Function at 0x471d90
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48419b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1bac
call fcn.0047bda0
push ebx
push esi
xor eax, eax
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x120], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x13fc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x8f4]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x471feb
push edx
lea ecx, [ebp - 0x8f4]
push 0x49f270
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x8f4]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push 0x4a1414
push eax
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x47200e
mov dword [ebp - 0x1b4], esi
lea ecx, [ebp - 0x8f4]
push str.Documents_and_Settings_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472041
lea edx, [ebp - 0x8f4]
push str.Application_Data_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472041
mov dword [ebp - 0x6c], esi
lea eax, [ebp - 0x8f4]
push str.documents_and_settings_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472074
lea ecx, [ebp - 0x8f4]
push str.Application_Data_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472074
mov dword [ebp - 0x6c], esi
lea edx, [ebp - 0x8f4]
push str.Program_Files_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472092
mov dword [ebp - 0x1c8], esi
mov al, byte [ebp - 0x8f4]
xor ecx, ecx
cmp al, 0x25
jne 0x4720a0
mov ecx, esi
lea edx, [ebx - 2]
test edx, edx
jle 0x4720c9
mov al, byte [ebp + edx - 0x8f4]
cmp al, 0x3a
jne 0x4720bc
cmp byte [ebp + edx - 0x8f3], 0x5c
je 0x4720c9
cmp ecx, esi
jne 0x4720c4
cmp al, 0x5c
je 0x4720cd
dec edx
test edx, edx
jg 0x4720a7
cmp ecx, esi
jne 0x472129
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x4720f3
mov ecx, ebx
lea esi, [ebp + edx - 0x8f3]
mov eax, ecx
lea edi, [ebp - 0xc2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xc2c], 0
lea edi, [ebp - 0xc2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x8f4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4721d7
test edx, edx
je 0x4721d7
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x1284]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x472171
cmp byte [ebp + ebx - 0x8f4], 0x2e
je 0x472171
dec ebx
test ebx, ebx
jg 0x472162
sub ebx, edx
mov byte [ebp - 0x8f4], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x47219c
lea esi, [ebp + edx - 0x1285]
mov edx, ecx
lea edi, [ebp - 0x8f4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x8ef], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4721c7
cmp byte [ebp + ecx - 0x8f4], 0x2e
je 0x4721c7
dec ecx
test ecx, ecx
jg 0x4721b8
test ecx, ecx
mov byte [ebp + ecx - 0x8f0], 0
jne 0x47229d
lea eax, [ebp - 0x6f4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x14bc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x9f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x9f4]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x47227b
lea edx, [ebp - 0x9f4]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x47227b
lea eax, [ebp - 0x9f4]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x47227b
lea ecx, [ebp - 0x9f4]
lea edx, [ebp - 0x6f4]
push ecx
jmp 0x472288
lea ecx, [ebp - 0x9f4]
lea edx, [ebp - 0x14bc]
push ecx
push edx
lea eax, [ebp - 0x8f4]
push 0x4966e0
push eax
call fcn.0047a8f8
add esp, 0x10
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4722c0
cmp byte [ebp + ecx - 0x8f4], 0x2e
je 0x4722c0
dec ecx
test ecx, ecx
jg 0x4722b1
mov byte [ebp + ecx - 0x8f0], 0
lea ecx, [ebp - 0x8f4]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 0xffffffff
jne 0x4722fa
push 0x4a13fc
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f4]
push edx
call fcn.004246a0
mov esi, eax
lea eax, [ebp - 0x17bc]
lea ecx, [ebp - 0x2f4]
push eax
lea edx, [ebp - 0x8f4]
push ecx
push edx
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x48], esi
call fcn.0046de70
movsx edi, ax
lea eax, [ebp - 0x1104]
lea ecx, [ebp - 0x163c]
push eax
lea edx, [ebp - 0x8f4]
push ecx
push edx
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x1104], 0
call fcn.00455090
add esp, 0x1c
cmp esi, 0xc8000
jle 0x4723ba
cmp edi, 1
jle 0x472382
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2f4]
lea edx, [ebp - 0x1284]
push ecx
push 0x4a13e4
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1284]
push eax
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x80]
push ecx
lea eax, [ebp - 0x8f4]
mov esi, 1
xor ebx, ebx
push edx
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xcc], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x4723f0
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
je 0x4723f6
mov dword [ebp - 0xcc], esi
xor edi, edi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
lea edx, [esi + str.CMBPB]
lea eax, [ebp - 0x1104]
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472454
lea ecx, [esi + str.PersonalBankPortal.exe]
lea edx, [ebp - 0x13fc]
push ecx
push edx
lea eax, [ebp - 0xc2c]
push str._s_system32_s
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x18
test eax, eax
je 0x4724ae
add esi, 0x100
inc edi
cmp esi, 0x200
jl 0x472401
xor edi, edi
mov esi, str.DriversCMBProtector.dat
lea edx, [ebp - 0x13fc]
push esi
push edx
lea eax, [ebp - 0xc2c]
push str._s_system32_s
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x18
test eax, eax
je 0x4724e9
add esi, 0x100
inc edi
cmp esi, 0x49a288
jl 0x47246a
jmp 0x472524
shl edi, 8
add edi, str.CMBPB
lea eax, [ebp - 0xc2c]
push edi
push 0x4a13b8
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x49a288
lea eax, [ebp - 0xc2c]
push edi
push 0x4a13b8
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x65cd60], 1
jne 0x47257a
xor edi, edi
mov esi, str.olelink.exe
lea edx, [ebp - 0x13fc]
push esi
push edx
lea eax, [ebp - 0xc2c]
push str._s_system32_s
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x18
test eax, eax
je 0x472608
add esi, 0x100
inc edi
cmp esi, 0x49a988
jl 0x472534
lea edx, [ebp - 0x8f4]
push str.DOCUME1_
push edx
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x47259a
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x8f4]
push str.LOCALS1Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4725b5
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x8f4]
push str.Program_FilesCommon_FilesSystem
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4725d0
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x163c]
push edx
push str.PowerWord
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x472643
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x49a988
lea eax, [ebp - 0xc2c]
push edi
push 0x4a13b8
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2f4]
push str.Maxthon_International
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47267b
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f4]
push str.MoreQuick
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4726b3
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f4]
push str.Opera_Software
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4726eb
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push str.Microsoft.NETFramework_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472723
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push str.jre_binjre
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47275b
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f4]
push 0x49b940
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472791
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push str.32A6Wizard_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4727c7
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push str.Java
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4727ff
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push str.java
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x472837
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f4]
push str.Microsoft.NETFramework_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47286f
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push str.microsoft.net_framework_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4728a7
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f4]
push str.Microsoft
push eax
mov dword [ebp - 0x28], ebx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x472911
lea ecx, [ebp - 0x17bc]
push str.Microsoft
push ecx
call fcn.0047bec0
add esp, 8
cmp eax, ebx
je 0x4728df
mov dword [ebp - 0x28], esi
jmp 0x472911
mov edi, 0x49ba20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xa0], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x674]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x137c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x674]
lea ecx, [ebp - 0xb2c]
push eax
push str._swinlogon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x8f4]
lea eax, [ebp - 0xb2c]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472987
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x674]
lea eax, [ebp - 0xb2c]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xb2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4729d9
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0xb2c]
push ecx
push str._s_services.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x8f4]
lea ecx, [ebp - 0xb2c]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472a2b
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x674]
lea ecx, [ebp - 0xb2c]
push eax
push str._slsass.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x8f4]
lea eax, [ebp - 0xb2c]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472a7d
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x674]
lea eax, [ebp - 0xb2c]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xb2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472acf
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0xb2c]
push ecx
push str._suserinit.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x8f4]
lea ecx, [ebp - 0xb2c]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472b21
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x674]
lea ecx, [ebp - 0xb2c]
push eax
push str._s_taskmgr.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x8f4]
lea eax, [ebp - 0xb2c]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472b73
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x674]
lea eax, [ebp - 0xb2c]
push edx
push str._s_spoolsv.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xb2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472bc5
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x137c]
lea edx, [ebp - 0xb2c]
push ecx
push str._sexplorer.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x8f4]
lea ecx, [ebp - 0xb2c]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472c17
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push eax
push str.SystemRootSystem32_smss.exe
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x472c4f
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x674]
lea eax, [ebp - 0xb2c]
push edx
push str._sctfmon.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xb2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472ca1
lea eax, [ebp - 0x2f4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x137c]
lea edx, [ebp - 0xb2c]
push ecx
push str._s_anotherlockfile.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x8f4]
lea ecx, [ebp - 0xb2c]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472cf1
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x674]
lea eax, [ebp - 0xb2c]
push edx
push str._sServerNT.EXE
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x8f4]
lea edx, [ebp - 0xb2c]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472dc1
lea eax, [ebp - 0x674]
lea ecx, [ebp - 0x1284]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1284]
push edx
call fcn.00429f20
mov esi, eax
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0xc2c]
push str._sAlertService.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xc2c]
push edx
call fcn.00429f20
mov edi, eax
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x9f4]
push str._sServerNT.EXE
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x9f4]
push edx
call fcn.00429f20
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x472dc1
push 0x4a1294
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x674]
lea ecx, [ebp - 0xb2c]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x8f4]
lea eax, [ebp - 0xb2c]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472e91
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0x1284]
push ecx
push str._sU8SMSSrv.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1284]
push eax
call fcn.00429f20
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0xc2c]
push ecx
push str._sAlertService.exe
push edx
mov esi, eax
call fcn.0047a8f8
lea eax, [ebp - 0xc2c]
push eax
call fcn.00429f20
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0x9f4]
push ecx
push str._sServerNT.EXE
push edx
mov edi, eax
call fcn.0047a8f8
lea eax, [ebp - 0x9f4]
push eax
call fcn.00429f20
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x472e91
push 0x4a1294
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0xb2c]
push ecx
push str._sAlertService.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x8f4]
lea ecx, [ebp - 0xb2c]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x472f61
lea edx, [ebp - 0x674]
lea eax, [ebp - 0x1284]
push edx
push str._sU8SMSSrv.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x1284]
push ecx
call fcn.00429f20
lea edx, [ebp - 0x674]
mov esi, eax
push edx
lea eax, [ebp - 0xc2c]
push str._sAlertService.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00429f20
lea edx, [ebp - 0x674]
mov edi, eax
push edx
lea eax, [ebp - 0x9f4]
push str._sServerNT.EXE
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x9f4]
push ecx
call fcn.00429f20
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x472f61
push 0x4a1294
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x8f4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x24], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], edx
cmp ecx, edx
mov dword [ebp - 0x1c], ebx
jle 0x472fa1
lea esi, [ebp + ecx - 0x8f4]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xe84], al
jne 0x472f9b
cmp edx, 2
jge 0x472fa1
inc edx
dec esi
cmp edx, ecx
jl 0x472f89
sub ecx, edx
xor eax, eax
mov edi, ecx
test edi, edi
jle 0x472fc7
mov cl, byte [ebp + eax - 0x8f4]
cmp cl, 0x5c
mov byte [ebp + eax - 0x1084], cl
jne 0x472fbf
inc ebx
inc eax
cmp eax, edi
jl 0x472fab
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov byte [ebp + edi - 0x1084], 0
test edx, edx
jle 0x473011
mov ecx, dword [ebp - 0x15c]
lea edi, [ebp + edi - 0x8f3]
mov al, byte [edi + esi]
cmp al, 0x5c
je 0x472ff0
mov byte [ebp + esi - 0xe84], al
cmp al, 0x2e
jne 0x472ff5
inc ecx
cmp al, 0x20
jne 0x472ffa
inc ecx
cmp al, 0x5c
jne 0x473006
mov byte [ebp + esi - 0xe84], 0
inc esi
cmp esi, edx
jl 0x472fe2
mov dword [ebp - 0x15c], ecx
mov al, byte [ebp - 0x1082]
mov byte [ebp + edx - 0xe84], 0
cmp al, 0x5c
je 0x473031
mov byte [ebp - 0x1082], 0x5c
mov byte [ebp - 0x1081], 0
lea edi, [ebp - 0xe84]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xe84]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..tmp
push edx
mov dword [ebp - 0x1d4], ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x473077
lea eax, [ebp - 0xe84]
push str..Tmp
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x473084
mov esi, 1
mov dword [ebp - 0x1a8], esi
jmp 0x473089
mov esi, 1
lea ecx, [ebp - 0x1084]
lea edx, [ebp - 0x13fc]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4730a6
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x1084]
lea ecx, [ebp - 0x674]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4730c3
mov dword [ebp + 8], esi
lea edx, [ebp - 0x8f4]
push 0x100
lea eax, [ebp - 0x5f4]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0xe84]
push 0x40
lea edx, [ebp - 0x12fc]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x1084]
push eax
call fcn.004688e0
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x17c], eax
jne 0x47319c
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0x5f4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x5f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x47316f
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, esi
jne 0x47316f
lea edx, [ebp - 0x5f4]
push edx
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x4f4]
mov edi, 0x4a1258
jmp 0x47317a
lea edx, [ebp - 0x4f4]
mov edi, 0x4a121c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp fcn.004778b7
cmp eax, esi
jne 0x4731a3
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x1084]
push edx
call fcn.00470cf0
mov ebx, eax
lea eax, [ebp - 0x8f4]
push eax
mov dword [ebp - 0x1d0], ebx
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x10
test eax, eax
jne 0x4731f5
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push 0x80
lea edx, [ebp - 0x15bc]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x8f4]
push 0x80
lea ecx, [ebp - 0x153c]
push eax
push ecx
call fcn.0047b120
lea edi, [ebp - 0x137c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x674]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x15bc], al
lea edx, [ebp - 0x137c]
mov byte [ebp + ecx - 0x153c], al
lea eax, [ebp - 0x15bc]
push edx
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x4732a0
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x473299
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x674]
lea edx, [ebp - 0x153c]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4732ed
push 0x491c80
push esi
mov dword [ebp - 0x24], 1
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4732ed
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push str.System
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x473372
push 0x491c80
push esi
mov dword [ebp - 0x24], 1
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x473338
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push ecx
call fcn.00428d90
mov edi, eax
push 0x491c80
push edi
call fcn.0047fde0
add esp, 0xc
test eax, eax
jne 0x473372
push edi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f4]
push str._system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4733f7
push 0x491c80
push esi
mov dword [ebp - 0x24], 1
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4733bd
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push eax
call fcn.00428d90
mov edi, eax
push 0x491c80
push edi
call fcn.0047fde0
add esp, 0xc
test eax, eax
jne 0x4733f7
push edi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8f4]
push str.SYSTEM
push ecx
call fcn.0047bec0
add esp, 8
mov edi, 1
test eax, eax
je 0x47347d
push 0x491c80
push esi
mov dword [ebp - 0x24], edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x473443
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x8f4]
push edx
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0xc
test eax, eax
jne 0x47347d
push esi
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8f4]
push str.Application_Data
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x473498
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x8f4]
push str.Microsoft_SharedMSINFO
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4734b3
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0x8f4]
push str.Microsoft_SharedMSInfo
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4734ce
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4737df
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4737df
cmp dword [ebp - 0x20], 2
jle 0x4737df
lea eax, [ebp - 0x2f4]
push str.Beijing_Rising
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47352e
mov edi, 0x4a120c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Trend_Micro_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47356e
mov edi, 0x4a11fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Eset
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4735ae
mov edi, str.NOD32
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Jiangmin_Co
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4735ee
mov edi, 0x4a11dc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Symantec_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47362e
mov edi, 0x4a11c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Network_Associates
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47366e
mov edi, str.McAfee
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.McAfee_Inc
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4736ae
mov edi, str.McAfee
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Kingsoft_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4736ee
mov edi, 0x4a11a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.Kaspersky_Lab
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47372e
mov edi, 0x4a1194
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push 0x4a1188
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x47376e
mov edi, 0x4a1178
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
push str.F_Secure_Corporation
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4737a4
push str.F_Secure
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f4]
push str.Avira_GmbH
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4737da
push 0x4a1130
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, dword [ebp + 8]
test eax, eax
jne 0x473a93
lea eax, [ebp - 0xe84]
push str.smss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea ecx, [ebp - 0xe84]
push str.winlogon.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea edx, [ebp - 0xe84]
push str.csrss.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea eax, [ebp - 0xe84]
push str.services.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea ecx, [ebp - 0xe84]
push str.lsass.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea edx, [ebp - 0xe84]
push str.svchost.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea eax, [ebp - 0xe84]
push str.taskmgr.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea ecx, [ebp - 0xe84]
push str.spoolsv.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea edx, [ebp - 0xe84]
push 0x48ba7c
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea eax, [ebp - 0xe84]
push str.userinit.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea ecx, [ebp - 0xe84]
push str.ctfmon.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea edx, [ebp - 0xe84]
push str.cmd.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea eax, [ebp - 0xe84]
push str.logo1_.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea ecx, [ebp - 0xe84]
push str.net.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4739ea
lea edx, [ebp - 0xe84]
push str.rundll
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4739ea
lea eax, [ebp - 0xe84]
push str.Rundll
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4739ea
lea ecx, [ebp - 0xe84]
push str.RUNDLL
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4739ea
lea edx, [ebp - 0xe84]
push str.svchost
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4739ea
lea eax, [ebp - 0xe84]
push str.SVCHOST
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x473a93
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.00429e70
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
lea edx, [ebp - 0x5f4]
push edx
call esi
lea eax, [ebp - 0x5f4]
push eax
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x473a66
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.004299c0
add esp, 4
lea edx, [ebp - 0x5f4]
push edx
call esi
test eax, eax
jne 0x473a66
lea eax, [ebp - 0x5f4]
push eax
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x473a66
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x4f4]
mov edi, 0x4a10ac
jmp 0x473a71
lea edx, [ebp - 0x4f4]
mov edi, 0x4a1064
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp fcn.004778b7
lea edx, [ebp - 0xe84]
push str.iexplore.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x473b63
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x473b63
lea eax, [ebp - 0x5f4]
push eax
call fcn.00429e70
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
lea ecx, [ebp - 0x5f4]
push ecx
call esi
lea edx, [ebp - 0x5f4]
push edx
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x473b36
lea eax, [ebp - 0x5f4]
push eax
call fcn.004299c0
add esp, 4
lea ecx, [ebp - 0x5f4]
push ecx
call esi
test eax, eax
jne 0x473b36
lea edx, [ebp - 0x5f4]
push edx
call fcn.00429f20
add esp, 4
cmp eax, edi
jne 0x473b36
lea eax, [ebp - 0x5f4]
push eax
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x4f4]
mov edi, 0x4a1010
jmp 0x473b41
lea edx, [ebp - 0x4f4]
mov edi, 0x4a0fbc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp fcn.004778b7
lea edi, [ebp - 0x2f4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x20]
not ecx
dec ecx
cmp eax, 3
jle 0x473bce
mov esi, dword [ebp - 0x84]
cmp esi, 0xc800
jle 0x473bdb
mov eax, dword [ebp - 0xa0]
test eax, eax
jne 0x473bdb
test ebx, ebx
jne 0x473bdb
mov ebx, 1
cmp ecx, ebx
je 0x473be0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x473be0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x473be0
lea edx, [ebp - 0x2f4]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x84]
mov ebx, 1
jmp 0x473be0
mov ebx, 1
lea edi, [ebp - 0xe84]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x6309b0
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0xec], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x50], edx
mov dword [ebp + 8], edx
mov dword [ebp - 0x100], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0x164], edx
call fcn.00404650
add esp, 4
lea eax, [ebp - 0x8f4]
push 0x6309b0
push eax
call fcn.004045b0
xor edi, edi
add esp, 8
cmp eax, edi
jne 0x473cab
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x8f4]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], ebx
jmp 0x474916
mov edx, dword [0x6309b8]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x1f4], eax
mov eax, dword [0x6309b8]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x168], eax
jne 0x473d90
cmp esi, 0x19000
jle 0x473d55
lea ecx, [ebp + 8]
lea edx, [ebp - 0x14bc]
push ecx
lea eax, [ebp - 0xe84]
push edx
lea ecx, [ebp - 0x1084]
push eax
push ecx
mov dword [ebp + 8], edi
call fcn.004557c0
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, esi
jge 0x473d16
mov dword [ebp + 8], esi
lea edx, [ebp - 0x14bc]
push 0x4a0fb8
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x473d55
cmp dword [ebp + 8], 0x32000
jle 0x473d55
push 0x4a0fa8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], 2
mov edx, dword [0x6309b8]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004046d0
add esp, 4
mov dword [ebp - 0x1a4], eax
test eax, eax
jne 0x474772
mov dword [ebp + 8], 6
jmp 0x47490a
mov dword [ebp - 0x16c], edi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x473d5c
mov eax, dword [eax + 0xc]
mov ecx, dword [0x6309b8]
mov edx, dword [ebp - 0x1f4]
push eax
push ecx
push edx
call fcn.00404730
mov ecx, dword [ebp - 0x38]
add esp, 0xc
mov esi, eax
inc ecx
push 0x49b730
push esi
mov dword [ebp - 0x38], ecx
call fcn.0047fde0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push esi
mov dword [ebp - 0x1e4], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push esi
mov dword [ebp - 0x1ec], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.mfc71.dll
inc eax
push esi
mov dword [ebp - 0x1f0], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.comdlg32.dll
inc eax
push esi
mov dword [ebp - 0x1d8], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.comctl32.dll
inc eax
push esi
mov dword [ebp - 0x1cc], eax
call fcn.0047fde0
neg eax
sbb eax, eax
push str.wtsapi32.dll
inc eax
push esi
mov dword [ebp - 0x1e0], eax
call fcn.0047fde0
add esp, 0x38
mov ebx, 1
test eax, eax
jne 0x473e61
mov dword [ebp - 0xb8], ebx
push str.rasapi32.dll
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x473e79
mov dword [ebp - 0x160], ebx
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x17c]
inc ecx
test eax, eax
mov dword [ebp - 0x100], ecx
jne 0x473ece
lea eax, [ebp - 0x1084]
push esi
push eax
lea ecx, [ebp - 0x12bc]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x12bc]
push edx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x473ece
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
inc edx
add ecx, eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x34], ebx
jne 0x473f11
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x473f11
cmp dword [ebp - 0x1c], 2
jle 0x473f5a
lea eax, [ebp - 0x1084]
push esi
push eax
lea ecx, [ebp - 0xc64]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xc64]
push edx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x473f5a
jmp 0x473f4b
cmp dword [ebp - 0x24], ebx
jne 0x473f5a
cmp dword [ebp - 0x1c], 3
jle 0x473f5a
lea eax, [ebp - 0x1084]
push esi
push eax
lea ecx, [ebp - 0xa2c]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xa2c]
push edx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x473f5a
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
inc edx
add ecx, eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], ecx
xor edi, edi
cmp edi, 0x66
jge 0x47400c
lea eax, [edi + edi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push esi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x474006
cmp edi, 0xf
jle 0x473f92
cmp edi, 0x12
jge 0x473f92
mov dword [ebp - 0xfc], ebx
cmp edi, 0x1d
je 0x473fa1
cmp edi, 0x1e
je 0x473fa1
cmp edi, 0x39
jne 0x473fa7
mov dword [ebp - 0xe8], ebx
cmp edi, 0x1f
je 0x473fb1
cmp edi, 0x20
jne 0x473fb7
mov dword [ebp - 0xc0], ebx
cmp edi, 0x21
je 0x473fc1
cmp edi, 0x22
jne 0x473fc7
mov dword [ebp - 0xf8], ebx
cmp edi, 0x23
je 0x473fd1
cmp edi, 0x24
jne 0x473fd7
mov dword [ebp - 0xd8], ebx
cmp edi, 0x2c
jne 0x473fe8
mov dword [ebp - 0xf0], ebx
inc edi
jmp 0x473f5c
cmp edi, 0x2d
je 0x474003
cmp edi, 0x2e
jne 0x473ffe
mov dword [ebp - 0xe0], ebx
inc edi
jmp 0x473f5c
cmp edi, 0x3d
jne 0x474006
mov dword [ebp - 0x5c], ebx
inc edi
jmp 0x473f5c
mov ecx, dword [0x6309b8]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0x1bc], 0
call fcn.004046b0
mov edx, dword [0x6309b8]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x1a4], esi
call fcn.004047a0
mov ecx, dword [ebp - 0x16c]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x474055
mov eax, dword [ecx + 0x10]
mov edx, dword [0x6309b8]
push eax
push edx
push esi
mov dword [ebp - 0x54], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x473d5c
mov eax, dword [eax]
test eax, eax
je 0x474719
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x4740df
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc84]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x143c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x143c]
jmp 0x47415f
mov ecx, dword [0x6309b8]
push eax
push ecx
push esi
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x474116
xor edx, edx
lea eax, [ebp - 0xc84]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x47415f
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc84]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x141c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x141c]
push str.SetupCopyOEMInf
push ebx
call fcn.0047bec0
add esp, 8
mov edi, 1
test eax, eax
je 0x47417c
mov dword [ebp - 0x128], edi
push 0x4a0f64
push ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x474194
mov dword [ebp - 0x84], edi
xor esi, esi
cmp esi, 0x66
jge 0x474656
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x474650
cmp esi, 0x45
jne 0x47428a
lea edx, [ebp - 0x14bc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x14bc]
lea ecx, [ebp - 0x6f4]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x6f4]
push edx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x47424f
lea eax, [ebp - 0x2f4]
lea ecx, [ebp - 0xc2c]
push eax
push 0x49b6c8
push ecx
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2f4]
lea eax, [ebp - 0xc2c]
push edx
push 0x49b698
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x474297
mov dword [ebp - 0x74], edi
inc esi
jmp 0x474196
cmp esi, edi
jne 0x4742a7
mov dword [ebp - 0xac], edi
inc esi
jmp 0x474196
cmp esi, 2
je 0x474650
cmp esi, 4
jne 0x4742c1
mov dword [ebp - 0x190], edi
inc esi
jmp 0x474196
cmp esi, 5
jne 0x4742d2
mov dword [ebp - 0x170], edi
inc esi
jmp 0x474196
cmp esi, 6
jne 0x4742e3
mov dword [ebp - 0x1a0], edi
inc esi
jmp 0x474196
cmp esi, 7
jne 0x4742f4
mov dword [ebp - 0x178], edi
inc esi
jmp 0x474196
cmp esi, 8
jne 0x474305
mov dword [ebp - 0x130], edi
inc esi
jmp 0x474196
cmp esi, 9
jne 0x474316
mov dword [ebp - 0x158], edi
inc esi
jmp 0x474196
cmp esi, 0xa
jne 0x474327
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x474196
cmp esi, 0xb
jne 0x474338
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x474196
jle 0x474345
cmp esi, 0xf
jge 0x474348
mov dword [ebp - 0xc4], edi
cmp esi, 0xf
jne 0x474356
mov dword [ebp - 0x134], edi
inc esi
jmp 0x474196
jle 0x474363
cmp esi, 0x12
jge 0x474363
mov dword [ebp - 0xfc], edi
cmp esi, 0x1b
jne 0x474374
mov dword [ebp - 0x138], edi
inc esi
jmp 0x474196
cmp esi, 0x1c
jne 0x474385
mov dword [ebp - 0x94], edi
inc esi
jmp 0x474196
cmp esi, 0x1d
je 0x474394
cmp esi, 0x1e
je 0x474394
cmp esi, 0x39
jne 0x47439a
mov dword [ebp - 0xe8], edi
cmp esi, 0x1f
je 0x4743a4
cmp esi, 0x20
jne 0x4743aa
mov dword [ebp - 0xc0], edi
cmp esi, 0x21
je 0x4743b4
cmp esi, 0x22
jne 0x4743ba
mov dword [ebp - 0xf8], edi
cmp esi, 0x23
je 0x4743c4
cmp esi, 0x24
jne 0x4743ca
mov dword [ebp - 0xd8], edi
cmp esi, 0x25
je 0x4743d4
cmp esi, 0x26
jne 0x4743da
mov dword [ebp - 0x148], edi
cmp esi, 0x27
jne 0x4743eb
mov dword [ebp - 0x140], edi
inc esi
jmp 0x474196
cmp esi, 0x28
jne 0x4743fc
mov dword [ebp - 0x150], edi
inc esi
jmp 0x474196
cmp esi, 0x29
jne 0x47440d
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x474196
cmp esi, 0x2c
jne 0x47441e
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x474196
cmp esi, 0x2d
jne 0x47442c
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x474196
cmp esi, 0x2e
jne 0x47443d
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x474196
cmp esi, 0x2f
jne 0x47444e
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x474196
cmp esi, 0x30
jne 0x47445f
mov dword [ebp - 0x114], edi
inc esi
jmp 0x474196
cmp esi, 0x31
jne 0x474470
mov dword [ebp - 0x11c], edi
inc esi
jmp 0x474196
cmp esi, 0x32
jne 0x474481
mov dword [ebp - 0x124], edi
inc esi
jmp 0x474196
cmp esi, 0x34
jne 0x474492
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x474196
cmp esi, 0x35
jne 0x4744a0
mov dword [ebp - 0x78], edi
inc esi
jmp 0x474196
cmp esi, 0x36
jne 0x4744b1
mov dword [ebp - 0x104], edi
inc esi
jmp 0x474196
cmp esi, 0x37
jne 0x4744c6
inc esi
jmp 0x474196
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1e4]
inc ecx
cmp eax, edi
mov dword [ebp - 0x50], ecx
jne 0x47466a
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x1ec], edi
jne 0x474678
inc dword [ebp - 0xec]
cmp dword [ebp - 0x1f0], edi
jne 0x474686
inc dword [ebp - 0x118]
cmp dword [ebp - 0x1d8], edi
jne 0x474694
inc dword [ebp - 0xe4]
cmp dword [ebp - 0x1cc], edi
jne 0x4746a2
inc dword [ebp - 0x194]
cmp dword [ebp - 0x1e0], edi
jne 0x4746b0
inc dword [ebp - 0x1ac]
cmp dword [ebp - 0x50], 0x4e20
jg 0x474719
mov esi, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x2c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x1bc], esi
mov esi, dword [ebp - 0x1a4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x2c], ecx
mov eax, ecx
jmp 0x474074
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x168], eax
jmp 0x473d96
mov eax, dword [0x6309b8]
push eax
call fcn.00404710
add esp, 4
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x54], ebx
mov ecx, dword [ebp - 0x1a4]
cmp bx, word [ecx + 2]
jae 0x47490a
xor edx, edx
push str..asp
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov byte [ebp - 0x88], dl
mov eax, dword [edi]
mov dword [ebp - 0x90], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x90]
mov dword [ebp - 0x8c], ecx
push edx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4747dc
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x90]
push str..upx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4747f7
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x90]
push str..upack
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x474812
mov dword [ebp - 0x44], esi
lea edx, [ebp - 0x90]
push str..Pecompact
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x47482d
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x90]
push str..aspack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x474848
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x90]
push str..fsg
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x474863
mov dword [ebp - 0x44], esi
lea edx, [ebp - 0x90]
push str.upx0
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x47487e
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x90]
push str.upx1
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x474899
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x90]
push 0x48b7ec
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4748b7
inc dword [ebp - 0x164]
mov esi, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x54]
inc esi
inc eax
cmp eax, 0x64
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0x54], eax
jg 0x47490a
add edi, 0x28
inc ebx
jmp 0x474787
mov dword [ebp - 4], 2
mov ebx, 1
mov edx, dword [0x6309b8]
push edx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x474954
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], 3
push 0x6309b0
call fcn.00404650
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, ebx
jne 0x474986
push 0x49b598
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xd4]
xor esi, esi
mov dword [ebp - 0x1c], edi
cmp eax, esi
jne 0x47530c
cmp edi, ebx
jge 0x47530c
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x38], esi
push ecx
call fcn.0047c0d3
jmp 0x4749cb
lea edx, [ebp - 0xe84]
push edx
call fcn.00483565
push eax
lea eax, [ebp - 0xc2c]
jmp loc.00663431