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x594]
push str.32A6Wizard_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4250c1
push 0x515dbc
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._smswsock.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x594]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425111
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._smsgina.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425161
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._swsock32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x594]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4251b1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._sws2_32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x594]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425201
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._sSETUPAPI.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425251
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._sNETUI1.DLl
push edx
call fcn.004f175f
lea eax, [ebp - 0x594]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4252a1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._sMSI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x594]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4252f1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._sSHELL32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425341
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._ses.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x594]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425391
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._surlmon.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x594]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4253e1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._smshtml.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425431
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._smfc42u.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x594]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425481
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._smprapi.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x594]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4254d1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._sinetcomm.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x594]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425521
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x594]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x425555
lea esi, [ebp + ecx - 0x594]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x1334], dl
jne 0x42554f
cmp eax, 2
jge 0x425555
inc eax
dec esi
cmp eax, ecx
jl 0x42553c
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x425577
mov ebx, ecx
lea esi, [ebp - 0x594]
lea edi, [ebp - 0xeb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xeb4], 0
test eax, eax
jle 0x4255aa
lea esi, [ebp + edx - 0x593]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x42559d
mov byte [ebp + ecx - 0x1334], dl
jne 0x4255a5
mov byte [ebp + ecx - 0x1334], 0
inc ecx
cmp ecx, eax
jl 0x42558c
mov byte [ebp + eax - 0x1334], 0
mov al, byte [ebp - 0xeb2]
cmp al, 0x5c
je 0x4255ca
mov byte [ebp - 0xeb2], 0x5c
mov byte [ebp - 0xeb1], 0
cmp byte [ebp - 0xeb3], 0x3a
je 0x42568a
lea edi, [ebp - 0xeb4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x4255fd
cmp byte [ebp + eax - 0xeb4], 0x3a
je 0x4255fd
inc eax
cmp eax, ecx
jl 0x4255ee
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x425628
mov ecx, edi
lea esi, [ebp + eax - 0xeb5]
mov ebx, ecx
lea edi, [ebp - 0xfb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0xfb3], 0
jne 0x425661
lea ecx, [ebp - 0x194]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x194]
lea eax, [ebp - 0xfb4]
push edx
push 0x50d39c
push eax
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0xfb4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xeb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xeb2], 0x5c
je 0x42569a
mov byte [ebp - 0xeb2], 0x5c
lea ecx, [ebp - 0x594]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
je 0x4256cc
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xeb3], 0x3a
je 0x4256f3
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xeb2], 0x5c
je 0x425703
mov byte [ebp - 0xeb2], 0x5c
lea edi, [ebp - 0x1334]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x425731
cmp byte [ebp + eax - 0x1334], 0x2e
jne 0x425728
mov edx, 1
inc eax
cmp eax, ecx
jl 0x425719
test edx, edx
jne 0x42574f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x1330], 0
jge 0x42577a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
push 0x80
push edx
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xa34]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x594]
push 0x100
lea edx, [ebp - 0x1434]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x1334]
push 0x40
lea ecx, [ebp - 0x7f4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x594]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x425810
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x594]
push 0x80
lea ecx, [ebp - 0xbb4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x594]
push 0x80
lea eax, [ebp - 0xb34]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xa34]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x214]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xbb4], al
lea edx, [ebp - 0xbb4]
mov byte [ebp + ecx - 0xb34], al
lea ecx, [ebp - 0xa34]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
mov ebx, 1
test eax, eax
jne 0x4258c0
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4258c0
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xb34]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42590d
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42590d
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x594]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x425958
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x425958
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x594]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4259a3
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4259a3
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x594]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4259ee
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4259ee
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xeb4]
push 0x20
lea eax, [ebp - 0xab4]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xab4]
push str.c:endp
push ecx
mov byte [ebp - 0xaad], 0
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x425a40
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1334]
push str.cmd.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x425a76
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xeb4]
push eax
call fcn.004f2beb
xor edi, edi
push 0xd53b20
mov dword [ebp - 4], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 8
lea ecx, [ebp - 0x594]
push 0xd53b20
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x425aee
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x594]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x426352
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 1
push eax
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov dword [ebp - 0x110], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xf0], eax
jne 0x425b7e
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd53b28]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0xf8], esi
jne 0x42622c
mov dword [ebp + 8], 6
jmp 0x426340
mov dword [ebp - 0xf4], edi
cmp dword [eax + 0x10], edi
je 0x425b4a
mov edx, dword [eax + 0xc]
mov eax, dword [0xd53b28]
mov ecx, dword [ebp - 0x110]
push edx
push eax
push ecx
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0xf8], eax
cmp esi, 0x69
jge 0x425c60
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x425c5a
cmp esi, 0xf
jle 0x425bfb
cmp esi, 0x12
jge 0x425bfb
mov dword [ebp - 0x5c], ebx
cmp esi, 0x1d
je 0x425c0a
cmp esi, 0x1e
je 0x425c0a
cmp esi, 0x39
jne 0x425c0d
mov dword [ebp - 0x58], ebx
cmp esi, 0x1f
je 0x425c17
cmp esi, 0x20
jne 0x425c1a
mov dword [ebp - 0x50], ebx
cmp esi, 0x21
je 0x425c24
cmp esi, 0x22
jne 0x425c27
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x425c31
cmp esi, 0x24
jne 0x425c34
mov dword [ebp - 0x44], ebx
cmp esi, 0x2c
jne 0x425c3f
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x425bcb
cmp esi, 0x2d
je 0x425c57
cmp esi, 0x2e
jne 0x425c52
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x425bcb
cmp esi, 0x3d
jne 0x425c5a
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x425bcb
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0xe8], 0
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x114], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0xf4]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x425ca9
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
push eax
mov eax, dword [0xd53b28]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x425b4a
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x42616e
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x425d39
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9b4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x9b4]
jmp 0x425dbd
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0x114]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x425d78
xor ecx, ecx
lea edx, [ebp - 0x5b4]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x98], esi
jmp 0x425dc8
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x994]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x994]
mov dword [ebp - 0x98], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x426128
mov eax, dword [ebp - 0x98]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x426122
cmp esi, 0x45
jne 0x425e9e
lea ecx, [ebp - 0x194]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x194]
lea eax, [ebp - 0x1034]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1034]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x425e63
lea edx, [ebp - 0x394]
lea eax, [ebp - 0xcb4]
push edx
push 0x5153f4
push eax
jmp 0x425e76
lea ecx, [ebp - 0x394]
lea edx, [ebp - 0xcb4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xcb4]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x425eab
mov dword [ebp - 0x34], edi
inc esi
jmp 0x425dca
cmp esi, edi
jne 0x425eb8
mov dword [ebp - 0x38], edi
inc esi
jmp 0x425dca
cmp esi, 2
je 0x426122
cmp esi, 4
jne 0x425ed2
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x425dca
cmp esi, 5
jne 0x425ee3
mov dword [ebp - 0xec], edi
inc esi
jmp 0x425dca
cmp esi, 6
jne 0x425ef4
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x425dca
cmp esi, 7
jne 0x425f05
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x425dca
cmp esi, 8
jne 0x425f16
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x425dca
cmp esi, 9
jne 0x425f27
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x425dca
cmp esi, 0xa
jne 0x425f38
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x425dca
cmp esi, 0xb
jne 0x425f49
mov dword [ebp - 0x84], edi
inc esi
jmp 0x425dca
jle 0x425f53
cmp esi, 0xf
jge 0x425f56
mov dword [ebp - 0x30], edi
cmp esi, 0xf
jne 0x425f61
mov dword [ebp - 0x70], edi
inc esi
jmp 0x425dca
jle 0x425f6b
cmp esi, 0x12
jge 0x425f6b
mov dword [ebp - 0x5c], edi
cmp esi, 0x1b
jne 0x425f7c
mov dword [ebp - 0x94], edi
inc esi
jmp 0x425dca
cmp esi, 0x1c
jne 0x425f8d
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x425dca
cmp esi, 0x1d
je 0x425f9c
cmp esi, 0x1e
je 0x425f9c
cmp esi, 0x39
jne 0x425f9f
mov dword [ebp - 0x58], edi
cmp esi, 0x1f
je 0x425fa9
cmp esi, 0x20
jne 0x425fac
mov dword [ebp - 0x50], edi
cmp esi, 0x21
je 0x425fb6
cmp esi, 0x22
jne 0x425fb9
mov dword [ebp - 0x60], edi
cmp esi, 0x23
je 0x425fc3
cmp esi, 0x24
jne 0x425fc6
mov dword [ebp - 0x44], edi
cmp esi, 0x25
je 0x425fd0
cmp esi, 0x26
jne 0x425fd6
mov dword [ebp - 0xa4], edi
cmp esi, 0x27
jne 0x425fe7
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x425dca
cmp esi, 0x28
jne 0x425ff8
mov dword [ebp - 0xac], edi
inc esi
jmp 0x425dca
cmp esi, 0x29
jne 0x426006
mov dword [ebp - 0x74], edi
inc esi
jmp 0x425dca
cmp esi, 0x2c
jne 0x426014
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x425dca
cmp esi, 0x2d
jne 0x426022
mov dword [ebp - 0x28], edi
inc esi
jmp 0x425dca
cmp esi, 0x2e
jne 0x426030
mov dword [ebp - 0x54], edi
inc esi
jmp 0x425dca
cmp esi, 0x2f
jne 0x426041
mov dword [ebp - 0x90], edi
inc esi
jmp 0x425dca
cmp esi, 0x30
jne 0x42604f
mov dword [ebp - 0x78], edi
inc esi
jmp 0x425dca
cmp esi, 0x31
jne 0x42605d
mov dword [ebp - 0x80], edi
inc esi
jmp 0x425dca
cmp esi, 0x32
jne 0x42606e
mov dword [ebp - 0x88], edi
inc esi
jmp 0x425dca
cmp esi, 0x34
jne 0x42607f
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x425dca
cmp esi, 0x35
jne 0x426090
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x425dca
cmp esi, 0x36
jne 0x4260a1
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x425dca
cmp esi, 0x37
jne 0x4260b6
mov dword [ebp - 0xc0], 0
inc esi
jmp 0x425dca
cmp esi, 0x38
jne 0x4260c7
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x425dca
cmp esi, 0x3a
je 0x4260d6
cmp esi, 0x3b
je 0x4260d6
cmp esi, 0x3c
jne 0x4260dc
mov dword [ebp - 0xd0], edi
cmp esi, 0x3d
jne 0x4260ea
mov dword [ebp - 0x28], edi
inc esi
jmp 0x425dca
cmp esi, 0x3e
jne 0x4260fb
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x425dca
cmp esi, 0x3f
jne 0x426109
mov dword [ebp - 0x48], edi
inc esi
jmp 0x425dca
cmp esi, 0x40
jne 0x426117
mov dword [ebp - 0x38], edi
inc esi
jmp 0x425dca
cmp esi, 0x41
jne 0x426122
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x425dca
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xf8]
inc ecx
cmp eax, edi
mov dword [ebp - 0x40], ecx
jne 0x42613c
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x40], 0xc350
jg 0x42616e
mov esi, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x425cd2
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0xe8]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf0]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], eax
xor edi, edi
jmp 0x425b84
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], ebx
cmp bx, word [esi + 2]
jae 0x426340
xor ecx, ecx
push str..asp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x64], cl
mov edx, dword [edi]
mov dword [ebp - 0x6c], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x68], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x42627c
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x6c]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x426294
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x6c]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4262ac
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x6c]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4262c4
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x6c]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4262dc
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x6c]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4262f4
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x24], eax
jg 0x426340
mov esi, dword [ebp - 0xf8]
add edi, 0x28
inc ebx
jmp 0x42623f
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x40]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x42638e
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x4263bd
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x7c]
mov dword [ebp + 8], edi
test esi, esi
mov dword [ebp - 0x18], edx
je 0x426b0e
cmp edi, ebx
jge 0x426b0e
xor esi, esi
mov dword [ebp - 0x1c], esi
jmp 0x4263ed
lea eax, [ebp - 0x1334]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xcb4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push ecx
call fcn.004f175f
add esp, 0x10
jmp 0x42641e
push ebx
lea ecx, [ebp - 0x15c]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x426448
lea edx, [ebp - 0xcb4]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x42645c
lea eax, [ebp - 0x1434]
push str.c:endpcachemonitor_procPath2.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp - 0x24], esi
push ecx
push ebx
push str.c:endpcachemonitor_procPath2.txt
lea ecx, [ebp - 0x15c]
call fcn.004f0727
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x158]
cmp dword [eax + 0x30], 0xffffffff
jne 0x4264a9
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x4266a1
mov esi, dword [ebp - 0x158]
push 0xa
lea ecx, [ebp - 0x8f4]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x158], esi
call fcn.004f0ae9
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x426aa0
lea edx, [ebp - 0x8f4]
push str.Bound_to
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x426aa0
lea eax, [ebp - 0x8f4]
push str.Dump_of
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x426aa0
lea ecx, [ebp - 0x8f4]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x426aa0
lea edx, [ebp - 0x8f4]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42655a
mov dword [ebp - 0x100], ebx
lea eax, [ebp - 0x8f4]
push str.EXEHDR_to_dump_it
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42657c
push 0x5147b4
jmp 0x426699
lea ecx, [ebp - 0x8f4]
push str.Setup
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42659a
inc dword [ebp - 0xdc]
lea edx, [ebp - 0x8f4]
push str.SETUPAPI
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4265bc
push 0x5147b4
jmp 0x426699
cmp dword [ebp - 0x3c], ebx
jne 0x4265c4
inc dword [ebp + 8]
cmp dword [ebp - 0x14], ebx
jne 0x4265cc
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x426a9d
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x8f4]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x426a97
mov ecx, dword [ebp - 0xfc]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xfc], ecx
jne 0x4266d0
lea edx, [ebp - 0x1034]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1034]
lea ecx, [ebp - 0x14b4]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x14b4]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x426677
lea edx, [ebp - 0x394]
lea eax, [ebp - 0x1134]
push edx
push 0x5153f4
push eax
jmp 0x42668a
lea ecx, [ebp - 0x394]
lea edx, [ebp - 0x1134]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1134]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x148]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x426750
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x4266f0
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x8f4]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x8f4]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x8f4]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4267c8
test ebx, ebx
jne 0x4267c8
test eax, eax
jne 0x4267c8
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4265d0
cmp esi, 0x1a
jne 0x4267dc
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x426774
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x8f4]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x8f4]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x8f4]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4267c8
test ebx, ebx
jne 0x4267c8
test eax, eax
jne 0x4267c8
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4265d0
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x4265d0
cmp esi, 0x2a
jne 0x4267f3
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4265d0
cmp esi, 0x2b
jne 0x42680a
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4265d0
cmp esi, edi
jne 0x426817
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x4265d0
cmp esi, ebx
jne 0x426824
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x4265d0
cmp esi, 2
je 0x426a97
cmp esi, 4
jne 0x42683e
mov dword [ebp - 0xd4], ebx
inc esi
jmp 0x4265d0
cmp esi, 5
jne 0x42684f
mov dword [ebp - 0xec], ebx
inc esi
jmp 0x4265d0
cmp esi, 6
jne 0x426860
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x4265d0
cmp esi, 7
jne 0x426871
mov dword [ebp - 0xe4], ebx
inc esi
jmp 0x4265d0
cmp esi, 8
jne 0x426882
mov dword [ebp - 0xc4], ebx
inc esi
jmp 0x4265d0
cmp esi, 9
jne 0x426893
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x4265d0
cmp esi, 0xa
jne 0x4268a4
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x4265d0
cmp esi, 0xb
jne 0x4268b5
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x4265d0
jle 0x4268bf
cmp esi, 0xf
jge 0x4268c2
mov dword [ebp - 0x30], ebx
cmp esi, 0xf
jne 0x4268cd
mov dword [ebp - 0x70], ebx
inc esi
jmp 0x4265d0
jle 0x4268d7
cmp esi, 0x12
jge 0x4268d7
mov dword [ebp - 0x5c], ebx
cmp esi, 0x11
jle 0x4268e4
cmp esi, 0x19
jge 0x4268e4
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x4268f5
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x1c
jne 0x426906
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x1d
je 0x426915
cmp esi, 0x1e
je 0x426915
cmp esi, 0x39
jne 0x426918
mov dword [ebp - 0x58], ebx
cmp esi, 0x1f
je 0x426922
cmp esi, 0x20
jne 0x426925
mov dword [ebp - 0x50], ebx
cmp esi, 0x21
je 0x42692f
cmp esi, 0x22
jne 0x426932
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x42693c
cmp esi, 0x24
jne 0x42693f
mov dword [ebp - 0x44], ebx
cmp esi, 0x25
je 0x426949
cmp esi, 0x26
jne 0x42694f
mov dword [ebp - 0xa4], ebx
cmp esi, 0x27
jne 0x426960
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x28
jne 0x426971
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x29
jne 0x42697f
mov dword [ebp - 0x74], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x2c
jne 0x42698d
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x2d
jne 0x42699b
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x2e
jne 0x4269a9
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x2f
jne 0x4269ba
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x30
jne 0x4269c8
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x31
jne 0x4269d6
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x32
jne 0x4269e7
mov dword [ebp - 0x88], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x34
jne 0x4269f8
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x35
jne 0x426a09
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x36
jne 0x426a1a
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x37
jne 0x426a2b
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x4265d0
cmp esi, 0x38
jne 0x426a3c
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x3a
je 0x426a4b
cmp esi, 0x3b
je 0x426a4b
cmp esi, 0x3c
jne 0x426a51
mov dword [ebp - 0xd0], ebx
cmp esi, 0x3d
jne 0x426a5f
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x3e
jne 0x426a70
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x3f
jne 0x426a7e
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x40
jne 0x426a8c
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x4265d0
cmp esi, 0x41
jne 0x426a97
mov dword [ebp - 0xcc], ebx
inc esi
jmp 0x4265d0
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x154], 1
je 0x4264a9
lea ecx, [ebp - 0x15c]
call fcn.004f076e
mov eax, dword [ebp + 8]
mov ecx, 5
cmp eax, ecx
jle 0x426ad3
sub eax, ecx
mov dword [ebp + 8], eax
mov edx, dword [ebp - 0x18]
cmp edx, ecx
jle 0x426adf
sub edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
jne 0x426af4
cmp eax, 6
jle 0x426af4
sub eax, 6
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, dword [ebp - 0x84]
mov byte [ebp - 0x7b4], 0
cmp eax, ebx
jne 0x426b35
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10c], ebx
jne 0x426b5b
cmp dword [ebp - 0xdc], ebx
jle 0x426b5b
mov eax, 0x516bb4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x8c]
xor ebx, ebx
cmp eax, 1
mov dword [ebp - 0x14], ebx
jne 0x426b9b
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x426bd9
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc4]
mov eax, 1
cmp ecx, eax
jne 0x426c1d
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x426c58
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x94], eax
jne 0x426c96
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], eax
je 0x426ca6
cmp dword [ebp - 0x9c], eax
jne 0x426cdb
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcc], eax
jne 0x426d19
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa4], eax
jne 0x426d56
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe4], eax
jne 0x426d94
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x426dcf
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xac], eax
jne 0x426e14
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], eax
jne 0x426e52
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb4], eax
jne 0x426e90
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], eax
jne 0x426eca
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x426f60
cmp dword [ebp - 0x78], eax
je 0x426eea
cmp dword [ebp - 0x80], eax
je 0x426eea
lea edx, [ebp - 0x7b4]
mov edi, 0x515278
jmp 0x426f35
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x88]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x7b4]
mov edi, 0x515258
je 0x426f35
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], eax
jne 0x426f9e
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], eax
jne 0x426fd9
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x5c], eax
jne 0x427014
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x427093
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x108]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, ecx
jne 0x427098
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x427098
mov ecx, 1
cmp dword [ebp - 0xa0], ecx
jne 0x427150
cmp dword [ebp - 0xa8], ecx
jne 0x427150
cmp dword [ebp - 0xb0], ecx
jne 0x427150
cmp dword [ebp - 0xb8], ecx
jne 0x427106
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x7b4]
cmp eax, ecx
mov edi, 0x5151ec
je 0x4270db
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xc0], ecx
jne 0x427150
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x7b4]
cmp eax, ecx
mov edi, 0x5151c4
je 0x427125
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xc8], ecx
jne 0x42718d
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x58], ecx
jne 0x4271c8
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x50], ecx
jne 0x427203
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x60], ecx
jne 0x42723e
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x44], ecx
jne 0x427279
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4272c0
mov eax, dword [ebp - 0x100]
test eax, eax
jne 0x4272c0
mov edi, 0x516ba4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x4c], ecx
jne 0x4272fb
mov edi, str.PING
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x28], ecx
jne 0x427336
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x54], ecx
jne 0x427371
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd0], ecx
jne 0x4273af
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd8], ecx
jne 0x4273ec
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x4273fa
mov eax, 4
jmp 0x4273fd
lea eax, [eax + eax*2]
cmp dword [ebp + 8], eax
jge 0x42743b
mov edi, 0x516b88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x427480
cmp dword [ebp - 0x1c], ecx
jne 0x427480
mov edi, 0x516b74
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xe0], ecx
jne 0x4274ca
cmp eax, 5
jge 0x4274ca
test eax, eax
jle 0x4274ca
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x104]
cmp eax, 7
jge 0x4275a6
cmp dword [ebp - 0x2c], ecx
jne 0x427559
cmp eax, ecx
lea edx, [ebp - 0x7b4]
jge 0x427523
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x42759f
mov dword [ebp - 0x14], 1
jmp 0x42759f
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x42759f
jmp 0x42759c
cmp eax, ecx
lea edx, [ebp - 0x7b4]
mov edi, 0x515078
jl 0x42756d
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x42759f
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x104]
inc ebx
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x4275dc
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4275dc
cmp eax, 6
jle 0x4275dc
cmp ebx, 3
jge 0x4275dc
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.c:endpcache
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x42760b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x427641
mov ecx, dword [ebp - 0x34]
mov eax, 1
cmp ecx, eax
je 0x427641
cmp dword [ebp - 0x14], eax
je 0x427641
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x7b4]
lea ecx, [ebp - 0x16b4]
push eax
push 0x516b3c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x16b4]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret