Function at 0x48c800
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb946
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x162c
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [ebp - 0x108], eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x10c], eax
lea edx, [ebp - 0x51c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x19c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x83c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x51c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 3
jge 0x48c980
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x51c], 0x5c
jne 0x48c99f
mov eax, str.NORMAL
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x51c]
push 0x516860
push eax
call fcn.004f2d80
add esp, 8
mov edi, 1
test eax, eax
je 0x48c9bf
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x51c]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48c9da
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x51c]
push str..TMP
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48c9f5
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x51c]
push str._temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ca10
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x51c]
push str.Temp_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ca2b
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x51c]
push str.TEMP_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ca46
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x51c]
push str.Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ca61
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x51c]
push str..dll_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48caa9
lea ecx, [ebp - 0x51c]
push str..Dll_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48caa9
lea ecx, [ebp - 0x51c]
push str..DLL_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48caf3
lea edx, [ebp - 0x51c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0xe56c90]
push 0x51f348
inc esi
mov dword [0xe56c90], esi
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x51c]
xor edx, edx
cmp al, 0x25
mov dword [ebp + 8], 0
jne 0x48cb08
mov edx, edi
lea eax, [esi - 2]
test eax, eax
jle 0x48cb33
mov cl, byte [ebp + eax - 0x51c]
cmp cl, 0x3a
jne 0x48cb25
cmp byte [ebp + eax - 0x51b], 0x5c
je 0x48cb33
cmp edx, edi
jne 0x48cb2e
cmp cl, 0x5c
je 0x48cb3b
dec eax
test eax, eax
jg 0x48cb0f
cmp edx, edi
jne 0x48cbe5
sub esi, eax
xor ecx, ecx
lea edx, [esi - 1]
test edx, edx
jle 0x48cb67
lea eax, [ebp + eax - 0x51b]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0xe3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [ebp + ecx - 0xe3c], 0
lea edi, [ebp - 0xe3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x51c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x19c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x51c]
push ecx
push edx
push str._s_s
push eax
call fcn.004f175f
lea edi, [ebp - 0xd3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x51c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x48cc33
cmp eax, esi
je 0x48cc33
mov edx, esi
test esi, esi
mov dword [ebp + 8], edx
jle 0x48cc04
cmp byte [ebp + edx - 0x51c], 0x2e
je 0x48cc01
dec edx
test edx, edx
jg 0x48cbf2
mov dword [ebp + 8], edx
mov esi, edx
xor ecx, ecx
sub esi, eax
mov byte [ebp - 0x51c], 0
add esi, 5
test esi, esi
jle 0x48cc2b
lea edi, [eax + ebx - 1]
mov al, byte [edi + ecx]
mov byte [ebp + ecx - 0x51c], al
inc ecx
cmp ecx, esi
jl 0x48cc1c
mov byte [ebp + edx - 0x517], 0
lea edi, [ebp - 0x51c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48cc56
cmp byte [ebp + ecx - 0x51c], 0x2e
je 0x48cc56
dec ecx
test ecx, ecx
jg 0x48cc47
mov eax, dword [ebp + 8]
mov byte [ebp + ecx - 0x518], 0
test eax, eax
jne 0x48cc83
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x51c]
push ecx
call fcn.004ab3c0
mov edi, eax
mov ebx, 1
add esp, 4
cmp edi, ebx
jge 0x48ccbb
push 0x51f318
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, str.cmmdjxsjcl.dll
lea edx, [ebp - 0x83c]
push esi
push edx
lea eax, [ebp - 0xd3c]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0xd3c]
lea edx, [ebp - 0x51c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x48cd32
add esi, 0x80
cmp esi, str.VRVWatchServer
jl 0x48ccc0
lea eax, [ebp - 0x79c]
lea ecx, [ebp - 0x51c]
push eax
push ecx
mov dword [ebp - 0xd8], edi
call fcn.004d9590
movsx eax, ax
add esp, 8
cmp eax, ebx
mov dword [ebp - 0xcc], eax
jge 0x48cd50
cmp edi, 0x64000
jle 0x48cda8
push 0x51f178
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x3c000
jle 0x48cda8
lea edx, [ebp - 0x79c]
push str.Microsoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48cda8
lea eax, [ebp - 0x79c]
lea ecx, [ebp - 0xd3c]
push eax
push 0x51f160
push ecx
call fcn.004f175f
lea edx, [ebp - 0xd3c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x79c]
xor esi, esi
push str.Microsoft
push eax
mov dword [ebp - 0x2c], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48cdca
mov esi, ebx
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x83c]
lea edx, [ebp - 0x29c]
push ecx
push str._s_twain.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48ce1a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x83c]
lea eax, [ebp - 0x29c]
push edx
push str._s_twain_32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48ce6a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x83c]
lea ecx, [ebp - 0x29c]
push eax
push str._sdaemon.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48ceba
push 0x526050
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._s_advapi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48cf0a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sWS2_32.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48cf5a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._swsock32.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48cfaa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._sWINMM.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48cffa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._smswsock.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d04a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._smsgina.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d09a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._swsock32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d0ea
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sws2_32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d13a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._sCOMCTL32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d18a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._sSETUPAPI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d1da
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sNETUI1.DLl
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d22a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._sMSI.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d27a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._sSHELL32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d2ca
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._ses.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d31a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._surlmon.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d36a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._smshtml.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d3ba
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._smfc42u.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d40a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._smprapi.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d45a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._sole32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d4aa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._scrypt32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d4fa
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._scryptui.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d54a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._s_shlwapi.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d59a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sinetcomm.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d5ea
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._smsvbvm60.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d63e
cmp esi, ebx
jne 0x48d63e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._soleaut32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d692
cmp esi, ebx
jne 0x48d692
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._swinsrv.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d6e6
cmp esi, ebx
jne 0x48d6e6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._sCLBCATQ.DLL
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d73a
cmp esi, ebx
jne 0x48d73a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._smsv1_0.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d78e
cmp esi, ebx
jne 0x48d78e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sole32.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d7e2
cmp esi, ebx
jne 0x48d7e2
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._scomdlg32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d836
cmp esi, ebx
jne 0x48d836
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._s_netapi32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d88a
cmp esi, ebx
jne 0x48d88a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._s_sfc.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d8de
cmp esi, ebx
jne 0x48d8de
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._s_sfc_os.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d932
cmp esi, ebx
jne 0x48d932
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._siphlpapi.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d986
cmp esi, ebx
jne 0x48d986
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sWMI.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48d9da
cmp esi, ebx
jne 0x48d9da
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._sCOMRes.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48da2e
cmp esi, ebx
jne 0x48da2e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._smsgina.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48da82
cmp esi, ebx
jne 0x48da82
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._smsvcrt.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48dad6
cmp esi, ebx
jne 0x48dad6
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._s_advapi32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48db2a
cmp esi, ebx
jne 0x48db2a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._suser32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48db7e
cmp esi, ebx
jne 0x48db7e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
push edx
push str._sgdi32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51c]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48dbd2
cmp esi, ebx
jne 0x48dbd2
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x29c]
push eax
push str._sWINSTA.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48dc26
cmp esi, ebx
jne 0x48dc26
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x19c]
lea edx, [ebp - 0x29c]
push ecx
push str._sUSERENV.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x29c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x48dc7a
cmp esi, ebx
jne 0x48dc7a
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x51c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48dcae
lea esi, [ebp + ecx - 0x51c]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0x13bc], dl
jne 0x48dca8
cmp eax, 2
jge 0x48dcae
inc eax
dec esi
cmp eax, ecx
jl 0x48dc95
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x48dcd5
mov ebx, ecx
lea esi, [ebp - 0x51c]
lea edi, [ebp - 0x103c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0x103c], 0
test eax, eax
jle 0x48dd08
lea esi, [ebp + edx - 0x51b]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x48dcfb
mov byte [ebp + ecx - 0x13bc], dl
jne 0x48dd03
mov byte [ebp + ecx - 0x13bc], 0
inc ecx
cmp ecx, eax
jl 0x48dcea
mov byte [ebp + eax - 0x13bc], 0
mov al, byte [ebp - 0x103a]
cmp al, 0x5c
je 0x48dd28
mov byte [ebp - 0x103a], 0x5c
mov byte [ebp - 0x1039], 0
cmp byte [ebp - 0x103b], 0x3a
je 0x48dded
lea edi, [ebp - 0x103c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x48dd5b
cmp byte [ebp + eax - 0x103c], 0x3a
je 0x48dd5b
inc eax
cmp eax, ecx
jl 0x48dd4c
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x48dd8b
mov ecx, edi
lea esi, [ebp + eax - 0x103d]
mov ebx, ecx
lea edi, [ebp - 0x113c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x113b], 0
jne 0x48ddc4
lea edx, [ebp - 0x31c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x31c]
lea ecx, [ebp - 0x113c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
add esp, 0xc
lea edi, [ebp - 0x113c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x103c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x103a], 0x5c
je 0x48ddfd
mov byte [ebp - 0x103a], 0x5c
lea ecx, [ebp - 0x51c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
je 0x48de2e
push 0x516c58
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x103b], 0x3a
je 0x48de55
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x103a], 0x5c
je 0x48de65
mov byte [ebp - 0x103a], 0x5c
lea edi, [ebp - 0x13bc]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48de90
cmp byte [ebp + eax - 0x13bc], 0x2e
jne 0x48de87
mov edx, ebx
inc eax
cmp eax, ecx
jl 0x48de7b
test edx, edx
jne 0x48deae
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0x13b8], 0
jge 0x48ded9
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x19c]
push 0x80
push edx
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x83c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x51c]
push 0x100
lea edx, [ebp - 0xabc]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x13bc]
push 0x40
lea ecx, [ebp - 0x87c]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x51c]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
mov dword [ebp - 0x114], esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x48df75
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x51c]
push 0x80
lea ecx, [ebp - 0xbbc]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0x51c]
push 0x80
lea eax, [ebp - 0xb3c]
push edx
push eax
call fcn.004f27c0
lea edi, [ebp - 0x83c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x19c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xbbc], al
lea edx, [ebp - 0xbbc]
mov byte [ebp + ecx - 0xb3c], al
lea ecx, [ebp - 0x83c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x48e020
push 0x5144fc
push esi
mov dword [ebp - 0x3c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e020
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0xb3c]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e06d
push 0x5144fc
push esi
mov dword [ebp - 0x3c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e06d
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x51c]
push str.System32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48e0b8
push 0x5144fc
push esi
mov dword [ebp - 0x3c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e0b8
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x51c]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48e103
push 0x5144fc
push esi
mov dword [ebp - 0x3c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e103
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x51c]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48e14e
push 0x5144fc
push esi
mov dword [ebp - 0x3c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e14e
push 0x5147b4
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x103c]
push 0x20
lea eax, [ebp - 0xc3c]
push edx
push eax
call fcn.004f27c0
xor esi, esi
xor edi, edi
push 0xd53b20
mov byte [ebp - 0xc35], 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x40], edi
mov dword [ebp + 8], esi
call fcn.004a6b50
add esp, 0x10
lea ecx, [ebp - 0x51c]
push 0xd53b20
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, esi
jne 0x48e1de
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x51c]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, ebx
jmp 0x48e8fa
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 1
push eax
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov dword [ebp - 0x110], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, esi
mov dword [ebp - 0x90], eax
jne 0x48e23f
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
jmp 0x48e8bd
mov dword [ebp - 0x18], esi
cmp dword [eax + 0x10], esi
je 0x48e8bb
mov edx, dword [eax + 0xc]
mov eax, dword [0xd53b28]
mov ecx, dword [ebp - 0x110]
push edx
push eax
push ecx
call fcn.004a6c30
add esp, 0xc
mov edi, eax
mov eax, dword [ebp - 0x20]
inc eax
push 0x515c98
push edi
mov dword [ebp - 0x20], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x11c], eax
call fcn.004f61e0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x118], eax
cmp esi, 0x69
jge 0x48e333
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48e32d
cmp esi, 0xf
jle 0x48e2ce
cmp esi, 0x12
jge 0x48e2ce
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1d
je 0x48e2dd
cmp esi, 0x1e
je 0x48e2dd
cmp esi, 0x39
jne 0x48e2e0
mov dword [ebp - 0x54], ebx
cmp esi, 0x1f
je 0x48e2ea
cmp esi, 0x20
jne 0x48e2ed
mov dword [ebp - 0x64], ebx
cmp esi, 0x21
je 0x48e2f7
cmp esi, 0x22
jne 0x48e2fa
mov dword [ebp - 0x78], ebx
cmp esi, 0x23
je 0x48e304
cmp esi, 0x24
jne 0x48e307
mov dword [ebp - 0x58], ebx
cmp esi, 0x2c
jne 0x48e312
mov dword [ebp - 0x60], ebx
inc esi
jmp 0x48e29e
cmp esi, 0x2d
je 0x48e32a
cmp esi, 0x2e
jne 0x48e325
mov dword [ebp - 0x6c], ebx
inc esi
jmp 0x48e29e
cmp esi, 0x3d
jne 0x48e32d
mov dword [ebp - 0x34], ebx
inc esi
jmp 0x48e29e
mov eax, dword [0xd53b28]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x100], 0
call fcn.004a6bb0
mov ecx, dword [0xd53b28]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0xfc], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x18]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x48e379
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x28], eax
push eax
mov eax, dword [0xd53b28]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x48e8bb
mov eax, dword [eax]
test eax, eax
je 0x48e861
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x48e402
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x9bc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x9bc]
jmp 0x48e482
mov ecx, dword [0xd53b28]
push eax
push ecx
push esi
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48e439
xor edx, edx
lea eax, [ebp - 0x7bc]
mov dx, word [esi]
push edx
push str._04lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x48e482
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x99c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x99c]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x48e7d6
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48e7d0
cmp esi, 0x45
jne 0x48e557
lea edx, [ebp - 0x31c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x31c]
lea ecx, [ebp - 0x11bc]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x11bc]
push edx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x48e51c
lea eax, [ebp - 0x79c]
lea ecx, [ebp - 0xe3c]
push eax
push 0x5153f4
push ecx
jmp 0x48e52f
lea edx, [ebp - 0x79c]
lea eax, [ebp - 0xe3c]
push edx
push 0x5153c4
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0xe3c]
push ecx
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x48e564
mov dword [ebp - 0x38], edi
inc esi
jmp 0x48e489
cmp esi, edi
jne 0x48e571
mov dword [ebp - 0x48], edi
inc esi
jmp 0x48e489
cmp esi, 2
je 0x48e7d0
cmp esi, 4
jne 0x48e58b
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x48e489
cmp esi, 5
jne 0x48e59c
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x48e489
cmp esi, 6
jne 0x48e5ad
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x48e489
cmp esi, 7
jne 0x48e5be
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x48e489
cmp esi, 8
jne 0x48e5cf
mov dword [ebp - 0x98], edi
inc esi
jmp 0x48e489
cmp esi, 9
jne 0x48e5e0
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x48e489
cmp esi, 0xa
jne 0x48e5ee
mov dword [ebp - 0x74], edi
inc esi
jmp 0x48e489
cmp esi, 0xb
jle 0x48e5fb
cmp esi, 0xf
jge 0x48e5fe
mov dword [ebp - 0x44], edi
cmp esi, 0xf
jne 0x48e60c
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x48e489
jle 0x48e616
cmp esi, 0x12
jge 0x48e616
mov dword [ebp - 0x7c], edi
cmp esi, 0x1b
jne 0x48e627
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x48e489
cmp esi, 0x1c
jne 0x48e638
mov dword [ebp - 0x94], edi
inc esi
jmp 0x48e489
cmp esi, 0x1d
je 0x48e647
cmp esi, 0x1e
je 0x48e647
cmp esi, 0x39
jne 0x48e64a
mov dword [ebp - 0x54], edi
cmp esi, 0x1f
je 0x48e654
cmp esi, 0x20
jne 0x48e657
mov dword [ebp - 0x64], edi
cmp esi, 0x21
je 0x48e661
cmp esi, 0x22
jne 0x48e664
mov dword [ebp - 0x78], edi
cmp esi, 0x23
je 0x48e66e
cmp esi, 0x24
jne 0x48e671
mov dword [ebp - 0x58], edi
cmp esi, 0x25
je 0x48e67b
cmp esi, 0x26
jne 0x48e681
mov dword [ebp - 0xf8], edi
cmp esi, 0x27
jne 0x48e692
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x48e489
cmp esi, 0x28
jne 0x48e6a0
mov dword [ebp - 0x68], edi
inc esi
jmp 0x48e489
cmp esi, 0x29
jne 0x48e6b1
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x48e489
cmp esi, 0x2c
jne 0x48e6bf
mov dword [ebp - 0x60], edi
inc esi
jmp 0x48e489
cmp esi, 0x2d
jne 0x48e6cd
mov dword [ebp - 0x34], edi
inc esi
jmp 0x48e489
cmp esi, 0x2e
jne 0x48e6db
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x48e489
cmp esi, 0x2f
jne 0x48e6ec
inc esi
jmp 0x48e489
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x11c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x40], ecx
jne 0x48e7ea
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x118], edi
jne 0x48e7f8
inc dword [ebp - 0xd0]
cmp dword [ebp - 0x40], 0x2710
jg 0x48e861
mov esi, dword [ebp - 0x100]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x100], esi
mov esi, dword [ebp - 0xfc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
mov eax, ecx
jmp 0x48e397
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x90]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x90], eax
mov ebx, 1
xor esi, esi
jmp 0x48e242
xor esi, esi
mov edx, dword [0xd53b28]
mov dword [ebp - 4], esi
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
add esp, 4
cmp eax, esi
mov dword [ebp - 0xfc], eax
jne 0x48e969
mov dword [ebp + 8], 6
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ebx, 1
mov edx, dword [0xd53b28]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x48e936
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd53b20
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x48eaa1
push 0x515b6c
call fcn.004fa6c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xd53b28]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov ecx, dword [ebp - 0xfc]
cmp bx, word [ecx + 2]
jae 0x48e8e8
xor edx, edx
push str..asp
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov byte [ebp - 0x80], dl
mov eax, dword [edi]
mov dword [ebp - 0x88], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x88]
mov dword [ebp - 0x84], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x48e9d0
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x88]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48e9eb
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x88]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48ea06
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x88]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48ea21
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x88]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48ea3c
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x88]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48ea57
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x28]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x28], eax
jg 0x48e8e8
add edi, 0x28
inc ebx
jmp 0x48e97e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], edi
test esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
je 0x48f1d2
cmp edi, ebx
jge 0x48f1d2
lea ecx, [ebp - 0x103c]
xor esi, esi
push ecx
mov dword [ebp - 0x20], esi
call fcn.004f2beb
jmp 0x48eae4
lea edx, [ebp - 0x13bc]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0xe3c]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath2.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x48eb15
push ebx
lea ecx, [ebp - 0x2e4]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, ebx
mov dword [ebp - 0x28], eax
jne 0x48eb42
lea ecx, [ebp - 0xe3c]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x48eb56
lea edx, [ebp - 0xabc]
push str.c:endpcachemonitor_procPath2.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x2e4]
push eax
push ebx
push str.c:endpcachemonitor_procPath2.txt
mov dword [ebp + 8], esi
call fcn.004f0727
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x2e0]
cmp dword [eax + 0x30], 0xffffffff
jne 0x48eba2
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
jmp 0x48ed5a
mov edi, dword [ebp - 0x2e0]
push 0xa
lea eax, [ebp - 0x97c]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2e0], edi
call fcn.004f0ae9
lea edi, [ebp - 0x97c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x48f164
lea ecx, [ebp - 0x97c]
push str.Bound_to
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48f164
lea edx, [ebp - 0x97c]
push str.Dump_of
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48f164
lea eax, [ebp - 0x97c]
push str.File_Type
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48f164
lea ecx, [ebp - 0x97c]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ec53
mov dword [ebp - 0x10c], ebx
lea edx, [ebp - 0x97c]
push str.EXEHDR_to_dump_it
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ec75
push 0x5147b4
jmp 0x48ed52
cmp dword [ebp - 0x50], ebx
jne 0x48ec7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x30], ebx
jne 0x48ec85
inc dword [ebp - 0x1c]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x48f161
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x97c]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x48f15b
mov ecx, dword [ebp - 0x108]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x108], ecx
jne 0x48ed89
lea edx, [ebp - 0x11bc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x11bc]
lea ecx, [ebp - 0x143c]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x143c]
push edx
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x48ed30
lea edx, [ebp - 0x79c]
lea eax, [ebp - 0xd3c]
push edx
push 0x5153f4
push eax
jmp 0x48ed43
lea ecx, [ebp - 0x79c]
lea edx, [ebp - 0xd3c]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xd3c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x2d0]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x2d0]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x48ee09
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x20], edx
jle 0x48eda9
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x97c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x97c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x97c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x48ee81
test ebx, ebx
jne 0x48ee81
test eax, eax
jne 0x48ee81
mov dword [ebp - 0x30], eax
mov ebx, 1
inc esi
jmp 0x48ec89
cmp esi, 0x1a
jne 0x48ee95
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x20], edx
jle 0x48ee2d
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x97c]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x97c]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x97c]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x48ee81
test ebx, ebx
jne 0x48ee81
test eax, eax
jne 0x48ee81
mov dword [ebp - 0x30], eax
mov ebx, 1
inc esi
jmp 0x48ec89
xor edi, edi
mov dword [ebp - 0x30], 1
mov ebx, 1
inc esi
jmp 0x48ec89
cmp esi, 0x2a
jne 0x48eeac
mov dword [ebp - 0x50], edi
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x30], edi
inc esi
jmp 0x48ec89
cmp esi, 0x2b
jne 0x48eec3
mov dword [ebp - 0x50], edi
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x30], edi
inc esi
jmp 0x48ec89
cmp esi, edi
jne 0x48eed0
mov dword [ebp - 0x38], ebx
inc esi
jmp 0x48ec89
cmp esi, ebx
jne 0x48eedd
mov dword [ebp - 0x48], ebx
inc esi
jmp 0x48ec89
cmp esi, 2
je 0x48f15b
cmp esi, 4
jne 0x48eef7
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x48ec89
cmp esi, 5
jne 0x48ef08
mov dword [ebp - 0xa0], ebx
inc esi
jmp 0x48ec89
cmp esi, 6
jne 0x48ef19
mov dword [ebp - 0xf4], ebx
inc esi
jmp 0x48ec89
cmp esi, 7
jne 0x48ef2a
mov dword [ebp - 0xb0], ebx
inc esi
jmp 0x48ec89
cmp esi, 8
jne 0x48ef3b
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x48ec89
cmp esi, 9
jne 0x48ef4c
mov dword [ebp - 0xb8], ebx
inc esi
jmp 0x48ec89
cmp esi, 0xa
jne 0x48ef5a
mov dword [ebp - 0x74], ebx
inc esi
jmp 0x48ec89
cmp esi, 0xb
jle 0x48ef67
inc esi
jmp 0x48ec89
inc dword [ebp + 8]
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x2dc], 1
je 0x48eba2
lea ecx, [ebp - 0x2e4]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
mov ecx, 5
cmp eax, ecx
jle 0x48f197
sub eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
cmp edx, ecx
jle 0x48f1a3
sub edx, ecx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0xec]
test ecx, ecx
jne 0x48f1b8
cmp eax, 6
jle 0x48f1b8
sub eax, 6
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x2d0]
call fcn.004f05fb
mov eax, dword [ebp - 0xd8]
xor ebx, ebx
cmp eax, 0x32000
mov byte [ebp - 0x71c], 0
mov dword [ebp + 8], ebx
jle 0x48f243
mov edx, dword [ebp - 0xd0]
mov ecx, 0x3c
cmp edx, ecx
jle 0x48f1ff
cmp dword [ebp - 0x4c], ecx
jmp 0x48f209
cmp dword [ebp - 0x4c], ecx
jle 0x48f243
cmp eax, 0x64000
jle 0x48f243
lea eax, [ebp - 0x79c]
lea ecx, [ebp - 0x71c]
push eax
push 0x526038
push ecx
call fcn.004f175f
lea edx, [ebp - 0x71c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov edx, 1
cmp eax, edx
je 0x48f282
lea edi, [ebp - 0x79c]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xd8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0xd8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], edx
jne 0x48f2ba
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x48f2fb
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 0x14], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x98]
mov eax, 1
cmp ecx, eax
jne 0x48f33f
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x48], eax
jne 0x48f37a
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xdc], eax
jne 0x48f3b8
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa0], eax
je 0x48f3c8
cmp dword [ebp - 0xe4], eax
jne 0x48f3fd
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xa8], eax
jne 0x48f43b
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf8], eax
jne 0x48f478
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], eax
jne 0x48f4b6
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], eax
jne 0x48f4f8
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x68], eax
jne 0x48f539
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe0], eax
jne 0x48f577
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb8], eax
jne 0x48f5b5
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf0], eax
jne 0x48f5f2
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x44], eax
jne 0x48f695
cmp dword [ebp - 0xc0], eax
je 0x48f618
cmp dword [ebp - 0xe8], eax
je 0x48f618
lea edx, [ebp - 0x71c]
mov edi, 0x515278
jmp 0x48f663
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc8]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x71c]
mov edi, 0x515258
je 0x48f663
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], eax
jne 0x48f6d3
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x8c], eax
jne 0x48f718
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], eax
jne 0x48f75a
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x24], eax
jne 0x48f7d6
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jne 0x48f7d6
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x68]
mov eax, 1
cmp ecx, eax
jne 0x48f828
cmp dword [ebp - 0x70], eax
jne 0x48f828
cmp dword [ebp - 0x2c], eax
jne 0x48f828
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x94], eax
jne 0x48f8e0
cmp dword [ebp - 0x9c], eax
jne 0x48f8e0
cmp dword [ebp - 0xa4], eax
jne 0x48f8e0
cmp dword [ebp - 0xac], eax
jne 0x48f896
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x71c]
cmp ecx, eax
mov edi, 0x5151ec
je 0x48f86b
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb4], eax
jne 0x48f8e0
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x71c]
cmp ecx, eax
mov edi, 0x5151c4
je 0x48f8b5
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], eax
jne 0x48f91a
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], eax
jne 0x48f963
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x48f95d
mov dword [ebp - 0x14], 1
inc ebx
mov eax, 1
cmp dword [ebp - 0x104], eax
jne 0x48f9a1
mov edi, 0x5160a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], eax
jne 0x48f9e3
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x78], eax
jne 0x48fa1e
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x58], eax
jne 0x48fa59
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x71c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x48faa0
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
jne 0x48faa0
cmp dword [ebp - 0x60], eax
jne 0x48fadb