Function at 0x45b4a0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483ec6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x19a4
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0xe4], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x104], eax
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x934]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or ecx, 0xffffffff
lea edi, [ebp - 0x414]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x45b624
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x414]
cmp al, 0x5c
jne 0x45b644
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor edi, edi
cmp al, 0x25
mov dword [ebp + 8], esi
jne 0x45b654
mov edi, 1
lea eax, [ecx - 2]
test eax, eax
jle 0x45b683
mov dl, byte [ebp + eax - 0x414]
cmp dl, 0x3a
jne 0x45b671
cmp byte [ebp + eax - 0x413], 0x5c
je 0x45b680
cmp edi, 1
jne 0x45b67b
cmp dl, 0x5c
je 0x45b68c
dec eax
test eax, eax
jg 0x45b65b
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x45b739
sub ecx, eax
xor esi, esi
lea edx, [ecx - 1]
test edx, edx
jle 0x45b6b8
lea eax, [ebp + eax - 0x413]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xdb4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea edi, [ebp - 0xdb4]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + esi - 0xdb4], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x16b4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x414]
push ecx
push edx
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x16b4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x414]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
jmp 0x45b781
cmp eax, ecx
je 0x45b781
test ecx, ecx
mov esi, ecx
jle 0x45b752
cmp byte [ebp + esi - 0x414], 0x2e
je 0x45b752
dec esi
test esi, esi
jg 0x45b743
mov edx, esi
xor ecx, ecx
sub edx, eax
mov byte [ebp - 0x414], 0
add edx, 5
test edx, edx
jle 0x45b779
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x414], al
inc ecx
cmp ecx, edx
jl 0x45b76a
mov byte [ebp + esi - 0x40f], 0
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45b7a4
cmp byte [ebp + ecx - 0x414], 0x2e
je 0x45b7a4
dec ecx
test ecx, ecx
jg 0x45b795
test esi, esi
mov byte [ebp + ecx - 0x410], 0
jne 0x45b7ce
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x45b89c
lea ecx, [ebp - 0x194]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9b4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x834]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x834]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45b87a
lea edx, [ebp - 0x834]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45b87a
lea eax, [ebp - 0x834]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x45b87a
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x194]
push ecx
jmp 0x45b887
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x9b4]
push ecx
push edx
lea eax, [ebp - 0x414]
push 0x4966e0
push eax
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x414]
push str.Application_Data
push ecx
call fcn.0047bec0
add esp, 8
mov ebx, 1
test eax, eax
je 0x45b8bc
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str.Microsoft_SharedMSINFO
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b8d7
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Microsoft_SharedMSInfo
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b8f2
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x414]
push str..TMP
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b90d
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b928
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b943
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x414]
push str.TEMP_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b95e
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x414]
push str.Documents_and_Settings_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b979
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x414]
push str.Program_FilesCommon_Files
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45b994
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x1534]
lea edx, [ebp - 0xeb4]
push ecx
lea eax, [ebp - 0x414]
push edx
push eax
call fcn.0046de70
lea ecx, [ebp - 0xa34]
lea edx, [ebp - 0x1134]
movsx esi, ax
push ecx
lea eax, [ebp - 0x414]
push edx
push eax
mov dword [ebp - 0x108], esi
call fcn.00455090
mov eax, dword [0x65cd60]
add esp, 0x18
cmp eax, ebx
jne 0x45ba8b
cmp esi, ebx
jle 0x45ba8b
lea ecx, [ebp - 0xeb4]
push 0x49f568
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45ba1f
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xa34]
push str.WestoneRepairFile
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45ba55
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa34]
push str.WestoneStartService
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45ba8b
push 0x49f558
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xeb4]
push str.Microsoft
push ecx
mov dword [ebp - 0x5c], 0
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45baad
mov dword [ebp - 0x5c], ebx
lea edx, [ebp - 0x414]
push str.WinRAR
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45bae3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._smswsock.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bb33
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._smsgina.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bb83
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._swsock32.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bbd3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._sws2_32.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bc23
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bc73
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._sNETUI1.DLl
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bcc3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._sMSI.DLL
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bd13
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._sSHELL32.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bd63
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._ses.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bdb3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._surlmon.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45be03
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._smshtml.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45be53
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x514]
push edx
push str._smfc42u.dll
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x514]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bea3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x514]
push eax
push str._smprapi.dll
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x414]
lea eax, [ebp - 0x514]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bef3
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x514]
push ecx
push str._sinetcomm.dll
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x514]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x45bf43
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x414]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45bf7c
lea esi, [ebp + ecx - 0x414]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x1434], dl
jne 0x45bf71
cmp eax, 2
jge 0x45bf77
inc eax
dec esi
cmp eax, ecx
jl 0x45bf5e
mov ebx, 1
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x45bfa3
mov ebx, ecx
lea esi, [ebp - 0x414]
lea edi, [ebp - 0x10b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0x10b4], 0
test eax, eax
jle 0x45bfd6
lea esi, [ebp + edx - 0x413]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x45bfc9
mov byte [ebp + ecx - 0x1434], dl
jne 0x45bfd1
mov byte [ebp + ecx - 0x1434], 0
inc ecx
cmp ecx, eax
jl 0x45bfb8
mov byte [ebp + eax - 0x1434], 0
mov al, byte [ebp - 0x10b2]
cmp al, 0x5c
je 0x45bff6
mov byte [ebp - 0x10b2], 0x5c
mov byte [ebp - 0x10b1], 0
cmp byte [ebp - 0x10b3], 0x3a
je 0x45c0bb
lea edi, [ebp - 0x10b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x45c029
cmp byte [ebp + eax - 0x10b4], 0x3a
je 0x45c029
inc eax
cmp eax, ecx
jl 0x45c01a
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x45c054
mov ecx, edi
lea esi, [ebp + eax - 0x10b5]
mov ebx, ecx
lea edi, [ebp - 0x1234]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x1233], 0
jne 0x45c08d
lea edx, [ebp - 0x9b4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x9b4]
lea ecx, [ebp - 0x1234]
push eax
push 0x48b2f4
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edi, [ebp - 0x1234]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x10b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10b2], 0x5c
je 0x45c0cb
mov byte [ebp - 0x10b2], 0x5c
lea ecx, [ebp - 0x414]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, ebx
je 0x45c1b1
mov edx, dword [0x65cd64]
test edx, edx
jle 0x45c14f
shl edx, 8
lea eax, [ebp - 0x414]
lea ecx, [edx + 0x62a3e4]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45c193
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x414]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45c193
jmp 0x45c189
mov ebx, edx
lea edi, [ebp - 0x414]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45c193
mov dword [0x65cd64], 0
push 0x49f958
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x10b3], 0x3a
je 0x45c1d8
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x10b2], 0x5c
je 0x45c1e8
mov byte [ebp - 0x10b2], 0x5c
lea edi, [ebp - 0x1434]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45c213
cmp byte [ebp + eax - 0x1434], 0x2e
jne 0x45c20a
mov edx, ebx
inc eax
cmp eax, ecx
jl 0x45c1fe
test edx, edx
jne 0x45c231
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x1430], 0
jge 0x45c25c
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
push 0x80
push ecx
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x934]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x414]
push 0x100
lea ecx, [ebp - 0xc34]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x1434]
push 0x40
lea eax, [ebp - 0x874]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x414]
push ecx
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x24
test eax, eax
jne 0x45c2f2
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x414]
push 0x80
lea eax, [ebp - 0xb34]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x414]
push 0x80
lea edx, [ebp - 0xab4]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0x934]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x214]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xb34], al
mov byte [ebp + ecx - 0xab4], al
lea eax, [ebp - 0x934]
lea ecx, [ebp - 0xb34]
push eax
push ecx
call fcn.0047fde0
add esp, 0x20
mov ebx, 1
test eax, eax
jne 0x45c3a2
push 0x491c80
push esi
mov dword [ebp - 0x30], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c3a2
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x214]
lea eax, [ebp - 0xab4]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c3ef
push 0x491c80
push esi
mov dword [ebp - 0x30], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c3ef
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x414]
push str.System32
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45c43a
push 0x491c80
push esi
mov dword [ebp - 0x30], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c43a
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x414]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45c485
push 0x491c80
push esi
mov dword [ebp - 0x30], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c485
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push str.system
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45c4d0
push 0x491c80
push esi
mov dword [ebp - 0x30], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45c4d0
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10b4]
push 0x20
lea edx, [ebp - 0xcb4]
push ecx
push edx
call fcn.0047b120
xor edi, edi
push 0x62a450
mov byte [ebp - 0xcad], 0
mov dword [ebp - 4], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x44], edi
mov dword [ebp + 8], edi
call fcn.00404650
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x62a450
push eax
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x45c55b
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x414]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, ebx
jmp 0x45cdc6
mov edx, dword [0x62a458]
mov byte [ebp - 4], 1
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x10c], eax
mov eax, dword [0x62a458]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xf8], eax
jne 0x45c5eb
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], 2
mov edx, dword [0x62a458]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004046d0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x100], esi
jne 0x45cca0
mov dword [ebp + 8], 6
jmp 0x45cdb4
mov dword [ebp - 0xfc], edi
cmp dword [eax + 0x10], edi
je 0x45c5b7
mov ecx, dword [eax + 0xc]
mov edx, dword [0x62a458]
mov eax, dword [ebp - 0x10c]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x1c], ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x100], eax
cmp esi, 0x66
jge 0x45c6ce
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45c6c8
cmp esi, 0xf
jle 0x45c669
cmp esi, 0x12
jge 0x45c669
mov dword [ebp - 0x64], ebx
cmp esi, 0x1d
je 0x45c678
cmp esi, 0x1e
je 0x45c678
cmp esi, 0x39
jne 0x45c67b
mov dword [ebp - 0x50], ebx
cmp esi, 0x1f
je 0x45c685
cmp esi, 0x20
jne 0x45c688
mov dword [ebp - 0x60], ebx
cmp esi, 0x21
je 0x45c692
cmp esi, 0x22
jne 0x45c695
mov dword [ebp - 0x58], ebx
cmp esi, 0x23
je 0x45c69f
cmp esi, 0x24
jne 0x45c6a2
mov dword [ebp - 0x48], ebx
cmp esi, 0x2c
jne 0x45c6ad
mov dword [ebp - 0x4c], ebx
inc esi
jmp 0x45c639
cmp esi, 0x2d
je 0x45c6c5
cmp esi, 0x2e
jne 0x45c6c0
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x45c639
cmp esi, 0x3d
jne 0x45c6c8
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x45c639
mov edx, dword [0x62a458]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0xf0], 0
call fcn.004046b0
add esp, 4
mov esi, eax
mov eax, dword [0x62a458]
mov dword [ebp - 0x114], esi
push eax
call fcn.004047a0
mov ecx, dword [ebp - 0xfc]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x45c716
mov eax, dword [ecx + 0x10]
mov edx, dword [0x62a458]
push eax
push edx
push esi
mov dword [ebp - 0x28], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
je 0x45c5b7
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x45cbe2
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x45c7a7
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x894]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x894]
jmp 0x45c82b
mov edx, dword [0x62a458]
push eax
mov eax, dword [ebp - 0x114]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45c7e6
xor ecx, ecx
lea edx, [ebp - 0x734]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x98], esi
jmp 0x45c836
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x734]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x8b4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x98], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x45cb99
mov eax, dword [ebp - 0x98]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x45cb93
cmp esi, 0x45
jne 0x45c90c
lea ecx, [ebp - 0x9b4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x9b4]
lea eax, [ebp - 0x194]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x194]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x45c8d1
lea edx, [ebp - 0xeb4]
lea eax, [ebp - 0xdb4]
push edx
push 0x49b6c8
push eax
jmp 0x45c8e4
lea ecx, [ebp - 0xeb4]
lea edx, [ebp - 0xdb4]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0xdb4]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x45c919
mov dword [ebp - 0x38], edi
inc esi
jmp 0x45c838
cmp esi, edi
jne 0x45c926
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x45c838
cmp esi, 2
je 0x45cb93
cmp esi, 4
jne 0x45c940
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x45c838
cmp esi, 5
jne 0x45c951
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x45c838
cmp esi, 6
jne 0x45c962
mov dword [ebp - 0x94], edi
inc esi
jmp 0x45c838
cmp esi, 7
jne 0x45c973
mov dword [ebp - 0xec], edi
inc esi
jmp 0x45c838
cmp esi, 8
jne 0x45c984
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x45c838
cmp esi, 9
jne 0x45c995
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x45c838
cmp esi, 0xa
jne 0x45c9a6
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x45c838
cmp esi, 0xb
jne 0x45c9b7
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x45c838
jle 0x45c9c1
cmp esi, 0xf
jge 0x45c9c4
mov dword [ebp - 0x34], edi
cmp esi, 0xf
jne 0x45c9d2
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x45c838
jle 0x45c9dc
cmp esi, 0x12
jge 0x45c9dc
mov dword [ebp - 0x64], edi
cmp esi, 0x1b
jne 0x45c9ed
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x45c838
cmp esi, 0x1c
jne 0x45c9fe
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x45c838
cmp esi, 0x1d
je 0x45ca0d
cmp esi, 0x1e
je 0x45ca0d
cmp esi, 0x39
jne 0x45ca10
mov dword [ebp - 0x50], edi
cmp esi, 0x1f
je 0x45ca1a
cmp esi, 0x20
jne 0x45ca1d
mov dword [ebp - 0x60], edi
cmp esi, 0x21
je 0x45ca27
cmp esi, 0x22
jne 0x45ca2a
mov dword [ebp - 0x58], edi
cmp esi, 0x23
je 0x45ca34
cmp esi, 0x24
jne 0x45ca37
mov dword [ebp - 0x48], edi
cmp esi, 0x25
je 0x45ca41
cmp esi, 0x26
jne 0x45ca47
mov dword [ebp - 0xac], edi
cmp esi, 0x27
jne 0x45ca58
mov dword [ebp - 0xa4], edi
inc esi
jmp 0x45c838
cmp esi, 0x28
jne 0x45ca69
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x45c838
cmp esi, 0x29
jne 0x45ca77
mov dword [ebp - 0x7c], edi
inc esi
jmp 0x45c838
cmp esi, 0x2c
jne 0x45ca85
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x45c838
cmp esi, 0x2d
jne 0x45ca93
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x45c838
cmp esi, 0x2e
jne 0x45caa1
mov dword [ebp - 0x54], edi
inc esi
jmp 0x45c838
cmp esi, 0x2f
jne 0x45caaf
mov dword [ebp - 0x78], edi
inc esi
jmp 0x45c838
cmp esi, 0x30
jne 0x45cabd
mov dword [ebp - 0x80], edi
inc esi
jmp 0x45c838
cmp esi, 0x31
jne 0x45cace
mov dword [ebp - 0x88], edi
inc esi
jmp 0x45c838
cmp esi, 0x32
jne 0x45cadf
mov dword [ebp - 0x90], edi
inc esi
jmp 0x45c838
cmp esi, 0x34
jne 0x45caf0
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x45c838
cmp esi, 0x35
jne 0x45cb01
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x45c838
cmp esi, 0x36
jne 0x45cb12
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x45c838
cmp esi, 0x37
jne 0x45cb27
mov dword [ebp - 0xc8], 0
inc esi
jmp 0x45c838
cmp esi, 0x38
jne 0x45cb38
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x45c838
cmp esi, 0x3a
je 0x45cb47
cmp esi, 0x3b
je 0x45cb47
cmp esi, 0x3c
jne 0x45cb4d
mov dword [ebp - 0xd8], edi
cmp esi, 0x3d
jne 0x45cb5b
mov dword [ebp - 0x2c], edi
inc esi
jmp 0x45c838
cmp esi, 0x3e
jne 0x45cb6c
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x45c838
cmp esi, 0x3f
jne 0x45cb7a
mov dword [ebp - 0x68], edi
inc esi
jmp 0x45c838
cmp esi, 0x40
jne 0x45cb88
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x45c838
cmp esi, 0x41
jne 0x45cb93
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x45c838
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x100]
inc ecx
cmp eax, edi
mov dword [ebp - 0x44], ecx
jne 0x45cbb0
inc dword [ebp - 0x84]
cmp dword [ebp - 0x44], 0xc350
jg 0x45cbe2
mov esi, dword [ebp - 0xf0]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], ecx
mov eax, ecx
jmp 0x45c740
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0xf0]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xf8]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], eax
xor edi, edi
jmp 0x45c5f1
mov eax, dword [0x62a458]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], ebx
cmp bx, word [esi + 2]
jae 0x45cdb4
xor ecx, ecx
push str..asp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov byte [ebp - 0x6c], cl
mov edx, dword [edi]
mov dword [ebp - 0x74], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x70], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x45ccf0
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x74]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45cd08
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x74]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45cd20
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x74]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45cd38
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x74]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45cd50
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x74]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x45cd68
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x28]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x28], eax
jg 0x45cdb4
mov esi, dword [ebp - 0x100]
add edi, 0x28
inc ebx
jmp 0x45ccb3
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ebx, 1
mov ecx, dword [0x62a458]
push ecx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x45ce02
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 3
push 0x62a450
call fcn.00404650
add esp, 4
cmp esi, ebx
jne 0x45ce31
push 0x49b598
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x84]
mov dword [ebp + 8], edi
test esi, esi
mov dword [ebp - 0x18], edx
je 0x45d50b
cmp edi, ebx
jge 0x45d50b
lea eax, [ebp - 0x10b4]
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.0047c0d3
push 0x5585c21b
call fcn.0066165f
pushal
pushfd
pushal
bt di, ax
sub ebp, 2
push dword [esp + 8]
push ecx
mov word [ebp], ax
push edi
lea esp, [esp + 0x50]
jmp fcn.00661a55
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 0x714], 0
cmp eax, ebx
jne 0x45d532
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x14], 0
cmp eax, ebx
jle 0x45d547
xor ebx, ebx
jmp 0x45d54d
mov ebx, dword [ebp - 0x110]
cmp dword [ebp - 0x94], 1
jne 0x45d586
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x45d5c0
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xcc]
mov eax, 1
cmp ecx, eax
jne 0x45d604
mov edi, 0x49ed54
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x3c], eax
jne 0x45d63f
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x9c], eax
jne 0x45d67d
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], eax
je 0x45d68d
cmp dword [ebp - 0xa4], eax
jne 0x45d6c2
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], eax
jne 0x45d700
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xac], eax
jne 0x45d73d
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], eax
jne 0x45d77b
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x45d7b6
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb4], eax
jne 0x45d7fb
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xdc], eax
jne 0x45d839
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xbc], eax
jne 0x45d877
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], eax
jne 0x45d8b1
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x45d94a
cmp dword [ebp - 0x80], eax
je 0x45d8d4
cmp dword [ebp - 0x88], eax
je 0x45d8d4
lea edx, [ebp - 0x714]
mov edi, 0x49b2d8
jmp 0x45d91f
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x90]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x714]
mov edi, 0x49b2b8
je 0x45d91f
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x45d985
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa0], eax
jne 0x45d9c3
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], eax
jne 0x45d9fe
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x24], eax
jne 0x45da7a
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp eax, ecx
jne 0x45da7f
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x45da7f
mov ecx, 1
cmp dword [ebp - 0xa8], ecx
jne 0x45db37
cmp dword [ebp - 0xb0], ecx
jne 0x45db37
cmp dword [ebp - 0xb8], ecx
jne 0x45db37
cmp dword [ebp - 0xc0], ecx
jne 0x45daed
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x714]
cmp eax, ecx
mov edi, 0x49b24c
je 0x45dac2
mov edi, 0x49b23c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xc8], ecx
jne 0x45db37
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x714]
cmp eax, ecx
mov edi, 0x49b224
je 0x45db0c
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd0], ecx
jne 0x45db74
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x50], ecx
jne 0x45dbaf
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x60], ecx
jne 0x45dbea
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x58], ecx
jne 0x45dc25
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x48], ecx
jne 0x45dc60
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x45dca7
mov eax, dword [ebp - 0x104]
test eax, eax
jne 0x45dca7
mov edi, 0x49f92c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x4c], ecx
jne 0x45dce2
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x2c], ecx
jne 0x45dd1d
mov edi, 0x49f920
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0x54], ecx
jne 0x45dd58
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xd8], ecx
jne 0x45dd96
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xe0], ecx
jne 0x45ddd3
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x45dde1
mov eax, 4
jmp 0x45dde4
lea eax, [eax + eax*2]
cmp dword [ebp + 8], eax
jge 0x45de22
mov edi, 0x49b12c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x45de67
cmp dword [ebp - 0x1c], ecx
jne 0x45de67
mov edi, 0x49b108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
cmp dword [ebp - 0xe8], ecx
jne 0x45deb1
cmp eax, 5
jge 0x45deb1
test eax, eax
jle 0x45deb1
mov edi, 0x49f904
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x714]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x108]
cmp eax, 7
jge 0x45dfda
cmp dword [ebp - 0x30], ecx
jne 0x45df54
cmp eax, ecx
lea edx, [ebp - 0x714]
jge 0x45df11
mov edi, 0x49b0d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x45dfd3
mov dword [ebp - 0x14], 1
jmp 0x45dfd3
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
je 0x45dfd0
cmp dword [ebp - 0x5c], eax
jne 0x45dfd3
jmp 0x45dfd0
cmp eax, ecx
lea edx, [ebp - 0x714]
jge 0x45df97
mov edi, 0x49b0ac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x20], eax
jne 0x45dfc6
mov dword [ebp - 0x14], eax
jmp 0x45dfc6
mov edi, 0x49b09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
je 0x45dfd0
cmp dword [ebp - 0x5c], eax
jne 0x45dfd3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x108]
inc ebx
mov ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x45e010
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x45e010
cmp eax, 6
jle 0x45e010
cmp ebx, 3
jge 0x45e010
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or esi, 0xffffffff
push str.c:endpcache
mov dword [ebp - 4], esi
call fcn.0047c0d3
add esp, 4
test ebx, ebx
jne 0x45e045
push 0x491c3c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45e099
mov ecx, dword [ebp - 0x38]
mov eax, 1
cmp ecx, eax
je 0x45e099
cmp dword [ebp - 0x14], eax
je 0x45e099
cmp ebx, eax
jle 0x45e027
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x19b4]
push eax
push 0x4a0298
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x19b4]
push edx
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x714]
lea ecx, [ebp - 0x17b4]
push eax
push 0x4a026c
push ecx
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0x15c]
push 1
call fcn.00479b69
mov edx, dword [0x4853bc]
lea ecx, [ebp - 0x15c]
push edx
push 1
push str.c:endpcache_auto_process_flag.txt
mov dword [ebp - 4], 9
call fcn.00479c3d
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x158]
cmp dword [eax + 0x30], esi
jne 0x45e133
lea edx, [ebp - 0x17b4]
push edx
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0x148]
mov edi, eax
mov dword [ebp - 4], esi
call fcn.00479c2a
lea ecx, [ebp - 0x148]
call fcn.00479b11
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov eax, dword [ebp - 0x158]
push 0xa
inc eax
push 0x100
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x15c]
call fcn.00479fff
lea edi, [ebp - 0x414]
mov ecx, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jle 0x45e187
lea ecx, [ebp - 0x414]
push str.close
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45e19c
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x154], 1
jne 0x45e1a1
jmp 0x45e135
mov ebx, 1
lea ecx, [ebp - 0x15c]
call fcn.00479c84
test ebx, ebx
jne 0x45e27a
cmp dword [ebp - 0x20], 1
jne 0x45e26f
mov edx, dword [0x65cd64]
test edx, edx
jle 0x45e22b
shl edx, 8
lea ecx, [ebp - 0x414]
lea edx, [edx + 0x62a3e4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45e26f
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x414]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45e26f
jmp 0x45e265
mov ebx, edx
lea edi, [ebp - 0x414]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45e26f
mov dword [0x65cd64], 0
lea ecx, [ebp - 0x17b4]
jmp 0x45e3d1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0xc34]
push edx
call esi
lea eax, [ebp - 0xc34]
push eax
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x45e2ec
lea ecx, [ebp - 0xc34]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0xc34]
push edx
call esi
test eax, eax
jne 0x45e2ec
lea eax, [ebp - 0xc34]
push eax
call fcn.00429f20
add esp, 4
cmp eax, 1
jne 0x45e2ec
lea ecx, [ebp - 0xc34]
push ecx
call fcn.00429e70
add esp, 4
lea edx, [ebp - 0x714]
mov edi, 0x49fc84
jmp 0x45e2f7
lea edx, [ebp - 0x714]
mov edi, 0x4a0224
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebx, ebx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [0x65cd64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x45e387
shl edx, 8
lea ecx, [ebp - 0x414]
lea edx, [edx + 0x62a3e4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45e3cb
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x414]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45e3cb
jmp 0x45e3c5
mov esi, edx
lea edi, [ebp - 0x414]
shl esi, 8
or ecx, 0xffffffff
xor eax, eax
add esi, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x45e3cb
mov dword [0x65cd64], ebx
lea ecx, [ebp - 0x714]
push ecx
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0x148]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00479c2a
lea ecx, [ebp - 0x148]
call fcn.00479b11
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret