Function at 0x47ab80
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e053e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov edi, 1
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call fcn.0040b7e0
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 2
call fcn.004798f0
mov dword [ebp - 0x34], eax
mov bl, 1
mov byte [ebp - 0x37], bl
cmp eax, esi
je 0x47ac63
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 3
lea edi, [ebp - 0x20]
call fcn.0040bc80
xor ecx, ecx
mov edx, str.protocolfilters.dll
mov esi, edi
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47ac1f
xor ecx, ecx
mov edx, str.nfapi.dll
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47ac24
xor bl, bl
mov byte [ebp - 0x37], bl
xor ecx, ecx
mov edx, 0x692fe8
lea esi, [ebp - 0x20]
call fcn.00437bc0
test eax, eax
je 0x47ac4a
test bl, bl
je 0x47ac4f
mov edx, esi
push edx
mov ecx, dword [ebp - 0x34]
call fcn.00486720
test al, al
je 0x47ac4f
xor bl, bl
mov byte [ebp - 0x37], bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040b950
test bl, bl
je 0x47c16d
push 0
push 0
push 0x6d49fc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x47acd4
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 4
lea edi, [ebp - 0x20]
call fcn.0040bc80
xor ecx, ecx
mov edx, str.keygen
mov esi, edi
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47acc3
xor ecx, ecx
mov edx, str.serial
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47acc3
xor ecx, ecx
mov edx, str.crack
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47acc8
xor bl, bl
mov byte [ebp - 0x37], bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0040b950
test bl, bl
je 0x47c16d
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x24]
add dword [esi + 0x38], ecx
mov edx, dword [ebp + 0x28]
adc dword [esi + 0x3c], edx
lea eax, [ebp - 0x3c]
push eax
call fcn.0040b610
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x10]
call fcn.00498c70
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 6
cmp eax, 0xffffffff
je 0x47c127
push eax
mov ebx, dword [0x6ea328]
call fcn.0049aed0
test al, al
jne 0x47c127
cmp dword [esi + 0x18], 0x3e8
jne 0x47b3ff
cmp byte [ebp + 0x30], al
jne 0x47b3f2
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov esi, 7
mov byte [ebp - 4], 7
lea edi, [ebp - 0x1c]
call fcn.0040bc80
mov byte [ebp - 0x2d], 1
lea edx, [ebp - 0x34]
push edx
mov ecx, str.:programdata
call fcn.0040b8a0
mov byte [ebp - 4], 8
mov dword [ebp - 0x24], 3
lea eax, [ebp - 0x34]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47ae00
lea eax, [ebp - 0x18]
push eax
mov ecx, str.:program_files
call fcn.0040b8a0
mov dword [ebp - 4], 9
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47ae00
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, str.:program_files__x86_
call fcn.0040b8a0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x2c]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47ae00
lea edx, [ebp - 0x20]
push edx
mov ecx, str.:windows_servicing
call fcn.0040b8a0
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x24], 0x1f
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47ae00
xor bl, bl
jmp 0x47ae02
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x24], 0x10
je 0x47ae1b
and dword [ebp - 0x24], 0xffffffef
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov dword [ebp - 4], 9
test byte [ebp - 0x24], 8
je 0x47ae34
and dword [ebp - 0x24], 0xfffffff7
lea ecx, [ebp - 0x2c]
call fcn.0040b950
mov dword [ebp - 4], 8
test byte [ebp - 0x24], 4
je 0x47ae4d
and dword [ebp - 0x24], 0xfffffffb
lea ecx, [ebp - 0x18]
call fcn.0040b950
mov dword [ebp - 4], esi
test byte [ebp - 0x24], 2
je 0x47ae62
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x34]
call fcn.0040b950
test bl, bl
jne 0x47aedc
mov eax, dword [0x6d49d4]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.0040b840
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
call fcn.00434b10
add esp, 4
cmp edx, esi
jl 0x47ae9d
jg 0x47aedc
cmp eax, edi
ja 0x47aedc
cmp dword [0x6d49d8], 0
je 0x47aee0
xor ecx, ecx
mov edx, str.keygen
lea esi, [ebp - 0x1c]
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47aedc
xor ecx, ecx
mov edx, str.serial
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47aedc
xor ecx, ecx
mov edx, str.crack
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47aee0
mov byte [ebp - 0x2d], 0
xor ecx, ecx
mov edx, str.hp_
lea esi, [ebp - 0x1c]
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47af38
xor ecx, ecx
mov edx, str.laserjet
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47af38
xor ecx, ecx
mov edx, str.printer
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47af38
xor ecx, ecx
mov edx, str.scanner
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47af38
xor ecx, ecx
mov edx, str._mfp
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47af41
mov byte [ebp - 0x2d], 0
jmp 0x47b3e3
cmp byte [ebp - 0x2d], 0
je 0x47b3e3
mov ecx, 0x2e
lea esi, [ebp - 0x1c]
call fcn.00437c10
cmp eax, 0xffffffff
je 0x47b3e3
lea edx, [eax + 1]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
push ecx
call fcn.00437c90
mov byte [ebp - 4], 0xd
lea edi, [ebp - 0x18]
call fcn.0040bc80
lea edx, [ebp - 0x20]
push edx
call fcn.0040b7e0
mov byte [ebp - 4], 0xe
mov eax, edi
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040b840
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x2c]
push edx
mov ecx, 0x69d0a8
call fcn.00437f30
add esp, 4
test al, al
jne 0x47afcd
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x69f660
call fcn.00437f30
add esp, 4
test al, al
jne 0x47afcd
lea edi, [ebp - 0x2c]
call fcn.00437c30
jmp 0x47afda
mov edx, 0x69f668
lea edi, [ebp - 0x2c]
call fcn.0040b9c0
cmp dword [0x6eab4c], 1
jne 0x47b04a
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, str.Malware.
call fcn.0040b8a0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x44]
push ecx
mov ebx, eax
call fcn.0041c9d0
mov byte [ebp - 4], 0x11
push eax
lea edx, [ebp - 0x34]
push edx
mov ebx, str..DeepDive
call fcn.004176f0
add esp, 0x10
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x20]
call fcn.0040daa0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x34]
call fcn.0040b950
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x44]
call fcn.0040b950
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4c]
call fcn.0040b950
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
jne 0x47b121
xor bl, bl
mov dword [ebp - 0x48], 0x6eaf50
push 0x6eaf50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x13
xor edi, edi
mov dword [ebp - 0x98], edi
mov ecx, dword [0x6eaf98]
sub ecx, dword [0x6eaf94]
sar ecx, 2
cmp edi, ecx
jae 0x47b0a8
mov esi, 0x6eaf88
call fcn.00467500
mov eax, dword [eax]
lea edx, [ebp - 0x18]
push edx
mov ecx, eax
call fcn.0040ba40
test eax, eax
je 0x47b0ac
inc edi
jmp 0x47b071
test bl, bl
je 0x47b113
lea eax, [ebp - 0x34]
push eax
mov ecx, str.Malware.
call fcn.0040b8a0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov ebx, eax
call fcn.0041c9d0
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x4c]
push eax
mov ebx, str..DeepDive
call fcn.004176f0
add esp, 0x10
mov byte [ebp - 4], 0x16
lea edi, [ebp - 0x20]
call fcn.0040daa0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x4c]
call fcn.0040b950
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x44]
call fcn.0040b950
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x34]
call fcn.0040b950
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d0ec
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d0f4
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d0fc
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d104
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d10c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d114
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d11c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d124
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d12c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d134
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d13c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d144
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d14c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d154
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b27c
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d15c
call fcn.00437f30
add esp, 4
test al, al
je 0x47b2e3
lea edx, [ebp - 0x44]
push edx
mov ecx, str.Malware.
call fcn.0040b8a0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x4c]
push edx
mov ebx, eax
call fcn.0041c9d0
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x48]
push eax
mov ebx, str..DeepScript
call fcn.004176f0
add esp, 0x10
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0x20]
call fcn.0040daa0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x48]
call fcn.0040b950
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x4c]
call fcn.0040b950
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.0040b950
mov ecx, dword [ebp - 0x20]
cmp dword [ecx - 0xc], 0
je 0x47b3bf
mov bl, 0x1a
mov byte [ebp - 4], bl
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x36], 0
lea edx, [ebp - 0x48]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x60]
push eax
call fcn.004451c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
call fcn.0040b950
cmp byte [ebp - 0x35], 0
jne 0x47b3b8
cmp byte [ebp - 0x36], 0
jne 0x47b3b8
push 0x1b7740
mov ecx, dword [0x6eac50]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x50], 0x6eae5c
push 0x6eae5c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1c
push 0x6eae58
call fcn.004496e0
test al, al
je 0x47b3aa
lea edx, [ebp - 0x1c]
push edx
call fcn.00449520
test al, al
jne 0x47b3aa
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d0fc
call fcn.0040bce0
add esp, 4
test al, al
jne 0x47b39d
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00434bb0
add esp, 4
test al, al
je 0x47b3aa
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x3c]
call fcn.0041c630
mov bl, 0x1a
mov byte [ebp - 4], bl
push 0x6eae5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xf
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.0040b950
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18]
call fcn.0040b950
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.0040b950
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0x3e8
je 0x47bcc1
mov edx, dword [ebp - 0x3c]
cmp dword [edx - 0xc], 0
jne 0x47bbdf
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x74], 0
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea edi, [ebp - 0x8c]
mov ebx, dword [ebp - 0x60]
lea esi, [ebp - 0x5c]
call fcn.004991f0
cmp byte [ebp - 0x50], 0
je 0x47bbdc
cmp byte [ebp - 0x74], 0
je 0x47bbdc
mov eax, dword [ebp - 0x88]
mov edi, dword [ebp - 0x78]
cmp eax, edi
jb 0x47b47e
ja 0x47b467
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [ebp - 0x7c]
jbe 0x47b47e
mov esi, dword [ebp - 0x8c]
mov edi, eax
jmp 0x47b481
mov esi, dword [ebp - 0x7c]
lea edx, [ebp - 0x3c]
push edx
push edi
push esi
mov ebx, dword [ebp - 0x58]
push ebx
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.004a9a10
test al, al
jne 0x47bbdc
mov byte [ebp - 0x35], al
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x35]
push eax
lea ecx, [ebp - 0x36]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00443d70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0040b950
push edi
push esi
push ebx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004a98d0
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx - 0xc], 0
jne 0x47bbdc
cmp dword [0x6eabf8], 0
je 0x47bbdc
push 0
push 0
push 0x6d4a24
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x47bbdc
mov esi, dword [ebp + 0xc]
add esi, 0x20
push esi
mov ecx, str.Quick
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b551
push esi
mov ecx, str.Full
call fcn.00437f30
add esp, 4
test al, al
je 0x47bbdc
cmp byte [ebp + 0x30], 0
jne 0x47bbdc
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 0x1f
lea edi, [ebp - 0x1c]
call fcn.0040bc80
mov byte [ebp - 0x25], 1
lea eax, [ebp - 0x18]
push eax
mov ecx, str.:programdata
call fcn.0040b8a0
mov byte [ebp - 4], 0x20
mov ebx, dword [ebp - 0x24]
or ebx, 0x20
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47b629
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, str.:program_files
call fcn.0040b8a0
mov dword [ebp - 4], 0x21
or ebx, 0x40
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x2c]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47b629
lea edx, [ebp - 0x20]
push edx
mov ecx, str.:program_files__x86_
call fcn.0040b8a0
mov dword [ebp - 4], 0x22
or ebx, 0x80
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.0049a660
test al, al
jne 0x47b629
lea eax, [ebp - 0x34]
push eax
mov ecx, str.:windows_servicing
call fcn.0040b8a0
mov dword [ebp - 4], 0x23
or ebx, 0x100
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x34]
mov edx, edi
call fcn.0049a660
test al, al
mov byte [ebp - 0x2e], 0
je 0x47b62d
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0x22
test ebx, 0x100
je 0x47b64d
and ebx, 0xfffffeff
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x34]
call fcn.0040b950
mov dword [ebp - 4], 0x21
test bl, bl
jns 0x47b669
and ebx, 0xffffff7f
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov dword [ebp - 4], 0x20
test bl, 0x40
je 0x47b683
and ebx, 0xffffffbf
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x2c]
call fcn.0040b950
mov dword [ebp - 4], 0x1f
test bl, 0x20
je 0x47b69d
and ebx, 0xffffffdf
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x18]
call fcn.0040b950
cmp byte [ebp - 0x2e], 0
jne 0x47b719
mov eax, dword [0x6d49d4]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x1c]
push edx
push ecx
call fcn.0040b840
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x1f
call fcn.00434b10
add esp, 4
cmp edx, esi
jl 0x47b6da
jg 0x47b719
cmp eax, edi
ja 0x47b719
cmp dword [0x6d49d8], 0
je 0x47b71d
xor ecx, ecx
mov edx, str.keygen
lea esi, [ebp - 0x1c]
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b719
xor ecx, ecx
mov edx, str.serial
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b719
xor ecx, ecx
mov edx, str.crack
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47b71d
mov byte [ebp - 0x25], 0
xor ecx, ecx
mov edx, str.hp_
lea esi, [ebp - 0x1c]
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b775
xor ecx, ecx
mov edx, str.laserjet
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b775
xor ecx, ecx
mov edx, str.printer
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b775
xor ecx, ecx
mov edx, str.scanner
call fcn.00437bc0
cmp eax, 0xffffffff
jne 0x47b775
xor ecx, ecx
mov edx, str._mfp
call fcn.00437bc0
cmp eax, 0xffffffff
je 0x47b77e
mov byte [ebp - 0x25], 0
jmp 0x47bbd0
cmp byte [ebp - 0x25], 0
je 0x47bbd0
cmp dword [0x6d4a28], 0
je 0x47b7a7
lea eax, [ebp - 0x1c]
push eax
call fcn.00425f70
test al, al
je 0x47b7a7
mov byte [ebp - 0x25], 0
jmp 0x47bbd0
mov ecx, 0x2e
lea esi, [ebp - 0x1c]
call fcn.00437c10
cmp eax, 0xffffffff
je 0x47bbd0
lea edx, [eax + 1]
lea ecx, [ebp - 0x18]
push ecx
mov eax, esi
push eax
call fcn.00437c90
mov byte [ebp - 4], 0x25
lea edi, [ebp - 0x18]
call fcn.0040bc80
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040b7e0
mov byte [ebp - 4], 0x26
mov edx, edi
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0040b840
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20]
push ecx
mov ecx, 0x69d0a8
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b829
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x69f660
call fcn.00437f30
add esp, 4
test al, al
jne 0x47b829
lea edi, [ebp - 0x20]
call fcn.00437c30
jmp 0x47b836
mov edx, 0x69f668
lea edi, [ebp - 0x20]
call fcn.0040b9c0
cmp dword [0x6d49cc], 0
je 0x47b98a
cmp dword [0x6eab4c], 1
jne 0x47b8b3
lea eax, [ebp - 0x44]
push eax
mov ecx, str.Malware.
call fcn.0040b8a0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x4c]
push edx
mov ebx, eax
call fcn.0041c9d0
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0x48]
push eax
mov ebx, str..DeepDive
call fcn.004176f0
add esp, 0x10
mov byte [ebp - 4], 0x2a
lea edi, [ebp - 0x2c]
call fcn.0040daa0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x48]
call fcn.0040b950
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x4c]
call fcn.0040b950
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x44]
call fcn.0040b950
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx - 0xc], 0
jne 0x47b98a
xor bl, bl
mov dword [ebp - 0x50], 0x6eaf50
push 0x6eaf50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x2b
xor edi, edi
mov dword [ebp - 0xa4], edi
mov edx, dword [0x6eaf98]
sub edx, dword [0x6eaf94]
sar edx, 2
cmp edi, edx
jae 0x47b911
mov esi, 0x6eaf88
call fcn.00467500
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.0040ba40
test eax, eax
je 0x47b915
inc edi
jmp 0x47b8da
test bl, bl
je 0x47b97c
lea edx, [ebp - 0x64]
push edx
mov ecx, str.Malware.
call fcn.0040b8a0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x6c]
push edx
mov ebx, eax
call fcn.0041c9d0
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x34]
push eax
mov ebx, str..DeepDive
call fcn.004176f0
add esp, 0x10
mov byte [ebp - 4], 0x2e
lea edi, [ebp - 0x2c]
call fcn.0040daa0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x34]
call fcn.0040b950
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x6c]
call fcn.0040b950
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x64]
call fcn.0040b950
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6eabfc], 0
je 0x47baff
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d0ec
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d0f4
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d0fc
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d104
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d10c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d114
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d11c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d124
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d12c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d134
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d13c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d144
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d14c
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x69d154
call fcn.00437f30
add esp, 4
test al, al
jne 0x47baf2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x69d15c
call fcn.00437f30
add esp, 4
test al, al
je 0x47baff
mov edx, str.Malware.DeepScript
lea edi, [ebp - 0x2c]
call fcn.0040b9c0
mov edx, dword [ebp - 0x2c]
cmp dword [edx - 0xc], 0
je 0x47bbac
mov byte [ebp - 4], 0x2f
cmp byte [ebp - 0x36], 0
jne 0x47bba5
cmp byte [ebp - 0x35], 0
jne 0x47bba5
push 0x1b7740
mov eax, dword [0x6eac50]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x50], 0x6eae5c
push 0x6eae5c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x30
push 0x6eae58
call fcn.004496e0
test al, al
je 0x47bb96
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00449520
test al, al
jne 0x47bb96
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x69d0fc
call fcn.0040bce0
add esp, 4
test al, al
jne 0x47bb8b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00434bb0
add esp, 4
test al, al
je 0x47bb96
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.0041c630
mov byte [ebp - 4], 0x2f
push 0x6eae5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0x27
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.0040b950
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x18]
call fcn.0040b950
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.0040b950
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0x3e8
je 0x47bcc1
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx - 0xc], 0
jne 0x47bcc1
mov ecx, dword [ebp + 0x28]
test ecx, ecx
jl 0x47bcc1
mov eax, dword [ebp + 0x24]
jg 0x47bc11
test eax, eax
jbe 0x47bcc1
cmp ecx, 0xffffffff
ja 0x47bcc1
jb 0x47bc25
cmp eax, 0xffffffff
jae 0x47bcc1
cmp dword [0x6d49c4], 0
je 0x47bcc1
mov byte [ebp - 0x3d], 0
lea edx, [ebp - 0x3d]
push edx
push 0
push eax
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x50]
call fcn.00417570
mov byte [ebp - 4], 0x32
lea ebx, [ebp - 0x3c]
call fcn.0040d9a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.0040b720
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
je 0x47bcc1
push 0x6eac1c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x6eac1c]
push ecx
push ecx
mov edx, esp
mov dword [ebp - 0x64], esp
push edx
mov ecx, str.CloudFound
call fcn.0040b8a0
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 6
call fcn.00441df0
push 0x69d5f4
lea eax, [ebp - 0x50]
push eax
mov ecx, ebx
call fcn.0041c860
add esp, 8
mov byte [ebp - 4], 0x34
call fcn.0040d9a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.0040b720
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx - 0xc], 0
je 0x47c127
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 0x35
lea edi, [ebp - 0x20]
call fcn.0040bc80
lea ebx, [esi + 0xc0]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
mov dword [ebp - 0x54], eax
mov ecx, edi
push ecx
lea edx, [ebp - 0x68]
push edx
mov esi, ebx
call fcn.004394e0
lea esi, [ebp - 0x54]
mov edi, eax
call fcn.00445ed0
test al, al
je 0x47c118
lea eax, [ebp - 0x20]
push eax
push ebx
lea ebx, [ebp - 0x58]
call fcn.0041d270
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.00499710
mov edi, eax
mov byte [ebp - 4], 0x36
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0xe0]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, ebx
call fcn.0041c7b0
mov byte [ebp - 4], 0x37
push 0x6987f4
lea edx, [ebp - 0x6c]
push edx
mov ecx, eax
call fcn.0041c860
mov byte [ebp - 4], 0x38
push edi
lea ecx, [ebp - 0x64]
push ecx
mov ecx, eax
call fcn.0041c7b0
mov byte [ebp - 4], 0x39
push 0x69a924
lea edx, [ebp - 0x50]
push edx
mov ecx, eax
call fcn.0041c860
add esp, 0x28
mov byte [ebp - 4], 0x3a
call fcn.0040d9a0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x50]
call fcn.0040b720
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x64]
call fcn.0040b720
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x6c]
call fcn.0040b720
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x48]
call fcn.0040b720
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x4c]
call fcn.0040b720
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00429380
add esp, 8
mov byte [ebp - 4], 0x3b
mov ebx, dword [ebp + 8]
mov edi, ebx
call fcn.0040daa0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x44]
call fcn.0040b950
push esi
push ebx
call fcn.00474670
add esp, 8
lea edx, [ebp - 0x94]
push edx
call fcn.00474100
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp + 0x2c]
cmp dword [eax - 0xc], 0
je 0x47be35
lea eax, [ebp + 0x2c]
jmp 0x47be4c
lea ecx, [ebp - 0x50]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b8a0
mov byte [ebp - 4], 0x3d
or dword [ebp - 0x24], 0x200
lea edi, [ebp - 0x94]
call fcn.0040daa0
mov dword [ebp - 4], 0x3c
test dword [ebp - 0x24], 0x200
je 0x47be76
and dword [ebp - 0x24], 0xfffffdff
lea ecx, [ebp - 0x50]
call fcn.0040b950
mov eax, ebx
lea edi, [ebp - 0x78]
call fcn.0040daa0
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x47be9f
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0x94]
push eax
push esi
call fcn.0047a410
add esp, 0x10
lea ecx, [ebp - 0x94]
push ecx
mov edi, dword [ebp + 0x18]
add edi, 0x1c
call fcn.0048d6a0
cmp byte [ebp + 0x20], 0
jne 0x47bece
push 0
push 0
push 0x6d49f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov byte [ebp - 0x2c], 0
jne 0x47bed2
mov byte [ebp - 0x2c], 1
xor edi, edi
mov edx, dword [ebp - 0x2c]
push edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push ebx
push eax
call fcn.0040b840
mov byte [ebp - 4], 0x3e
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
lea edx, [ebp - 0x94]
push edx
push ecx
call fcn.0040b840
mov byte [ebp - 4], 0x3f
push esi
mov byte [ebp - 4], 0x3c
mov ecx, edi
mov esi, dword [ebp + 0x18]
call fcn.0047a200
add esp, 0x10
push 0x6eac10
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0xa0], edi
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x84]
sar eax, 2
cmp edi, eax
jae 0x47bf90
push 0x6eac0c
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0x6eac10
call esi
mov ecx, dword [ebp - 0x2c]
push ecx
push ecx
mov edx, esp
mov dword [ebp - 0x50], esp
push ebx
push edx
call fcn.0040b840
mov byte [ebp - 4], 0x40
lea esi, [ebp - 0x90]
call fcn.00467500
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push eax
push ecx
call fcn.0040b840
mov byte [ebp - 4], 0x41
mov edx, dword [ebp + 0xc]
push edx
mov byte [ebp - 4], 0x3c
xor ecx, ecx
mov esi, dword [ebp + 0x18]
call fcn.0047a200
add esp, 0x10
inc edi
jmp 0x47bf1d
mov eax, dword [0x6eac10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push ecx
mov ecx, str.ManualFound
call fcn.0040b8a0
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x3c
call fcn.00441df0
cmp byte [ebp + 0x20], 0
jne 0x47bfd1
push 0
push 0
push 0x6d49f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x47c108
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0x84]
sar edx, 2
inc edx
mov eax, dword [ebp + 0xc]
add dword [eax + 0x40], edx
push 1
mov esi, ebx
call fcn.0040bd40
sub esp, 0x1c
mov dword [ebp - 0x50], esp
mov ecx, esp
call fcn.0040b2d0
mov byte [ebp - 4], 0x43
sub esp, 0x1c
mov dword [ebp - 0x64], esp
mov esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, esp
call fcn.0040b2d0
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x3c
call fcn.00476000
add esp, 0x3c
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.0040b8a0
mov byte [ebp - 4], 0x45
push ebx
lea ecx, [ebp - 0x34]
call fcn.00435770
add esp, 4
test al, al
sete byte [ebp - 0x3d]
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x34]
call fcn.0040b950
cmp byte [ebp - 0x3d], 0
je 0x47c0f5
lea ecx, [ebp - 0x34]
push ecx
mov ecx, 0x69c078
call fcn.0040b8a0
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x34]
mov ecx, ebx
call fcn.00499ba0
mov bl, al
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x34]
call fcn.0040b950
test bl, bl
je 0x47c0ab
lea edx, [ebp - 0x2e]
push edx
push 1
mov eax, dword [ebp + 0x24]
push eax
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.00417570
lea ecx, [ebp - 0x50]
call fcn.0040b720
cmp byte [ebp - 0x2e], 0
jne 0x47c0b2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp - 0x80]
mov ecx, eax
sub ecx, dword [ebp - 0x84]
sar ecx, 2
cmp edi, ecx
jae 0x47c0f8
lea esi, [ebp - 0x90]
call fcn.00467500
push eax
call fcn.0042ff00
add esp, 4
test al, al
je 0x47c0f2
call fcn.00467500
push eax
call fcn.0042fff0
add esp, 4
inc edi
jmp 0x47c0b4
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x84]
sar eax, 2
inc eax
mov ecx, dword [ebp + 0x18]
add dword [ecx + 8], eax
mov byte [ebp - 4], 0x35
lea edx, [ebp - 0x94]
push edx
call fcn.0047c1b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.0040b950
mov esi, dword [ebp + 0xc]
cmp byte [ebp + 0x14], 0
je 0x47c14c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
mov edx, dword [esi]
push edx
test eax, eax
setne al
movzx ecx, al
push ecx
call fcn.00474d50
add esp, 8
inc dword [esi + 0x28]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x60]
cmp eax, 0xffffffff
je 0x47c15f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.0040b720
jmp 0x47c173
mov eax, dword [ebp + 0xc]
inc dword [eax + 0x44]
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x2c]
call fcn.0040b950
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret