Function at 0x4a3e30
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbb4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1624
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x100], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x104], eax
lea edx, [ebp - 0x714]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xab4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x714]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x4a3fae
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x714]
cmp al, 0x5c
jne 0x4a3fce
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor edi, edi
cmp al, 0x25
mov dword [ebp + 8], esi
jne 0x4a3fde
mov edi, 1
lea eax, [ecx - 2]
test eax, eax
jle 0x4a400d
mov dl, byte [ebp + eax - 0x714]
cmp dl, 0x3a
jne 0x4a3ffb
cmp byte [ebp + eax - 0x713], 0x5c
je 0x4a400a
cmp edi, 1
jne 0x4a4005
cmp dl, 0x5c
je 0x4a4016
dec eax
test eax, eax
jg 0x4a3fe5
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x4a40c3
sub ecx, eax
xor esi, esi
lea edx, [ecx - 1]
test edx, edx
jle 0x4a4042
lea eax, [ebp + eax - 0x713]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xdb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0xdb4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + esi - 0xdb4], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x714]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x13b4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x714]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0x13b4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x714]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
jmp 0x4a410b
cmp eax, ecx
je 0x4a410b
test ecx, ecx
mov esi, ecx
jle 0x4a40dc
cmp byte [ebp + esi - 0x714], 0x2e
je 0x4a40dc
dec esi
test esi, esi
jg 0x4a40cd
mov edx, esi
xor ecx, ecx
sub edx, eax
mov byte [ebp - 0x714], 0
add edx, 5
test edx, edx
jle 0x4a4103
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x714], al
inc ecx
cmp ecx, edx
jl 0x4a40f4
mov byte [ebp + esi - 0x70f], 0
lea edi, [ebp - 0x714]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4a412e
cmp byte [ebp + ecx - 0x714], 0x2e
je 0x4a412e
dec ecx
test ecx, ecx
jg 0x4a411f
test esi, esi
mov byte [ebp + ecx - 0x710], 0
jne 0x4a4158
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x4a4226
lea ecx, [ebp - 0x194]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xb34]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x714]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x834]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x834]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a4204
lea edx, [ebp - 0x834]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a4204
lea eax, [ebp - 0x834]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a4204
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x194]
push ecx
jmp 0x4a4211
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0xb34]
push ecx
push edx
lea eax, [ebp - 0x714]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x8b4]
lea edx, [ebp - 0x714]
push ecx
push edx
call fcn.004d9590
movsx eax, ax
lea ecx, [ebp - 0x8b4]
push str.Microsoft
push ecx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x58], 0
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x4a4268
mov dword [ebp - 0x58], 1
lea edx, [ebp - 0x714]
push str.CCManager
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a429e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x714]
push str.WinRAR
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a42d4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4324
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x714]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4374
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._swsock32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x714]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a43c4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._sws2_32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4414
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x714]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4464
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._sNETUI1.DLl
push ecx
call fcn.004f175f
lea edx, [ebp - 0x714]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a44b4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4504
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x714]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4554
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x714]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a45a4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._surlmon.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a45f4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._smshtml.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x714]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4644
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x314]
push eax
push str._smfc42u.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x714]
lea eax, [ebp - 0x314]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4694
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x314]
push ecx
push str._smprapi.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x314]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a46e4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x314]
push edx
push str._sinetcomm.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x714]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4734
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x714]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4a4768
lea esi, [ebp + ecx - 0x714]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x12b4], dl
jne 0x4a4762
cmp eax, 2
jge 0x4a4768
inc eax
dec esi
cmp eax, ecx
jl 0x4a474f
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x4a478a
mov ebx, ecx
lea esi, [ebp - 0x714]
lea edi, [ebp - 0xfb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xfb4], 0
test eax, eax
jle 0x4a47bd
lea esi, [ebp + edx - 0x713]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x4a47b0
mov byte [ebp + ecx - 0x12b4], dl
jne 0x4a47b8
mov byte [ebp + ecx - 0x12b4], 0
inc ecx
cmp ecx, eax
jl 0x4a479f
mov byte [ebp + eax - 0x12b4], 0
mov al, byte [ebp - 0xfb2]
cmp al, 0x5c
je 0x4a47dd
mov byte [ebp - 0xfb2], 0x5c
mov byte [ebp - 0xfb1], 0
cmp byte [ebp - 0xfb3], 0x3a
je 0x4a489d
lea edi, [ebp - 0xfb4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x4a4810
cmp byte [ebp + eax - 0xfb4], 0x3a
je 0x4a4810
inc eax
cmp eax, ecx
jl 0x4a4801
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x4a483b
mov ecx, edi
lea esi, [ebp + eax - 0xfb5]
mov ebx, ecx
lea edi, [ebp - 0x10b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x10b3], 0
jne 0x4a4874
lea eax, [ebp - 0xb34]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xb34]
lea edx, [ebp - 0x10b4]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x10b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xfb2], 0x5c
je 0x4a48ad
mov byte [ebp - 0xfb2], 0x5c
lea ecx, [ebp - 0x714]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
je 0x4a48df
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfb3], 0x3a
je 0x4a4906
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfb2], 0x5c
je 0x4a4916
mov byte [ebp - 0xfb2], 0x5c
lea edi, [ebp - 0x12b4]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4a4944
cmp byte [ebp + eax - 0x12b4], 0x2e
jne 0x4a493b
mov edx, 1
inc eax
cmp eax, ecx
jl 0x4a492c
test edx, edx
jne 0x4a4962
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x12b0], 0
jge 0x4a498d
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
push 0x80
push edx
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xab4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x714]
push 0x100
lea edx, [ebp - 0x9b4]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x12b4]
push 0x40
lea ecx, [ebp - 0x9f4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x714]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x4a4a23
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x714]
push 0x80
lea ecx, [ebp - 0xbb4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x714]
push 0x80
lea eax, [ebp - 0xc34]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0xab4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x214]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xbb4], al
lea edx, [ebp - 0xbb4]
mov byte [ebp + ecx - 0xc34], al
lea ecx, [ebp - 0xab4]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
mov ebx, 1
test eax, eax
jne 0x4a4ad3
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4ad3
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xc34]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4b20
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4b20
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x714]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a4b6b
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4b6b
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x714]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a4bb6
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4bb6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x714]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a4c01
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4c01
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xfb4]
push 0x20
lea eax, [ebp - 0xcb4]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xcb4]
push str.c:endp
push ecx
mov byte [ebp - 0xcad], 0
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4a4c53
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x12b4]
push str.cmd.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a4c89
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xfb4]
push eax
call fcn.004cc430
add esp, 4
cmp eax, ebx
mov dword [ebp - 0x110], eax
jne 0x4a4d40
lea ecx, [ebp - 0x9b4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x9b4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4a4cf8
lea eax, [ebp - 0x9b4]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x4a4cf8
lea ecx, [ebp - 0x9b4]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x514]
mov edi, 0x526f28
jmp 0x4a4d03
lea edx, [ebp - 0x514]
mov edi, 0x526ef4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x514]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
push 0xd53b20
mov dword [ebp - 4], edi
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0x40], edi
mov dword [ebp + 8], edi
mov dword [ebp - 0xc0], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x714]
push 0xd53b20
push edx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x4a4db5
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x714]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x4a5618
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 1
push edx
call fcn.004a6bb0
add esp, 4
mov dword [ebp - 0x10c], eax
mov eax, dword [0xd53b28]
push eax
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xec], eax
jne 0x4a4e45
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd53b28]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0xfc], esi
jne 0x4a54f2
mov dword [ebp + 8], 6
jmp 0x4a5606
mov dword [ebp - 0x80], edi
cmp dword [eax + 0x10], edi
je 0x4a4e11
mov ecx, dword [eax + 0xc]
mov edx, dword [0xd53b28]
mov eax, dword [ebp - 0x10c]
push ecx
push edx
push eax
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xc0]
inc eax
xor esi, esi
mov dword [ebp - 0xc0], eax
cmp esi, 0x69
jge 0x4a4f32
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a4f2c
cmp esi, 0xf
jle 0x4a4ecd
cmp esi, 0x12
jge 0x4a4ecd
mov dword [ebp - 0x60], ebx
cmp esi, 0x1d
je 0x4a4edc
cmp esi, 0x1e
je 0x4a4edc
cmp esi, 0x39
jne 0x4a4edf
mov dword [ebp - 0x4c], ebx
cmp esi, 0x1f
je 0x4a4ee9
cmp esi, 0x20
jne 0x4a4eec
mov dword [ebp - 0x5c], ebx
cmp esi, 0x21
je 0x4a4ef6
cmp esi, 0x22
jne 0x4a4ef9
mov dword [ebp - 0x54], ebx
cmp esi, 0x23
je 0x4a4f03
cmp esi, 0x24
jne 0x4a4f06
mov dword [ebp - 0x44], ebx
cmp esi, 0x2c
jne 0x4a4f11
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x4a4e9d
cmp esi, 0x2d
je 0x4a4f29
cmp esi, 0x2e
jne 0x4a4f24
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x4a4e9d
cmp esi, 0x3d
jne 0x4a4f2c
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4a4e9d
mov edx, dword [0xd53b28]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0x78], 0
call fcn.004a6bb0
add esp, 4
mov esi, eax
mov eax, dword [0xd53b28]
mov dword [ebp - 0x114], esi
push eax
call fcn.004a6ca0
mov ecx, dword [ebp - 0x80]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x4a4f74
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd53b28]
push eax
push edx
push esi
mov dword [ebp - 0x24], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4a4e11
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4a543d
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x4a5005
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xa34]
jmp 0x4a5089
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0x114]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4a5044
xor ecx, ecx
lea edx, [ebp - 0x734]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x94], esi
jmp 0x4a5094
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xa14]
mov dword [ebp - 0x94], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x4a53fa
mov eax, dword [ebp - 0x94]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a53f4
cmp esi, 0x45
jne 0x4a516a
lea ecx, [ebp - 0xb34]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0xb34]
lea eax, [ebp - 0x194]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x194]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x4a512f
lea edx, [ebp - 0x8b4]
lea eax, [ebp - 0xdb4]
push edx
push 0x5153f4
push eax
jmp 0x4a5142
lea ecx, [ebp - 0x8b4]
lea edx, [ebp - 0xdb4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xdb4]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x4a5177
mov dword [ebp - 0x34], edi
inc esi
jmp 0x4a5096
cmp esi, edi
jne 0x4a5184
mov dword [ebp - 0x38], edi
inc esi
jmp 0x4a5096
cmp esi, 2
je 0x4a53f4
cmp esi, 4
jne 0x4a519e
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x4a5096
cmp esi, 5
jne 0x4a51af
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x4a5096
cmp esi, 6
jne 0x4a51c0
mov dword [ebp - 0x90], edi
inc esi
jmp 0x4a5096
cmp esi, 7
jne 0x4a51d1
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x4a5096
cmp esi, 8
jne 0x4a51e2
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x4a5096
cmp esi, 9
jne 0x4a51f3
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x4a5096
cmp esi, 0xa
jne 0x4a5204
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x4a5096
cmp esi, 0xb
jne 0x4a5215
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x4a5096
jle 0x4a521f
cmp esi, 0xf
jge 0x4a5222
mov dword [ebp - 0x30], edi
cmp esi, 0xf
jne 0x4a5230
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x4a5096
jle 0x4a523a
cmp esi, 0x12
jge 0x4a523a
mov dword [ebp - 0x60], edi
cmp esi, 0x1b
jne 0x4a524b
mov dword [ebp - 0x98], edi
inc esi
jmp 0x4a5096
cmp esi, 0x1c
jne 0x4a525c
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x4a5096
cmp esi, 0x1d
je 0x4a526b
cmp esi, 0x1e
je 0x4a526b
cmp esi, 0x39
jne 0x4a526e
mov dword [ebp - 0x4c], edi
cmp esi, 0x1f
je 0x4a5278
cmp esi, 0x20
jne 0x4a527b
mov dword [ebp - 0x5c], edi
cmp esi, 0x21
je 0x4a5285
cmp esi, 0x22
jne 0x4a5288
mov dword [ebp - 0x54], edi
cmp esi, 0x23
je 0x4a5292
cmp esi, 0x24
jne 0x4a5295
mov dword [ebp - 0x44], edi
cmp esi, 0x25
je 0x4a529f
cmp esi, 0x26
jne 0x4a52a5
mov dword [ebp - 0xa8], edi
cmp esi, 0x27
jne 0x4a52b6
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x4a5096
cmp esi, 0x28
jne 0x4a52c7
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x4a5096
cmp esi, 0x29
jne 0x4a52d8
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x4a5096
cmp esi, 0x2c
jne 0x4a52e6
mov dword [ebp - 0x48], edi
inc esi
jmp 0x4a5096
cmp esi, 0x2d
jne 0x4a52f4
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4a5096
cmp esi, 0x2e
jne 0x4a5302
mov dword [ebp - 0x50], edi
inc esi
jmp 0x4a5096
cmp esi, 0x2f
jne 0x4a5310
mov dword [ebp - 0x74], edi
inc esi
jmp 0x4a5096
cmp esi, 0x30
jne 0x4a531e
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x4a5096
cmp esi, 0x31
jne 0x4a532f
mov dword [ebp - 0x84], edi
inc esi
jmp 0x4a5096
cmp esi, 0x32
jne 0x4a5340
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x4a5096
cmp esi, 0x34
jne 0x4a5351
mov dword [ebp - 0xac], edi
inc esi
jmp 0x4a5096
cmp esi, 0x35
jne 0x4a5362
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x4a5096
cmp esi, 0x36
jne 0x4a5373
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4a5096
cmp esi, 0x37
jne 0x4a5388
mov dword [ebp - 0xc4], 0
inc esi
jmp 0x4a5096
cmp esi, 0x38
jne 0x4a5399
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x4a5096
cmp esi, 0x3a
je 0x4a53a8
cmp esi, 0x3b
je 0x4a53a8
cmp esi, 0x3c
jne 0x4a53ae
mov dword [ebp - 0xd4], edi
cmp esi, 0x3d
jne 0x4a53bc
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4a5096
cmp esi, 0x3e
jne 0x4a53cd
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x4a5096
cmp esi, 0x3f
jne 0x4a53db
mov dword [ebp - 0x64], edi
inc esi
jmp 0x4a5096
cmp esi, 0x40
jne 0x4a53e9
mov dword [ebp - 0x38], edi
inc esi
jmp 0x4a5096
cmp esi, 0x41
jne 0x4a53f4
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x4a5096
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xfc]
inc ecx
cmp eax, edi
mov dword [ebp - 0x40], ecx
jne 0x4a5411
inc dword [ebp - 0xf4]
cmp dword [ebp - 0x40], 0x2710
jg 0x4a543d
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x4a4f9e
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x78]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0xec]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0xec], eax
xor edi, edi
jmp 0x4a4e48
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], ebx
cmp bx, word [esi + 2]
jae 0x4a5606
xor ecx, ecx
push str..asp
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 0x68], cl
mov edx, dword [edi]
mov dword [ebp - 0x70], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4a5542
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x70]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a555a
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x70]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a5572
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x70]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a558a
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x70]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a55a2
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x70]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a55ba
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x24], eax
jg 0x4a5606
mov esi, dword [ebp - 0xfc]
add edi, 0x28
inc ebx
jmp 0x4a5505
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x4a5654
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x4a5683
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xf4]
test eax, eax
mov dword [ebp + 8], edi
mov dword [ebp - 0x18], edx
jne 0x4a5dcb
cmp edi, ebx
jge 0x4a5dcb
lea eax, [ebp - 0xfb4]
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.004f2beb
jmp 0x4a56c8
lea ecx, [ebp - 0x12b4]
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0xdb4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x4a56f9
push ebx
lea ecx, [ebp - 0x15c]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x4a5723
lea eax, [ebp - 0xdb4]
push eax
call fcn.004f2ce2
add esp, 4
jmp 0x4a5737
lea ecx, [ebp - 0x9b4]
push str.c:endpcachemonitor_procPath2.txt
push ecx
call fcn.00403af0
add esp, 8
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x15c]
push edx
push ebx
push str.c:endpcachemonitor_procPath2.txt
mov dword [ebp - 0x24], esi
call fcn.004f0727
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x158]
cmp dword [eax + 0x30], 0xffffffff
jne 0x4a5784
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x4a5958
mov esi, dword [ebp - 0x158]
push 0xa
lea edx, [ebp - 0x834]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x158], esi
call fcn.004f0ae9
lea edi, [ebp - 0x834]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x4a5d5d
lea eax, [ebp - 0x834]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a5d5d
lea ecx, [ebp - 0x834]
push str.Dump_of
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a5d5d
lea edx, [ebp - 0x834]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a5d5d
lea eax, [ebp - 0x834]
push str.Summary
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a5835
mov dword [ebp - 0x104], ebx
lea ecx, [ebp - 0x834]
push str.Dump_of_file
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4a5d5d
lea edx, [ebp - 0x834]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4a5873
push 0x5147b4
jmp 0x4a5950
cmp dword [ebp - 0x3c], ebx
jne 0x4a587b
inc dword [ebp + 8]
cmp dword [ebp - 0x14], ebx
jne 0x4a5883
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x4a5d5a
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x834]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x4a5d54
mov ecx, dword [ebp - 0x100]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x100], ecx
jne 0x4a5987
lea edx, [ebp - 0xb34]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xb34]
lea ecx, [ebp - 0x1434]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1434]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x4a592e
lea edx, [ebp - 0x8b4]
lea eax, [ebp - 0x13b4]
push edx
push 0x5153f4
push eax
jmp 0x4a5941
lea ecx, [ebp - 0x8b4]
lea edx, [ebp - 0x13b4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x13b4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x148]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x4a5a07
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x4a59a7
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x834]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x834]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x834]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4a5a7f
test ebx, ebx
jne 0x4a5a7f
test eax, eax
jne 0x4a5a7f
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4a5887
cmp esi, 0x1a
jne 0x4a5a93
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], edx
jle 0x4a5a2b
sub ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x834]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x834]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x834]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4a5a7f
test ebx, ebx
jne 0x4a5a7f
test eax, eax
jne 0x4a5a7f
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x4a5887
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x4a5887
cmp esi, 0x2a
jne 0x4a5aaa
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4a5887
cmp esi, 0x2b
jne 0x4a5ac1
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x4a5887
cmp esi, edi
jne 0x4a5ace
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x4a5887
cmp esi, ebx
jne 0x4a5adb
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x4a5887
cmp esi, 2
je 0x4a5d54
cmp esi, 4
jne 0x4a5af5
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x4a5887
cmp esi, 5
jne 0x4a5b06
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x4a5887
cmp esi, 6
jne 0x4a5b17
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x4a5887
cmp esi, 7
jne 0x4a5b28
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x4a5887
cmp esi, 8
jne 0x4a5b39
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x4a5887
cmp esi, 9
jne 0x4a5b4a
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x4a5887
cmp esi, 0xa
jne 0x4a5b5b
mov dword [ebp - 0xe4], ebx
inc esi
jmp 0x4a5887
cmp esi, 0xb
jne 0x4a5b6c
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x4a5887
jle 0x4a5b76
cmp esi, 0xf
jge 0x4a5b79
mov dword [ebp - 0x30], ebx
cmp esi, 0xf
jne 0x4a5b87
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x4a5887
jle 0x4a5b91
cmp esi, 0x12
jge 0x4a5b91
mov dword [ebp - 0x60], ebx
cmp esi, 0x11
jle 0x4a5b9e
cmp esi, 0x19
jge 0x4a5b9e
mov dword [ebp - 0x20], ebx
cmp esi, 0x1b
jne 0x4a5baf
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x1c
jne 0x4a5bc0
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x1d
je 0x4a5bcf
cmp esi, 0x1e
je 0x4a5bcf
cmp esi, 0x39
jne 0x4a5bd2
mov dword [ebp - 0x4c], ebx
cmp esi, 0x1f
je 0x4a5bdc
cmp esi, 0x20
jne 0x4a5bdf
mov dword [ebp - 0x5c], ebx
cmp esi, 0x21
je 0x4a5be9
cmp esi, 0x22
jne 0x4a5bec
mov dword [ebp - 0x54], ebx
cmp esi, 0x23
je 0x4a5bf6
cmp esi, 0x24
jne 0x4a5bf9
mov dword [ebp - 0x44], ebx
cmp esi, 0x25
je 0x4a5c03
cmp esi, 0x26
jne 0x4a5c09
mov dword [ebp - 0xa8], ebx
cmp esi, 0x27
jne 0x4a5c1a
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x28
jne 0x4a5c2b
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x29
jne 0x4a5c3c
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x2c
jne 0x4a5c4a
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x2d
jne 0x4a5c58
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x2e
jne 0x4a5c66
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x2f
jne 0x4a5c74
mov dword [ebp - 0x74], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x30
jne 0x4a5c82
mov dword [ebp - 0x7c], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x31
jne 0x4a5c93
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x32
jne 0x4a5ca4
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x34
jne 0x4a5cb5
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x35
jne 0x4a5cc6
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x36
jne 0x4a5cd7
mov dword [ebp - 0xbc], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x37
jne 0x4a5ce8
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x4a5887
cmp esi, 0x38
jne 0x4a5cf9
mov dword [ebp - 0xcc], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x3a
je 0x4a5d08
cmp esi, 0x3b
je 0x4a5d08
cmp esi, 0x3c
jne 0x4a5d0e
mov dword [ebp - 0xd4], ebx
cmp esi, 0x3d
jne 0x4a5d1c
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x3e
jne 0x4a5d2d
mov dword [ebp - 0xdc], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x3f
jne 0x4a5d3b
mov dword [ebp - 0x64], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x40
jne 0x4a5d49
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x4a5887
cmp esi, 0x41
jne 0x4a5d54
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x4a5887
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x154], 1
je 0x4a5784
lea ecx, [ebp - 0x15c]
call fcn.004f076e
mov eax, dword [ebp + 8]
mov ecx, 5
cmp eax, ecx
jle 0x4a5d90
sub eax, ecx
mov dword [ebp + 8], eax
mov edx, dword [ebp - 0x18]
cmp edx, ecx
jle 0x4a5d9c
sub edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x88]
test ecx, ecx
jne 0x4a5db1
cmp eax, 6
jle 0x4a5db1
sub eax, 6
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 0x514], 0
cmp eax, ebx
jne 0x4a5df2
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x90]
xor ebx, ebx
cmp eax, 1
mov dword [ebp - 0x14], ebx
jne 0x4a5e32
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x4a5e73
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 0x14], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc8]
mov eax, 1
cmp ecx, eax
jne 0x4a5eb7
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x4a5ef2
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], eax
jne 0x4a5f30
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
je 0x4a5f40
cmp dword [ebp - 0xa0], eax
jne 0x4a5f75
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], eax
jne 0x4a5fb3
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
jne 0x4a5ff0
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], eax
jne 0x4a602e
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x4a6069
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x4a60ae
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x4a60ec
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x4a612a
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], eax
jne 0x4a6167
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
jne 0x4a6200
cmp dword [ebp - 0x7c], eax
je 0x4a618a
cmp dword [ebp - 0x84], eax
je 0x4a618a
lea edx, [ebp - 0x514]
mov edi, 0x515278
jmp 0x4a61d5
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x8c]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x514]
mov edi, 0x515258
je 0x4a61d5
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], eax
jne 0x4a623b
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x9c], eax
jne 0x4a6279
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], eax
jne 0x4a62b4
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x4a6330
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x58]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, ecx
jne 0x4a6335
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x4a6335
mov ecx, 1
cmp dword [ebp - 0xa4], ecx
jne 0x4a63ed
cmp dword [ebp - 0xac], ecx
jne 0x4a63ed
cmp dword [ebp - 0xb4], ecx
jne 0x4a63ed
cmp dword [ebp - 0xbc], ecx
jne 0x4a63a3
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x514]
cmp eax, ecx
mov edi, 0x5151ec
je 0x4a6378
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xc4], ecx
jne 0x4a63ed
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x514]
cmp eax, ecx
mov edi, 0x5151c4
je 0x4a63c2
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xcc], ecx
jne 0x4a642a
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x4c], ecx
jne 0x4a6465
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x5c], ecx
jne 0x4a64a0
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x54], ecx
jne 0x4a64db
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x44], ecx
jne 0x4a6516
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4a655d
mov eax, dword [ebp - 0x104]
test eax, eax
jne 0x4a655d
mov edi, 0x516ba4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x48], ecx
jne 0x4a6598
mov edi, str.PING
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x28], ecx
jne 0x4a65d3
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x50], ecx
jne 0x4a660e
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd4], ecx
jne 0x4a664c
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xdc], ecx
jne 0x4a6689
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x4a6697
mov eax, 4
jmp 0x4a669a
lea eax, [eax + eax*2]
cmp dword [ebp + 8], eax
jge 0x4a66d8
mov edi, 0x516b88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x4a671d
cmp dword [ebp - 0x1c], ecx
jne 0x4a671d
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xe4], ecx
jne 0x4a6767
cmp eax, 5
jge 0x4a6767
test eax, eax
jle 0x4a6767
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x514]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x108]
cmp eax, 7
jge 0x4a6854
cmp dword [ebp - 0x2c], ecx
jne 0x4a6802
cmp eax, ecx
lea edx, [ebp - 0x514]
jge 0x4a67c7
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x4a684d
mov dword [ebp - 0x14], 1
jmp 0x4a684d
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
je 0x4a684a
cmp dword [ebp - 0x58], eax
jne 0x4a684d
jmp 0x4a684a
cmp eax, ecx
lea edx, [ebp - 0x514]
mov edi, 0x515078
jl 0x4a6816
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], eax
je 0x4a684a
cmp dword [ebp - 0x58], eax
jne 0x4a684d
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x108]
inc ebx
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x4a688a
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a688a
cmp eax, 6
jle 0x4a688a
cmp ebx, 3
jge 0x4a688a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x4a68c0
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov edi, 1
test eax, eax
je 0x4a6912
cmp dword [ebp - 0x34], edi
je 0x4a6912
cmp dword [ebp - 0x14], edi
je 0x4a6912
cmp ebx, edi
jle 0x4a68a2
lea eax, [ebp - 0x514]
lea ecx, [ebp - 0x1634]
push eax
push 0x5229f4
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1634]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x110], edi
je 0x4a6952
lea eax, [ebp - 0x514]
lea ecx, [ebp - 0x1634]
push eax
push 0x514fd8
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1634]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x9b4]
push 0xdb198c
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4a698c
lea ecx, [ebp - 0x9b4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x4a698c
lea edx, [ebp - 0x9b4]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x9b4]
push eax
call esi
lea ecx, [ebp - 0x9b4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x4a69fc
lea edx, [ebp - 0x9b4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x9b4]
push eax
call esi
test eax, eax
jne 0x4a69fc
lea ecx, [ebp - 0x9b4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, edi
jne 0x4a69fc
lea edx, [ebp - 0x9b4]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x514]
mov edi, 0x526ed0
jmp 0x4a6a07
lea edx, [ebp - 0x514]
mov edi, 0x526e90
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0x9b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x514]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret