Function at 0x43f2c0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1c78
call fcn.0047bda0
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x18c], ebx
lea eax, [ebp - 0x1708]
push 0x80
push eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x194], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0xb28]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 8], ecx
jge 0x43f51e
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
push 0x49bbd4
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str.rundll32.exe
push edx
call fcn.0047bec0
lea eax, [ebp - 0x428]
push str.rundll32.
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
jne 0x43f57b
lea ecx, [ebp - 0x428]
push str.RUNDLL32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43f57b
lea edx, [ebp - 0x428]
push str.Rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f60b
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x728]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x728]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x43f5db
cmp byte [ebp + eax - 0x728], 0x33
jne 0x43f5d6
cmp byte [ebp + eax - 0x727], 0x32
jne 0x43f5d6
cmp byte [ebp + eax - 0x726], 0x2e
je 0x43f5db
inc eax
cmp eax, ecx
jl 0x43f5b8
mov edx, ecx
sub edx, eax
lea ecx, [edx - 7]
cmp ecx, ebx
jle 0x43f603
lea eax, [ebp + eax - 0x721]
lea edi, [ebp - 0x428]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + edx - 0x42f], 0
lea ecx, [ebp - 0x428]
push str.MySQLMySQL
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f652
lea edx, [ebp - 0x428]
push edx
call fcn.00483565
mov ecx, dword [ebp + 0xc]
push 0x49e9f0
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str.mysqld_nt
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f6b1
lea eax, [ebp - 0x428]
push 0x492670
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f6b1
lea ecx, [ebp - 0x428]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
push 0x49e9f0
mov dword [edx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x428]
push str.mysqld_nt
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f6e5
lea ecx, [ebp - 0x428]
push 0x49e9e0
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43f623
lea edx, [ebp - 0x428]
push str.MySql_bin_mysql
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43f715
lea edx, [ebp - 0x428]
push str.Mysql_bin_mysql
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f744
lea eax, [ebp - 0x428]
push eax
call fcn.00483565
mov ecx, dword [ebp + 0xc]
push 0x49e9a0
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x428]
push str..dll
push edx
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x43f764
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str..DLL
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f77f
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str..Dll
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f79a
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str..tmp
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f7b8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str..Tmp
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f7d6
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str..TMP
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f7f4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f812
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f830
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.TEMP_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f84e
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.Documents_and_Settings_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f88d
lea eax, [ebp - 0x428]
push str.Application_Data_
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xcc], esi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f88d
mov dword [ebp - 0x60], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesCommon_Files
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f8ab
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.program_filesWindows_NT_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f8d2
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x428]
push str.Program_FilesOutlook_Express
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f8f0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.documents_and_settings_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f92f
lea edx, [ebp - 0x428]
push str.Application_Data_
push edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xcc], esi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f92f
mov dword [ebp - 0x60], esi
lea eax, [ebp - 0x428]
push str.program_filescommon_Files
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f94d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str._temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f96b
mov dword [ebp - 0xac], esi
lea edx, [ebp - 0x428]
push str.Temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f989
mov dword [ebp - 0xac], esi
lea eax, [ebp - 0x428]
push str.RECYCLER_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f9a7
mov dword [ebp - 0xc4], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesMicrosoft
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f9c2
mov dword [ebp - 0x64], esi
lea edx, [ebp - 0x428]
push str.Program_FilesWindows
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f9e3
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x428]
push str.Program_FilesOutlook
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43f9fe
mov dword [ebp - 0x64], esi
lea ecx, [ebp - 0x428]
push str.Program_FilesNetMeeting
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fa19
mov dword [ebp - 0x64], esi
lea edx, [ebp - 0x428]
push str.Program_FilesMSN
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fa34
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0x428]
push 0x492024
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fab1
lea ecx, [ebp - 0x428]
push 0x492288
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fab1
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
xor edx, edx
cmp ecx, ebx
jle 0x43faa4
mov al, byte [ebp + edx - 0x428]
cmp al, 0x3a
jne 0x43fa92
mov edi, 1
cmp esi, edi
je 0x43faa4
cmp al, 0x25
jne 0x43fa9f
mov esi, 1
cmp edi, esi
je 0x43faa4
inc edx
cmp edx, ecx
jl 0x43fa7e
mov byte [ebp + edx - 0x428], 0
mov esi, 1
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43fd9b
lea eax, [ebp - 0x428]
push 0x492288
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43fd9b
lea ecx, [ebp - 0x428]
push str.SystemRoot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fbcf
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x43fb6d
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x43fb6d
cmp dl, 0x73
je 0x43fb6d
inc eax
cmp eax, esi
jl 0x43fb57
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x43fb99
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push str.systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fcb5
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x43fc53
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x43fc53
cmp dl, 0x73
je 0x43fc53
inc eax
cmp eax, esi
jl 0x43fc3d
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x43fc7f
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push str.Systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fd9b
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
cmp esi, ebx
jle 0x43fd39
mov dl, byte [ebp + eax - 0x528]
cmp dl, 0x53
je 0x43fd39
cmp dl, 0x73
je 0x43fd39
inc eax
cmp eax, esi
jl 0x43fd23
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
cmp edx, ebx
jle 0x43fd65
lea eax, [ebp + eax - 0x51e]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x492024
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43fea2
lea edx, [ebp - 0x428]
push 0x49e810
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43fea2
lea eax, [ebp - 0x218]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x215], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x43fe3b
cmp byte [ebp + eax - 0x528], 0x25
je 0x43fe3b
inc eax
cmp eax, edx
jl 0x43fe2c
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x43fe67
lea eax, [ebp + eax - 0x51a]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push str.Program_Files
push edx
lea eax, [ebp - 0x428]
push 0x493248
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x14
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x492024
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x43ffa9
lea edx, [ebp - 0x428]
push 0x48bb40
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x43ffa9
lea eax, [ebp - 0x218]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x215], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x43ff42
cmp byte [ebp + eax - 0x528], 0x25
je 0x43ff42
inc eax
cmp eax, edx
jl 0x43ff33
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xe]
cmp edx, ebx
jle 0x43ff6e
lea eax, [ebp + eax - 0x51a]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push str.Program_Files
push edx
lea eax, [ebp - 0x428]
push 0x493248
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x14
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x48b2f4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440088
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x440026
cmp byte [ebp + eax - 0x528], 0x25
je 0x440026
inc eax
cmp eax, edx
jl 0x440017
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x440052
lea eax, [ebp + eax - 0x51c]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x49bba4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440167
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x440105
cmp byte [ebp + eax - 0x528], 0x25
je 0x440105
inc eax
cmp eax, edx
jl 0x4400f6
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
cmp edx, ebx
jle 0x440131
lea eax, [ebp + eax - 0x51c]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x428], al
jle 0x44050c
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x728]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x728]
mov byte [ebp - 0x71a], 0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44027a
lea edx, [ebp - 0x218]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x216], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x440249
lea eax, [ecx - 0xe]
lea esi, [ebp - 0x51a]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0x728]
push str.Systemroot
push eax
mov byte [ebp - 0x71e], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x440356
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x44030e
lea eax, [ecx - 0xa]
lea esi, [ebp - 0x51e]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
lea eax, [ebp - 0x728]
push str.system32
push eax
mov byte [ebp - 0x720], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x440432
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x4403ea
lea eax, [ecx - 8]
lea esi, [ebp - 0x520]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
lea eax, [ebp - 0x728]
push str._Windir_
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x440507
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x4404bf
lea eax, [ecx - 8]
lea esi, [ebp - 0x520]
mov ecx, eax
lea edi, [ebp - 0xc28]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc28], 0
lea eax, [ebp - 0xc28]
lea ecx, [ebp - 0x218]
push eax
push ecx
lea edx, [ebp - 0x428]
push str._s_s
push edx
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x428], al
mov esi, 1
lea eax, [ebp - 0x428]
push str..RECYCLER
push eax
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x4405fb
lea ecx, [ebp - 0x218]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x216], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xc]
cmp esi, ebx
jle 0x440590
cmp byte [ebp + eax - 0x528], 0x5c
je 0x440590
inc eax
cmp eax, esi
jl 0x440581
mov edx, ecx
xor esi, esi
sub edx, eax
cmp edx, ebx
jle 0x4405bb
lea eax, [ebp + eax - 0x528]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x728]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x728]
lea edx, [ebp - 0x218]
push ecx
push edx
lea eax, [ebp - 0x428]
push str._s_s
push eax
mov byte [ebp + esi - 0x728], 0
mov byte [ebp - 0x428], 0
call fcn.0047a8f8
add esp, 0x10
mov dword [ebp - 0xc4], 1
mov esi, 1
cmp byte [ebp - 0x428], 0x22
jne 0x44065e
mov esi, dword [ebp + 8]
xor edx, edx
xor eax, eax
cmp esi, ebx
jle 0x440628
mov cl, byte [ebp + eax - 0x428]
cmp cl, 0x22
je 0x440623
mov byte [ebp + edx - 0x528], cl
inc edx
inc eax
cmp eax, esi
jl 0x44060f
lea edi, [ebp - 0x528]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0x528], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x428]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
lea ecx, [ebp - 0x428]
push 0x48b7ec
push ecx
call fcn.0047bec0
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x440777
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x528]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x527], 0x3a
je 0x440721
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 2]
cmp edx, ebx
jle 0x4406ed
cmp byte [ebp + eax - 0x428], 0x3a
jne 0x4406e8
cmp byte [ebp + eax - 0x427], 0x5c
je 0x4406ed
inc eax
cmp eax, edx
jl 0x4406d4
sub ecx, eax
xor esi, esi
lea edx, [ecx + 1]
cmp edx, ebx
jle 0x440719
lea eax, [ebp + eax - 0x529]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov byte [ebp + esi - 0x428], 0
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x440755
cmp byte [ebp + eax - 0x428], 0x2e
jne 0x440750
mov dl, byte [ebp + eax - 0x427]
cmp dl, 0x65
je 0x44076a
cmp dl, 0x45
je 0x44076a
inc eax
cmp eax, ecx
jl 0x440735
cmp ecx, ebx
mov eax, ecx
jle 0x44076a
cmp byte [ebp + eax - 0x428], 0x2e
je 0x44076a
dec eax
cmp eax, ebx
jg 0x44075b
mov byte [ebp + eax - 0x424], 0
mov esi, 1
lea ecx, [ebp - 0x9a8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x428]
push 0x492024
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x440875
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x218]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.System32
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x440823
lea edx, [ebp - 0x218]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x440823
lea eax, [ebp - 0x218]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x440823
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0xb28]
push ecx
jmp 0x440830
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x9a8]
push ecx
push edx
lea eax, [ebp - 0x428]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x440868
cmp byte [ebp + ecx - 0x428], 0x2e
je 0x440868
dec ecx
cmp ecx, ebx
jg 0x440859
mov byte [ebp + ecx - 0x424], 0
mov esi, 1
lea ecx, [ebp - 0x428]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x428]
push eax
call fcn.00429f20
add esp, 8
cmp eax, esi
je 0x4408a3
push 0x49e7e4
jmp 0x4451f2
lea ecx, [ebp - 0x428]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x428]
push str..sys
push edx
mov dword [ebp - 0x78], eax
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x440a18
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xca8]
mov esi, eax
lea edx, [ebp - 0xba8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 8], esi
call fcn.004456c0
lea edx, [ebp - 0xca8]
lea eax, [ebp - 0xba8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x440a0c
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x440a0c
cmp dword [ebp - 0x18], ebx
jne 0x440a0c
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x440a0c
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str..SYS
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440b7e
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 8], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x440b72
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x440b72
cmp dword [ebp - 0x18], ebx
jne 0x440b72
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x440b72
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str..Sys
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440ce4
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 8], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x440cd8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x440cd8
cmp dword [ebp - 0x18], ebx
jne 0x440cd8
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x440cd8
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str..SYs
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440e4a
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 8], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x440e3e
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x440e3e
cmp dword [ebp - 0x18], ebx
jne 0x440e3e
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x440e3e
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str..syS
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x440fb0
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov esi, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
mov dword [ebp + 8], esi
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push esi
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x440fa4
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x440fa4
cmp dword [ebp - 0x18], ebx
jne 0x440fa4
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x440fa4
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xea8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push edx
push 0x49e7c0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0xea8]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str..sYS
push edx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x441116
lea eax, [ebp - 0x428]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xba8]
mov ebx, eax
lea edx, [ebp - 0xca8]
push ecx
lea eax, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x428]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push ebx
lea edx, [ebp - 0xea8]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x218]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x44110a
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x528]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x528]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x528], al
lea ecx, [ebp - 0x9a8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44110a
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x44110a
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x44110a
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xea8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xea8]
push eax
jmp 0x4451f2
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._swinlogon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x441152
push 0x49bab4
jmp 0x4451f2
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xfc8]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0xfc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44118e
push 0x49bab4
jmp 0x4451f2
lea eax, [ebp - 0xb28]
lea ecx, [ebp - 0xfc8]
push eax
push str._s_services.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x428]
lea eax, [ebp - 0xfc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4411ca
push 0x49ba7c
jmp 0x4451f2
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._slsass.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x441206
push 0x49ba7c
jmp 0x4451f2
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xfc8]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x428]
lea edx, [ebp - 0xfc8]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x441242
push 0x49ba7c
jmp 0x4451f2
lea eax, [ebp - 0xb28]
lea ecx, [ebp - 0xfc8]
push eax
push str._sctfmon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x428]
lea eax, [ebp - 0xfc8]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x44127e
push 0x49ba7c
jmp 0x4451f2
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0xfc8]
push ecx
push str._s_rundll32.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0xfc8]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4412ba
push 0x49ba7c
jmp 0x4451f2
lea edx, [ebp - 0x9a8]
lea eax, [ebp - 0x1888]
push edx
push str._sTEMPOSCETEMPSVRINST.exe
push eax
mov byte [ebp - 0x1888], 0
call fcn.0047a8f8
lea ecx, [ebp - 0x1888]
lea edx, [ebp - 0x428]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x4451ed
lea eax, [ebp - 0x428]
push str.TEMPOSCETEMPSVRINST.exe
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4451ed
cmp dword [0x65cd60], esi
jne 0x4413b5
lea ecx, [ebp - 0xb28]
lea edx, [ebp - 0x1888]
push ecx
push str._sigSvc.EXE
push edx
mov byte [ebp - 0x1888], 0
call fcn.0047a8f8
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x1888]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4413b5
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0xda8]
push edx
push str._sigAgent.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xda8]
push ecx
call fcn.00429f20
lea edx, [ebp - 0xb28]
mov esi, eax
push edx
lea eax, [ebp - 0x528]
push str._sigTerm.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x528]
push ecx
call fcn.00429f20
add eax, esi
add esp, 0x20
test eax, eax
jle 0x4413b5
push 0x49e730
jmp 0x4451f2
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x7c]
push edx
lea ecx, [ebp - 0x428]
mov edi, 1
push eax
push ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x4413e6
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x74]
cmp edx, eax
je 0x4413e9
mov dword [ebp - 0x70], edi
lea eax, [ebp - 0x1988]
lea ecx, [ebp - 0x628]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.0046de70
movsx esi, ax
lea eax, [ebp - 0x1608]
lea ecx, [ebp - 0x1788]
push eax
lea edx, [ebp - 0x428]
push ecx
push edx
mov dword [ebp - 0x34], esi
call fcn.00455090
mov eax, dword [ebp - 0x78]
add esp, 0x18
cmp eax, 0xc8000
jle 0x44148f
cmp esi, edi
jge 0x44144c
cmp eax, 0x177000
jle 0x44144c
push 0x49e718
jmp 0x4451f2
cmp esi, ebx
jle 0x44148f
lea eax, [ebp - 0x1608]
lea ecx, [ebp - 0x628]
push eax
push ecx
lea edx, [ebp - 0x928]
push 0x49e6ec
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x928]
push eax
call fcn.00483565
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x628]
push 0x49b940
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4414b1
push 0x49b934
jmp 0x4451f2
lea edx, [ebp - 0x428]
push str.32A6Wizard_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4414d3
push 0x49b934
jmp 0x4451f2
lea eax, [ebp - 0x628]
push str.Microsoft
push eax
mov dword [ebp - 0x44], ebx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x44158c
lea edi, [ebp - 0x1988]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x441528
lea ecx, [ebp - 0x1988]
push str.Microsoft
push ecx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x441528
mov dword [ebp - 0x44], 1
jmp 0x441557
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x68], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], 1
jne 0x44158c
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x68], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xb28]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9a8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1508]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x1688]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1508]
mov byte [ebp - 0x1506], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebx, ebx
test ecx, ecx
jle 0x441630
lea edx, [ebp + ecx - 0x428]
mov al, byte [edx]
cmp al, 0x5c
mov byte [ebp + ebx - 0x1208], al
jne 0x44162a
cmp ebx, 2
jge 0x441630
inc ebx
dec edx
cmp ebx, ecx
jl 0x441618
sub ecx, ebx
cmp ecx, 4
mov dword [ebp + 8], ecx
jge 0x441645
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
test ecx, ecx
jle 0x441663
mov eax, ecx
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x1408]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x1408]
lea edx, [ebp - 0x1688]
push ecx
push edx
mov byte [ebp + edi - 0x1408], 0
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x441690
mov dword [ebp - 0x18], esi
xor ecx, ecx
test ebx, ebx
jle 0x4416d2
lea edx, [ebp + edi - 0x427]
mov edi, dword [ebp - 0x140]
mov al, byte [ecx + edx]
cmp al, 0x5c
je 0x4416b1
mov byte [ebp + ecx - 0x1208], al
cmp al, 0x2e
jne 0x4416b6
inc edi
cmp al, 0x20
jne 0x4416bb
inc edi
cmp al, 0x5c
jne 0x4416c7
mov byte [ebp + ecx - 0x1208], 0
inc ecx
cmp ecx, ebx
jl 0x4416a3
mov dword [ebp - 0x140], edi
mov al, byte [ebp - 0x1407]
mov byte [ebp + ebx - 0x1208], 0
cmp al, 0x3a
je 0x4416ee
push 0x49b790
jmp 0x4451f2
cmp byte [ebp - 0x1406], 0x5c
je 0x441705
mov byte [ebp - 0x1406], 0x5c
mov byte [ebp - 0x1405], 0
lea eax, [ebp - 0x428]
push 0x100
lea ecx, [ebp - 0xaa8]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x1208]
push 0x40
lea eax, [ebp - 0x1a88]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x1408]
push ecx
call fcn.00468c80
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x21c], eax
jne 0x4417e5
lea edx, [ebp - 0xaa8]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xaa8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xaa8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4417b1
lea edx, [ebp - 0xaa8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x4417b1
lea eax, [ebp - 0xaa8]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x928]
mov edi, 0x49e6b0
jmp 0x4417bc
lea edx, [ebp - 0x928]
mov edi, 0x49e674
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x928]
push ecx
jmp 0x4451f2
cmp eax, esi
jne 0x4417ec
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push edx
call fcn.00483565
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x428]
push edx
mov dword [ecx], eax
call fcn.00428d90
mov ebx, eax
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 0x10
test eax, eax
jne 0x441830
cmp dword [ebp - 0x44], esi
jne 0x441947
push 0x49b774
jmp 0x4451f2
lea eax, [ebp - 0x428]
push str.LOCALS1Temp
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44184e
mov dword [ebp - 0xac], esi
lea ecx, [ebp - 0x428]
push str.Application_Data
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441869
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push str.Microsoft_SharedMSINFO
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441884
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x428]
push str.Microsoft_SharedMSInfo
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44189f
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x428]
push str.Documents_and_Settings
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4418ba
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x428]
push 0x80
lea eax, [ebp - 0x1588]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x428]
push 0x80
lea edx, [ebp - 0x1488]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0xb28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x1588], al
mov dword [ebp - 0x38], eax
mov byte [ebp + ecx - 0x1488], al
lea eax, [ebp - 0x9a8]
lea ecx, [ebp - 0x1588]
push eax
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x441982
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x441951
push 0x491c80
jmp 0x4451f2
lea edi, [ebp - 0x428]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x40], esi
test ecx, ecx
jle 0x441982
cmp byte [ebp + eax - 0x428], 0x5c
jne 0x441975
inc edx
inc eax
cmp eax, ecx
jl 0x44196a
cmp edx, 2
jne 0x441982
mov dword [ebp - 0x2c], esi
lea edx, [ebp - 0xb28]
lea eax, [ebp - 0x1488]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4419bb
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4419b8
push 0x491c80
jmp 0x4451f2
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x428]
push str.System
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4419f2
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4419ef
push 0x491c80
jmp 0x4451f2
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0x428]
push str._system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441a29
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x441a26
push 0x491c80
jmp 0x4451f2
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x428]
push str.SYSTEM
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441a60
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x441a5d
push 0x491c80
jmp 0x4451f2
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x34], esi
jle 0x442115
lea ecx, [ebp - 0x628]
push str.Beijing_Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441b26
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x528]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x528]
push str.Beijing
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441b26
lea ecx, [ebp - 0x528]
push str.Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441b26
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x441b29
mov ebx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x628]
push str.Jiangmin_Co
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441bcc
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Jiangmin
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441bcc
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Eset
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441c6f
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Eset
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441c6f
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Symantec_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441d5e
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441d12
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x428]
push str.SYMANT1Rtvscan.exe
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441d5e
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push ecx
jmp 0x4451f2
lea edx, [ebp - 0x628]
push str.Network_Associates
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441e01
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Networks_Associates_Technology__Inc
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441e01
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.McAfee_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441ea4
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push 0x49b830
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441ea4
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Kingsoft_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441f47
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Kingsoft
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441f47
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Panda_Software
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x441fea
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Panda
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x441fea
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x628]
push str.Kaspersky_Lab
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44208a
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xda8]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xda8]
push str.Kaspersky
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x442094
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x442099
cmp dword [ebp - 0x1c], 1
jne 0x44221f
mov edx, 1
cmp dword [ebp - 0x40], edx
jne 0x4420d6
mov edi, 0x49e59c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x628]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xfc], edx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x18], edx
jne 0x442224
mov edi, 0x49e59c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0xfc], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x628]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1208]
push str.smss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea edx, [ebp - 0x1208]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea eax, [ebp - 0x1208]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea ecx, [ebp - 0x1208]
push str.services.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea edx, [ebp - 0x1208]
push str.lsass.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea eax, [ebp - 0x1208]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea ecx, [ebp - 0x1208]
push str.taskmgr.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea edx, [ebp - 0x1208]
push str.spoolsv.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea eax, [ebp - 0x1208]
push 0x48ba7c
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x442215
lea ecx, [ebp - 0x1208]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442238
mov ebx, 1
mov dword [ebp - 0x68], ebx
jmp 0x44223d
mov edx, 1
cmp ebx, edx
jne 0x442115
lea eax, [ebp - 0x628]
push eax
jmp 0x4451f2
mov ebx, 1
xor esi, esi
xor edi, edi
push 0x6309b0
mov dword [ebp - 4], 2
mov dword [ebp - 0x58], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x54], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0xec], esi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x428]
push 0x6309b0
push edx
call fcn.004045b0
add esp, 8
test eax, eax
jne 0x4422c2
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x428]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], ebx
jmp 0x442d26
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [0x6309b8]
push eax
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x6c], eax
test eax, eax
jne 0x442353
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], 2
mov edx, dword [0x6309b8]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004046d0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x190], esi
jne 0x442b7e
mov dword [ebp + 8], 6
jmp 0x442d11
mov dword [ebp - 0x174], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44231b
mov ecx, dword [eax + 0xc]
mov edx, dword [0x6309b8]
mov eax, dword [ebp - 0x220]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x4c], ecx
call fcn.0047fde0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x228], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.wtsapi32.dll
inc eax
push edi
mov dword [ebp - 0x190], eax
call fcn.0047fde0
add esp, 0x18
mov ebx, 1
test eax, eax
jne 0x4423d0
mov dword [ebp - 0x198], ebx
push str.WSTSecDvc.dll
push edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4423e8
mov dword [ebp - 0x194], ebx
xor esi, esi
cmp esi, 0x66
jge 0x44249b
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x442495
cmp esi, 0xf
jle 0x442421
cmp esi, 0x12
jge 0x442421
mov dword [ebp - 0xf8], ebx
cmp esi, 0x1d
je 0x442430
cmp esi, 0x1e
je 0x442430
cmp esi, 0x39
jne 0x442436
mov dword [ebp - 0xf0], ebx
cmp esi, 0x1f
je 0x442440
cmp esi, 0x20
jne 0x442446
mov dword [ebp - 0x90], ebx
cmp esi, 0x21
je 0x442450
cmp esi, 0x22
jne 0x442456
mov dword [ebp - 0xd0], ebx
cmp esi, 0x23
je 0x442460
cmp esi, 0x24
jne 0x442466
mov dword [ebp - 0xe8], ebx
cmp esi, 0x2c
jne 0x442477
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x4423ea
cmp esi, 0x2d
je 0x442492
cmp esi, 0x2e
jne 0x44248d
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x4423ea
cmp esi, 0x3d
jne 0x442495
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x4423ea
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 4
push edx
mov dword [ebp - 0x158], 0
call fcn.004046b0
add esp, 4
mov esi, eax
mov eax, dword [0x6309b8]
mov dword [ebp - 0x224], esi
push eax
call fcn.004047a0
mov ecx, dword [ebp - 0x174]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x4424e3
mov eax, dword [ecx + 0x10]
mov edx, dword [0x6309b8]
push eax
push edx
push esi
mov dword [ebp - 0x50], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x30], eax
test eax, eax
je 0x44231b
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x442ac8
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x442574
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xec8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xfe8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xfe8]
jmp 0x4425f5
mov edx, dword [0x6309b8]
push eax
mov eax, dword [ebp - 0x224]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4425b0
xor ecx, ecx
lea edx, [ebp - 0xec8]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x4425fd
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xec8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1008]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x442a74
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x442a6e
cmp esi, 0x45
jne 0x4426ce
lea ecx, [ebp - 0xba8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0xba8]
lea eax, [ebp - 0xca8]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xca8]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x4426a7
lea edx, [ebp - 0x628]
lea eax, [ebp - 0x528]
push edx
push 0x49b6c8
push eax
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
jmp 0x4451f2
lea ecx, [ebp - 0x628]
lea edx, [ebp - 0x528]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
jmp 0x4451f2
test esi, esi
jne 0x4426de
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x4425ff
cmp esi, edi
jne 0x4426ee
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x4425ff
cmp esi, 2
je 0x442a6e
cmp esi, 4
jne 0x442708
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x4425ff
cmp esi, 5
jne 0x442719
mov dword [ebp - 0x124], edi
inc esi
jmp 0x4425ff
cmp esi, 6
jne 0x44272a
mov dword [ebp - 0x114], edi
inc esi
jmp 0x4425ff
cmp esi, 7
jne 0x44273b
mov dword [ebp - 0x134], edi
inc esi
jmp 0x4425ff
cmp esi, 8
jne 0x44274c
mov dword [ebp - 0x154], edi
inc esi
jmp 0x4425ff
cmp esi, 9
jne 0x44275d
mov dword [ebp - 0x17c], edi
inc esi
jmp 0x4425ff
cmp esi, 0xa
jne 0x44276e
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x4425ff
cmp esi, 0xb
jne 0x44277f
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4425ff
jle 0x44278c
cmp esi, 0xf
jge 0x44278f
mov dword [ebp - 0xa4], edi
cmp esi, 0xf
jne 0x44279d
mov dword [ebp - 0x110], edi
inc esi
jmp 0x4425ff
jle 0x4427aa
cmp esi, 0x12
jge 0x4427aa
mov dword [ebp - 0xf8], edi
cmp esi, 0x1b
jne 0x4427bb
mov dword [ebp - 0x100], edi
inc esi
jmp 0x4425ff
cmp esi, 0x1c
jne 0x4427cc
mov dword [ebp - 0x118], edi
inc esi
jmp 0x4425ff
cmp esi, 0x1d
je 0x4427db
cmp esi, 0x1e
je 0x4427db
cmp esi, 0x39
jne 0x4427e1
mov dword [ebp - 0xf0], edi
cmp esi, 0x1f
je 0x4427eb
cmp esi, 0x20
jne 0x4427f1
mov dword [ebp - 0x90], edi
cmp esi, 0x21
je 0x4427fb
cmp esi, 0x22
jne 0x442801
mov dword [ebp - 0xd0], edi
cmp esi, 0x23
je 0x44280b
cmp esi, 0x24
jne 0x442811
mov dword [ebp - 0xe8], edi
cmp esi, 0x25
je 0x44281b
cmp esi, 0x26
jne 0x442821
mov dword [ebp - 0x184], edi
cmp esi, 0x27
jne 0x442832
mov dword [ebp - 0x15c], edi
inc esi
jmp 0x4425ff
cmp esi, 0x28
jne 0x442843
mov dword [ebp - 0x164], edi
inc esi
jmp 0x4425ff
cmp esi, 0x2c
jne 0x442854
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x4425ff
cmp esi, 0x2d
jne 0x442862
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x4425ff
cmp esi, 0x2e
jne 0x442873
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x4425ff
cmp esi, 0x2f
jne 0x442884
inc esi
jmp 0x4425ff
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x228]
inc ecx
cmp eax, edi
mov dword [ebp - 0x54], ecx
jne 0x442a88
inc dword [ebp - 0x58]
cmp dword [ebp - 0x190], edi
jne 0x442a96
inc dword [ebp - 0xa0]
cmp dword [ebp - 0x54], 0x2710
jg 0x442ac8
mov esi, dword [ebp - 0x158]
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x30]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x30], ecx
mov eax, ecx
jmp 0x44250d
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0x158]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x6c]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x6c], eax
jmp 0x44235d
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x50], ebx
cmp bx, word [esi + 2]
jae 0x442d11
xor ecx, ecx
push str..asp
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov byte [ebp - 0x80], cl
mov edx, dword [edi]
mov dword [ebp - 0x88], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x84], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x442bdd
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x88]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442bf8
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x88]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c13
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x88]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c2e
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x88]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c49
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x88]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c64
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x88]
push str.upx0
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c7f
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x88]
push str.upx1
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x442c9a
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x88]
push 0x48b7ec
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x442cb8
inc dword [ebp - 0xec]
mov esi, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x50]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x50], eax
jg 0x442d11
mov esi, dword [ebp - 0x190]
add edi, 0x28
inc ebx
jmp 0x442b91
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0xf4]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0x6309b8]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x442d64
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], 3
push 0x6309b0
call fcn.00404650
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, ebx
jne 0x442d82
push 0x49b598
jmp 0x4451f2
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x1c], esi
test edi, edi
mov dword [ebp - 0x30], edx
jne 0x4436e7
cmp esi, ebx
jge 0x4436e7
lea eax, [ebp - 0x1408]
mov dword [ebp - 0x4c], edi
push eax
call fcn.0047c0d3
push 0x5585bfc3
call fcn.00661bc3
cmp dword [ebp + 8], 5
jne 0x4436f2
test esi, esi
jne 0x4436f4
test edi, edi
jle 0x4437b0
mov ebx, dword [ebp - 0x78]
cmp ebx, 0xc800
jge 0x4437b3
cmp ebx, 0x400
jle 0x4437b3
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xaa8]
push eax
call esi
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x4417b1
lea edx, [ebp - 0xaa8]
push edx
call fcn.004299c0
add esp, 4
lea eax, [ebp - 0xaa8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xaa8]
push ecx
call esi
test eax, eax
jne 0x4417b1
lea edx, [ebp - 0xaa8]
push edx
call fcn.00429f20
add esp, 4
cmp eax, 1
jmp 0x441793
mov ecx, dword [ebp - 0xec]
jmp 0x443642
test esi, esi
jle 0x4437b0
cmp esi, 0xa
jge 0x4437b0
test ecx, ecx
jle 0x4437b0
lea eax, [edi - 1]
cmp ecx, eax
jg 0x443718
jne 0x4437b0
mov ebx, dword [ebp - 0x78]
cmp ebx, 0xa000
jge 0x4437b3
cmp ebx, 0x400
jle 0x4437b3
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0xaa8]
push edx
call esi
lea eax, [ebp - 0xaa8]
push eax
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x4417b1
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0xaa8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0xaa8]
push eax
call esi
test eax, eax
jne 0x4417b1
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x4417b1
lea edx, [ebp - 0xaa8]
push edx
jmp 0x44179c
mov ebx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x180]
xor edx, edx
cmp eax, 1
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x928], dl
jle 0x4437f8
mov edi, 0x49e558
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x44385d
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x14]
and ecx, 3
mov eax, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x70]
inc edx
cmp ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x170], eax
jne 0x44385d
cmp dword [ebp - 0x34], eax
jge 0x44385d
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xfc]
mov edi, 1
cmp eax, edi
jne 0x4438af
mov edi, 0x49e548
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x2c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0xbc], edi
jne 0x44390d
mov eax, dword [ebp - 0x170]
test eax, eax
jne 0x44390d
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44390d
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x48]
test esi, esi
jne 0x443913
test edx, edx
jne 0x443913
cmp dword [ebp - 0x14c], edi
jne 0x443913
cmp dword [ebp - 0x34], edi
jge 0x4438fc
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x443913
cmp ebx, 0x4b000
jle 0x443913
push 0x49e518
jmp 0x4451f2
lea eax, [ebp - 0x628]
push eax
push 0x49e4f0
jmp 0x443a66
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x48]
cmp dword [ebp - 0x198], edi
jne 0x44394c
cmp ebx, 0xc800
jle 0x44394c
mov ecx, dword [ebp - 0x58]
cmp ecx, 0x3c
jle 0x44394f
test esi, esi
jne 0x44394f
test edx, edx
jne 0x44394f
cmp dword [0x65cd60], edi
jne 0x44394f
lea eax, [ebp - 0x628]
push eax
push 0x49e4c4
jmp 0x443a66
mov ecx, dword [ebp - 0x58]
cmp ebx, 0x32000
jle 0x443a0b
test esi, esi
jne 0x443a0b
test edx, edx
jne 0x443a0b
cmp ebx, 0x7d000
jle 0x44397c
cmp ecx, 0x64
jg 0x443a5a
cmp ebx, 0x57800
jle 0x4439a4
cmp ecx, 0x64
jle 0x4439a4
cmp dword [ebp - 0x34], edi
jg 0x443a5a
cmp ecx, 0x64
jle 0x4439a4
cmp dword [ebp - 0xa0], 0x50
jg 0x443a5a
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x443a0b
cmp dword [ebp - 0x188], edi
jne 0x4439cf
cmp ecx, 0x50
jle 0x4439cf
cmp ebx, 0x4b000
jg 0x443a5a
mov eax, dword [ebp - 0x34]
test eax, eax
jg 0x443a5a
mov eax, dword [ebp - 0x10c]
cmp eax, edi
jne 0x4439f2
cmp ecx, 0x50
jle 0x443a0b
cmp ebx, 0x4b000
jg 0x443a5a
mov edi, dword [ebp - 0x34]
test edi, edi
jg 0x443a5a
mov edi, 1
cmp ecx, 0x50
jle 0x443a0b
mov edi, dword [ebp - 0xa0]
cmp edi, 0x50
mov edi, 1
jle 0x443a0b
cmp eax, edi
je 0x443a5a
mov eax, dword [ebp - 0x98]
test eax, eax
jle 0x443a2b
cmp dword [ebp - 0x54], 0x28
jle 0x443a2b
test esi, esi
jne 0x443a2b
test edx, edx
jne 0x443a2b
cmp dword [ebp - 0x194], edi
je 0x443a5a
cmp ecx, 0x64
jle 0x443a92
cmp dword [ebp - 0xa0], 0x50
jle 0x443a92
cmp dword [ebp - 0x54], 0xc8
jle 0x443a92
cmp ebx, 0x32000
jle 0x443a92
test esi, esi
jne 0x443a92
test edx, edx
jne 0x443a92
cmp dword [ebp - 0x18c], edi
jne 0x443a92
lea eax, [ebp - 0x628]
push eax
push 0x49e4ac
lea ecx, [ebp - 0x928]
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x928]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x114], edi
jne 0x443acf
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
mov al, byte [ebp - 0x1208]
cmp al, 0x30
je 0x443afd
cmp al, 0x31
je 0x443afd
cmp al, 0x32
je 0x443afd
cmp al, 0x33
je 0x443afd
cmp al, 0x34
je 0x443afd
cmp al, 0x35
je 0x443afd
cmp al, 0x36
je 0x443afd
cmp al, 0x37
je 0x443afd
cmp al, 0x38
je 0x443afd
cmp al, 0x39
jne 0x443b39
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
mov eax, dword [ebp - 0x68]
mov dword [ebp + 8], 0
cmp eax, edi
jne 0x443b84
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
mov dword [ebp + 8], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2c], eax
mov edi, eax
cmp dword [ebp - 0x44], edi
jne 0x443bf3
lea eax, [ebp - 0xda8]
lea ecx, [ebp - 0x428]
push eax
push ecx
call fcn.004294c0
movsx eax, ax
add esp, 8
test eax, eax
je 0x443bbe
lea edx, [ebp - 0xda8]
push 0x49e4a8
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x443bf3
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x154], edi
jne 0x443c30
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x11c], edi
jne 0x443c81
cmp dword [ebp - 0xb0], edi
jne 0x443c81
cmp dword [ebp - 0x70], edi
jne 0x443c81
mov edi, 0x49e480
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0xa8], edi
jne 0x443cc5
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x100], edi
jne 0x443d09
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x124], edi
je 0x443d19
cmp dword [ebp - 0x15c], edi
jne 0x443d4e
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x12c], edi
jne 0x443d92
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x184], edi
jne 0x443dcf
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x134], edi
jne 0x443e0c
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0xd4], edi
jne 0x443e57
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x2c], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x164], edi
jne 0x443ea2
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x13c], edi
jne 0x443ee6
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x17c], edi
jne 0x443f2a
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x8c], edi
jne 0x443f67
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0xa4], edi
jne 0x44400c
cmp dword [ebp - 0x144], edi
je 0x443f90
cmp dword [ebp - 0x16c], edi
je 0x443f90
lea edx, [ebp - 0x928]
mov edi, 0x49b2d8
jmp 0x443fdb
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x104]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x928]
mov edi, 0x49b2b8
je 0x443fdb
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x108], edi
jne 0x444050
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edi, 1
cmp dword [ebp - 0x110], edi
jne 0x44409e
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x40]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, 1
mov dword [ebp - 0x14], ecx
jne 0x44409e
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0xf8], 1
jne 0x4440de
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x928]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x3c], 1
jne 0x44415f
push 0x49e39c
call fcn.00483565
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret