Function at 0x475460
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb74b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1574
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x1104]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x124], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0xb8], esi
lea ebx, [ebp - 0x464]
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x475649
push edx
lea ecx, [ebp - 0x464]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x464]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x464]
push str.svchost__k_DcomLaunch
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47566b
push 0x5147b4
jmp 0x478b52
lea ecx, [ebp - 0x464]
push str..exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4756b3
lea ecx, [ebp - 0x464]
push str..Exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4756b3
lea ecx, [ebp - 0x464]
push str..EXE_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4756e9
lea edx, [ebp - 0x464]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0xe56d00]
push 0x5168b0
inc esi
mov dword [0xe56d00], esi
jmp 0x478b52
lea ecx, [ebp - 0x464]
push 0x51688c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475719
lea edx, [ebp - 0x464]
push str.Rundll32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475726
mov esi, 1
mov dword [ebp - 0x154], esi
jmp 0x47572b
mov esi, 1
lea eax, [ebp - 0x464]
push 0x516878
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475746
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x464]
push str..Dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475761
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x464]
push str..DLL
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47577c
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x464]
push 0x516860
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47579a
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x464]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4757b8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x464]
push str..TMP
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4757d6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x464]
push str._temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4757f4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x464]
push str.Temp_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475812
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x464]
push str.TEMP_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475830
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x464]
push str.Documents_and_Settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47584e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x464]
push str.documents_and_settings_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47586c
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x464]
push str.Program_FilesCommon_Files
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47588a
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x464]
push str.program_Filescommon_Files
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4758a8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], esi
mov al, byte [ebp - 0x464]
xor ecx, ecx
cmp al, 0x25
jne 0x4758b6
mov ecx, esi
lea edx, [ebx - 2]
test edx, edx
jle 0x4758df
mov al, byte [ebp + edx - 0x464]
cmp al, 0x3a
jne 0x4758d2
cmp byte [ebp + edx - 0x463], 0x5c
je 0x4758df
cmp ecx, esi
jne 0x4758da
cmp al, 0x5c
je 0x4758e3
dec edx
test edx, edx
jg 0x4758bd
cmp ecx, esi
jne 0x475941
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x47590b
mov ecx, ebx
lea esi, [ebp + edx - 0x463]
mov edx, ecx
lea edi, [ebp - 0xe04]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xe04], 0
lea edi, [ebp - 0xe04]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x464]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4759ef
test edx, edx
je 0x4759ef
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0xa44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x475989
cmp byte [ebp + ebx - 0x464], 0x2e
je 0x475989
dec ebx
test ebx, ebx
jg 0x47597a
sub ebx, edx
mov byte [ebp - 0x464], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x4759b4
lea esi, [ebp + edx - 0xa45]
mov edx, ecx
lea edi, [ebp - 0x464]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x45f], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4759df
cmp byte [ebp + ecx - 0x464], 0x2e
je 0x4759df
dec ecx
test ecx, ecx
jg 0x4759d0
test ecx, ecx
mov byte [ebp + ecx - 0x460], 0
jne 0x475ab5
lea eax, [ebp - 0x264]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x1084]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x864]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x864]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475a93
lea edx, [ebp - 0x864]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475a93
lea eax, [ebp - 0x864]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475a93
lea ecx, [ebp - 0x864]
lea edx, [ebp - 0x264]
push ecx
jmp 0x475aa0
lea ecx, [ebp - 0x864]
lea edx, [ebp - 0x1084]
push ecx
push edx
lea eax, [ebp - 0x464]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x475ad8
cmp byte [ebp + ecx - 0x464], 0x2e
je 0x475ad8
dec ecx
test ecx, ecx
jg 0x475ac9
mov byte [ebp + ecx - 0x460], 0
lea ecx, [ebp - 0xc84]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x8e4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x8e4]
lea ecx, [ebp - 0xb84]
push eax
push str._sexplorer.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x464]
lea eax, [ebp - 0xb84]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x475b40
push 0x5147b4
jmp 0x478b52
lea ecx, [ebp - 0x464]
push ecx
call fcn.004ab3c0
mov esi, eax
mov ebx, 1
add esp, 4
cmp esi, ebx
jge 0x475b64
push 0x5240fc
jmp 0x478b52
lea edx, [ebp - 0x1e4]
lea eax, [ebp - 0x464]
push edx
push eax
mov dword [ebp - 0x14c], esi
call fcn.004d9590
movsx edi, ax
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x114], eax
lea edx, [ebp - 0x48]
push ecx
lea eax, [ebp - 0x464]
push edx
push eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x475bb7
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
je 0x475bbd
mov dword [ebp - 0x114], ebx
lea edx, [ebp - 0x1e4]
push str.Sybase_Inc
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475bee
cmp esi, 0x7d000
jle 0x475bee
push str.Sybase
jmp 0x478b52
cmp edi, ebx
jge 0x475c04
cmp esi, 0x100000
jle 0x475c5c
push 0x515e50
jmp 0x478b52
cmp esi, 0xc8000
jle 0x475c5c
lea eax, [ebp - 0x1e4]
push str.Microsoft
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475c5c
lea ecx, [ebp - 0x1e4]
lea edx, [ebp - 0xa44]
push ecx
push 0x515e38
push edx
call fcn.004f175f
lea eax, [ebp - 0xa44]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x475d85
lea ecx, [ebp - 0x1e4]
push str.Beijing_Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475c7f
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x864]
lea eax, [ebp - 0x464]
push edx
push eax
call fcn.004c23b0
lea ecx, [ebp - 0x864]
push str.Rising
push ecx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x475cad
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x1e4]
push str.Eset
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475cc8
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x864]
push str.Eset
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475ce3
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x1e4]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475cfe
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x864]
push str.Symantec
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475d19
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x1e4]
push str.Network_Associates
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475d34
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x864]
push str.Networks_Associates_Technology__Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475d4f
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x1e4]
push str.McAfee_Inc
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475d6a
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x864]
push 0x5162ac
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475d85
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x1e4]
xor esi, esi
push str.Microsoft
push ecx
mov dword [ebp - 0x6c], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475da7
mov esi, ebx
mov dword [ebp - 0x6c], esi
lea edx, [ebp - 0x8e4]
lea eax, [ebp - 0xb84]
push edx
push str._s_amcap.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x464]
lea edx, [ebp - 0xb84]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x475e12
cmp esi, ebx
jne 0x475e12
lea eax, [ebp - 0xa44]
lea ecx, [ebp - 0x464]
push eax
push ecx
call fcn.004c27a0
lea edx, [ebp - 0xa44]
push str.DirectX
push edx
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x475e12
push 0x5240ac
jmp 0x478b52
lea eax, [ebp - 0x8e4]
lea ecx, [ebp - 0xb84]
push eax
push str._sNIRegApp.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x464]
lea eax, [ebp - 0xb84]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x475e7c
lea ecx, [ebp - 0x8e4]
lea edx, [ebp - 0xb84]
push ecx
push str._sNIRpcss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0xb84]
push eax
call fcn.004ab3c0
add esp, 0x10
cmp eax, 0x1400
jle 0x475e7c
push 0x524074
jmp 0x478b52
lea ecx, [ebp - 0x8e4]
lea edx, [ebp - 0xb84]
push ecx
push str._sNIRpcss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x464]
lea ecx, [ebp - 0xb84]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x475ee6
lea edx, [ebp - 0x8e4]
lea eax, [ebp - 0xb84]
push edx
push str._sNIRegApp.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0xb84]
push ecx
call fcn.004ab3c0
add esp, 0x10
cmp eax, 0x1400
jle 0x475ee6
push 0x524074
jmp 0x478b52
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x34], edx
cmp ecx, edx
jle 0x475f1e
lea esi, [ebp + ecx - 0x464]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0x1004], al
jne 0x475f18
cmp edx, 2
jge 0x475f1e
inc edx
dec esi
cmp edx, ecx
jl 0x475f06
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x475f45
mov ebx, ecx
lea esi, [ebp - 0x464]
lea edi, [ebp - 0x1384]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x1384], 0
test edx, edx
jle 0x475f8f
mov edi, dword [ebp - 0x110]
lea esi, [ebp + eax - 0x463]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x475f6e
mov byte [ebp + ecx - 0x1004], al
cmp al, 0x2e
jne 0x475f73
inc edi
cmp al, 0x20
jne 0x475f78
inc edi
cmp al, 0x5c
jne 0x475f84
mov byte [ebp + ecx - 0x1004], 0
inc ecx
cmp ecx, edx
jl 0x475f60
mov dword [ebp - 0x110], edi
mov al, byte [ebp - 0x1382]
mov byte [ebp + edx - 0x1004], 0
cmp al, 0x5c
je 0x475faf
mov byte [ebp - 0x1382], 0x5c
mov byte [ebp - 0x1381], 0
lea edx, [ebp - 0x464]
push 0x100
lea eax, [ebp - 0x764]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x1004]
push 0x40
lea edx, [ebp - 0x944]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x464]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x476006
push 0x5144fc
jmp 0x478b52
lea ecx, [ebp - 0x464]
push 0x515d14
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476021
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x464]
push str.application_data
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47603c
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x464]
push str.Microsoft_SharedMSINFO
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476057
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x464]
push str.microsoft_sharedmsinfo
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476072
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x464]
push str.Microsoft_SharedMSInfo
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47608d
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x464]
push str.Documents_and_Settings
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4760a8
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x464]
push 0x80
lea edx, [ebp - 0xc04]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x464]
push 0x80
lea ecx, [ebp - 0xd04]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0x8e4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0xc84]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xc04], al
lea edx, [ebp - 0x8e4]
mov byte [ebp + ecx - 0xd04], al
lea eax, [ebp - 0xc04]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x476169
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476138
push esi
jmp 0x478b52
lea edi, [ebp - 0x464]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x54], ebx
test ecx, ecx
jle 0x476169
cmp byte [ebp + eax - 0x464], 0x5c
jne 0x47615c
inc edx
inc eax
cmp eax, ecx
jl 0x476151
cmp edx, 2
jne 0x476169
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0xc84]
lea edx, [ebp - 0xd04]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47619e
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47619e
push esi
jmp 0x478b52
lea eax, [ebp - 0x464]
push str.System32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4761f7
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4761d1
push esi
jmp 0x478b52
lea ecx, [ebp - 0x464]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4761f7
push edi
jmp 0x478b52
lea edx, [ebp - 0x464]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476250
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x47622a
push esi
jmp 0x478b52
lea eax, [ebp - 0x464]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x476250
push edi
jmp 0x478b52
lea ecx, [ebp - 0x464]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4762a9
push 0x5144fc
push esi
mov dword [ebp - 0x34], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476283
push esi
jmp 0x478b52
lea edx, [ebp - 0x464]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4762a9
push esi
jmp 0x478b52
cmp dword [ebp - 0x20], ebx
jne 0x476359
lea eax, [ebp - 0x764]
push 0xdb198c
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4762d9
lea ecx, [ebp - 0x764]
push ecx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x764]
push edx
call esi
lea eax, [ebp - 0x764]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x476349
lea ecx, [ebp - 0x764]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0x764]
push edx
call esi
test eax, eax
jne 0x476349
lea eax, [ebp - 0x764]
push eax
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x476349
lea ecx, [ebp - 0x764]
push ecx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x664]
mov edi, 0x52402c
jmp 0x478af0
lea edx, [ebp - 0x664]
mov edi, 0x523fe4
jmp 0x478af0
lea ecx, [ebp - 0x1004]
push str.smss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea edx, [ebp - 0x1004]
push str.winlogon.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea eax, [ebp - 0x1004]
push str.csrss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea ecx, [ebp - 0x1004]
push str.services.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea edx, [ebp - 0x1004]
push str.lsass.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea eax, [ebp - 0x1004]
push str.svchost.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea ecx, [ebp - 0x1004]
push str.taskmgr.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea edx, [ebp - 0x1004]
push str.spoolsv.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea eax, [ebp - 0x1004]
push str.explorer.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
lea ecx, [ebp - 0x1004]
push str.conime.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x478a51
mov esi, 2
xor edi, edi
push 0xd8a430
mov dword [ebp - 4], esi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x58], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea edx, [ebp - 0x464]
push 0xd8a430
push edx
call fcn.004a6ab0
add esp, 8
test eax, eax
jne 0x4764b9
mov esi, ebx
jmp 0x476dc6
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 3
push eax
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov dword [ebp - 0x160], eax
push ecx
call fcn.004a6ca0
add esp, 4
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x476525
mov dword [ebp + 8], esi
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x148], esi
jne 0x476c7c
mov dword [ebp + 8], 6
jmp 0x476db1
mov dword [ebp - 0xc0], 0
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4764ed
mov edx, dword [eax + 0xc]
mov eax, dword [0xd8a438]
mov ecx, dword [ebp - 0x160]
push edx
push eax
push ecx
call fcn.004a6c30
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x28], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x15c], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.COMCTL32.dll
inc eax
push edi
mov dword [ebp - 0x148], eax
call fcn.004f61e0
add esp, 0x18
mov ebx, 1
test eax, eax
jne 0x4765a1
mov dword [ebp - 0x130], ebx
push str.comdlg32.dll
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4765b9
mov dword [ebp - 0xc4], ebx
xor esi, esi
cmp esi, 0x69
jge 0x476656
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476650
cmp esi, 0xf
jle 0x4765ee
cmp esi, 0x12
jge 0x4765ee
mov dword [ebp - 0x88], ebx
cmp esi, 0x1d
je 0x4765fd
cmp esi, 0x1e
je 0x4765fd
cmp esi, 0x39
jne 0x476600
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1f
je 0x47660a
cmp esi, 0x20
jne 0x47660d
mov dword [ebp - 0x68], ebx
cmp esi, 0x21
je 0x476617
cmp esi, 0x22
jne 0x47661a
mov dword [ebp - 0x5c], ebx
cmp esi, 0x23
je 0x476624
cmp esi, 0x24
jne 0x476627
mov dword [ebp - 0x64], ebx
cmp esi, 0x2c
jne 0x476632
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x4765bb
cmp esi, 0x2d
je 0x47664d
cmp esi, 0x2e
jne 0x476648
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x4765bb
cmp esi, 0x3d
jne 0x476650
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x4765bb
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x11c], 0
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x164], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0xc0]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x47669f
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x60], eax
push eax
mov eax, dword [0xd8a438]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4764ed
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x476bc0
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x47672f
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x904]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa64]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xa64]
jmp 0x4767b0
mov edx, dword [0xd8a438]
push eax
mov eax, dword [ebp - 0x164]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47676b
xor ecx, ecx
lea edx, [ebp - 0x904]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x4767b8
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x904]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa84]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xa84]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x476b69
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476b63
cmp esi, 0x45
jne 0x476887
lea ecx, [ebp - 0x1084]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x1084]
lea eax, [ebp - 0x264]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x264]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x476861
lea edx, [ebp - 0x1e4]
lea eax, [ebp - 0xe04]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xe04]
jmp 0x478b51
lea ecx, [ebp - 0x1e4]
lea edx, [ebp - 0xe04]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xe04]
jmp 0x478b51
test esi, esi
jne 0x476894
mov dword [ebp - 0x44], edi
inc esi
jmp 0x4767ba
cmp esi, edi
jne 0x4768a1
mov dword [ebp - 0x70], edi
inc esi
jmp 0x4767ba
cmp esi, 2
je 0x476b63
cmp esi, 4
jne 0x4768bb
mov dword [ebp - 0x104], edi
inc esi
jmp 0x4767ba
cmp esi, 5
jne 0x4768cc
mov dword [ebp - 0xec], edi
inc esi
jmp 0x4767ba
cmp esi, 6
jne 0x4768dd
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x4767ba
cmp esi, 7
jne 0x4768ee
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x4767ba
cmp esi, 8
jne 0x4768ff
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x4767ba
cmp esi, 9
jne 0x476910
mov dword [ebp - 0x144], edi
inc esi
jmp 0x4767ba
cmp esi, 0xa
jne 0x476921
mov dword [ebp - 0x94], edi
inc esi
jmp 0x4767ba
cmp esi, 0xb
jle 0x47692e
cmp esi, 0xf
jge 0x476931
mov dword [ebp - 0x50], edi
cmp esi, 0xf
jne 0x47693f
mov dword [ebp - 0x9c], edi
inc esi
jmp 0x4767ba
jle 0x47694c
cmp esi, 0x12
jge 0x47694c
mov dword [ebp - 0x88], edi
cmp esi, 0x1b
jne 0x47695d
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x4767ba
cmp esi, 0x1c
jne 0x47696b
mov dword [ebp - 0x78], edi
inc esi
jmp 0x4767ba
cmp esi, 0x1d
je 0x47697a
cmp esi, 0x1e
je 0x47697a
cmp esi, 0x39
jne 0x47697d
mov dword [ebp - 0x7c], edi
cmp esi, 0x1f
je 0x476987
cmp esi, 0x20
jne 0x47698a
mov dword [ebp - 0x68], edi
cmp esi, 0x21
je 0x476994
cmp esi, 0x22
jne 0x476997
mov dword [ebp - 0x5c], edi
cmp esi, 0x23
je 0x4769a1
cmp esi, 0x24
jne 0x4769a4
mov dword [ebp - 0x64], edi
cmp esi, 0x25
je 0x4769ae
cmp esi, 0x26
jne 0x4769b4
mov dword [ebp - 0x134], edi
cmp esi, 0x27
jne 0x4769c5
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x4767ba
cmp esi, 0x28
jne 0x4769d6
mov dword [ebp - 0x124], edi
inc esi
jmp 0x4767ba
cmp esi, 0x29
jne 0x4769e7
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x4767ba
cmp esi, 0x2c
jne 0x4769f5
mov dword [ebp - 0x80], edi
inc esi
jmp 0x4767ba
cmp esi, 0x2d
jne 0x476a03
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x4767ba
cmp esi, 0x2e
jne 0x476a14
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x4767ba
cmp esi, 0x2f
jne 0x476a25
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x4767ba
cmp esi, 0x30
jne 0x476a36
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x4767ba
cmp esi, 0x31
jne 0x476a47
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x4767ba
cmp esi, 0x32
jne 0x476a58
mov dword [ebp - 0xe0], edi
inc esi
jmp 0x4767ba
cmp esi, 0x34
jne 0x476a69
mov dword [ebp - 0x84], edi
inc esi
jmp 0x4767ba
cmp esi, 0x35
jne 0x476a7a
mov dword [ebp - 0x98], edi
inc esi
jmp 0x4767ba
cmp esi, 0x36
jne 0x476a8b
mov dword [ebp - 0x90], edi
inc esi
jmp 0x4767ba
cmp esi, 0x37
jne 0x476aa0
mov dword [ebp - 0xf0], 0
inc esi
jmp 0x4767ba
cmp esi, 0x38
jne 0x476ab1
mov dword [ebp - 0x100], edi
inc esi
jmp 0x4767ba
cmp esi, 0x3a
je 0x476ac0
cmp esi, 0x3b
je 0x476ac0
cmp esi, 0x3c
jne 0x476ac6
mov dword [ebp - 0x118], edi
cmp esi, 0x3d
jne 0x476ad4
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x4767ba
cmp esi, 0x3e
jne 0x476ae5
mov dword [ebp - 0x120], edi
inc esi
jmp 0x4767ba
cmp esi, 0x3f
jne 0x476af6
mov dword [ebp - 0xa0], edi
inc esi
jmp 0x4767ba
cmp esi, 0x40
jne 0x476b04
mov dword [ebp - 0x70], edi
inc esi
jmp 0x4767ba
cmp esi, 0x41
jne 0x476b15
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x4767ba
cmp esi, 0x42
jne 0x476b26
mov dword [ebp - 0xf8], edi
inc esi
jmp 0x4767ba
cmp esi, 0x43
je 0x476b30
cmp esi, 0x44
jne 0x476b36
mov dword [ebp - 0x108], edi
cmp esi, 0x56
jne 0x476b47
mov dword [ebp - 0x140], edi
inc esi
jmp 0x4767ba
cmp esi, 0x57
jne 0x476b58
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x4767ba
cmp esi, 0x58
jne 0x476b63
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x4767ba
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x15c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x58], ecx
jne 0x476b80
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x148], edi
jne 0x476b8e
inc dword [ebp - 0x138]
cmp dword [ebp - 0x58], 0x4e20
jg 0x476bc0
mov esi, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x24]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x24], ecx
mov eax, ecx
jmp 0x4766c8
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x11c]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xcc]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xcc], eax
jmp 0x47652f
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x60], ebx
cmp bx, word [esi + 2]
jae 0x476db1
xor ecx, ecx
push str..asp
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov byte [ebp - 0xa8], cl
mov edx, dword [edi]
mov dword [ebp - 0xb0], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xac], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x476cde
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0xb0]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476cf9
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0xb0]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476d14
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0xb0]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476d2f
mov dword [ebp - 0x38], esi
lea edx, [ebp - 0xb0]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476d4a
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0xb0]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x476d65
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x60]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x60], eax
jg 0x476db1
mov esi, dword [ebp - 0x148]
add edi, 0x28
inc ebx
jmp 0x476c8f
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 4], 2
mov ebx, 1
mov ecx, dword [0xd8a438]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x476e02
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp esi, ebx
jne 0x476e1d
push 0x515b6c
jmp 0x478b52
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], edi
test esi, esi
mov dword [ebp - 0x1c], eax
je 0x4775ab
cmp eax, ebx
jge 0x4775ab
lea edx, [ebp - 0x1384]
xor esi, esi
push edx
mov dword [ebp - 0x28], esi
call fcn.004f2beb
jmp 0x476e59
lea eax, [ebp - 0x1004]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xe04]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x476e8a
push ebx
lea ecx, [ebp - 0x22c]
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, ebx
jne 0x476eb4
lea edx, [ebp - 0xe04]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x476ec8
lea eax, [ebp - 0x764]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp + 8], esi
push ecx
push ebx
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x22c]
call fcn.004f0727
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x228]
cmp dword [eax + 0x30], 0xffffffff
jne 0x476f4d
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x218]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x218]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x228]
push 0xa
lea ecx, [ebp - 0x864]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x228], esi
call fcn.004f0ae9
lea edi, [ebp - 0x864]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x477537
lea edx, [ebp - 0x864]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x476faa
mov dword [ebp - 0x150], ebx
lea eax, [ebp - 0x864]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x477537
lea ecx, [ebp - 0x864]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x477537
lea edx, [ebp - 0x864]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x477537
lea eax, [ebp - 0x864]
push str.invalid_file
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47754e
cmp dword [ebp - 0x74], ebx
jne 0x477022
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x14], ebx
jne 0x47702a
inc dword [ebp - 0x24]
xor edi, edi
xor esi, esi
cmp esi, 0x69
jge 0x477534
lea ecx, [esi + esi*2]
lea edx, [ebp - 0x864]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edx
call fcn.004f2d80
add esp, 8
cmp eax, edi
je 0x47752e
mov ecx, dword [ebp - 0x12c]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x12c], ecx
jne 0x47710f
lea eax, [ebp - 0x1084]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x1084]
lea edx, [ebp - 0x1184]
push ecx
push str._sMicrosoft.NETFramework
push edx
call fcn.004f175f
lea eax, [ebp - 0x1184]
push eax
call fcn.004f2beb
xor ecx, ecx
cmp eax, edi
sete cl
push str.c:endpcache
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, ebx
jne 0x4770e8
lea edx, [ebp - 0x1e4]
lea eax, [ebp - 0xa44]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xa44]
push eax
jmp 0x476f16
lea ecx, [ebp - 0x1e4]
lea edx, [ebp - 0xa44]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xa44]
push eax
jmp 0x476f16
cmp esi, 0x19
jne 0x47718f
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x28], edx
jle 0x47712f
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x864]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x864]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x864]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x477207
test ebx, ebx
jne 0x477207
test eax, eax
jne 0x477207
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x47702e
cmp esi, 0x1a
jne 0x47721b
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x28], edx
jle 0x4771b3
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x864]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x864]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x864]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x477207
test ebx, ebx
jne 0x477207
test eax, eax
jne 0x477207
mov dword [ebp - 0x14], eax
mov ebx, 1
inc esi
jmp 0x47702e
xor edi, edi
mov dword [ebp - 0x14], 1
mov ebx, 1
inc esi
jmp 0x47702e
cmp esi, 0x2a
jne 0x477232
mov dword [ebp - 0x74], edi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x47702e
cmp esi, 0x2b
jne 0x477249
mov dword [ebp - 0x74], edi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x14], edi
inc esi
jmp 0x47702e
cmp esi, edi
jne 0x477256
mov dword [ebp - 0x44], ebx
inc esi
jmp 0x47702e
cmp esi, ebx
jne 0x477263
mov dword [ebp - 0x70], ebx
inc esi
jmp 0x47702e
cmp esi, 2
je 0x47752e
cmp esi, 4
jne 0x47727d
mov dword [ebp - 0x104], ebx
inc esi
jmp 0x47702e
cmp esi, 5
jne 0x47728e
mov dword [ebp - 0xec], ebx
inc esi
jmp 0x47702e
cmp esi, 6
jne 0x47729f
mov dword [ebp - 0xdc], ebx
inc esi
jmp 0x47702e
cmp esi, 7
jne 0x4772b0
mov dword [ebp - 0xfc], ebx
inc esi
jmp 0x47702e
cmp esi, 8
jne 0x4772c1
mov dword [ebp - 0xe4], ebx
inc esi
jmp 0x47702e
cmp esi, 9
jne 0x4772d2
mov dword [ebp - 0x144], ebx
inc esi
jmp 0x47702e
cmp esi, 0xa
jne 0x4772e3
mov dword [ebp - 0x94], ebx
inc esi
jmp 0x47702e
cmp esi, 0xb
jle 0x4772f0
cmp esi, 0xf
jge 0x4772f3
mov dword [ebp - 0x50], ebx
cmp esi, 0xf
jne 0x477301
mov dword [ebp - 0x9c], ebx
inc esi
jmp 0x47702e
jle 0x47730e
cmp esi, 0x12
jge 0x47730e
mov dword [ebp - 0x88], ebx
cmp esi, 0x11
jle 0x47731b
cmp esi, 0x19
jge 0x47731b
mov dword [ebp - 0x38], ebx
cmp esi, 0x1b
jne 0x47732c
mov dword [ebp - 0x13c], ebx
inc esi
jmp 0x47702e
cmp esi, 0x1c
jne 0x47733a
mov dword [ebp - 0x78], ebx
inc esi
jmp 0x47702e
cmp esi, 0x1d
je 0x477349
cmp esi, 0x1e
je 0x477349
cmp esi, 0x39
jne 0x47734c
mov dword [ebp - 0x7c], ebx
cmp esi, 0x1f
je 0x477356
cmp esi, 0x20
jne 0x477359
mov dword [ebp - 0x68], ebx
cmp esi, 0x21
je 0x477363
cmp esi, 0x22
jne 0x477366
mov dword [ebp - 0x5c], ebx
cmp esi, 0x23
je 0x477370
cmp esi, 0x24
jne 0x477373
mov dword [ebp - 0x64], ebx
cmp esi, 0x25
je 0x47737d
cmp esi, 0x26
jne 0x477383
mov dword [ebp - 0x134], ebx
cmp esi, 0x27
jne 0x477394
mov dword [ebp - 0xb4], ebx
inc esi
jmp 0x47702e
cmp esi, 0x28
jne 0x4773a5
mov dword [ebp - 0x124], ebx
inc esi
jmp 0x47702e
cmp esi, 0x29
jne 0x4773b6
mov dword [ebp - 0xc8], ebx
inc esi
jmp 0x47702e
cmp esi, 0x2c
jne 0x4773c4
mov dword [ebp - 0x80], ebx
inc esi
jmp 0x47702e
cmp esi, 0x2d
jne 0x4773d2
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x47702e
cmp esi, 0x2e
jne 0x4773e3
mov dword [ebp - 0x8c], ebx
inc esi
jmp 0x47702e
cmp esi, 0x2f
jne 0x4773f4
mov dword [ebp - 0xe8], ebx
inc esi
jmp 0x47702e
cmp esi, 0x30
jne 0x477405
mov dword [ebp - 0xd0], ebx
inc esi
jmp 0x47702e
cmp esi, 0x31
jne 0x477416
mov dword [ebp - 0xd8], ebx
inc esi
jmp 0x47702e
cmp esi, 0x32
jne 0x477427
mov dword [ebp - 0xe0], ebx
inc esi
jmp 0x47702e
cmp esi, 0x34
jne 0x477438
mov dword [ebp - 0x84], ebx
inc esi
jmp 0x47702e
cmp esi, 0x35
jne 0x477449
mov dword [ebp - 0x98], ebx
inc esi
jmp 0x47702e
cmp esi, 0x36
jne 0x47745a
mov dword [ebp - 0x90], ebx
inc esi
jmp 0x47702e
cmp esi, 0x37
jne 0x47746b
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x47702e
cmp esi, 0x38
jne 0x47747c
mov dword [ebp - 0x100], ebx
inc esi
jmp 0x47702e
cmp esi, 0x3a
je 0x47748b
inc esi
jmp 0x47702e
inc dword [ebp + 8]
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x224], 1
je 0x476f4d
lea ecx, [ebp - 0x22c]
call fcn.004f076e
mov eax, dword [ebp - 0x24]
mov ecx, 5
cmp eax, ecx
jle 0x47756a
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x477576
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
jne 0x47758b
cmp eax, 6
jle 0x47758b
sub eax, 6
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x218]
call fcn.004f05fb
mov edi, dword [ebp - 0xa4]
cmp dword [ebp - 0x14c], 0x32000
jle 0x47773f
mov esi, dword [ebp - 0x4c]
cmp esi, ebx
jle 0x4776c7
lea eax, [ebp - 0x1e4]
push str.InstallShield_Software
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x477667
cmp dword [ebp - 0x130], ebx
je 0x47762f
cmp dword [ebp - 0xc4], ebx
je 0x47762f
cmp edi, 0x64
jle 0x477667
lea ecx, [ebp - 0x1e4]
lea edx, [ebp - 0xa44]
push ecx
push 0x523fb0
push edx
call fcn.004f175f
lea eax, [ebp - 0xa44]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1e4]
lea edx, [ebp - 0xa44]
push ecx
push 0x523fb0
push edx
call fcn.004f175f
lea eax, [ebp - 0xa44]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1e4]
push str.Indigo_Rose_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4776c7
cmp dword [ebp - 0x130], ebx
je 0x47768f
cmp dword [ebp - 0xc4], ebx
jne 0x4776c7
lea edx, [ebp - 0x1e4]
lea eax, [ebp - 0xa44]
push edx
push 0x523fb0
push eax
call fcn.004f175f
lea ecx, [ebp - 0xa44]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x138]
cmp ecx, 0x64
jle 0x47770f
cmp edi, 0x64
jle 0x47773f
lea edx, [ebp - 0x1e4]
push edx
push 0x523f7c
lea eax, [ebp - 0x664]
push eax
call fcn.004f175f
lea ecx, [ebp - 0x664]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x64
jle 0x47773f
mov eax, dword [ebp - 0x14c]
cmp eax, 0x3e800
jle 0x477725
cmp esi, ebx
jg 0x4776d7
cmp ecx, 0x50
jle 0x47773f
cmp eax, 0x37000
jle 0x47773f
lea edx, [ebp - 0x1e4]
push edx
push 0x515a74
jmp 0x4776e3
cmp dword [ebp - 0x58], 0x64
jle 0x477785
cmp edi, 0x2d
jle 0x477785
cmp dword [ebp - 0x140], ebx
je 0x477762
cmp dword [ebp - 0x10c], ebx
je 0x477762
cmp dword [ebp - 0xd4], ebx
jne 0x477785
lea edx, [ebp - 0x1e4]
lea eax, [ebp - 0xa44]
push edx
push 0x523fb0
push eax
call fcn.004f175f
lea ecx, [ebp - 0xa44]
jmp 0x4776f5
mov eax, dword [ebp - 0x12c]
mov edx, 1
xor ebx, ebx
cmp eax, edx
mov dword [ebp + 8], ebx
mov byte [ebp - 0x664], bl
mov dword [ebp - 0x14], ebx
jle 0x4777d1
mov edi, 0x5169cc
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xdc], edx
jne 0x47780e
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x6c], edx
jne 0x477916
lea eax, [ebp - 0xa44]
lea ecx, [ebp - 0x464]
push eax
push ecx
call fcn.004c23b0
movsx eax, ax
add esp, 8
test eax, eax
je 0x47784c
lea edx, [ebp - 0xa44]
push 0x516158
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x477884
mov edi, 0x51613c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], 7
jle 0x4778d2
lea eax, [ebp - 0xa44]
push 0x516138
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4778d2
mov edi, 0x523f70
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x114], 1
jne 0x477916
mov edi, 0x523f58
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x2c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x477969
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb8], eax
mov al, byte [ebp - 0x1004]
cmp al, 0x30
je 0x477997
cmp al, 0x31
je 0x477997
cmp al, 0x32
je 0x477997
cmp al, 0x33
je 0x477997
cmp al, 0x34
je 0x477997
cmp al, 0x35
je 0x477997
cmp al, 0x36
je 0x477997
cmp al, 0x37
je 0x477997
cmp al, 0x38
je 0x477997
cmp al, 0x39
jne 0x4779cb
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xe4], 1
jne 0x477a04
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x70], 1
jne 0x477a3e
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x13c], 1
jne 0x477a7b
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0xec]
mov eax, 1
cmp ecx, eax
je 0x477a92
cmp dword [ebp - 0xb4], eax
jne 0x477ac2
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xf4], 1
jne 0x477aff
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x134], 1
jne 0x477b38
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xfc], 1
jne 0x477b71
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x44], 1
jne 0x477bb2
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x2c], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x124], 1
jne 0x477bf6
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x104], 1
jne 0x477c33
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x144], 1
jne 0x477c70
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xc8], 1
jne 0x477cad
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0x50]
mov eax, 1
cmp ecx, eax
jne 0x477d4e
cmp dword [ebp - 0xd0], eax
je 0x477cda
cmp dword [ebp - 0xd8], eax
je 0x477cda
lea edx, [ebp - 0x664]
mov edi, 0x515278
jmp 0x477d25
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe0]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x664]
mov edi, 0x515258
je 0x477d25
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xe8], 1
jne 0x477d8b
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x9c], 1
jne 0x477dd5
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], eax
jne 0x477dd1
mov dword [ebp - 0x2c], eax
inc ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x88], 1
jne 0x477e12
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x38], 1
jne 0x477e95
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
cmp ecx, eax
mov dword [ebp + 8], ebx
jne 0x477e9a
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0x14], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x477e9a
mov eax, 1
cmp dword [ebp - 0x78], eax
jne 0x477f5b
cmp dword [ebp - 0x84], eax
jne 0x477f5b
cmp dword [ebp - 0x98], eax
jne 0x477f5b
cmp dword [ebp - 0x90], eax
jne 0x477f0b
mov ecx, dword [ebp - 0xa0]
lea edx, [ebp - 0x664]
cmp ecx, eax
mov edi, 0x5151ec
je 0x477edd
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xf0], eax
jne 0x477f5b
mov ecx, dword [ebp - 0xa0]
lea edx, [ebp - 0x664]
cmp ecx, eax
mov edi, 0x5151c4
je 0x477f2d
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0xf8], eax
jne 0x477fc6
cmp dword [ebp - 0x78], eax
jne 0x477f8d
cmp dword [ebp - 0x84], eax
jne 0x477f8d
cmp dword [ebp - 0x98], eax
jne 0x477f8d
cmp dword [ebp - 0x90], eax
jne 0x477f8d
lea edx, [ebp - 0x664]
mov edi, 0x5160c0
jmp 0x477f98
lea edx, [ebp - 0x664]
mov edi, 0x5160b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x100], eax
jne 0x478003
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], eax
jne 0x478041
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x108], eax
jne 0x478082
mov edi, 0x5160a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x68], eax
jne 0x4780c8
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x54], eax
jne 0x4780c4
mov dword [ebp - 0x2c], eax
inc ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x5c], eax
jne 0x478106
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x64], eax
jne 0x478144
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x47818e
mov ecx, dword [ebp - 0x150]
test ecx, ecx
jne 0x47818e
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x110], eax
jle 0x4781cf
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x80], eax
jne 0x47820d
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x3c], eax
jne 0x47824b
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x8c], eax
jne 0x478288
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x118], eax
jne 0x4782c9
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x120], eax
jne 0x478306
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x28]
cmp ecx, eax
mov eax, 4
je 0x478319
lea eax, [ecx*4]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
jl 0x478327
cmp ecx, 7
jge 0x47837d
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x664]
cmp eax, 1
mov edi, 0x5150f8
je 0x478342
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x54]
mov ecx, edx
mov edx, 1
and ecx, 3
cmp eax, edx
mov dword [ebp - 0x14], edx
rep movsb byte es:[edi], byte [esi]
jne 0x478379
mov dword [ebp - 0x2c], edx
inc ebx
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0x24]
mov esi, 1
cmp eax, esi
jle 0x4783cf
cmp dword [ebp - 0x28], esi
jne 0x4783cf
mov edi, 0x516090
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 3
mov edx, 1
rep movsb byte es:[edi], byte [esi]
inc ebx
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], ebx
mov esi, edx
cmp dword [ebp - 0x94], esi
jne 0x478417
cmp eax, 5
jge 0x478417
test eax, eax
jle 0x478417
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x664]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov eax, dword [ebp - 0x4c]
cmp eax, 7
jge 0x478534
cmp dword [ebp - 0x34], esi
jne 0x4784b1
cmp eax, esi
lea ebx, [ebp - 0x664]
jge 0x47847d
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp + 8]
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x47846e
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x128], 1
jmp 0x47852b
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x50]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x478528
jmp 0x478521
cmp eax, esi
lea ebx, [ebp - 0x664]
jge 0x4784f1
mov edi, 0x515078
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x128], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47851b
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], 1
jne 0x478528
mov dword [ebp - 0x14], 1
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x4c]
inc ebx
mov esi, 1
cmp dword [ebp - 0x68], esi
jne 0x47855d
cmp dword [ebp - 0x5c], esi
jne 0x478541
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x64], esi
jne 0x478549
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x50], 0xb
jne 0x478552
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x9c], esi
jne 0x47855d
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x30], esi
jne 0x478569
test ebx, ebx
jle 0x478569
mov dword [ebp - 0x14], esi
cmp eax, 6
jle 0x47859f
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x47859f
mov ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x4786b0
test edx, edx
jne 0x4785aa
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x4785aa
mov ecx, dword [ebp - 0xb8]
test ecx, ecx
jne 0x4785aa
push 0x5147b4
jmp 0x478b52
mov ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x4786b0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4786b0
cmp eax, 6
jle 0x4786b0
cmp dword [ebp - 0x6c], esi
jne 0x478683
push 0xd9b940
push 0xd6d890
lea eax, [ebp - 0x464]
push 0xd56eac
push eax
call fcn.004b7fe0
add esp, 0x10
lea ecx, [ebp - 0x464]
movsx esi, ax
push 0xd4f1d0
push ecx
call fcn.004b83e0
add esp, 8
cmp esi, 6
jle 0x4786b0
push 0xd56eac
push 0xd9b8c0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4786b0
push 0xd6d890
push 0xe56a50
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4786b0
push 0xd9b940
push 0xdb1c0c
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4786b0
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x20], esi
jne 0x478595
lea edx, [ebp - 0x1e4]
push edx
jmp 0x478b52
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x478757
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x478757
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x478757
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x478757
test ebx, ebx
jle 0x478757
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x478757
lea edi, [ebp - 0x1e4]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], 0
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x4c]
not ecx
dec ecx
test eax, eax
jle 0x478736
push str.c:endpcache
mov dword [ebp - 4], 0xffffffff
call fcn.004f2beb
add esp, 4
test ebx, ebx
jne 0x47879c
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x20], 1
jne 0x478595
lea eax, [ebp - 0x1e4]
jmp 0x478b51
mov eax, dword [ebp - 0x128]
mov esi, 1
cmp eax, esi
jne 0x4787b3
cmp dword [ebp - 0x2c], esi
jne 0x4787b3
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x478878
cmp dword [ebp - 0x44], esi
je 0x478878
cmp dword [ebp - 0x14], esi
je 0x478878
cmp dword [ebp - 0x2c], esi
je 0x478878
mov ecx, dword [ebp - 0x54]
test ecx, ecx
jne 0x4788cf
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4788cf
mov ecx, dword [ebp - 0x154]
test ecx, ecx
jne 0x4788cf
lea edx, [ebp - 0x764]
push 0xdb198c
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x478909
lea eax, [ebp - 0x764]
push eax
call fcn.004abe70
add esp, 4
cmp eax, esi
jne 0x478909
mov eax, dword [ebp - 0x158]
test eax, eax
jne 0x478922
lea ecx, [ebp - 0x764]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x478a78
lea edx, [ebp - 0x764]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x764]
push eax
call esi
lea ecx, [ebp - 0x764]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x478ae5
lea edx, [ebp - 0x764]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0x764]
push eax
call esi
test eax, eax
jne 0x478ae5
lea ecx, [ebp - 0x764]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x478ae5
lea edx, [ebp - 0x764]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x664]
mov edi, 0x5158dc
jmp 0x478af0
lea edx, [ebp - 0x664]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56d00]
mov dword [0xe56d20], eax
inc edi
mov dword [0xe56d00], edi
lea edi, [ebp - 0x764]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x664]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret