Function at 0x4679c0
Capabilities:
Encode data using base64
Get common file path
Get file attributes
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb53b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x18a4
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x88], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x10c], eax
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x934]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or ecx, 0xffffffff
lea edi, [ebp - 0x414]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x467b4a
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x414]
cmp al, 0x5c
jne 0x467b6a
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor edi, edi
cmp al, 0x25
mov dword [ebp + 8], esi
jne 0x467b7a
mov edi, 1
lea eax, [ecx - 2]
test eax, eax
jle 0x467ba9
mov dl, byte [ebp + eax - 0x414]
cmp dl, 0x3a
jne 0x467b97
cmp byte [ebp + eax - 0x413], 0x5c
je 0x467ba6
cmp edi, 1
jne 0x467ba1
cmp dl, 0x5c
je 0x467bb2
dec eax
test eax, eax
jg 0x467b81
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x467c5f
sub ecx, eax
xor esi, esi
lea edx, [ecx - 1]
test edx, edx
jle 0x467bde
lea eax, [ebp + eax - 0x413]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xcb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0xcb4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + esi - 0xcb4], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1534]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0x1534]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
jmp 0x467ca7
cmp eax, ecx
je 0x467ca7
test ecx, ecx
mov esi, ecx
jle 0x467c78
cmp byte [ebp + esi - 0x414], 0x2e
je 0x467c78
dec esi
test esi, esi
jg 0x467c69
mov edx, esi
xor ecx, ecx
sub edx, eax
mov byte [ebp - 0x414], 0
add edx, 5
test edx, edx
jle 0x467c9f
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x414], al
inc ecx
cmp ecx, edx
jl 0x467c90
mov byte [ebp + esi - 0x40f], 0
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x467cca
cmp byte [ebp + ecx - 0x414], 0x2e
je 0x467cca
dec ecx
test ecx, ecx
jg 0x467cbb
test esi, esi
mov byte [ebp + ecx - 0x410], 0
jne 0x467cf4
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x467dc2
lea ecx, [ebp - 0x194]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9b4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x834]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x834]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x467da0
lea edx, [ebp - 0x834]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x467da0
lea eax, [ebp - 0x834]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x467da0
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x194]
push ecx
jmp 0x467dad
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x9b4]
push ecx
push edx
lea eax, [ebp - 0x414]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x414]
push 0x515d14
push ecx
call fcn.004f2d80
add esp, 8
mov ebx, 1
test eax, eax
je 0x467de2
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str.Microsoft_SharedMSINFO
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467dfd
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Microsoft_SharedMSInfo
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e18
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x414]
push str..TMP
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e33
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str._temp_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e4e
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e69
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x414]
push str.TEMP_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e84
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str.Documents_and_Settings_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467e9f
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Program_FilesCommon_Files
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467eba
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x1634]
lea edx, [ebp - 0xdb4]
push ecx
lea eax, [ebp - 0x414]
push edx
push eax
call fcn.004d9d40
lea ecx, [ebp - 0xa34]
lea edx, [ebp - 0x1034]
movsx esi, ax
push ecx
lea eax, [ebp - 0x414]
push edx
push eax
mov dword [ebp - 0x108], esi
call fcn.004ca130
mov eax, dword [0xe56be4]
add esp, 0x18
cmp eax, ebx
jne 0x467fb1
cmp esi, ebx
jle 0x467fb1
lea ecx, [ebp - 0xdb4]
push 0x522a74
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467f45
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xa34]
push str.WestoneRepairFile
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467f7b
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa34]
push str.WestoneStartService
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467fb1
push 0x522a64
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xdb4]
push str.Microsoft
push ecx
mov dword [ebp - 0x5c], 0
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x467fd3
mov dword [ebp - 0x5c], ebx
lea edx, [ebp - 0x414]
push str.CCManager
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x468009
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push str.WinRAR
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46803f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46808f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4680df
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._swsock32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46812f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._sws2_32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46817f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4681cf
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._sNETUI1.DLl
push ecx
call fcn.004f175f
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46821f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46826f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4682bf
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46830f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._surlmon.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46835f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._smshtml.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4683af
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._smfc42u.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4683ff
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._smprapi.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46844f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._sinetcomm.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x46849f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4684d8
lea esi, [ebp + ecx - 0x414]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x1334], dl
jne 0x4684cd
cmp eax, 2
jge 0x4684d3
inc eax
dec esi
cmp eax, ecx
jl 0x4684ba
mov ebx, 1
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x4684ff
mov ebx, ecx
lea esi, [ebp - 0x414]
lea edi, [ebp - 0xfb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xfb4], 0
test eax, eax
jle 0x468532
lea esi, [ebp + edx - 0x413]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x468525
mov byte [ebp + ecx - 0x1334], dl
jne 0x46852d
mov byte [ebp + ecx - 0x1334], 0
inc ecx
cmp ecx, eax
jl 0x468514
mov byte [ebp + eax - 0x1334], 0
mov al, byte [ebp - 0xfb2]
cmp al, 0x5c
je 0x468552
mov byte [ebp - 0xfb2], 0x5c
mov byte [ebp - 0xfb1], 0
cmp byte [ebp - 0xfb3], 0x3a
je 0x468617
lea edi, [ebp - 0xfb4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x468585
cmp byte [ebp + eax - 0xfb4], 0x3a
je 0x468585
inc eax
cmp eax, ecx
jl 0x468576
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x4685b0
mov ecx, edi
lea esi, [ebp + eax - 0xfb5]
mov ebx, ecx
lea edi, [ebp - 0x1134]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x1133], 0
jne 0x4685e9
lea eax, [ebp - 0x9b4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x9b4]
lea edx, [ebp - 0x1134]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x1134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xfb2], 0x5c
je 0x468627
mov byte [ebp - 0xfb2], 0x5c
lea ecx, [ebp - 0x414]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
je 0x468658
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfb3], 0x3a
je 0x46867f
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xfb2], 0x5c
je 0x46868f
mov byte [ebp - 0xfb2], 0x5c
lea edi, [ebp - 0x1334]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4686ba
cmp byte [ebp + eax - 0x1334], 0x2e
jne 0x4686b1
mov edx, ebx
inc eax
cmp eax, ecx
jl 0x4686a5
test edx, edx
jne 0x4686d8
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x1330], 0
jge 0x468703
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
push 0x80
push edx
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x934]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x414]
push 0x100
lea edx, [ebp - 0x1434]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x1334]
push 0x40
lea ecx, [ebp - 0x874]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x414]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x468799
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push 0x80
lea ecx, [ebp - 0xb34]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x414]
push 0x80
lea eax, [ebp - 0xab4]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0x934]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x214]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xb34], al
lea edx, [ebp - 0xb34]
mov byte [ebp + ecx - 0xab4], al
lea ecx, [ebp - 0x934]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
mov ebx, 1
test eax, eax
jne 0x468849
push 0x5144fc
push esi
mov dword [ebp - 0x30], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x468849
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xab4]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x468896
push 0x5144fc
push esi
mov dword [ebp - 0x30], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x468896
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x414]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4688e1
push 0x5144fc
push esi
mov dword [ebp - 0x30], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4688e1
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46892c
push 0x5144fc
push esi
mov dword [ebp - 0x30], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x46892c
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x414]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x468977
push 0x5144fc
push esi
mov dword [ebp - 0x30], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x468977
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xfb4]
push 0x20
lea eax, [ebp - 0xbb4]
push edx
push eax
call fcn.004f27c0
xor edi, edi
push 0xd53b20
mov byte [ebp - 0xbad], 0
mov dword [ebp - 4], edi
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0x68], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 0x10
lea ecx, [ebp - 0x414]
push 0xd53b20
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x468a02
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x414]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x469264
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 1
push eax
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov dword [ebp - 0x114], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x80], eax
jne 0x468a8f
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd53b28]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0xfc], esi
jne 0x46913e
mov dword [ebp + 8], 6
jmp 0x469252
mov dword [ebp - 0xec], edi
cmp dword [eax + 0x10], edi
je 0x468a5b
mov edx, dword [eax + 0xc]
mov eax, dword [0xd53b28]
mov ecx, dword [ebp - 0x114]
push edx
push eax
push ecx
call fcn.004a6c30
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x1c], ecx
call fcn.004f61e0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x104], eax
cmp esi, 0x69
jge 0x468b5a
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x468b57
cmp esi, 0xf
jle 0x468b08
cmp esi, 0x12
jge 0x468b08
mov dword [ebp - 0x64], ebx
cmp esi, 0x1d
je 0x468b17
cmp esi, 0x1e
je 0x468b17
cmp esi, 0x39
jne 0x468b1a
mov dword [ebp - 0x48], ebx
cmp esi, 0x1f
je 0x468b24
cmp esi, 0x20
jne 0x468b27
mov dword [ebp - 0x58], ebx
cmp esi, 0x21
je 0x468b31
cmp esi, 0x22
jne 0x468b34
mov dword [ebp - 0x60], ebx
cmp esi, 0x2c
jne 0x468b3f
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x468adc
cmp esi, 0x2d
je 0x468b54
cmp esi, 0x2e
jne 0x468b4f
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x468adc
cmp esi, 0x3d
jne 0x468b57
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x468adc
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x9c], 0
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0xfc], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0xec]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x468ba3
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x40], eax
push eax
mov eax, dword [0xd53b28]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x468a5b
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x469086
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x468c33
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x8b4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x8b4]
jmp 0x468cb4
mov edx, dword [0xd53b28]
push eax
mov eax, dword [ebp - 0xfc]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x468c6f
xor ecx, ecx
lea edx, [ebp - 0x734]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x14], esi
jmp 0x468cbc
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x894]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [ebp - 0x14], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x469012
mov eax, dword [ebp - 0x14]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46900c
cmp esi, 0x45
jne 0x468d8f
lea ecx, [ebp - 0x9b4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x9b4]
lea eax, [ebp - 0x194]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x194]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x468d54
lea edx, [ebp - 0xdb4]
lea eax, [ebp - 0xcb4]
push edx
push 0x5153f4
push eax
jmp 0x468d67
lea ecx, [ebp - 0xdb4]
lea edx, [ebp - 0xcb4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xcb4]
push eax
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x468d9c
mov dword [ebp - 0x34], edi
inc esi
jmp 0x468cbe
cmp esi, edi
jne 0x468da9
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x468cbe
cmp esi, 2
je 0x46900c
cmp esi, 4
jne 0x468dc3
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x468cbe
cmp esi, 5
jne 0x468dd4
mov dword [ebp - 0x98], edi
inc esi
jmp 0x468cbe
cmp esi, 6
jne 0x468de5
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x468cbe
cmp esi, 7
jne 0x468df6
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x468cbe
cmp esi, 8
jne 0x468e07
mov dword [ebp - 0x90], edi
inc esi
jmp 0x468cbe
cmp esi, 9
jne 0x468e18
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x468cbe
cmp esi, 0xa
jne 0x468e29
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x468cbe
cmp esi, 0xb
jne 0x468e3a
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x468cbe
jle 0x468e44
cmp esi, 0xf
jge 0x468e47
mov dword [ebp - 0x38], edi
cmp esi, 0xf
jne 0x468e55
mov dword [ebp - 0x94], edi
inc esi
jmp 0x468cbe
jle 0x468e5f
cmp esi, 0x12
jge 0x468e5f
mov dword [ebp - 0x64], edi
cmp esi, 0x1b
jne 0x468e70
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x468cbe
cmp esi, 0x1c
jne 0x468e7e
mov dword [ebp - 0x78], edi
inc esi
jmp 0x468cbe
cmp esi, 0x1d
je 0x468e8d
cmp esi, 0x1e
je 0x468e8d
cmp esi, 0x39
jne 0x468e90
mov dword [ebp - 0x48], edi
cmp esi, 0x1f
je 0x468e9a
cmp esi, 0x20
jne 0x468e9d
mov dword [ebp - 0x58], edi
cmp esi, 0x21
je 0x468ea7
cmp esi, 0x22
jne 0x468eaa
mov dword [ebp - 0x60], edi
cmp esi, 0x25
je 0x468eb4
cmp esi, 0x26
jne 0x468eba
mov dword [ebp - 0xd0], edi
cmp esi, 0x27
jne 0x468ecb
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x468cbe
cmp esi, 0x28
jne 0x468edc
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x468cbe
cmp esi, 0x29
jne 0x468eed
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x468cbe
cmp esi, 0x2c
jne 0x468efb
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x2d
jne 0x468f09
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x2e
jne 0x468f17
mov dword [ebp - 0x54], edi
inc esi
jmp 0x468cbe
cmp esi, 0x2f
jne 0x468f28
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x30
jne 0x468f39
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x468cbe
cmp esi, 0x31
jne 0x468f47
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x32
jne 0x468f58
mov dword [ebp - 0x84], edi
inc esi
jmp 0x468cbe
cmp esi, 0x34
jne 0x468f69
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x468cbe
cmp esi, 0x35
jne 0x468f7a
mov dword [ebp - 0xac], edi
inc esi
jmp 0x468cbe
cmp esi, 0x36
jne 0x468f8b
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x468cbe
cmp esi, 0x37
jne 0x468fa0
mov dword [ebp - 0xbc], 0
inc esi
jmp 0x468cbe
cmp esi, 0x38
jne 0x468fb1
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x468cbe
cmp esi, 0x3a
je 0x468fc0
cmp esi, 0x3b
je 0x468fc0
cmp esi, 0x3c
jne 0x468fc6
mov dword [ebp - 0xcc], edi
cmp esi, 0x3d
jne 0x468fd4
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x3e
jne 0x468fe5
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x468cbe
cmp esi, 0x3f
jne 0x468ff3
mov dword [ebp - 0x50], edi
inc esi
jmp 0x468cbe
cmp esi, 0x40
jne 0x469001
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x468cbe
cmp esi, 0x41
jne 0x46900c
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x468cbe
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x104]
inc ecx
cmp eax, edi
mov dword [ebp - 0x68], ecx
jne 0x469029
inc dword [ebp - 0xf4]
cmp dword [ebp - 0x68], 0xc350
jg 0x469086
cmp dword [ebp - 0x104], edi
jne 0x46905d
xor esi, esi
cmp esi, 6
jge 0x46905d
mov edx, dword [ebp - 0x14]
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.VirtualProtectEx
push ecx
push edx
call fcn.004f2d80
add esp, 8
inc esi
jmp 0x46903c
mov esi, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x468bcc
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x9c]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x80]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x80], eax
xor edi, edi
jmp 0x468a95
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x40], ebx
cmp bx, word [esi + 2]
jae 0x469252
xor ecx, ecx
push str..asp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov byte [ebp - 0x6c], cl
mov edx, dword [edi]
mov dword [ebp - 0x74], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x70], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x46918e
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x74]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4691a6
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x74]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4691be
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x74]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4691d6
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x74]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4691ee
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x74]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x469206
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x40]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x40], eax
jg 0x469252
mov esi, dword [ebp - 0xfc]
add edi, 0x28
inc ebx
jmp 0x469151
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x68]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0xd53b28]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x4692a0
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x4692cf
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x14], edi
test esi, esi
mov dword [ebp - 0x18], edx
je 0x4699e1
cmp edi, ebx
jge 0x4699e1
lea eax, [ebp - 0xfb4]
push eax
call fcn.004f2beb
jmp 0x469309
lea ecx, [ebp - 0x1334]
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0xcb4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x46933a
push ebx
lea ecx, [ebp - 0x15c]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
jne 0x469364
lea eax, [ebp - 0xcb4]
push eax
call fcn.004f2ce2
add esp, 4
jmp 0x469378
lea ecx, [ebp - 0x1434]
push str.c:endpcachemonitor_procPath2.txt
push ecx
call fcn.00403af0
add esp, 8
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x15c]
push edx
push ebx
push str.c:endpcachemonitor_procPath2.txt
mov dword [ebp + 8], 0
call fcn.004f0727
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x158]
cmp dword [eax + 0x30], 0xffffffff
jne 0x4693c9
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x46959d
mov esi, dword [ebp - 0x158]
push 0xa
lea edx, [ebp - 0x834]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x158], esi
call fcn.004f0ae9
lea edi, [ebp - 0x834]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x4699a5
lea eax, [ebp - 0x834]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4699a5
lea ecx, [ebp - 0x834]
push str.Dump_of
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4699a5
lea edx, [ebp - 0x834]
push str.File_Type
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4699a5
lea eax, [ebp - 0x834]
push str.Summary
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46947a
mov dword [ebp - 0x10c], ebx
lea ecx, [ebp - 0x834]
push str.Dump_of_file
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4699a5
lea edx, [ebp - 0x834]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4694b8
push 0x5147b4
jmp 0x469595
cmp dword [ebp - 0x44], ebx
jne 0x4694c0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x28], ebx
jne 0x4694c8
inc dword [ebp - 0x18]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x4699a2
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x834]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x46999c
mov ecx, dword [ebp - 0x88]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x88], ecx
jne 0x4695cc
lea edx, [ebp - 0x9b4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x9b4]
lea ecx, [ebp - 0x16b4]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x16b4]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x469573
lea edx, [ebp - 0xdb4]
lea eax, [ebp - 0x1534]
push edx
push 0x5153f4
push eax
jmp 0x469586
lea ecx, [ebp - 0xdb4]
lea edx, [ebp - 0x1534]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x1534]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x148]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x46964c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x4695ec
sub ecx, eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x834]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x834]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x834]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4696c4
test ebx, ebx
jne 0x4696c4
test eax, eax
jne 0x4696c4
mov dword [ebp - 0x28], eax
mov ebx, 1
inc esi
jmp 0x4694cc
cmp esi, 0x1a
jne 0x4696d8
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], edx
jle 0x469670
sub ecx, eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x834]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x834]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x834]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x4696c4
test ebx, ebx
jne 0x4696c4
test eax, eax
jne 0x4696c4
mov dword [ebp - 0x28], eax
mov ebx, 1
inc esi
jmp 0x4694cc
xor edi, edi
mov dword [ebp - 0x28], 1
mov ebx, 1
inc esi
jmp 0x4694cc
cmp esi, 0x2a
jne 0x4696ef
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4694cc
cmp esi, 0x2b
jne 0x469706
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4694cc
cmp esi, edi
jne 0x469713
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x4694cc
cmp esi, ebx
jne 0x469720
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x4694cc
cmp esi, 2
je 0x46999c
cmp esi, 4
jne 0x46973a
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x4694cc
cmp esi, 5
jne 0x46974b
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x4694cc
cmp esi, 6
jne 0x46975c
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x4694cc
cmp esi, 7
jne 0x46976d
mov dword [ebp - 0xa8], ebx
inc esi
jmp 0x4694cc
cmp esi, 8
jne 0x46977e
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x4694cc
cmp esi, 9
jne 0x46978f
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x4694cc
cmp esi, 0xa
jne 0x4697a0
mov dword [ebp - 0xe4], ebx
inc esi
jmp 0x4694cc
cmp esi, 0xb
jne 0x4697b1
mov dword [ebp - 0xc0], ebx
inc esi
jmp 0x4694cc
jle 0x4697bb
cmp esi, 0xf
jge 0x4697be
mov dword [ebp - 0x38], ebx
cmp esi, 0xf
jne 0x4697cc
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x4694cc
jle 0x4697d6
cmp esi, 0x12
jge 0x4697d6
mov dword [ebp - 0x64], ebx
cmp esi, 0x11
jle 0x4697e3
cmp esi, 0x19
jge 0x4697e3
mov dword [ebp - 0x24], ebx
cmp esi, 0x1b
jne 0x4697f4
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x1c
jne 0x469802
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x1d
je 0x469811
cmp esi, 0x1e
je 0x469811
cmp esi, 0x39
jne 0x469814
mov dword [ebp - 0x48], ebx
cmp esi, 0x1f
je 0x46981e
cmp esi, 0x20
jne 0x469821
mov dword [ebp - 0x58], ebx
cmp esi, 0x21
je 0x46982b
cmp esi, 0x22
jne 0x46982e
mov dword [ebp - 0x60], ebx
cmp esi, 0x23
je 0x469838
cmp esi, 0x24
jne 0x46983e
mov dword [ebp - 0x100], ebx
cmp esi, 0x25
je 0x469848
cmp esi, 0x26
jne 0x46984e
mov dword [ebp - 0xd0], ebx
cmp esi, 0x27
jne 0x46985f
mov dword [ebp - 0xf0], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x28
jne 0x469870
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x29
jne 0x469881
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x2c
jne 0x46988f
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x2d
jne 0x46989d
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x2e
jne 0x4698ab
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x2f
jne 0x4698bc
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x30
jne 0x4698cd
mov dword [ebp - 0xf8], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x31
jne 0x4698db
mov dword [ebp - 0x7c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x32
jne 0x4698ec
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x34
jne 0x4698fd
mov dword [ebp - 0xa4], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x35
jne 0x46990e
mov dword [ebp - 0xac], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x36
jne 0x46991f
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x37
jne 0x469930
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4694cc
cmp esi, 0x38
jne 0x469941
mov dword [ebp - 0xc4], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x3a
je 0x469950
cmp esi, 0x3b
je 0x469950
cmp esi, 0x3c
jne 0x469956
mov dword [ebp - 0xcc], ebx
cmp esi, 0x3d
jne 0x469964
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x3e
jne 0x469975
mov dword [ebp - 0xd4], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x3f
jne 0x469983
mov dword [ebp - 0x50], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x40
jne 0x469991
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x4694cc
cmp esi, 0x41
jne 0x46999c
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x4694cc
inc dword [ebp + 8]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x154], 1
je 0x4693c9
lea ecx, [ebp - 0x15c]
call fcn.004f076e
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x148]
call fcn.004f05fb
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 0x714], 0
cmp eax, ebx
jne 0x469a08
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x88]
mov dword [ebp + 8], 0
cmp eax, ebx
jle 0x469a1d
xor ebx, ebx
jmp 0x469a23
mov ebx, dword [ebp - 0x110]
cmp dword [ebp - 0xe0], 1
jne 0x469a5c
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x469a96
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x90]
mov eax, 1
cmp ecx, eax
jne 0x469ada
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3c], eax
jne 0x469b15
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc8], eax
jne 0x469b53
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x98], eax
je 0x469b63
cmp dword [ebp - 0xf0], eax
jne 0x469b98
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa0], eax
jne 0x469bd6
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd0], eax
jne 0x469c13
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
jne 0x469c51
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x469c8c
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], eax
jne 0x469cd1
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x469d0f
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd8], eax
jne 0x469d4d
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x469d8a
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x469e23
cmp dword [ebp - 0xf8], eax
je 0x469dad
cmp dword [ebp - 0x7c], eax
je 0x469dad
lea edx, [ebp - 0x714]
mov edi, 0x515278
jmp 0x469df8
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x84]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x714]
mov edi, 0x515258
je 0x469df8
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x8c], eax
jne 0x469e61
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x94], eax
jne 0x469e9f
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], eax
jne 0x469eda
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x24], eax
jne 0x469f56
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp eax, esi
jne 0x469f5b
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dword [ebp + 8], esi
jmp 0x469f5b
mov esi, 1
cmp dword [ebp - 0x78], esi
jne 0x46a010
cmp dword [ebp - 0xa4], esi
jne 0x46a010
cmp dword [ebp - 0xac], esi
jne 0x46a010
cmp dword [ebp - 0xb4], esi
jne 0x469fc6
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x714]
cmp eax, esi
mov edi, 0x5151ec
je 0x469f9b
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xbc], esi
jne 0x46a010
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x714]
cmp eax, esi
mov edi, 0x5151c4
je 0x469fe5
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xc4], esi
jne 0x46a04d
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x48], esi
jne 0x46a088
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x46a0c3
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x60], esi
jne 0x46a0fe
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x100], esi
jne 0x46a13c
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x46a183
mov eax, dword [ebp - 0x10c]
test eax, eax
jne 0x46a183
mov edi, 0x516ba4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x4c], esi
jne 0x46a1be
mov edi, str.PING
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x2c], esi
jne 0x46a1f9
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x54], esi
jne 0x46a234
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xcc], esi
jne 0x46a272
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xd4], esi
jne 0x46a2af
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov edx, dword [ebp - 0x1c]
cmp edx, esi
jne 0x46a2bd
mov edx, 4
jmp 0x46a2c0
lea edx, [edx + edx*2]
mov eax, dword [ebp - 0x14]
cmp eax, 5
jle 0x46a2cb
sub eax, 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 5
jle 0x46a2d9
sub ecx, 5
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp - 0xdc]
test edi, edi
jne 0x46a2eb
cmp eax, 6
jle 0x46a2eb
sub eax, 6
cmp eax, edx
jge 0x46a32b
mov edi, 0x516b88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, 1
mov dword [ebp + 8], esi
test ecx, ecx
jle 0x46a36d
cmp dword [ebp - 0x1c], esi
jne 0x46a36d
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, 1
cmp dword [ebp - 0xe4], esi
jne 0x46a3b7
cmp ecx, 5
jge 0x46a3b7
test ecx, ecx
jle 0x46a3b7
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dword [ebp + 8], esi
mov eax, dword [ebp - 0x108]
cmp eax, 7
jge 0x46a4e0
cmp dword [ebp - 0x30], esi
jne 0x46a45a
cmp eax, esi
lea edx, [ebp - 0x714]
jge 0x46a417
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x46a4d9
mov dword [ebp + 8], 1
jmp 0x46a4d9
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
je 0x46a4d6
cmp dword [ebp - 0x5c], eax
jne 0x46a4d9
jmp 0x46a4d6
cmp eax, esi
lea edx, [ebp - 0x714]
jge 0x46a49d
mov edi, 0x515078
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x46a4cc
mov dword [ebp + 8], eax
jmp 0x46a4cc
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
je 0x46a4d6
cmp dword [ebp - 0x5c], eax
jne 0x46a4d9
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x108]
inc ebx
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x46a516
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x46a516
cmp eax, 6
jle 0x46a516
cmp ebx, 3
jge 0x46a516
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.c:endpcache
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x46a545
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46a599
mov ecx, dword [ebp - 0x34]
mov eax, 1
cmp ecx, eax
je 0x46a599
cmp dword [ebp + 8], eax
je 0x46a599
cmp ebx, eax
jle 0x46a527
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x18b4]
push eax
push 0x5229f4
push ecx
call fcn.004f175f
lea edx, [ebp - 0x18b4]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x18b4]
push eax
push 0x514fd8
push ecx
call fcn.004f175f
lea edx, [ebp - 0x18b4]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret