Function at 0x423970
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46df1c
mov eax, dword fs:[0]
push eax
sub esp, 0x710
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5d0], ecx
mov dword [ebp - 0x604], eax
xor esi, esi
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x5b4], edi
mov dword [ebp - 0x5e0], edx
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x330], esi
mov word [ebp - 0x340], cx
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x29c], esi
mov word [ebp - 0x2ac], dx
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b8], esi
mov word [ebp - 0x2c8], cx
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], esi
mov word [ebp - 0x258], dx
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2f0], esi
mov word [ebp - 0x300], cx
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d4], esi
mov word [ebp - 0x2e4], dx
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x368], esi
mov word [ebp - 0x378], cx
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x264], esi
mov word [ebp - 0x274], dx
mov dword [ebp - 0x27c], eax
xor eax, eax
mov dword [ebp - 0x280], esi
mov word [ebp - 0x290], ax
lea ecx, [ebp - 0x71c]
push ecx
mov byte [ebp - 4], 8
call fcn.0040f450
push str.Checking_for_processes_to_terminate:_r_n_r_n
push edi
mov byte [ebp - 4], 9
mov dword [ebp - 0x5dc], esi
call fcn.00414730
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, dword [eax + edi + 0xc]
add esp, 8
xor ebx, ebx
test cl, 6
jne 0x423ad7
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x423ad7
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x423af6
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x423aef
or eax, 4
push esi
push eax
call fcn.00402d10
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x5d4], esi
cmp esi, 0xffffffff
jne 0x423d2c
push str.invalid
push 0x49ae58
call fcn.00414730
add esp, 8
mov edi, eax
push edi
call fcn.0042ee30
mov edx, dword [edi]
mov eax, dword [edx + 4]
xor esi, esi
test byte [eax + edi + 0xc], 6
jne 0x423b51
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x423b51
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x423b70
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x423b69
or eax, 4
push esi
push eax
call fcn.00402d10
mov eax, dword [ebp - 0x71c]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x5d8], edx
mov dword [ebp + ecx - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 0xa
call fcn.0040edf0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x71c]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x6cc]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043dec4
mov edi, 8
add esp, 4
cmp dword [ebp - 0x27c], edi
jb 0x423bec
mov edx, dword [ebp - 0x290]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x280], esi
mov word [ebp - 0x290], ax
cmp dword [ebp - 0x260], edi
jb 0x423c1d
mov ecx, dword [ebp - 0x274]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x264], esi
mov word [ebp - 0x274], dx
cmp dword [ebp - 0x2d0], edi
jb 0x423c49
mov eax, dword [ebp - 0x2e4]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2d4], esi
mov word [ebp - 0x2e4], cx
cmp dword [ebp - 0x2ec], edi
jb 0x423c75
mov edx, dword [ebp - 0x300]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2f0], esi
mov word [ebp - 0x300], ax
cmp dword [ebp - 0x244], edi
jb 0x423ca1
mov ecx, dword [ebp - 0x258]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x248], esi
mov word [ebp - 0x258], dx
cmp dword [ebp - 0x2b4], edi
jb 0x423ccd
mov eax, dword [ebp - 0x2c8]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b8], esi
mov word [ebp - 0x2c8], cx
cmp dword [ebp - 0x298], edi
jb 0x423cf9
mov edx, dword [ebp - 0x2ac]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x29c], esi
mov word [ebp - 0x2ac], ax
cmp dword [ebp - 0x32c], edi
jb 0x423d25
mov ecx, dword [ebp - 0x340]
push ecx
call fcn.0044e60d
add esp, 4
xor eax, eax
jmp 0x4262db
lea edx, [ebp - 0x5ac]
push edx
push esi
mov dword [ebp - 0x5ac], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x423ec2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 8
call fcn.0040ce10
mov edi, 8
cmp dword [ebp - 0x27c], edi
jb 0x423d7e
mov eax, dword [ebp - 0x290]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov esi, 7
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x280], ebx
mov word [ebp - 0x290], cx
cmp dword [ebp - 0x260], edi
jb 0x423daf
mov edx, dword [ebp - 0x274]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x264], ebx
mov word [ebp - 0x274], ax
cmp dword [ebp - 0x2d0], edi
jb 0x423ddb
mov ecx, dword [ebp - 0x2e4]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x2d0], esi
mov dword [ebp - 0x2d4], ebx
mov word [ebp - 0x2e4], dx
cmp dword [ebp - 0x2ec], edi
jb 0x423e07
mov eax, dword [ebp - 0x300]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2f0], ebx
mov word [ebp - 0x300], cx
cmp dword [ebp - 0x244], edi
jb 0x423e33
mov edx, dword [ebp - 0x258]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x258], ax
cmp dword [ebp - 0x2b4], edi
jb 0x423e5f
mov ecx, dword [ebp - 0x2c8]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2b8], ebx
mov word [ebp - 0x2c8], dx
cmp dword [ebp - 0x298], edi
jb 0x423e8b
mov eax, dword [ebp - 0x2ac]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x29c], ebx
mov word [ebp - 0x2ac], cx
cmp dword [ebp - 0x32c], edi
jb 0x423d25
mov edx, dword [ebp - 0x340]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
jmp 0x4262db
mov ebx, dword [ebp - 0x5c0]
call fcn.0042cc40
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0x5c0]
cmp eax, dword [ecx + 0x348]
je 0x425de7
cmp eax, dword [ebp - 0x600]
je 0x425de7
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5c4], eax
test eax, eax
je 0x425de7
mov ecx, dword [ebp - 0x5c4]
lea edx, [ebp - 0x684]
push edx
push 4
lea eax, [ebp - 0x618]
push eax
push ecx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x425de7
mov eax, dword [ebp - 0x5c4]
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, dword [ebp - 0x5c0]
cmp dword [ecx + 0x350], 0
je 0x423fe0
lea edx, [ebp - 0x21c]
push edx
push ecx
push str.Processing:
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 8
mov edi, eax
push edi
call fcn.0042ee30
mov eax, dword [edi]
mov eax, dword [eax + 4]
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x423fb2
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x423fb2
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x423fd3
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x423fcb
or eax, 4
push 0
push eax
call fcn.00402d10
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c0]
cmp dword [edx + 0x35c], 0
je 0x424051
sub esp, 0x1c
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x5b8], esp
push eax
call fcn.0040ead0
mov edi, dword [ebp - 0x604]
call fcn.00426300
add esp, 0x1c
test eax, eax
je 0x424051
lea ecx, [ebp - 0x290]
push ecx
mov eax, 0x47845c
call fcn.0040eb50
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x21c]
call fcn.0040eb50
lea eax, [ebp - 0x290]
push eax
mov eax, str.__WL__r_n
call fcn.0040eb50
jmp 0x425de7
mov ecx, dword [ebp - 0x5e0]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x5c8], eax
cmp eax, ecx
je 0x42499f
mov ecx, dword [ebp - 0x5c0]
lea edx, [ecx + 0x24c]
mov dword [ebp - 0x620], edx
lea edx, [ecx + 0x1dc]
mov dword [ebp - 0x638], edx
lea edx, [ecx + 0x1c0]
mov dword [ebp - 0x650], edx
lea edx, [ecx + 0xfc]
mov dword [ebp - 0x668], edx
lea edx, [ecx + 0x1f8]
mov dword [ebp - 0x680], edx
lea edx, [ecx + 0x8c]
mov dword [ebp - 0x5f4], edx
lea esi, [ecx + 0x54]
lea edx, [ecx + 0x230]
add ecx, 0x214
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x5cc], edx
mov dword [ebp - 0x5b8], ecx
jmp 0x4240e6
mov esi, dword [ebp - 0x664]
xor ecx, ecx
push 0xffffffffffffffff
add eax, 0xc
push ecx
mov word [ebp - 0x23c], cx
push eax
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
call fcn.004015e0
mov byte [ebp - 4], 0xb
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x61c]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x42414c
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x61c]
call fcn.00439fc8
lea edx, [ebp - 0x5bc]
push edx
lea eax, [ebp - 0x23c]
push str._SystemDrive_
push eax
mov eax, dword [ebp - 0x620]
mov byte [ebp - 4], 0xc
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x4241c3
push 0
lea ecx, [ebp - 0x628]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4241a1
cmp eax, 0xffffffff
jae 0x4241a1
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x628]
not edi
call fcn.00439fc8
and edi, ebx
je 0x4241c3
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x630]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4241f0
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x630]
call fcn.00439fc8
mov eax, dword [ebp - 0x638]
lea ecx, [ebp - 0x5bc]
push ecx
lea edx, [ebp - 0x23c]
push str._WinDir_
push edx
mov byte [ebp - 4], 0xd
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x424267
push 0
lea ecx, [ebp - 0x640]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x424245
cmp eax, 0xffffffff
jae 0x424245
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x640]
not edi
call fcn.00439fc8
and edi, ebx
je 0x424267
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x648]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x424294
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x648]
call fcn.00439fc8
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [ebp - 0x650]
lea ecx, [ebp - 0x23c]
push str._System_
push ecx
mov byte [ebp - 4], 0xe
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x42430b
push 0
lea ecx, [ebp - 0x658]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4242e9
cmp eax, 0xffffffff
jae 0x4242e9
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x658]
not edi
call fcn.00439fc8
and edi, ebx
je 0x42430b
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x660]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x424338
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x660]
call fcn.00439fc8
mov eax, dword [ebp - 0x668]
lea ecx, [ebp - 0x5bc]
push ecx
lea edx, [ebp - 0x23c]
push str._Desktop_
push edx
mov byte [ebp - 4], 0xf
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x4243af
push 0
lea ecx, [ebp - 0x670]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x42438d
cmp eax, 0xffffffff
jae 0x42438d
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x670]
not edi
call fcn.00439fc8
and edi, ebx
je 0x4243af
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x678]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4243dc
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x678]
call fcn.00439fc8
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [ebp - 0x680]
lea ecx, [ebp - 0x23c]
push ecx
mov byte [ebp - 4], 0x10
call fcn.00432060
add esp, 8
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x42444e
push 0
lea ecx, [ebp - 0x60c]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x42442c
cmp eax, 0xffffffff
jae 0x42442c
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x60c]
not edi
call fcn.00439fc8
and edi, ebx
je 0x42444e
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x63c]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x42447b
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x63c]
call fcn.00439fc8
mov eax, dword [ebp - 0x5f4]
lea ecx, [ebp - 0x5bc]
push ecx
lea edx, [ebp - 0x23c]
push str._UserProfile_
push edx
mov byte [ebp - 4], 0x11
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x4244f2
push 0
lea ecx, [ebp - 0x67c]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4244d0
cmp eax, 0xffffffff
jae 0x4244d0
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x67c]
not edi
call fcn.00439fc8
and edi, ebx
je 0x4244f2
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x5fc]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x42451f
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x5fc]
call fcn.00439fc8
lea eax, [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x23c]
push str._AllUsersProfile_
push ecx
mov eax, esi
mov byte [ebp - 4], 0x12
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x424592
push 0
lea ecx, [ebp - 0x644]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x424570
cmp eax, 0xffffffff
jae 0x424570
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x644]
not edi
call fcn.00439fc8
and edi, ebx
je 0x424592
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x5e8]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4245bf
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x5e8]
call fcn.00439fc8
lea ecx, [ebp - 0x5bc]
push ecx
lea edx, [ebp - 0x23c]
push str._AppData_
push edx
mov eax, esi
mov byte [ebp - 4], 0x13
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x424632
push 0
lea ecx, [ebp - 0x608]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x424610
cmp eax, 0xffffffff
jae 0x424610
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x608]
not edi
call fcn.00439fc8
and edi, ebx
je 0x424632
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x610]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x42465f
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x610]
call fcn.00439fc8
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x23c]
push str._ProgramFilesX86_
push ecx
mov byte [ebp - 4], 0x14
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x4246d6
push 0
lea ecx, [ebp - 0x614]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4246b4
cmp eax, 0xffffffff
jae 0x4246b4
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x614]
not edi
call fcn.00439fc8
and edi, ebx
je 0x4246d6
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5bc], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x64c]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x424703
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x64c]
call fcn.00439fc8
lea ecx, [ebp - 0x5bc]
push ecx
lea edx, [ebp - 0x23c]
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x5b8]
push str._ProgramFiles_
push edx
call fcn.00414fc0
add esp, 0xc
mov byte [ebp - 4], 0xb
test ebx, ebx
je 0x42477a
push 0
lea ecx, [ebp - 0x674]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x424758
cmp eax, 0xffffffff
jae 0x424758
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x674]
not edi
call fcn.00439fc8
and edi, ebx
je 0x42477a
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov eax, dword [ebp - 0x23c]
mov esi, 8
cmp dword [ebp - 0x228], esi
jae 0x424793
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x424962
mov ecx, dword [ebp - 0x5c0]
cmp dword [ecx + 0x350], 0
je 0x424886
mov edx, dword [ebp - 0x5e4]
mov eax, dword [ebp - 0x5a4]
push str._DEBUG__r_n
push ecx
add edx, 0x1c
push edx
push ecx
push 0x486010
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x424858
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x424858
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x424879
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x424871
or eax, 4
push 0
push eax
call fcn.00402d10
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x424962
mov eax, dword [ebp - 0x5e4]
push 0x474630
push ecx
add eax, 0x1c
push eax
mov eax, dword [ebp - 0x5b4]
push ecx
push 0x486010
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov edi, eax
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x42493b
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x42493b
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x42495c
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x424954
or eax, 4
push 0
push eax
call fcn.00402d10
inc dword [ebp - 0x5b0]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x228], esi
jb 0x42497d
mov edx, dword [ebp - 0x23c]
push edx
call fcn.0044e60d
add esp, 4
lea eax, [ebp - 0x5c8]
call fcn.00431d50
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x5c8]
cmp eax, ecx
jne 0x4240e0
mov dword [ebp - 0x324], str.chrome.exe
mov dword [ebp - 0x320], str.safari.exe
mov dword [ebp - 0x31c], str.iexplore.exe
mov dword [ebp - 0x318], str.firefox.exe
mov dword [ebp - 0x314], str.nvtray.exe
mov dword [ebp - 0x310], str.itunes.exe
mov dword [ebp - 0x30c], str.acrotray.exe
mov dword [ebp - 0x308], str.jusched.exe
mov dword [ebp - 0x304], str.nvvsvc.exe
xor esi, esi
mov ecx, dword [ebp + esi*4 - 0x324]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x424b9e
lea ecx, [ebp - 0x21c]
call fcn.0042cde0
test al, al
jne 0x424b9e
mov eax, dword [ebp - 0x5c0]
cmp dword [eax + 0x350], 0
je 0x424ae5
push str.___FI_DEBUG__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
mov edi, eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x424ab7
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x424ab7
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x424ad8
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x424ad0
or eax, 4
push 0
push eax
call fcn.00402d10
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x424b9e
mov eax, dword [ebp - 0x5a4]
mov edx, dword [ebp - 0x5b4]
push str.___FI__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
mov edi, eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x424b77
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x424b77
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x424b98
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x424b90
or eax, 4
push 0
push eax
call fcn.00402d10
inc dword [ebp - 0x5b0]
inc esi
cmp esi, 9
jb 0x4249fb
push 0x22
push str.SystemRootSystem32_._.exe_
lea ecx, [ebp - 0x300]
call fcn.00401740
mov eax, dword [ebp - 0x5c0]
xor edx, edx
push 0xffffffffffffffff
push edx
add eax, 0x1c0
mov esi, 7
push eax
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x34c], 0
mov word [ebp - 0x35c], dx
call fcn.004015e0
mov byte [ebp - 4], 0x16
call fcn.0043a1b1
mov ebx, eax
mov dword [ebp - 0x5b8], ebx
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x624]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x424c23
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x624]
call fcn.00439fc8
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x35c]
push 0x4743e0
push edx
mov ecx, 0x4743d8
mov byte [ebp - 4], 0x17
call fcn.00414d80
add esp, 0xc
mov byte [ebp - 4], 0x16
test ebx, ebx
je 0x424c99
push 0
lea ecx, [ebp - 0x654]
call fcn.00439fa0
mov eax, dword [ebx + 4]
test eax, eax
je 0x424c77
cmp eax, 0xffffffff
jae 0x424c77
dec eax
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x654]
not edi
call fcn.00439fc8
and edi, ebx
je 0x424c99
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
lea eax, [ebp - 0x31c]
push str.___
push eax
lea ebx, [ebp - 0x35c]
call fcn.00414e00
push eax
mov eax, str._._.exe_
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0x18
call fcn.00414ee0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x19
call fcn.00401560
mov edi, 8
cmp dword [ebp - 0x228], edi
jb 0x424cf4
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], dx
cmp dword [ebp - 0x308], edi
jb 0x424d28
mov eax, dword [ebp - 0x31c]
push eax
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0x5d0]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x5c8], eax
cmp eax, ecx
je 0x4250ab
add eax, 0xc
lea edx, [eax + 0x1c]
mov ebx, 8
mov dword [ebp - 0x5cc], eax
cmp dword [edx + 0x14], ebx
jb 0x424d59
mov edx, dword [edx]
xor eax, eax
mov word [ebp - 0x23c], ax
mov eax, edx
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
lea edi, [eax + 2]
jmp 0x424d80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424d80
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x23c]
call fcn.00401740
lea ecx, [ebp - 0x23c]
push ecx
mov edx, 0x4861b4
lea esi, [ebp - 0x31c]
mov byte [ebp - 4], 0x1a
call fcn.004320e0
add esp, 4
push eax
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x1b
call fcn.00401560
cmp dword [ebp - 0x308], ebx
jb 0x424de1
mov edx, dword [ebp - 0x31c]
push edx
call fcn.0044e60d
add esp, 4
xor ebx, ebx
xor eax, eax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x228], 8
mov dword [ebp - 0x308], 7
mov dword [ebp - 0x30c], ebx
mov word [ebp - 0x31c], ax
jb 0x424e18
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0044e60d
add esp, 4
call fcn.0043a1b1
mov edi, eax
mov dword [ebp - 0x5b8], edi
call fcn.0043a06b
push ebx
lea ecx, [ebp - 0x62c]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x424e44
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x62c]
call fcn.00439fc8
lea edx, [ebp - 0x5b8]
push edx
lea eax, [ebp - 0x340]
push 0x4743e0
push eax
mov ecx, 0x4743d8
mov byte [ebp - 4], 0x1c
call fcn.00414d80
add esp, 0xc
mov byte [ebp - 4], 0x16
cmp edi, ebx
je 0x424ebb
push ebx
lea ecx, [ebp - 0x66c]
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, ebx
jbe 0x424e97
cmp eax, 0xffffffff
jae 0x424e97
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [ebp - 0x66c]
and esi, edi
call fcn.00439fc8
cmp esi, ebx
je 0x424ebb
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push 0xf
mov eax, 0x4861b8
lea esi, [ebp - 0x340]
call fcn.00412040
mov eax, dword [ebp - 0x5cc]
cmp dword [eax + 0x14], 8
jb 0x424edb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42508b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x340]
mov edi, 7
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push eax
mov word [ecx], dx
call fcn.004015e0
lea esi, [ebp - 0x21c]
call fcn.004268b0
add esp, 0x1c
cmp eax, ebx
jne 0x42508b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x300]
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push eax
mov word [ecx], dx
call fcn.004015e0
call fcn.004268b0
add esp, 0x1c
cmp eax, ebx
jne 0x42508b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2e4]
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push eax
mov word [ecx], dx
call fcn.004015e0
call fcn.004268b0
add esp, 0x1c
cmp eax, ebx
jne 0x42508b
mov ecx, esi
call fcn.0042cde0
test al, al
jne 0x42508b
mov ecx, dword [ebp - 0x5c0]
cmp dword [ecx + 0x350], ebx
je 0x425019
mov edx, dword [ebp - 0x5a4]
push str.___SFI_DEBUG__r_n
push ecx
push edx
push ecx
push str.__PID:
push ecx
mov eax, esi
push eax
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov ecx, dword [ebp - 0x5c4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x42508b
mov edx, dword [ebp - 0x5a4]
push str.___SFI__r_n
push ecx
push edx
push ecx
push str.__PID:
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
mov ecx, dword [ebp - 0x5b4]
push 0x47845c
push ecx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
inc dword [ebp - 0x5b0]
lea eax, [ebp - 0x5c8]
call fcn.00431d50
mov edx, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x5c8]
cmp eax, dword [edx + 4]
jne 0x424d41
push 1
push 0x4861b4
lea ecx, [ebp - 0x2ac]
call fcn.00401740
mov eax, dword [ebp - 0x5c0]
push 0xffffffffffffffff
push 0
add eax, 0x24c
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00411f30
push 0xf
mov eax, 0x4861b8
lea esi, [ebp - 0x2ac]
call fcn.00412040
push 1
push 0x4861b4
lea ecx, [ebp - 0x274]
call fcn.00401740
mov ebx, dword [ebp - 0x5c0]
push 0xffffffffffffffff
lea eax, [ebx + 0x1dc]
push 0
push eax
lea ecx, [ebp - 0x274]
call fcn.00411f30
call fcn.0043a1b1
mov edi, eax
mov dword [ebp - 0x5b8], edi
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x634]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x425145
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x634]
call fcn.00439fc8
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x274]
push 0x4743e0
push edx
mov ecx, 0x4743d8
mov byte [ebp - 4], 0x1d
call fcn.00414d80
add esp, 0xc
mov byte [ebp - 4], 0x16
test edi, edi
je 0x4251bb
push 0
lea ecx, [ebp - 0x65c]
call fcn.00439fa0
mov eax, dword [edi + 4]
test eax, eax
je 0x425199
cmp eax, 0xffffffff
jae 0x425199
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
lea ecx, [ebp - 0x65c]
not esi
call fcn.00439fc8
and esi, edi
je 0x4251bb
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push 0xb
mov eax, str._._.exe_
lea esi, [ebp - 0x274]
call fcn.00412040
push 1
push 0x4861b4
lea ecx, [ebp - 0x258]
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x214]
push eax
lea ecx, [ebp - 0x258]
call fcn.00411f30
call fcn.0043a1b1
mov edi, eax
mov dword [ebp - 0x5b8], edi
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x5ec]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x425222
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x5ec]
call fcn.00439fc8
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x258]
push 0x4743e0
push edx
mov ecx, 0x4743d8
mov byte [ebp - 4], 0x1e
call fcn.00414d80
add esp, 0xc
mov byte [ebp - 4], 0x16
test edi, edi
je 0x425298
push 0
lea ecx, [ebp - 0x5f0]
call fcn.00439fa0
mov eax, dword [edi + 4]
test eax, eax
je 0x425276
cmp eax, 0xffffffff
jae 0x425276
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
lea ecx, [ebp - 0x5f0]
not esi
call fcn.00439fc8
and esi, edi
je 0x425298
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push 0xf
mov eax, 0x4861b8
lea esi, [ebp - 0x258]
call fcn.00412040
cmp dword [ebx + 0x240], 0
je 0x425394
push 1
push 0x4861b4
lea ecx, [ebp - 0x2c8]
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x230]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.004015e0
call fcn.0043a1b1
mov edi, eax
mov dword [ebp - 0x5b8], edi
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x5f8]
mov esi, eax
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x42530c
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x5f8]
call fcn.00439fc8
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x2c8]
push 0x4743e0
push edx
mov ecx, 0x4743d8
mov byte [ebp - 4], 0x1f
call fcn.00414d80
add esp, 0xc
mov byte [ebp - 4], 0x16
test edi, edi
je 0x425382
push 0
lea ecx, [ebp - 0x5d8]
call fcn.00439fa0
mov eax, dword [edi + 4]
test eax, eax
je 0x425360
cmp eax, 0xffffffff
jae 0x425360
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
lea ecx, [ebp - 0x5d8]
not esi
call fcn.00439fc8
and esi, edi
je 0x425382
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push 0xf
mov eax, 0x4861b8
lea esi, [ebp - 0x2c8]
call fcn.00412040
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x2ac]
mov edi, 7
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], 0
push edx
mov word [ecx], ax
call fcn.004015e0
lea esi, [ebp - 0x21c]
call fcn.004268b0
add esp, 0x1c
test eax, eax
je 0x4254ea
mov ecx, esi
call fcn.0042cde0
test al, al
jne 0x4254c4
cmp dword [ebx + 0x350], 0
je 0x425451
mov eax, dword [ebp - 0x5a4]
push str.___SD_HEUR_DEBUG__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
mov ecx, esi
push ecx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254c4
push str.___SD_HEUR__r_n
mov eax, dword [ebp - 0x5a4]
mov edx, dword [ebp - 0x5b4]
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
inc dword [ebp - 0x5b0]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, dword [ebp - 0x5c0]
cmp dword [esi + 0x1f0], 8
lea edi, [esi + 0x1dc]
jb 0x425b0c
mov ecx, dword [edi]
jmp 0x425b0e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x274]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], 0
push edx
mov word [ecx], ax
call fcn.004015e0
lea esi, [ebp - 0x21c]
call fcn.004268b0
add esp, 0x1c
test eax, eax
je 0x425676
mov ecx, esi
call fcn.0042cde0
test al, al
jne 0x4254c4
mov eax, dword [ebp - 0x5d0]
push eax
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov eax, esi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x5b8], esp
mov word [ecx], dx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x425560
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00401740
call fcn.004266a0
add esp, 0x20
test eax, eax
jne 0x42563d
cmp dword [ebx + 0x350], eax
je 0x4255f9
push str.___WD_HEUR_DEBUG__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov eax, dword [ebp - 0x5c4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254c4
mov eax, dword [ebp - 0x5b4]
push str.___WD_HEUR__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push eax
jmp 0x42548c
push 0x47325c
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
lea edx, [ebp - 0x71c]
push 0x47845c
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 8
jmp 0x4254c4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5b8], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x258]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], 0
push edx
mov word [ecx], ax
call fcn.004015e0
lea esi, [ebp - 0x21c]
call fcn.004268b0
add esp, 0x1c
test eax, eax
je 0x42574f
mov ecx, esi
call fcn.0042cde0
test al, al
je 0x4254c4
cmp dword [ebx + 0x350], 0
je 0x42572e
mov eax, dword [ebp - 0x5a4]
push str.___P_HEUR_DEBUG__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
mov ecx, esi
push ecx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254c4
push str.___P_HEUR__r_n
jmp 0x425469
cmp dword [ebx + 0x68], 8
lea eax, [ebx + 0x54]
jb 0x42575a
mov eax, dword [eax]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
test eax, eax
je 0x42583d
lea ecx, [ebp - 0x21c]
call fcn.0042cde0
test al, al
jne 0x4254ca
mov ecx, dword [ebp - 0x5c0]
cmp dword [ecx + 0x350], 0
je 0x4257f9
mov edx, dword [ebp - 0x5a4]
push str.___AU_HEUR_DEBUG__r_n
push ecx
push edx
push ecx
push str.__PID:
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov ecx, dword [ebp - 0x5c4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254ca
push str.___AU_HEUR__r_n
mov edx, dword [ebp - 0x5a4]
push ecx
push edx
push ecx
push str.__PID:
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
mov ecx, dword [ebp - 0x5b4]
push 0x47845c
push ecx
jmp 0x425a0b
mov esi, dword [ebp - 0x5c0]
lea eax, [esi + 0x70]
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x425852
mov eax, dword [eax]
push eax
lea edx, [ebp - 0x21c]
push edx
call ebx
test eax, eax
je 0x425929
lea ecx, [ebp - 0x21c]
call fcn.0042cde0
test al, al
jne 0x4254ca
cmp dword [esi + 0x350], 0
je 0x4258e5
mov eax, dword [ebp - 0x5a4]
push str.___SAUP_HEUR_DEBUG__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254ca
mov eax, dword [ebp - 0x5a4]
mov edx, dword [ebp - 0x5b4]
push str.___SAUP_HEUR__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push edx
jmp 0x425a0b
cmp dword [esi + 0xa0], edi
lea eax, [esi + 0x8c]
jb 0x425939
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
test eax, eax
je 0x425a48
lea ecx, [ebp - 0x21c]
call fcn.0042cde0
test al, al
jne 0x4254ca
cmp dword [esi + 0x350], 0
je 0x4259cc
push str.___UP_HEUR_DEBUG__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov eax, dword [ebp - 0x5c4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254ca
mov eax, dword [ebp - 0x5b4]
push str.___UP_HEUR__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
inc dword [ebp - 0x5b0]
jmp 0x4254ca
cmp dword [esi + 0xbc], edi
lea eax, [esi + 0xa8]
jb 0x425a58
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call ebx
test eax, eax
je 0x4254ca
lea ecx, [ebp - 0x21c]
call fcn.0042cde0
test al, al
jne 0x4254ca
cmp dword [esi + 0x350], 0
je 0x425aeb
mov edx, dword [ebp - 0x5a4]
push str.___SUP_HEUR_DEBUG__r_n
push ecx
push edx
push ecx
push str.__PID:
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov ecx, dword [ebp - 0x5c4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4254ca
push str.___SUP_HEUR__r_n
jmp 0x425815
mov ecx, edi
add esi, 0xc4
cmp dword [esi + 0x14], 8
jb 0x425b1e
mov eax, dword [esi]
jmp 0x425b20
mov eax, esi
push ecx
push eax
call ebx
test eax, eax
jne 0x425d38
cmp dword [edi + 0x14], 8
jb 0x425b36
mov ecx, dword [edi]
jmp 0x425b38
mov ecx, edi
mov edi, dword [ebp - 0x5c0]
add edi, 0xe0
cmp dword [edi + 0x14], 8
jb 0x425b4e
mov eax, dword [edi]
jmp 0x425b50
mov eax, edi
push ecx
push eax
call ebx
test eax, eax
jne 0x425d38
cmp dword [esi + 0x14], 8
jb 0x425b64
mov esi, dword [esi]
push esi
lea edx, [ebp - 0x21c]
push edx
call ebx
test eax, eax
je 0x425c2e
mov eax, dword [ebp - 0x5c0]
cmp dword [eax + 0x350], 0
je 0x425bea
push str.___T_DEBUG__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov eax, dword [ebp - 0x5c4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x425dc5
mov eax, dword [ebp - 0x5b4]
push str.___T_HEUR__r_n
push ecx
mov ecx, dword [ebp - 0x5a4]
push ecx
push ecx
push str.__PID:
push ecx
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0x47845c
push eax
jmp 0x425cfb
cmp dword [edi + 0x14], 8
jb 0x425c36
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x21c]
push ecx
call ebx
test eax, eax
je 0x425dc5
mov edx, dword [ebp - 0x5c0]
cmp dword [edx + 0x350], 0
je 0x425cbc
mov eax, dword [ebp - 0x5a4]
push str.___ST_HEUR_DEBUG__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push str.Pause
call fcn.004525d8
add esp, 4
mov edx, dword [ebp - 0x5c4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x425dc5
mov eax, dword [ebp - 0x5a4]
mov edx, dword [ebp - 0x5b4]
push str.___ST_HEUR__r_n
push ecx
push eax
push ecx
push str.__PID:
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push ecx
push 0x47845c
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
inc dword [ebp - 0x5b0]
jmp 0x425dc5
cmp dword [ebp - 0x5dc], 0
jne 0x425dc5
mov eax, dword [ebp - 0x5b4]
push str.__which_can_be_dangerous._Skipping_termination_for_this_folder._r_n
push ecx
push esi
push ecx
push str.__Your__Temp__folder_is_set_to
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x425d9a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x425d9a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x425dbb
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x425db3
or eax, 4
push 0
push eax
call fcn.00402d10
mov dword [ebp - 0x5dc], 1
mov byte [ebp - 4], 9
cmp dword [ebp - 0x348], 8
jb 0x425de1
mov edx, dword [ebp - 0x35c]
push edx
call fcn.0044e60d
add esp, 4
mov esi, dword [ebp - 0x5d4]
lea eax, [ebp - 0x5ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x423ed3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5b0]
cmp eax, 1
jne 0x425e96
push str._proccess_terminated__r_n_r_n
push ecx
push eax
push ecx
mov ecx, dword [ebp - 0x5b4]
push 0x47325c
push ecx
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x425e68
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x425e68
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
test ebx, ebx
je 0x425e89
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x425e81
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x425ef3
jbe 0x425ed9
mov edx, dword [ebp - 0x5b4]
push str._proccesses_terminated__r_n_r_n
push ecx
push eax
push ecx
push 0x47325c
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.0040e1e0
add esp, 4
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x425ef3
mov eax, dword [ebp - 0x5b4]
push str.__No_malware_processes_found_to_kill._r_n_r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x280], 0
je 0x425fc9
mov ecx, dword [ebp - 0x5b4]
push str.Processes_not_terminated_due_to_white_list:_r_n_r_n
push ecx
call fcn.00414730
mov edi, eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
add esp, 8
xor esi, esi
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x425f3d
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x425f3d
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x425f5c
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x425f55
or eax, 4
push esi
push eax
call fcn.00402d10
mov eax, dword [ebp - 0x5b4]
push 0x47325c
push ecx
lea edx, [ebp - 0x290]
push edx
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov edi, eax
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x425fa8
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x425fa8
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x425fcb
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x425fc0
or eax, 4
push esi
push eax
call fcn.00402d10
jmp 0x425fcb
xor esi, esi
mov edx, dword [ebp - 0x71c]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x710], 6
jne 0x426007
mov ecx, dword [ebp + eax - 0x6e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
push 2
push 1
push esi
push esi
lea edx, [ebp - 0x23c]
push edx
call eax
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x23c]
jmp 0x426020
mov ecx, dword [0x46f4d4]
mov eax, dword [0x46f4d0]
mov dword [ebp - 0x238], ecx
xor ecx, ecx
mov dword [ebp - 0x230], esi
add eax, ecx
cmp eax, esi
je 0x426121
mov edx, dword [ebp - 0x5b4]
push str.Possibly_Patched_Files._r_n_r_n
push edx
call fcn.00414730
mov edi, eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x426065
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x426065
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x426084
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x42607d
or eax, 4
push esi
push eax
call fcn.00402d10
lea edx, [ebp - 0x71c]
push 0x47325c
push edx
call fcn.00414730
add esp, 8
lea ecx, [ebp - 0x31c]
lea eax, [ebp - 0x71c]
call fcn.0040f530
push eax
mov eax, dword [ebp - 0x5b4]
push eax
mov byte [ebp - 4], 0x20
call fcn.004149f0
mov edi, eax
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + edi + 0xc], 6
jne 0x4260e4
mov eax, dword [eax + edi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x4260e4
mov ebx, 4
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
cmp ebx, esi
je 0x426103
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], esi
jne 0x4260fc
or eax, 4
push esi
push eax
call fcn.00402d10
mov ebx, 8
cmp dword [ebp - 0x308], ebx
jb 0x426126
mov edx, dword [ebp - 0x31c]
push edx
call fcn.0044e60d
add esp, 4
jmp 0x426126
mov ebx, 8
mov ecx, dword [ebp - 0x71c]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x618], eax
mov dword [ebp + edx - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 0x21
call fcn.0040edf0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x71c]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x6cc]
mov dword [ebp + ecx - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
push edx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0043dec4
add esp, 4
cmp dword [ebp - 0x27c], ebx
jb 0x42619c
mov eax, dword [ebp - 0x290]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x280], esi
mov word [ebp - 0x290], cx
cmp dword [ebp - 0x260], ebx
jb 0x4261cd
mov edx, dword [ebp - 0x274]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x264], esi
mov word [ebp - 0x274], ax
cmp dword [ebp - 0x2d0], ebx
jb 0x4261f9
mov ecx, dword [ebp - 0x2e4]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x2d0], edi
mov dword [ebp - 0x2d4], esi
mov word [ebp - 0x2e4], dx
cmp dword [ebp - 0x2ec], ebx
jb 0x426225
mov eax, dword [ebp - 0x300]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2ec], edi
mov dword [ebp - 0x2f0], esi
mov word [ebp - 0x300], cx
cmp dword [ebp - 0x244], ebx
jb 0x426251
mov edx, dword [ebp - 0x258]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x248], esi
mov word [ebp - 0x258], ax
cmp dword [ebp - 0x2b4], ebx
jb 0x42627d
mov ecx, dword [ebp - 0x2c8]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x2b4], edi
mov dword [ebp - 0x2b8], esi
mov word [ebp - 0x2c8], dx
cmp dword [ebp - 0x298], ebx
jb 0x4262a9
mov eax, dword [ebp - 0x2ac]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x29c], esi
mov word [ebp - 0x2ac], cx
cmp dword [ebp - 0x32c], ebx
jb 0x4262d5
mov edx, dword [ebp - 0x340]
push edx
call fcn.0044e60d
add esp, 4
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret