Function at 0x465ff0
Capabilities:
Check os version
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483fdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x17ec
call fcn.0047bda0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], esp
push ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], eax
call fcn.0046d730
add esp, 4
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x568]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xb68]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x568]
lea eax, [ebp - 0x157c]
push edx
push str._sdrivers_tcpip.sys
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x568]
lea edx, [ebp - 0x147c]
push ecx
push str._sdriversipsec.sys
push edx
call fcn.0047a8f8
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0xcf8]
mov dword [ebp - 0xcfc], 0x94
add esp, 0x18
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcfc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x466155
mov eax, 0x49f164
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x137c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x9a8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [ebx + 1]
and ecx, 3
cmp al, 0x3a
rep movsb byte es:[edi], byte [esi]
je 0x4664ed
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x9a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x466209
mov edx, ecx
sub edx, eax
mov dl, byte [ebp + edx - 0x9a8]
cmp dl, 0x5c
mov byte [ebp + eax - 0xefc], dl
jne 0x466206
cmp eax, 2
jge 0x466209
inc eax
jmp 0x4661e6
sub ecx, eax
mov edi, ecx
mov cl, byte [ebp - 0x9a8]
cmp cl, 0x22
jne 0x46623c
xor edx, edx
lea ecx, [edi - 1]
cmp edx, ecx
jge 0x466232
mov cl, byte [ebp + edx - 0x9a7]
mov byte [ebp + edx - 0x7a8], cl
inc edx
jmp 0x46621a
mov byte [ebp + edi - 0x7a9], 0
jmp 0x46625b
xor edx, edx
cmp edx, edi
jge 0x466253
mov cl, byte [ebp + edx - 0x9a8]
mov byte [ebp + edx - 0x7a8], cl
inc edx
jmp 0x46623e
mov byte [ebp + edi - 0x7a8], 0
xor esi, esi
cmp esi, eax
jge 0x466284
lea edx, [esi + edi]
mov dl, byte [ebp + edx - 0x9a7]
cmp dl, 0x5c
je 0x466279
mov byte [ebp + esi - 0xefc], dl
jne 0x466281
mov byte [ebp + esi - 0xefc], 0
inc esi
jmp 0x46625d
mov byte [ebp + eax - 0xefc], 0
lea edi, [ebp - 0xefc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xefd]
mov cl, byte [ebp + ecx - 0xefd]
cmp cl, 0x22
jne 0x4662b2
mov byte [eax], 0
lea edi, [ebp - 0x7a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp eax, esi
jge 0x4662d5
cmp byte [ebp + eax - 0x7a8], 0x3a
je 0x4662d5
inc eax
jmp 0x4662c4
xor edx, edx
mov ecx, esi
sub ecx, eax
inc ecx
cmp edx, ecx
jge 0x4662f4
lea ecx, [edx + eax]
inc edx
mov cl, byte [ebp + ecx - 0x7a9]
mov byte [ebp + edx - 0xac9], cl
jmp 0x4662d7
mov edx, esi
sub edx, eax
cmp eax, esi
mov byte [ebp + edx - 0xac7], 0
jne 0x466335
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x148]
push 0x80
push eax
call esi
lea ecx, [ebp - 0x148]
lea edx, [ebp - 0xac8]
push ecx
push str._s_system32drivers
push edx
call fcn.0047a8f8
add esp, 0xc
jmp 0x46633b
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x7a8]
push str.SystemRoot
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46637c
lea ecx, [ebp - 0x148]
push 0x80
push ecx
call esi
lea edx, [ebp - 0x148]
lea eax, [ebp - 0xac8]
push edx
push str._s_system32drivers
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0x7a8]
push str.systemroot
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4663bd
lea edx, [ebp - 0x148]
push 0x80
push edx
call esi
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0xac8]
push eax
push str._s_system32drivers
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0x7a8]
push str.Systemroot
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4663fe
lea eax, [ebp - 0x148]
push 0x80
push eax
call esi
lea ecx, [ebp - 0x148]
lea edx, [ebp - 0xac8]
push ecx
push str._s_system32drivers
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x7a8]
push str.System32
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466457
lea ecx, [ebp - 0x7a8]
push str.rivers
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x466457
lea edx, [ebp - 0x148]
push 0x80
push edx
call esi
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0xac8]
push eax
push str._s_system32
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xefc]
push edx
call fcn.00483565
add esp, 4
push eax
lea eax, [ebp - 0xac8]
push eax
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0x137c]
push eax
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edi, [ebp - 0x137c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x9a8]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.procpath::
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x137c]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x9a8]
push edx
push eax
call fcn.004290e0
movsx esi, ax
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 0x1c], esi
push ecx
call fcn.004246a0
add esp, 0xc
mov ebx, eax
cmp esi, 1
mov dword [ebp - 0x20], ebx
jle 0x466569
cmp ebx, 0x32000
jle 0x4665ba
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x10fc]
push edx
push 0x49f120
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x10fc]
push ecx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x64000
jle 0x46658f
push 0x49e7d4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x400
jge 0x4665ba
cmp ebx, 1
jle 0x4665ba
push 0x49f10c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1c8]
push str.Microsoft
push edx
mov dword [ebp - 0xbc], 0
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4665e6
mov dword [ebp - 0xbc], 1
lea eax, [ebp - 0x157c]
lea ecx, [ebp - 0x9a8]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46661e
push 0x49f0f8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x147c]
lea eax, [ebp - 0x9a8]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466656
push 0x49f0f8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x9a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x46668a
lea esi, [ebp + ecx - 0x9a8]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0xefc], dl
jne 0x466684
cmp eax, 2
jge 0x46668a
inc eax
dec esi
cmp eax, ecx
jl 0x466671
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x4666af
mov ebx, ecx
lea esi, [ebp - 0x9a8]
lea edi, [ebp - 0x7a8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0x7a8], 0
test eax, eax
jle 0x4666e2
lea esi, [ebp + edx - 0x9a7]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x4666d5
mov byte [ebp + ecx - 0xefc], dl
jne 0x4666dd
mov byte [ebp + ecx - 0xefc], 0
inc ecx
cmp ecx, eax
jl 0x4666c4
mov byte [ebp + eax - 0xefc], 0
mov al, byte [ebp - 0x7a6]
cmp al, 0x5c
je 0x466702
mov byte [ebp - 0x7a6], 0x5c
mov byte [ebp - 0x7a5], 0
mov al, byte [ebp - 0x7a7]
mov byte [ebp - 0xac8], 0
cmp al, 0x3a
je 0x4667cd
lea edi, [ebp - 0x7a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x46673d
cmp byte [ebp + eax - 0x7a8], 0x3a
je 0x46673d
inc eax
cmp eax, ecx
jl 0x46672e
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x46676b
mov ecx, edi
lea esi, [ebp + eax - 0x7a9]
mov ebx, ecx
lea edi, [ebp - 0xac8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0xac7], 0
jne 0x4667a4
lea ecx, [ebp - 0x148]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x148]
lea eax, [ebp - 0xac8]
push edx
push 0x48b2f4
push eax
call fcn.0047a8f8
add esp, 0xc
lea edi, [ebp - 0xac8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7a8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x7a6], 0x5c
je 0x4667dd
mov byte [ebp - 0x7a6], 0x5c
lea ecx, [ebp - 0x9a8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
je 0x46680f
push 0x49f0e0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x7a7], 0x3a
je 0x466836
push 0x49f0cc
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x7a6], 0x5c
je 0x466846
mov byte [ebp - 0x7a6], 0x5c
lea edx, [ebp - 0x7a8]
xor eax, eax
push edx
mov dword [ebp + 8], eax
mov dword [ebp - 0x24], eax
call fcn.004688e0
add esp, 4
cmp eax, 1
je 0x466904
lea edi, [ebp - 0x1c8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x7a8]
dec ecx
push eax
mov esi, ecx
call fcn.00465cd0
add esp, 4
cmp eax, 1
je 0x466904
mov edi, dword [ebp - 0x1c]
test edi, edi
jle 0x4668dd
test esi, esi
jle 0x4668dd
lea ecx, [ebp - 0x1c8]
push 0x491b90
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4668dd
lea edx, [ebp - 0x24]
lea eax, [ebp + 8]
push edx
lea ecx, [ebp - 0x148]
push eax
lea edx, [ebp - 0xefc]
push ecx
lea eax, [ebp - 0x7a8]
push edx
lea ecx, [ebp - 0x1c8]
push eax
push ecx
call fcn.00465170
add esp, 0x18
jmp 0x466907
lea edx, [ebp - 0x24]
lea eax, [ebp + 8]
push edx
lea ecx, [ebp - 0x148]
push eax
lea edx, [ebp - 0xefc]
push ecx
lea eax, [ebp - 0x7a8]
push edx
push eax
call fcn.00465910
add esp, 0x14
jmp 0x466907
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
mov eax, dword [eax]
test eax, eax
jg 0x466922
cmp ecx, 2
jle 0x46698d
cmp edi, 1
jle 0x466967
cmp ebx, 0x19000
jle 0x46698d
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x10fc]
push eax
push 0x49f120
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x10fc]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x32000
jle 0x46698d
push 0x49e7d4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 4
jle 0x4669d3
cmp edi, 1
jle 0x466571
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x10fc]
push eax
push 0x49f120
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x10fc]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0xefc]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x466a02
mov bl, 0x2e
cmp byte [ebp + eax - 0xefc], bl
jne 0x4669f9
mov edx, 1
inc eax
cmp eax, ecx
jl 0x4669eb
test edx, edx
jne 0x466a20
push 0x49f0b0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0xef8], 0
jge 0x466a4b
push 0x49f0b0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x568]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xb68]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x9a8]
push 0x100
lea eax, [ebp - 0x2c8]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0xefc]
push 0x40
lea edx, [ebp - 0x5a8]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x9a8]
push eax
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x24
test eax, eax
jne 0x466ada
push 0x49f094
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x9a8]
push 0x80
lea edx, [ebp - 0xc68]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x9a8]
push 0x80
lea ecx, [ebp - 0xbe8]
push eax
push ecx
call fcn.0047b120
lea edi, [ebp - 0xb68]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x568]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xc68], al
lea edx, [ebp - 0xb68]
mov byte [ebp + ecx - 0xbe8], al
lea eax, [ebp - 0xc68]
push edx
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x466b82
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466b82
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x568]
lea edx, [ebp - 0xbe8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466bcc
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466bcc
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x9a8]
push str.System32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x466c14
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466c14
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x9a8]
push str.system32
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x466c5c
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466c5c
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x9a8]
push str.system
push edx
call fcn.0047bec0
xor edi, edi
add esp, 8
cmp eax, edi
je 0x466ca6
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x466ca6
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xefc]
lea ecx, [ebp - 0x568]
push eax
push ecx
lea edx, [ebp - 0x167c]
push 0x4966e0
push edx
call fcn.0047a8f8
mov esi, 2
push 0x650c60
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], edi
call fcn.00404650
add esp, 0x14
lea eax, [ebp - 0x9a8]
push 0x650c60
push eax
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x466d39
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x9a8]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ebx, 1
mov esi, ebx
mov dword [ebp + 0xc], esi
jmp 0x466da1
mov edx, dword [0x650c68]
mov byte [ebp - 4], 3
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0xc4], eax
mov eax, dword [0x650c68]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x78], eax
jne 0x466e31
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 2
mov ebx, 1
mov edx, dword [0x650c68]
push edx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x467542
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
lea eax, [ebp - 0x2c8]
cmp esi, 2
push 0x80
push eax
jne 0x467502
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2c8]
push edx
call fcn.00429e70
add esp, 4
push 0x49f050
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x9c], edi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x466d92
mov ecx, dword [eax + 0xc]
mov edx, dword [0x650c68]
mov eax, dword [ebp - 0xc4]
push ecx
push edx
push eax
call fcn.00404730
add esp, 0xc
mov ecx, 0x65cd80
mov esi, eax
push edi
call fcn.00479a12
push str.::DllName::
mov ecx, eax
call fcn.00479641
push esi
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
push str.ntoskrnl.exe
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x466ed2
push str.ntkrnlpa.exe
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x466ed2
push str.ntkrnlmp.exe
push esi
call fcn.0047fde0
add esp, 8
mov dword [ebp - 0xb4], 0
test eax, eax
jne 0x466edc
mov dword [ebp - 0xb4], 1
mov ecx, dword [0x650c68]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0xb8], 0
call fcn.004046b0
mov edx, dword [0x650c68]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0xc8], esi
call fcn.004047a0
lea ecx, [edi + edi*4]
add esp, 4
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x466f1f
mov eax, dword [ecx + 0x10]
mov edx, dword [0x650c68]
push eax
push edx
push esi
mov dword [ebp - 0xb0], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x466d92
mov eax, dword [eax]
test eax, eax
je 0x4674ad
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x466fac
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9c8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x9c8]
jmp 0x467032
mov ecx, dword [0x650c68]
mov edx, dword [ebp - 0xc8]
push eax
push ecx
push edx
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x466fe9
xor eax, eax
lea ecx, [ebp - 0x4e8]
mov ax, word [esi]
push eax
push str._04lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x467032
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xae8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0xae8]
xor esi, esi
mov edi, 1
cmp esi, 0x38
jge 0x467430
mov ecx, esi
shl ecx, 6
add ecx, str.RtlQueryRegistryValues
push ecx
push ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46742a
cmp esi, 0x45
jne 0x467106
lea edx, [ebp - 0x148]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x127c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x127c]
push edx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x4670cb
lea eax, [ebp - 0x1c8]
lea ecx, [ebp - 0x11fc]
push eax
push 0x49efe8
push ecx
jmp 0x4670de
lea edx, [ebp - 0x1c8]
lea eax, [ebp - 0x11fc]
push edx
push 0x49efb0
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0x11fc]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x46711a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, edi
jne 0x467131
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 2
jne 0x467146
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 3
jne 0x46715e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x88], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 4
jne 0x467173
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 5
jne 0x46718b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 6
jne 0x4671a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 7
jne 0x4671b8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x90], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 8
jne 0x4671cd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 9
jne 0x4671e5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xa
jne 0x4671fa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xb
jne 0x46720f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xc
jne 0x467224
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xd
jne 0x467239
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xe
jne 0x46724e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0xf
jne 0x467263
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x10
jne 0x467278
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x11
jne 0x46728d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x12
jne 0x4672a2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x74], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x13
jne 0x4672b7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x14
jne 0x4672cc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x15
jne 0x4672e1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x16
jne 0x4672f6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x17
jne 0x46730b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x18
jne 0x467320
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x19
jne 0x467338
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x84], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x1a
jne 0x46734d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x1b
je 0x467357
cmp esi, 0x1c
jne 0x467364
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], edi
inc eax
mov dword [ebp - 0x14], eax
cmp esi, 0x1d
jne 0x46737c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x1e
jne 0x467394
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x1f
jne 0x4673a2
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x467039
cmp esi, 0x20
jne 0x4673b3
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x467039
cmp esi, 0x23
jne 0x4673c8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x80], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x467039
cmp esi, 0x27
jne 0x4673da
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x467039
cmp esi, 0x28
jne 0x4673ec
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x467039
cmp esi, 0x29
jne 0x4673fe
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x467039
cmp esi, 0x2a
jne 0x467410
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x467039
cmp esi, 0x2b
jne 0x467422
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x467039
cmp esi, 0x2c
jne 0x46742a
inc dword [ebp - 0x38]
inc esi
jmp 0x467039
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xb4]
inc ecx
cmp eax, edi
mov dword [ebp + 0x10], ecx
jne 0x467444
inc dword [ebp - 0x24]
cmp dword [ebp + 0x10], 0xc350
jg 0x4674ad
mov esi, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb0]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xb0], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x466f41
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x78]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x78], eax
mov edi, ecx
jmp 0x466e37
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2c8]
push edx
call fcn.00429e70
add esp, 4
push 0x4a06f0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x650c60
call fcn.00404650
add esp, 4
cmp esi, ebx
jne 0x467571
push 0x49ef68
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4675d7
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jle 0x4675df
cmp eax, 0x1400
jge 0x4675df
cmp dword [ebp - 0x1c], ebx
jge 0x4675df
lea eax, [ebp - 0x2c8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x2c8]
push edx
call fcn.00429e70
add esp, 4
push 0x49f050
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ebx
jge 0x467bb8
test esi, esi
je 0x467bb8
push str.c:endpcachemonitor_sysPath6.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7a8]
push eax
call fcn.0047c0d3
push 0x5585bc51
call fcn.00660f10
lea eax, [ebp - 0x9a8]
mov dword [ebp + 8], 0
push eax
mov byte [ebp - 0x4c8], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x467c69
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jle 0x467c69
cmp eax, 0x2800
jge 0x467c69
cmp dword [ebp - 0x1c], ebx
jge 0x467c69
lea ecx, [ebp - 0x2c8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2c8]
push eax
call fcn.00429e70
add esp, 4
push 0x4a0688
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 2
jne 0x467ccb
mov edi, 0x49ee40
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov edi, 0x49ee2c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x4c8]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 0xc], esi
mov esi, edi
mov edi, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], edx
mov al, byte [ebp - 0xefc]
cmp al, 0x30
je 0x467cf9
cmp al, 0x31
je 0x467cf9
cmp al, 0x32
je 0x467cf9
cmp al, 0x33
je 0x467cf9
cmp al, 0x34
je 0x467cf9
cmp al, 0x35
je 0x467cf9
cmp al, 0x36
je 0x467cf9
cmp al, 0x37
je 0x467cf9
cmp al, 0x38
je 0x467cf9
cmp al, 0x39
jne 0x467d30
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 2
jge 0x467d66
mov edi, 0x49ee20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x48], ebx
jne 0x467dea
mov edi, 0x49ee10
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [ebp - 0x4c8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1c8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4c8]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xa0], ebx
jne 0x467e25
mov edi, 0x49ede0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], ebx
jne 0x467e61
mov edi, 0x49eda8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x80], ebx
jne 0x467eb8
mov eax, dword [ebp - 0x24]
test eax, eax
jle 0x467eb8
cmp eax, 0xa
jge 0x467eb8
cmp dword [ebp - 0x20], 0xf000
jge 0x467eb8
cmp dword [ebp + 0x10], 0xf
jge 0x467eb8
mov edi, 0x49ed84
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x58], ebx
jne 0x467eed
mov edi, 0x49ed74
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], ebx
jne 0x467f25
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x60], ebx
jne 0x467f5a
mov edi, 0x49ed64
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x88], ebx
jne 0x467f92
mov edi, 0x49ed54
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x68], ebx
jne 0x467fc7
mov edi, 0x49ed44
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], ebx
jne 0x467fff
mov edi, 0x49ed34
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], ebx
jne 0x468034
mov edi, 0x49ed2c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x90], ebx
jne 0x46806c
mov edi, 0x49ed20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], ebx
jne 0x4680a1
mov edi, 0x49ed14
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x44], ebx
jne 0x4680d6
mov edi, 0x49ed04
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], ebx
jne 0x468112
mov edi, 0x49ecf4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x54], ebx
jne 0x46814e
mov edi, 0x49ece4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x5c], ebx
jne 0x46818a
mov edi, 0x49ecd0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x64], ebx
jne 0x4681c6
mov edi, 0x49ecbc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x6c], ebx
jne 0x4681fb
mov edi, 0x49ecac
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], ebx
jne 0x468237
mov edi, 0x49eca0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x30], ebx
jne 0x46826c
mov edi, 0x49ec94
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], ebx
jne 0x4682a1
mov edi, 0x49ec84
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], ebx
jne 0x4682f9
cmp dword [ebp - 0x34], ebx
jne 0x4682f9
lea eax, [ebp - 0x1c8]
push str.UnNoo___www.unnoo.com
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4682db
lea ecx, [ebp - 0x1c8]
push str.www.unnoo.com
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4682f9
push 0x4a0670
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x7c], ebx
jne 0x46832e
mov edi, 0x49ec34
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x28], ebx
jne 0x468363
mov edi, str.NDIS
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x2c], ebx
jne 0x468398
mov edi, 0x49ec14
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x84], ebx
jne 0x4683d7
mov edi, 0x49ec04
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x8c], ebx
jne 0x468416
mov edi, 0x49ebf4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x94], ebx
jne 0x468455
mov edi, 0x49ebe4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x3c], ebx
je 0x468462
cmp dword [ebp - 0xa4], ebx
jne 0x468492
mov edi, 0x49ebd8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x18], ebx
jle 0x4684c7
mov edi, 0x49ebc8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp - 0xbc]
cmp ebx, 1
jne 0x4685cc
lea eax, [ebp - 0x10fc]
lea ecx, [ebp - 0x9a8]
push eax
push ecx
call fcn.004294c0
add esp, 8
test ax, ax
jne 0x468528
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x46857e
lea eax, [ebp - 0x10fc]
push 0x49e4a8
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46857e
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 7
jle 0x4685cc
lea eax, [ebp - 0x10fc]
push 0x49ebc4
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4685cc
mov edi, 0x49ebb8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x9a8]
lea ecx, [ebp - 0x167c]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4686aa
test ebx, ebx
jne 0x4686aa
mov edi, 0x49ebac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x4c8]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
and ecx, 3
cmp eax, 0x2800
rep movsb byte es:[edi], byte [esi]
jge 0x46869b
mov ecx, dword [ebp - 0x1c]
mov eax, 1
cmp ecx, eax
jge 0x46869b
cmp dword [ebp + 0x10], 0x28
jge 0x46869b
cmp dword [ebp - 0x14], eax
jle 0x46869b
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x2c8]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x49eb8c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x4686b0
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x4686b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0xc0], 1
jne 0x46870d
cmp dword [ebp - 0x20], 0x7800
jge 0x46870d
lea eax, [ebp - 0x2c8]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x49eb8c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xac], 1
jne 0x468761
lea eax, [ebp - 0x2c8]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x49eaf8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x1c], 2
jge 0x4687ca
lea eax, [ebp - 0x9a8]
push str.Documents_and_Settings_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4687ca
lea ecx, [ebp - 0x2c8]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x49eadc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 8], 2
jle 0x468855
cmp dword [ebp - 0x1c], 1
jle 0x468855
lea eax, [ebp - 0x1c8]
push str.NVIDIA
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x46880a
lea ecx, [ebp - 0x1c8]
push str.nvidia
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x468855
lea edx, [ebp - 0x2c8]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x4a0648
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4c8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], 0x32000
jle 0x468868
cmp dword [ebp - 0x24], 0x50
jle 0x468868
xor esi, esi
jmp 0x46886b
mov esi, dword [ebp - 0x14]
push str.c:endpcachemonitor_sysPath6.txt
call fcn.0047c159
push str.c:endpcache
call fcn.0047c0d3
add esp, 8
test esi, esi
jne 0x467dca
push 0x49ea94
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret