Function at 0x4cf530
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1f50]
mov eax, 0x1f50
call fcn.005e00d0
push 0xfffffffffffffffe
push 0x672520
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1f4c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x1f58]
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
or ebx, 0xffffffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp + 0x131c], 0
push 0x207
push esi
lea eax, [ebp + 0x131d]
push eax
call fcn.005dfd60
mov byte [ebp + 0x1b3c], 0
push 0x207
push esi
lea ecx, [ebp + 0x1b3d]
push ecx
call fcn.005dfd60
mov byte [ebp + 0x1934], 0
push 0x103
push esi
lea edx, [ebp + 0x1935]
push edx
call fcn.005dfd60
mov byte [ebp + 0x1d44], 0
push 0x103
push esi
lea eax, [ebp + 0x1d45]
push eax
call fcn.005dfd60
add esp, 0x30
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
cmp dword [edi + 0x448], esi
je 0x4cf615
push str._GDR__Start
push esi
call fcn.004f0f30
add esp, 8
mov eax, dword [edi + 0x30c]
cmp eax, 1
je 0x4cf62e
cmp eax, 3
je 0x4cf62e
cmp eax, 4
jne 0x4cf90b
mov byte [ebp + 0x1a38], 0
push 0x103
push esi
lea ecx, [ebp + 0x1a39]
push ecx
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 1
cmp dword [edi + 0x448], esi
je 0x4cf66a
push str._GDR__GetDetectionRatio_Start
push esi
call fcn.004f0f30
add esp, 8
lea eax, [edi + 0x104]
cmp eax, esi
je 0x4cf688
cmp byte [eax], 0
je 0x4cf688
push eax
push str.https:__www.virustotal.com_file__s_analysis_
lea edx, [ebp + 0x800]
push edx
jmp 0x4cf695
push edi
push str.https:__www.virustotal.com_file__s_analysis_
lea eax, [ebp + 0x800]
push eax
call fcn.005dfb23
add esp, 0xc
mov dword [ebp - 0x1c], 2
lea ecx, [ebp + 0x1a38]
push ecx
lea edx, [ebp + 0x800]
push edx
call fcn.0040f000
add esp, 8
cmp dword [edi + 0x448], esi
je 0x4cf6d0
push str._GDR__GetDetectionRatio_End
push esi
call fcn.004f0f30
add esp, 8
mov eax, dword [edi + 0x43c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0
push 0x644dfc
lea ecx, [ebp + 0x1a38]
push ecx
call fcn.004f5880
add esp, 0xc
mov dword [ebp - 0x1c], 3
cmp eax, 0xffffffff
je 0x4cf771
mov byte [ebp + eax + 0x1a38], 0
lea edx, [ebp + 0x1a38]
push edx
call fcn.005e0909
add esp, 4
mov ebx, eax
mov dword [ebp - 0x34], ebx
cmp ebx, 0x28
jle 0x4cf771
mov ebx, 0x28
mov dword [ebp - 0x34], ebx
mov eax, dword [edi + 0x434]
push eax
call esi
mov eax, 4
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x30c], eax
je 0x4cf909
mov eax, dword [edi + 0x314]
cmp eax, 0xffffffff
je 0x4cf7a4
cmp eax, 0xfffffffe
je 0x4cf7a4
test eax, eax
jne 0x4cf75f
test ebx, ebx
je 0x4cf7a4
mov ecx, 1
cmp eax, ecx
jne 0x4cf796
test ebx, ebx
jle 0x4cf796
mov dword [ebp - 0x2c], ecx
jmp 0x4cf7ab
test ebx, ebx
jge 0x4cf77d
mov eax, dword [edi + 0x438]
jmp 0x4cf730
jne 0x4cf788
mov ecx, dword [edi + 0x42c]
push ecx
jmp 0x4cf731
cmp ebx, 1
jne 0x4cf72a
mov edx, dword [edi + 0x430]
push edx
jmp 0x4cf731
cmp eax, 7
jne 0x4cf7ab
cmp ebx, eax
jle 0x4cf7ab
mov dword [ebp - 0x2c], ecx
jmp 0x4cf7ab
mov dword [ebp - 0x2c], 1
cmp dword [edi + 0x318], 0
je 0x4cf909
cmp dword [ebp - 0x2c], 0
je 0x4cf909
lea esi, [edi + 0x208]
push 0x7c
push esi
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cf82c
cmp byte [ebp + 0x1a38], 0
je 0x4cf7fe
lea ecx, [ebp + 0x1a38]
push ecx
push esi
push str._s_:__s
lea edx, [ebp + 0x131c]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x4cf813
push esi
push str._s_:_Not_Found
lea eax, [ebp + 0x131c]
push eax
call fcn.005dfb23
add esp, 0xc
lea ecx, [ebp + 0x131c]
push ecx
push 0x60c990
call fcn.005e0e7f
add esp, 8
jmp 0x4cf909
mov byte [ebp + 0x1010], 0
push 0x103
push 0
lea edx, [ebp + 0x1011]
push edx
call fcn.005dfd60
add esp, 0xc
cmp byte [ebp + 0x1a38], 0
je 0x4cf871
lea eax, [ebp + 0x1a38]
push eax
push esi
push edi
push str._s_s_:__s
lea ecx, [ebp + 0x131c]
push ecx
call fcn.005dfb23
add esp, 0x14
jmp 0x4cf887
push esi
push edi
push str._s_s_:_Not_Found
lea edx, [ebp + 0x131c]
push edx
call fcn.005dfb23
add esp, 0x10
lea eax, [ebp + 0x131c]
push eax
push 0x60c990
call fcn.005e0e7f
add esp, 8
mov dword [ebp - 0x1c], 5
cmp dword [edi + 0x310], 2
jne 0x4cf909
cmp dword [edi + 0x30c], 1
jne 0x4cf909
cmp ebx, 0xffffffff
je 0x4cf8c1
lea ecx, [ebx - 3]
cmp ecx, 4
ja 0x4cf909
push 1
push esi
call fcn.004e53d0
add esp, 8
test eax, eax
je 0x4cf909
push esi
call fcn.004cefb0
add esp, 4
test eax, eax
je 0x4cf909
mov edx, dword [edi + 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push esi
mov eax, dword [edi + 0x428]
mov ecx, dword [eax]
push ecx
push str.Posted__u:___s____d_..._n
call fcn.005e0e7f
add esp, 0x10
mov dword [ebp - 0x38], 1
xor esi, esi
mov dword [ebp - 0x1c], 6
mov eax, dword [edi + 0x30c]
cmp eax, 2
je 0x4cf930
cmp eax, 3
je 0x4cf930
cmp eax, 4
je 0x4cf930
cmp eax, 5
jne 0x4d02be
mov byte [ebp + 0x1e48], 0
push 0x103
push esi
lea edx, [ebp + 0x1e49]
push edx
call fcn.005dfd60
mov byte [ebp + 0xc10], 0
push 0x3ff
push esi
lea eax, [ebp + 0xc11]
push eax
call fcn.005dfd60
add esp, 0x18
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 7
cmp byte [0x74a688], 0
jne 0x4cf985
push 0x74a688
call fcn.004e7aa0
add esp, 4
cmp dword [0x68fa84], esi
je 0x4cf9a6
push edi
call fcn.004dd6c0
push eax
lea ecx, [ebp + 0xc10]
push ecx
push edi
call fcn.004f99d0
add esp, 0x10
jmp 0x4cf9bb
push 0xb00b
lea edx, [ebp + 0xc10]
push edx
push edi
call fcn.004f24a0
add esp, 0xc
cmp dword [0x68fa84], esi
je 0x4cf9f8
cmp dword [edi + 0x310], esi
jne 0x4cf9de
lea eax, [ebp + 0xc10]
push eax
push 0x74a688
push str.http:__cloud3.escanav.com_getendata_default_enc.aspx_strm_sstrh_s
jmp 0x4cfa2b
lea edx, [ebp + 0xc10]
push edx
push 0x74a688
push str.http:__cloud3.escanav.com_getendata_default_enc.aspx_strm_sstrh_srr
lea eax, [ebp + 0x1114]
push eax
jmp 0x4cfa32
cmp dword [edi + 0x310], esi
jne 0x4cfa1a
lea ecx, [ebp + 0xc10]
push ecx
push 0x74a688
push str.http:__cloud.escanav.com_getendata2_default.aspx_strm_sstrh_s
lea edx, [ebp + 0x1114]
push edx
jmp 0x4cfa32
lea eax, [ebp + 0xc10]
push eax
push 0x74a688
push str.http:__cloud.escanav.com_getendata2_default.aspx_strm_sstrh_srr
lea ecx, [ebp + 0x1114]
push ecx
call fcn.005dfb23
add esp, 0x10
cmp dword [edi + 0x448], esi
je 0x4cfa50
push str._GDR__GetDetectionCount_Start
push esi
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1c], 8
lea edx, [ebp + 0x1e48]
push edx
lea eax, [ebp + 0x1114]
push eax
call fcn.0040f2c0
add esp, 8
cmp dword [edi + 0x448], esi
je 0x4cfa83
push str._GDR__GetDetectionCount_End
push esi
call fcn.004f0f30
add esp, 8
cmp byte [ebp + 0x1e48], 0
jne 0x4cfaa3
push 0x644c40
lea ecx, [ebp + 0x1e48]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4cfbb2
push 0x7c
lea edx, [ebp + 0x1e48]
push edx
call fcn.005e0940
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4cfbb2
lea esi, [ebx + 1]
push esi
call fcn.004dd6c0
add esp, 4
cmp eax, 0x103
jae 0x4cfbaf
push esi
lea eax, [ebp + 0x1d44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x7c
lea ecx, [ebp + 0x1d44]
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cfafb
mov byte [eax], 0
cmp byte [ebp + 0x1d44], 0
je 0x4cfbaf
push 0
push str.probably_a_variant_of
lea edx, [ebp + 0x1d44]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4cfb36
push 0x60c81c
push str.probably_a_variant_of
lea eax, [ebp + 0x1d44]
push eax
jmp 0x4cfb62
push 0
push str.a_variant_of
lea ecx, [ebp + 0x1d44]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4cfb6a
push 0x60c81c
push str.a_variant_of
lea edx, [ebp + 0x1d44]
push edx
call fcn.004e9030
add esp, 0xc
mov dword [ebp - 0x1c], 9
lea eax, [ebp + 0x1e48]
push eax
call fcn.005e0909
push eax
lea ecx, [ebp + 0x1d44]
push ecx
call fcn.004ae580
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4cfbaf
push eax
lea edx, [ebp + 0x1d44]
push edx
call fcn.004cf110
add esp, 8
test eax, eax
je 0x4cfbaf
mov dword [ebp - 0x28], 3
mov byte [ebx], 0
mov dword [ebp - 0x1c], 0xa
mov eax, dword [edi + 0x43c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
lea ecx, [ebp + 0x1e48]
push ecx
call fcn.005e0909
add esp, 4
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0x28
jle 0x4cfc14
mov ebx, 0x28
mov dword [ebp - 0x20], ebx
mov ecx, dword [edi + 0x434]
push ecx
call esi
mov dword [ebp - 0x1c], 0xb
mov eax, dword [edi + 0x314]
cmp eax, 0xffffffff
jne 0x4cfd15
mov dword [ebp - 0x24], 1
jmp 0x4cfd87
test ebx, ebx
jge 0x4cfcf2
mov edx, dword [edi + 0x438]
push edx
call esi
cmp ebx, 0xfffffffe
jne 0x4cfc45
mov eax, dword [str.ERROR]
mov dword [ebp + 0x1e48], eax
mov cx, word [0x610c1c]
mov word [ebp + 0x1e4c], cx
jmp 0x4cfbf2
cmp ebx, 0xffffffff
jne 0x4cfcb3
cmp dword [edi + 0x30c], 5
jne 0x4cfc89
mov edx, dword [str.Not_Processed]
mov dword [ebp + 0x1e48], edx
mov eax, dword [0x644c0c]
mov dword [ebp + 0x1e4c], eax
mov ecx, dword [0x644c10]
mov dword [ebp + 0x1e50], ecx
mov dx, word [0x644c14]
mov word [ebp + 0x1e54], dx
jmp 0x4cfbf2
mov eax, dword [str.Not_Found]
mov dword [ebp + 0x1e48], eax
mov ecx, dword [0x644c00]
mov dword [ebp + 0x1e4c], ecx
mov dx, word [0x644c04]
mov word [ebp + 0x1e50], dx
jmp 0x4cfbf2
mov eax, dword [str.Not_Found__UNKNOWN_]
mov dword [ebp + 0x1e48], eax
mov ecx, dword [0x644bec]
mov dword [ebp + 0x1e4c], ecx
mov edx, dword [0x644bf0]
mov dword [ebp + 0x1e50], edx
mov eax, dword [0x644bf4]
mov dword [ebp + 0x1e54], eax
mov ecx, dword [0x644bf8]
mov dword [ebp + 0x1e58], ecx
jmp 0x4cfbf2
jne 0x4cfd00
mov edx, dword [edi + 0x42c]
push edx
jmp 0x4cfbf0
cmp ebx, 1
jne 0x4cfbe9
mov eax, dword [edi + 0x430]
push eax
jmp 0x4cfbf0
cmp eax, 0xfffffffe
jne 0x4cfd28
cmp ebx, 0xffffffff
jne 0x4cfd28
mov dword [ebp - 0x24], 1
jmp 0x4cfd73
test eax, eax
jne 0x4cfd47
test ebx, ebx
jne 0x4cfd47
mov dword [ebp - 0x24], 1
lea ecx, [edi + 0x324]
push ecx
lea edx, [ebp + 0x1934]
push edx
jmp 0x4cfd81
mov ecx, 1
cmp eax, ecx
jne 0x4cfd67
test ebx, ebx
jle 0x4cfd67
mov dword [ebp - 0x24], ecx
lea eax, [edi + 0x324]
push eax
lea ecx, [ebp + 0x1934]
push ecx
jmp 0x4cfd81
cmp eax, 7
jne 0x4cfd87
cmp ebx, eax
jle 0x4cfd87
mov dword [ebp - 0x24], ecx
lea edx, [edi + 0x324]
push edx
lea eax, [ebp + 0x1934]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [edi + 0x318], 0
je 0x4d0249
cmp dword [ebp - 0x24], 0
je 0x4d0249
mov byte [ebp + 0x1830], 0
push 0x103
push 0
lea ecx, [ebp + 0x1831]
push ecx
call fcn.005dfd60
mov byte [ebp + 0x172c], 0
push 0x103
push 0
lea edx, [ebp + 0x172d]
push edx
call fcn.005dfd60
add esp, 0x18
lea esi, [edi + 0x208]
push esi
lea eax, [ebp + 0x172c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x7c
lea ecx, [ebp + 0x172c]
push ecx
call fcn.005e0940
add esp, 8
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4cff91
mov byte [eax], 0
inc eax
mov dword [ebp - 0x30], eax
push eax
lea edx, [ebp + 0x1830]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [ebp + 0x1524], 0
push 0x103
push 0
lea eax, [ebp + 0x1525]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x1c], 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp + 0x1524]
push ecx
lea edx, [ebp + 0x1830]
push edx
call fcn.004fe960
cmp eax, 1
jne 0x4cff85
lea eax, [ebp + 0x172c]
push eax
lea ecx, [ebp + 0x1524]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4cff85
cmp byte [ebp + 0x1e48], al
je 0x4cff49
cmp dword [edi + 0x30c], 5
jne 0x4cfef2
cmp ebx, 0x10
jle 0x4cfea7
push 0x10
push esi
push str._s_:_eScan.Cloud.Malicious._u
jmp 0x4d00cb
cmp ebx, 2
jge 0x4cfec6
push esi
push str._s_:_eScan.Cloud.Clean
lea eax, [ebp + 0x1b3c]
push eax
call fcn.005dfb23
add esp, 0xc
jmp 0x4d00da
cmp ebx, 7
jg 0x4cfee5
push esi
push str._s_:_eScan.Cloud.AboveAvgRep.2.7
lea ecx, [ebp + 0x1b3c]
push ecx
call fcn.005dfb23
add esp, 0xc
jmp 0x4d00da
push 0x10
push esi
push str._s_:_eScan.Cloud.BelowAvgRep.7._u
jmp 0x4d00cb
lea eax, [ebp + 0x1e48]
lea ecx, [ebp + 0x1b3c]
cmp byte [ebp + 0x1d44], 0
jne 0x4cff14
push eax
push esi
push str._s_:__s
push ecx
jmp 0x4d00d2
lea edx, [ebp + 0x1d44]
push edx
push eax
push esi
cmp dword [ebp - 0x28], 0
je 0x4cff36
push str._s_:__s____s__
push ecx
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
push str._s_:__s___s_
push ecx
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
push esi
cmp dword [edi + 0x30c], 5
jne 0x4cff6c
push str._s_:_Not_Processed
lea edx, [ebp + 0x1b3c]
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x4d00da
push str._s_:_Not_Found
lea eax, [ebp + 0x1b3c]
push eax
call fcn.005dfb23
add esp, 0xc
jmp 0x4d00da
mov byte [ebp + 0x1934], 0
jmp 0x4d00da
mov dword [ebp - 0x1c], 0xd
push esi
lea ecx, [ebp + 0x1830]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp + 0x1e48], 0
je 0x4d00ad
cmp dword [edi + 0x30c], 5
jne 0x4d0055
test ebx, ebx
jl 0x4d0033
cmp ebx, 0x10
jle 0x4cffe6
push 0x10
push esi
push edi
push str._s_s_:_eScan.Cloud.Malicious._u
lea edx, [ebp + 0x1b3c]
push edx
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
cmp ebx, 2
jge 0x4cfffe
push esi
push edi
push str._s_s_:_eScan.Cloud.Clean
lea eax, [ebp + 0x1b3c]
push eax
jmp 0x4d00d2
cmp ebx, 7
jg 0x4d0016
push esi
push edi
push str._s_s_:_eScan.Cloud.AboveAvgRep.2.7
lea ecx, [ebp + 0x1b3c]
push ecx
jmp 0x4d00d2
push 0x10
push esi
push edi
push str._s_s_:_eScan.Cloud.BelowAvgRep.7._u
lea edx, [ebp + 0x1b3c]
push edx
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
lea eax, [ebp + 0x1e48]
push eax
push esi
push edi
push str._s_s_:__s
lea ecx, [ebp + 0x1b3c]
push ecx
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
lea edx, [ebp + 0x1e48]
lea eax, [ebp + 0x1b3c]
cmp byte [ebp + 0x1d44], 0
jne 0x4d007d
push edx
push esi
push edi
push str._s_s_:__s
push eax
call fcn.005dfb23
add esp, 0x14
jmp 0x4d00da
lea ecx, [ebp + 0x1d44]
push ecx
push edx
push esi
push edi
cmp dword [ebp - 0x28], 0
je 0x4d009d
push str._s_s_:__s____s__
push eax
call fcn.005dfb23
add esp, 0x18
jmp 0x4d00da
push str._s_s_:__s___s_
push eax
call fcn.005dfb23
add esp, 0x18
jmp 0x4d00da
push esi
push edi
cmp dword [edi + 0x30c], 5
jne 0x4d00c6
push str._s_s_:_Not_Processed
lea ecx, [ebp + 0x1b3c]
push ecx
jmp 0x4d00d2
push str._s_s_:_Not_Found
lea edx, [ebp + 0x1b3c]
push edx
call fcn.005dfb23
add esp, 0x10
mov dword [ebp - 0x1c], 0xe
cmp byte [ebp + 0x1934], 0
je 0x4d0249
xor esi, esi
cmp dword [0x74a030], esi
je 0x4d0103
push 0x749db8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 1
mov dword [ebp - 0x40], ebx
cmp dword [0x74a680], esi
jne 0x4d01ae
mov dword [0x74a680], ebx
cmp dword [0x74a67c], esi
jne 0x4d01ae
push 0x74a67c
call fcn.004a5710
add esp, 4
cmp dword [0x74a67c], esi
je 0x4d01ae
call fcn.004d96c0
test eax, eax
je 0x4d01ae
push str._pf_eScan_
lea eax, [ebp + 0x1628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea ecx, [ebp + 0x1628]
push ecx
call fcn.00515650
push esi
push 0x61b06c
lea edx, [ebp + 0x1628]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4d0199
push 0x60c81c
push 0x61b06c
lea eax, [ebp + 0x1628]
push eax
call fcn.004e9030
add esp, 0xc
push 1
push 0x2c
lea ecx, [ebp + 0x1628]
push ecx
push 0x74a67c
call fcn.004e5820
mov dword [ebp - 0x1c], 0xf
cmp dword [0x74a030], esi
je 0x4d01c8
push 0x749db8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x74a67c]
cmp eax, esi
je 0x4d0229
mov dword [ebp - 0x3c], esi
push 1
push esi
push 0x2c
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x3c], 0xffffffff
je 0x4d0229
lea edx, [ebp + 0xa08]
push edx
lea eax, [ebp + 0x1830]
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4d0212
mov dword [ebp - 0x40], esi
jmp 0x4d0249
push 1
push esi
push 0x2c
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp + 0xa08]
push edx
mov eax, dword [0x74a67c]
jmp 0x4d01e4
cmp ebx, esi
je 0x4d0249
push 0
push 0
push 0
lea ecx, [ebp + 0x1934]
push ecx
lea edx, [ebp + 0x1830]
push edx
call fcn.004ef320
add esp, 0x14
mov dword [ebp - 0x1c], 0x10
cmp dword [edi + 0x310], 2
jne 0x4d02be
cmp dword [ebp - 0x30], 0
jne 0x4d02be
mov ebx, dword [ebp - 0x20]
cmp ebx, 0xffffffff
je 0x4d0270
dec ebx
cmp ebx, 6
ja 0x4d02be
mov ebx, dword [ebp - 0x20]
lea esi, [edi + 0x208]
push 1
push esi
call fcn.004e53d0
add esp, 8
test eax, eax
je 0x4d02be
push esi
call fcn.004cefb0
add esp, 4
test eax, eax
je 0x4d02be
mov eax, dword [edi + 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push esi
mov ecx, dword [edi + 0x428]
mov edx, dword [ecx]
push edx
push str.Posted__u:___s____d_..._n
call fcn.005e0e7f
add esp, 0x10
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x1c], 0x11
cmp dword [0x74a030], 0
je 0x4d02d9
push 0x749db8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x74a578], 0
jne 0x4d0318
push 0x74a578
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [0x74a578], 0
je 0x4d0318
push 0x74a578
call fcn.004e24e0
add esp, 4
push str.HASHVTP.DAT
push 0x74a578
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x1c], 0x12
cmp byte [0x74a470], 0
jne 0x4d035e
push 0x74a470
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [0x74a470], 0
je 0x4d035e
push 0x74a470
call fcn.004e24e0
add esp, 4
push str.HASHFP.DAT
push 0x74a470
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x30], 0
je 0x4d03e4
cmp dword [edi + 0x310], 1
jne 0x4d03e4
cmp esi, 7
ja 0x4d03e4
cmp byte [ebp + 0x1d44], 0
je 0x4d03b3
push 0x60c81c
push str.__ES_
lea eax, [ebp + 0x1d44]
push eax
call fcn.004e9030
push esi
lea ecx, [ebp + 0x1d44]
push ecx
push edi
push str._s_s___u_
lea edx, [ebp + 0x400]
push edx
call fcn.005dfb23
add esp, 0x20
jmp 0x4d03ce
push esi
push str.HashFP
push edi
push str._s_s___u_
lea eax, [ebp + 0x400]
push eax
call fcn.005dfb23
add esp, 0x14
push 1
lea ecx, [ebp + 0x400]
push ecx
push 0x74a470
call fcn.004e1620
add esp, 0xc
mov dword [ebp - 0x1c], 0x13
cmp dword [edi + 0x448], 0
je 0x4d0403
push str._GDR__End
push 0
call fcn.004f0f30
add esp, 8
cmp byte [0x74a578], 0
je 0x4d043b
cmp dword [ebp - 0x38], 0
je 0x4d043b
lea edx, [edi + 0x208]
push edx
push edi
push 0x61c9ec
lea eax, [ebp]
push eax
call fcn.005dfb23
push 1
lea ecx, [ebp]
push ecx
push 0x74a578
call fcn.004e1620
add esp, 0x1c
cmp byte [ebp + 0x1b3c], 0
je 0x4d0458
lea edx, [ebp + 0x1b3c]
push edx
push 0x60c990
call fcn.005e0e7f
add esp, 8
cmp dword [0x74a030], 0
je 0x4d046c
push 0x749db8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x1c], 0x14
cmp dword [edi + 0x30c], 4
jne 0x4d04a4
mov eax, dword [ebp - 0x34]
cmp esi, eax
je 0x4d04a4
push esi
push eax
push edi
push str.Count_Differs___s___FromVT:___d___FromES:___d_
call fcn.004fbb50
lea eax, [edi + 0x208]
push eax
push str.Filename:___s_
call fcn.004fbb50
add esp, 0x18
mov dword [ebp - 0x1c], 0x15
mov eax, dword [edi + 0x320]
test eax, eax
je 0x4d04d6
cmp dword [0x74a02c], 0
jne 0x4d04d6
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp + 0x1d44]
push edx
push esi
add edi, 0x31c
push edi
call eax
add esp, 0x10
mov dword [ebp - 0x1c], 0x16
jmp 0x4d04fb
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1f4c]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x1f50
mov esp, ebp
pop ebp
ret