Function at 0x4cfd30
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5958a3
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x6071d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], 0
push 0x6118b4
mov dword [ebp - 0x18c], 0x6118b4
call fcn.0053c980
add esp, 4
test eax, eax
je 0x4cfd92
push eax
call fcn.0053c464
add esp, 4
mov byte [ebp - 0x188], 1
mov dword [ebp - 0xfc], 0
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0xfc], 0
mov dword [ebp - 0x100], 5
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0xb8], 3
call fcn.004aafc0
push str.PROGRAMDATA
call fcn.0057b280
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.004d6ee0
push 0x5e2258
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac]
call fcn.004b0740
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4cfe20
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov dword [ebp - 0x140], 0
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x140], 0
mov dword [ebp - 0x144], 5
push 0
push 0xffffffffffffffff
push ecx
lea edx, [ebp - 0x148]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xac]
call fcn.00515f00
add esp, 0xc
test eax, eax
js 0x4d0192
mov eax, dword [ebp - 0x144]
cmp eax, 3
jne 0x4cfe92
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jmp 0x4cfea4
cmp eax, 2
jne 0x4cfea2
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 8]
jmp 0x4cfea4
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xb4], eax
test eax, eax
jle 0x4d0192
nop dword [eax]
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
push ebx
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x148]
call fcn.004ab4b0
mov edi, eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x40]
mov ecx, dword [edi]
push eax
mov esi, dword [ecx + 0x128]
mov ecx, esi
call dword [0x5a143c]
mov ecx, edi
call esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
push ecx
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 7
call fcn.004d4f20
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x234]
cmovae eax, dword [ebp - 0x40]
sub esp, 8
push eax
call fcn.004d6360
test eax, eax
mov eax, dword [ebp - 0x244]
push 0
mov eax, dword [eax + 4]
jne 0x4cff7d
lea edx, [ebp - 0x244]
add edx, eax
mov ecx, dword [edx + 0xc]
or ecx, 2
mov eax, ecx
or eax, 4
cmp dword [edx + 0x38], 0
cmovne eax, ecx
mov ecx, edx
jmp 0x4cff92
lea ecx, [ebp - 0x244]
xor edx, edx
add ecx, eax
mov eax, 4
cmp dword [ecx + 0x38], edx
cmovne eax, edx
push eax
call fcn.004b5c70
push 0
push 0x5d2d2d
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.004b7670
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x244]
call fcn.004d7040
lea ecx, [ebp - 0x234]
call fcn.004d62a0
test eax, eax
jne 0x4d0007
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x244]
push 0
mov eax, dword [eax + 4]
add edx, eax
mov ecx, dword [edx + 0xc]
or ecx, 2
mov eax, ecx
or eax, 4
cmp dword [edx + 0x38], 0
cmovne eax, ecx
mov ecx, edx
push eax
call fcn.004b5c70
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xd0], vtable.WaJson.0
mov byte [ebp - 0xc8], 0
mov dword [ebp - 0xcc], 5
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.004b8330
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], 8
jb 0x4d0047
mov eax, dword [eax]
test eax, eax
jne 0x4d0066
mov eax, dword [ebp - 0xd0]
mov esi, dword [eax + 0x5c]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0xd0]
call esi
jmp 0x4d0081
sub esp, 0x18
lea esi, [ebp - 0xd0]
mov ecx, esp
push eax
call fcn.004a94b0
mov ecx, esi
call fcn.004b2af0
add esp, 0x18
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d009a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0x104]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x104]
call esi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], vtable.WaJson.0
call fcn.004ab230
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4d00e8
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.004b7bd0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x244]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x248], eax
lea ecx, [ebp - 0x234]
call fcn.004d58a0
mov eax, dword [ebp - 0x244]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x244]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x248], eax
lea eax, [ebp - 0x1d4]
mov byte [ebp - 4], 0xf
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.005402a1
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x4d0185
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004a9d40
inc ebx
cmp ebx, dword [ebp - 0xb4]
jl 0x4cfec0
mov dword [ebp - 0x120], 0
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x120], 0
mov dword [ebp - 0x124], 5
mov dword [ebp - 0x14c], 0
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x14c], 0
mov dword [ebp - 0x150], 5
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x128]
mov dword [ebp - 0xb8], 2
call fcn.004aafc0
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 2
push eax
lea ecx, [ebp - 0x154]
call fcn.004aafc0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
call fcn.004bbea0
mov dword [ebp - 0xd8], eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
call fcn.004d6c90
mov dword [ebp - 0xf0], eax
mov byte [ebp - 4], 0x13
call fcn.004cf860
mov ebx, eax
mov dword [ebp - 0xe8], ebx
test ebx, ebx
je 0x4d0ec7
push ebx
call fcn.004cfae0
test al, al
je 0x4d0ec7
push str.oiGetThreatLogEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4d0806
lea eax, [ebp - 0x138]
mov ecx, esi
push eax
push 0
push 0
call dword [0x5a143c]
call esi
add esp, 0xc
test eax, eax
js 0x4d07f7
mov edi, dword [ebp - 0x138]
test edi, edi
je 0x4d07e8
mov eax, 0xf2b9d649
xor ecx, ecx
mul edi
shr edx, 0xa
mov eax, edx
mov edx, 0x438
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053b6d3
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0xf8], ebx
mov ecx, esi
push eax
push edi
push ebx
call dword [0x5a143c]
call esi
add esp, 0xc
test eax, eax
jle 0x4d07df
mov eax, 0xf2b9d649
mul dword [ebp - 0x138]
mov esi, edx
shr esi, 0xa
mov dword [ebp - 0xb8], esi
test esi, esi
jle 0x4d07df
add ebx, 0x424
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xd0], vtable.WaJson.0
mov byte [ebp - 0xc8], 0
mov dword [ebp - 0xcc], 5
mov byte [ebp - 4], 0x14
lea eax, [ebx - 0x424]
mov dword [ebp - 0x12c], 0
lea ecx, [ebp - 0x134]
push eax
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x12c], 0
mov dword [ebp - 0x130], 5
call fcn.004ad7b0
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0x15
push eax
push str.threat_name
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x134]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x14
lea edi, [ebx - 0x21c]
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x64]
push edi
mov dword [ebp - 0x64], vtable.WaJson.0
mov byte [ebp - 0x5c], 0
mov dword [ebp - 0x60], 5
call fcn.004ad7b0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x17
push eax
push str.path
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x14
mov eax, dword [ebx + 4]
sub eax, 0x76c
mov dword [ebp - 0x80], eax
mov eax, dword [ebx]
dec eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebx - 4]
mov dword [ebp - 0x88], eax
mov eax, dword [ebx - 8]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebx - 0xc]
mov dword [ebp - 0x90], eax
mov eax, dword [ebx - 0x10]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
call fcn.0057442c
add esp, 4
mov dword [ebp - 0xdc], 0
mov esi, eax
mov dword [ebp - 0xf4], edx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xe4], vtable.WaJson.0
mov byte [ebp - 0xdc], 0
mov dword [ebp - 0xe0], 5
call fcn.004ab230
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe0], 1
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x19
push eax
push str.scan_time
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4d055b
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x110]
push str.none
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x108], al
mov dword [ebp - 0x10c], 5
call fcn.004ad7b0
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x1b
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x110]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
jmp 0x4d0613
cmp eax, 1
jne 0x4d05a1
push 0x5e134c
lea ecx, [ebp - 0xc4]
call fcn.004aa220
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x1d
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
jmp 0x4d0613
cmp eax, 0xc
je 0x4d05e0
cmp eax, 0x70
je 0x4d05e0
push 0x5e2284
lea ecx, [ebp - 0x4c]
call fcn.004aa220
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x21
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.WaJson.0
jmp 0x4d0613
push 0x5e133c
lea ecx, [ebp - 0x34]
call fcn.004aa220
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x1f
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.WaJson.0
call fcn.004ab230
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x28]
mov esi, dword [eax + 0x28]
mov byte [ebp - 4], 0x14
call fcn.004a9470
push edi
lea ecx, [ebp - 0x28]
call fcn.004a94b0
test esi, esi
je 0x4d0729
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x164]
mov esi, dword [ebp - 0xb4]
mov eax, dword [eax + 0x28]
cdq
cmp edx, dword [ebp - 0xf4]
jg 0x4d06a6
jl 0x4d069d
cmp eax, esi
jae 0x4d06a6
mov byte [ebp - 0xad], 1
jmp 0x4d06ad
mov byte [ebp - 0xad], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.004a9470
cmp byte [ebp - 0xad], 0
je 0x4d07a9
push edi
lea ecx, [ebp - 0x28]
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
mov dword [eax + 0x28], esi
call fcn.004a9470
push edi
lea ecx, [ebp - 0x28]
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004d7c70
mov edi, dword [ebp - 0x174]
jmp 0x4d0787
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0xb4]
mov byte [ebp - 4], 0x14
mov dword [eax + 0x28], esi
call fcn.004a9470
push edi
lea ecx, [ebp - 0x28]
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004d7c70
mov edi, dword [ebp - 0x184]
mov eax, dword [edi + 0x28]
lea ecx, [ebp - 0xd0]
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [edi + 0x28]
call esi
lea ecx, [ebp - 0x28]
call fcn.004a9470
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x13
add ebx, 0x438
sub dword [ebp - 0xb8], 1
jne 0x4d0334
mov ebx, dword [ebp - 0xf8]
push ebx
call fcn.0053b6ce
add esp, 4
mov dword [ebp - 0xb4], 0
jmp 0x4d0e9a
mov dword [ebp - 0xb4], 0xffffffff
jmp 0x4d0e9a
push str.oiGetNextThreat
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0xf4], ebx
test ebx, ebx
je 0x4d0e90
push 0x43c
call fcn.0053b416
add esp, 4
mov esi, eax
mov ecx, ebx
mov dword [ebp - 0xb8], esi
push 0x43c
push esi
push 0
call dword [0x5a143c]
call ebx
add esp, 0xc
cmp eax, 1
jne 0x4d0e86
lea ebx, [esi + 0x208]
nop dword [eax + eax]
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xd0], vtable.WaJson.0
mov byte [ebp - 0xc8], 0
mov dword [ebp - 0xcc], 5
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x108], 0
push esi
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x108], 0
mov dword [ebp - 0x10c], 5
call fcn.004ad7b0
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x2b
push eax
push str.threat_name
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x110]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x5c], 0
push ebx
mov dword [ebp - 0x64], vtable.WaJson.0
mov byte [ebp - 0x5c], 0
mov dword [ebp - 0x60], 5
call fcn.004ad7b0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x2d
push eax
push str.path
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0x428]
sub eax, 0x76c
mov dword [ebp - 0x80], eax
mov eax, dword [esi + 0x424]
dec eax
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0x420]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x41c]
mov dword [ebp - 0x8c], eax
mov eax, dword [esi + 0x418]
mov dword [ebp - 0x90], eax
mov eax, dword [esi + 0x414]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
call fcn.0057442c
add esp, 4
mov dword [ebp - 0xdc], 0
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xf8], edx
mov edi, eax
mov dword [ebp - 0xe4], vtable.WaJson.0
mov byte [ebp - 0xdc], 0
mov dword [ebp - 0xe0], 5
call fcn.004ab230
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xe0], 1
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x2f
push eax
push str.scan_time
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x2a
mov eax, dword [esi + 0x430]
test eax, eax
jne 0x4d0a8b
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x134]
push str.none
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
mov byte [ebp - 0x12c], al
mov dword [ebp - 0x130], 5
call fcn.004ad7b0
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0x31
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x134]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
jmp 0x4d0b9d
cmp eax, 1
jne 0x4d0ae1
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
push 0x5e134c
mov dword [ebp - 0x34], vtable.WaJson.0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 5
call fcn.004ad7b0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x33
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.WaJson.0
jmp 0x4d0b9d
cmp eax, 0xc
je 0x4d0b39
cmp eax, 0x70
je 0x4d0b39
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
push 0x5e2284
mov dword [ebp - 0x4c], vtable.WaJson.0
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x48], 5
call fcn.004ad7b0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x37
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.WaJson.0
jmp 0x4d0b9d
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
push 0x5e133c
mov dword [ebp - 0xc4], vtable.WaJson.0
mov byte [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 5
call fcn.004ad7b0
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x35
push eax
push str.remediation
lea ecx, [ebp - 0xd0]
call fcn.004ab650
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebx], ax
jne 0x4d0bc3
xor ecx, ecx
jmp 0x4d0bdf
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d0bd0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a96a0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x184]
mov esi, dword [eax + 0x28]
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0c25
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test esi, esi
je 0x4d0d44
cmp word [ebx], ax
jne 0x4d0c4a
xor ecx, ecx
jmp 0x4d0c5f
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d0c50
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a96a0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0x28]
cdq
cmp edx, dword [ebp - 0xf8]
jg 0x4d0ca4
jl 0x4d0c9b
cmp eax, edi
jae 0x4d0ca4
mov byte [ebp - 0xad], 1
jmp 0x4d0cab
mov byte [ebp - 0xad], 0
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0cc4
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
cmp byte [ebp - 0xad], 0
je 0x4d0e38
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x174]
mov byte [ebp - 4], 0x2a
mov dword [eax + 0x28], edi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0d16
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a94b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004d7c70
mov edi, dword [ebp - 0x16c]
jmp 0x4d0e09
cmp word [ebx], ax
jne 0x4d0d4d
xor ecx, ecx
jmp 0x4d0d61
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d0d52
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a96a0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0xd8]
call fcn.004d7d00
mov eax, dword [ebp - 0x164]
mov byte [ebp - 4], 0x2a
mov dword [eax + 0x28], edi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0da7
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebx], ax
jne 0x4d0dc4
xor ecx, ecx
jmp 0x4d0ddf
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d0dd0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004a96a0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004d7c70
mov edi, dword [ebp - 0x15c]
mov eax, dword [edi + 0x28]
lea ecx, [ebp - 0xd0]
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [edi + 0x28]
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0e38
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov edi, dword [ebp - 0xb8]
mov esi, dword [edi + 0x438]
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], vtable.WaJson.0
call fcn.004ab230
push 0x43c
push edi
mov byte [ebp - 4], 0x13
push esi
mov esi, dword [ebp - 0xf4]
mov ecx, esi
call dword [0x5a143c]
call esi
add esp, 0xc
mov esi, edi
cmp eax, 1
je 0x4d0860
xor eax, eax
mov dword [ebp - 0xb4], eax
jmp 0x4d0e9a
mov dword [ebp - 0xb4], 0xffffffe5
mov edi, dword [ebp - 0xe8]
push str.FinalizeClientPipe
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4d0ec0
mov ecx, esi
call dword [0x5a143c]
call esi
test al, al
jne 0x4d0ed4
mov ebx, 0xffffffe5
jmp 0x4d0eda
mov edi, dword [ebp - 0xe8]
mov ebx, 0xffffffe5
jmp 0x4d0eda
mov ebx, dword [ebp - 0xb4]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or ecx, 0xffffffff
test eax, eax
cmove ebx, ecx
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0xb4], ebx
call fcn.004d4da0
mov eax, dword [ebp - 0xf0]
mov esi, dword [eax]
mov dword [ebp - 0xb8], esi
cmp esi, eax
je 0x4d1073
nop dword [eax + eax]
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0xf8]
push ecx
push str.scan_time
mov edi, dword [eax + 0x9c]
mov ecx, edi
call dword [0x5a143c]
lea ecx, [esi + 0x28]
call edi
mov edx, dword [ebp - 0xf8]
lea ecx, [ebp - 0x28]
call fcn.0051abf0
mov byte [ebp - 4], 0x40
cmp dword [eax + 0x14], 8
jb 0x4d0f5c
mov eax, dword [eax]
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], vtable.WaJson.0
mov byte [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 5
call fcn.004ad7b0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xc4]
mov eax, dword [esi + 0x28]
push ecx
push str.scan_time
mov edi, dword [eax + 0x80]
mov ecx, edi
call dword [0x5a143c]
lea ecx, [esi + 0x28]
call edi
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d0fe5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
cmp dword [ebp - 0x100], 3
je 0x4d1018
lea eax, [ebp - 0xf4]
mov dword [ebp - 0xf4], 3
push eax
mov eax, dword [ebp - 0x104]
mov edi, dword [eax + 0x48]
mov ecx, edi
call dword [0x5a143c]
lea ecx, [ebp - 0x104]
call edi
mov edi, dword [ebp - 0xfc]
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
jne 0x4d102e
push ecx
mov ecx, edi
call fcn.004b0930
mov ecx, dword [edi + 4]
add esi, 0x28
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xe8], ecx
mov byte [ebp - 4], 0x43
test ecx, ecx
je 0x4d104e
push esi
call fcn.004aa150
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb8]
add dword [edi + 4], 0xc
call fcn.004c4af0
mov esi, dword [ebp - 0xb8]
cmp esi, dword [ebp - 0xf0]
jne 0x4d0f20
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
push dword [eax + 4]
call fcn.004aff90
mov eax, dword [ebp - 0xd8]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], eax
mov eax, dword [ebp - 0xd8]
mov dword [eax + 8], eax
mov dword [ebp - 0xd4], 0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
push dword [eax + 4]
call fcn.004d5f00
mov eax, dword [ebp - 0xf0]
xor edi, edi
mov byte [ebp - 0xad], 1
xor ebx, ebx
mov dword [eax + 4], eax
mov eax, dword [ebp - 0xf0]
mov dword [eax], eax
mov eax, dword [ebp - 0xf0]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xe8], edi
mov dword [eax + 8], eax
mov dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x100]
cmp eax, 3
jne 0x4d1128
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jmp 0x4d113a
cmp eax, 2
jne 0x4d1138
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax + 8]
jmp 0x4d113a
xor eax, eax
cmp ebx, eax
jae 0x4d1399
push 1
xor eax, eax
mov dword [ebp - 0x5c], 7
push str.0123:
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
call fcn.004a96a0
push ebx
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0x104]
call fcn.004ab4b0
mov edi, eax
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x70]
mov ecx, dword [edi]
push eax
push str.scan_time
mov esi, dword [ecx + 0xa4]
mov ecx, esi
call dword [0x5a143c]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
xor eax, eax
mov byte [ebp - 4], 0x46
push 0xffffffffffffffff
push eax
mov word [ebp - 0x11c], ax
lea ecx, [ebp - 0x11c]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x108], 7
push eax
mov dword [ebp - 0x10c], 0
call fcn.004a99e0
cmp dword [ebp - 0x108], 8
lea eax, [ebp - 0x11c]
cmovae eax, dword [ebp - 0x11c]
push eax
call fcn.0057b2dc
mov ecx, dword [ebp - 0x108]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x4d1228
inc ecx
push ecx
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x11c]
call fcn.004a9d40
cmp esi, dword [ebp - 0xe8]
jle 0x4d12a0
xor eax, eax
mov dword [ebp - 0x108], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x11c], ax
lea ecx, [ebp - 0x11c]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x10c], 0
push eax
call fcn.004a99e0
cmp dword [ebp - 0x108], 8
lea eax, [ebp - 0x11c]
cmovae eax, dword [ebp - 0x11c]
push eax
call fcn.0057b2dc
mov dword [ebp - 0xe8], eax
add esp, 4
mov eax, dword [ebp - 0x108]
cmp eax, 8
jb 0x4d12a0
inc eax
lea ecx, [ebp - 0x11c]
push eax
push dword [ebp - 0x11c]
call fcn.004a9d40
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x5df834
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.004a96a0
push ebx
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0x104]
call fcn.004ab4b0
mov edi, eax
mov byte [ebp - 4], 0x4a
lea eax, [ebp - 0x40]
mov ecx, dword [edi]
push eax
push str.remediation
mov esi, dword [ecx + 0xa4]
mov ecx, esi
call dword [0x5a143c]
mov ecx, edi
call esi
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], vtable.WaJson.0
call fcn.004ab230
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
mov edi, dword [ebp - 0x40]
cmp esi, 8
mov edx, dword [ebp - 0x30]
push 4
cmovae ecx, edi
push str.none
call fcn.004af3c0
add esp, 8
test eax, eax
je 0x4d134d
cmp esi, 8
lea ecx, [ebp - 0x40]
push 7
cmovae ecx, edi
push 0x5e2284
call fcn.004af3c0
add esp, 8
test eax, eax
jne 0x4d1354
mov byte [ebp - 0xad], 0
cmp esi, 8
jb 0x4d1366
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.004a9d40
xor eax, eax
mov byte [ebp - 4], 0x13
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x4d1393
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.004a9d40
inc ebx
jmp 0x4d1100
mov dword [ebp - 0xdc], 0
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], vtable.WaJson.0
mov byte [ebp - 0xdc], 0
mov dword [ebp - 0xe0], 5
call fcn.004ab230
mov al, byte [ebp - 0xad]
mov byte [ebp - 0xdc], al
mov dword [ebp - 0xe0], 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x28]
push 0xa
xor eax, eax
mov dword [ebp - 0x14], 7
push str.no_threats
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004a96a0
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x128]
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x128]
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d1443
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x13
mov edi, dword [ebp - 0xe8]
test edi, edi
je 0x4d1554
mov edx, edi
lea ecx, [ebp - 0x58]
call fcn.0051abf0
mov byte [ebp - 4], 0x4f
cmp dword [eax + 0x14], 8
jb 0x4d1484
mov eax, dword [eax]
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], vtable.WaJson.0
mov byte [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 5
call fcn.004ad7b0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x28]
push 0x10
xor eax, eax
mov dword [ebp - 0x14], 7
push str.last_threat_time
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004a96a0
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x51
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x128]
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x128]
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d1519
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x4d160a
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.004a9d40
jmp 0x4d160a
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
push str.0123:
mov dword [ebp - 0xc4], vtable.WaJson.0
mov byte [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 5
call fcn.004ad7b0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x28]
push 0x10
xor eax, eax
mov dword [ebp - 0x14], 7
push str.last_threat_time
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004a96a0
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x54
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x128]
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x128]
call esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d15ed
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x13
push 7
xor eax, eax
mov dword [ebp - 0x14], 7
push str.threats
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004a96a0
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0x56
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x128]
mov esi, dword [eax + 0x7c]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x128]
call esi
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d166e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
push 6
xor eax, eax
mov dword [ebp - 0x14], 7
push str.result
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004a96a0
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 0x57
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x154]
mov esi, dword [eax + 0x7c]
mov ecx, esi
call dword [0x5a143c]
lea ecx, [ebp - 0x154]
call esi
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d16d2
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x154]
call fcn.004ada70
mov esi, eax
mov ebx, dword [ebp - 0x13c]
cmp ebx, esi
je 0x4d1728
cmp dword [ebx + 0x14], 8
jb 0x4d1701
mov eax, dword [ebx + 0x14]
mov ecx, ebx
inc eax
push eax
push dword [ebx]
call fcn.004a9d40
mov dword [ebx + 0x14], 7
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], 0
jb 0x4d1719
mov eax, dword [ebx]
jmp 0x4d171b
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push esi
call fcn.004a9850
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4d173d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004a9d40
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push eax
push dword [eax]
lea eax, [ebp - 0x13c]
push eax
call fcn.004d6630
push dword [ebp - 0xf0]
call fcn.00405150
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x13c]
push eax
call fcn.004c6660
push dword [ebp - 0xd8]
call fcn.00405150
add esp, 4
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x154]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x128]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x148]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
push 0
push 1
lea ecx, [ebp - 0xac]
call fcn.004a9510
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x104]
mov dword [ebp - method.WaJson.virtual_0], vtable.WaJson.0
call fcn.004ab230
lea ecx, [ebp - 0x18c]
call fcn.004aee90
mov dword [ebp - 4], 0x5d
lea ecx, [ebp + 8]
mov dword [ebp + 8], vtable.WaJson.0
call fcn.004ab230
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053b206
mov esp, ebp
pop ebp
ret 0x10