Function at 0x41f0c0
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa94b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1554
call fcn.004f2630
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xde4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x544]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 3
jge 0x41f258
push edx
lea ecx, [ebp - 0x544]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x544]
push str.svchost__k_DcomLaunch
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41f27a
push 0x5147b4
jmp 0x421fcb
mov al, byte [ebp - 0x544]
xor ecx, ecx
cmp al, 0x25
jne 0x41f28b
mov ecx, 1
lea edx, [ebx - 2]
test edx, edx
jle 0x41f2b5
mov al, byte [ebp + edx - 0x544]
cmp al, 0x3a
jne 0x41f2a7
cmp byte [ebp + edx - 0x543], 0x5c
je 0x41f2b5
cmp ecx, 1
jne 0x41f2b0
cmp al, 0x5c
je 0x41f2ba
dec edx
test edx, edx
jg 0x41f292
cmp ecx, 1
jne 0x41f318
sub ebx, edx
xor eax, eax
dec ebx
test ebx, ebx
jle 0x41f2e2
mov ecx, ebx
lea esi, [ebp + edx - 0x543]
mov edx, ecx
lea edi, [ebp - 0xce4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xce4], 0
lea edi, [ebp - 0xce4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x544]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41f3c6
test edx, edx
je 0x41f3c6
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x10e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
jle 0x41f360
cmp byte [ebp + ebx - 0x544], 0x2e
je 0x41f360
dec ebx
test ebx, ebx
jg 0x41f351
sub ebx, edx
mov byte [ebp - 0x544], 0
lea ecx, [ebx + 5]
test ecx, ecx
jle 0x41f38b
lea esi, [ebp + edx - 0x10e5]
mov edx, ecx
lea edi, [ebp - 0x544]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + ebx - 0x53f], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41f3b6
cmp byte [ebp + ecx - 0x544], 0x2e
je 0x41f3b6
dec ecx
test ecx, ecx
jg 0x41f3a7
test ecx, ecx
mov byte [ebp + ecx - 0x540], 0
jne 0x41f48c
lea eax, [ebp - 0x244]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xd64]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x8e4]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41f46a
lea edx, [ebp - 0x8e4]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41f46a
lea eax, [ebp - 0x8e4]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41f46a
lea ecx, [ebp - 0x8e4]
lea edx, [ebp - 0x244]
push ecx
jmp 0x41f477
lea ecx, [ebp - 0x8e4]
lea edx, [ebp - 0xd64]
push ecx
push edx
lea eax, [ebp - 0x544]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41f4af
cmp byte [ebp + ecx - 0x544], 0x2e
je 0x41f4af
dec ecx
test ecx, ecx
jg 0x41f4a0
mov byte [ebp + ecx - 0x540], 0
lea ecx, [ebp - 0x1c4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x9e4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._swinlogon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f517
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._scsrss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f553
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0x344]
push edx
push str._s_services.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x544]
lea edx, [ebp - 0x344]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f58f
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._slsass.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f5cb
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._s_svchost.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f607
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0x344]
push edx
push str._s_taskmgr.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x544]
lea edx, [ebp - 0x344]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f643
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._s_spoolsv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f67f
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x9e4]
lea edx, [ebp - 0x344]
push ecx
push str._sexplorer.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f6bb
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x544]
push edx
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41f6dd
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._sctfmon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f719
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._smswsock.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f755
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0x344]
push edx
push str._smsgina.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x544]
lea edx, [ebp - 0x344]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f791
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._swsock32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f7cd
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._sws2_32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f809
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0x344]
push edx
push str._sSETUPAPI.DLL
push eax
call fcn.004f175f
lea ecx, [ebp - 0x544]
lea edx, [ebp - 0x344]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f845
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._ses.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f881
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._sMSI.DLL
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f8bd
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0x344]
push edx
push str._sSHELL32.dll
push eax
call fcn.004f175f
lea ecx, [ebp - 0x544]
lea edx, [ebp - 0x344]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f8f9
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x1c4]
lea ecx, [ebp - 0x344]
push eax
push str._s_svchost__k_DcomLaunch
push ecx
call fcn.004f175f
lea edx, [ebp - 0x544]
lea eax, [ebp - 0x344]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f935
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x1c4]
lea edx, [ebp - 0x344]
push ecx
push str._s_svchost__k_rpcss
push edx
call fcn.004f175f
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x344]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x41f971
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x544]
push edx
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x41f98f
push 0x516500
jmp 0x421fcb
lea eax, [ebp - 0x544]
push eax
call fcn.004ab3c0
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0x544]
push ecx
push edx
mov dword [ebp - 0x114], eax
call fcn.004d9590
movsx esi, ax
lea eax, [ebp - 0x544]
mov dword [ebp - 0x3c], esi
push eax
call fcn.004d9260
movsx ecx, ax
lea edx, [ebp - 0x544]
push 0x5156a4
push edx
mov dword [ebp - 0xf8], ecx
call fcn.004f2d80
add esp, 0x18
test eax, eax
je 0x41f9f1
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x544]
push str.java
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fa13
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x544]
push str.mcnstart.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fa35
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x544]
push str.gmcstart.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fa57
push 0x5147b4
jmp 0x421fcb
cmp esi, 2
jle 0x41fae8
lea eax, [ebp - 0x544]
push str.Network_Associates
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fa82
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x544]
push str.kav.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41faa4
push 0x5147b4
jmp 0x421fcb
lea edx, [ebp - 0x544]
push str.Kav.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fac6
push 0x5147b4
jmp 0x421fcb
lea eax, [ebp - 0x544]
push str.System32_smss.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fae8
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0x7c4]
push str.Microsoft
push ecx
mov dword [ebp - 0x100], 0
call fcn.004f2d80
add esp, 8
mov ebx, 1
test eax, eax
je 0x41fb15
mov dword [ebp - 0x100], ebx
lea edx, [ebp - 0x544]
push str.CCManager
push edx
call fcn.004f2d80
xor edx, edx
add esp, 8
cmp eax, edx
je 0x41fb39
push 0x5147b4
jmp 0x421fcb
lea edi, [ebp - 0x544]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x41fb6f
lea esi, [ebp + ecx - 0x544]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xfe4], al
jne 0x41fb69
cmp edx, 2
jge 0x41fb6f
inc edx
dec esi
cmp edx, ecx
jl 0x41fb57
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x41fb96
mov ebx, ecx
lea esi, [ebp - 0x544]
lea edi, [ebp - 0x12e4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x12e4], 0
test edx, edx
jle 0x41fbe0
mov edi, dword [ebp - 0xe0]
lea esi, [ebp + eax - 0x543]
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x41fbbf
mov byte [ebp + ecx - 0xfe4], al
cmp al, 0x2e
jne 0x41fbc4
inc edi
cmp al, 0x20
jne 0x41fbc9
inc edi
cmp al, 0x5c
jne 0x41fbd5
mov byte [ebp + ecx - 0xfe4], 0
inc ecx
cmp ecx, edx
jl 0x41fbb1
mov dword [ebp - 0xe0], edi
mov al, byte [ebp - 0x12e2]
mov byte [ebp + edx - 0xfe4], 0
cmp al, 0x5c
je 0x41fc00
mov byte [ebp - 0x12e2], 0x5c
mov byte [ebp - 0x12e1], 0
lea eax, [ebp - 0x544]
push 0x100
lea ecx, [ebp - 0xae4]
push eax
push ecx
call fcn.004f27c0
lea edx, [ebp - 0xfe4]
push 0x40
lea eax, [ebp - 0x924]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x544]
push ecx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0x24
test eax, eax
jne 0x41fc57
push 0x5144fc
jmp 0x421fcb
lea edx, [ebp - 0x544]
push 0x80
lea eax, [ebp - 0xb64]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0x544]
push 0x80
lea edx, [ebp - 0xbe4]
push ecx
push edx
call fcn.004f27c0
lea edi, [ebp - 0x9e4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x1c4]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xb64], al
mov byte [ebp + ecx - 0xbe4], al
lea eax, [ebp - 0x9e4]
lea ecx, [ebp - 0xb64]
push eax
push ecx
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x41fce7
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fce7
push esi
jmp 0x421fcb
lea edx, [ebp - 0x1c4]
lea eax, [ebp - 0xbe4]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fd1c
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fd1c
push esi
jmp 0x421fcb
lea ecx, [ebp - 0x544]
push str.System32
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fd75
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fd4f
push esi
jmp 0x421fcb
lea edx, [ebp - 0x544]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41fd75
push edi
jmp 0x421fcb
lea eax, [ebp - 0x544]
push str.system32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fdce
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fda8
push esi
jmp 0x421fcb
lea ecx, [ebp - 0x544]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41fdce
push edi
jmp 0x421fcb
lea edx, [ebp - 0x544]
push str.system
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41fe27
push 0x5144fc
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41fe01
push esi
jmp 0x421fcb
lea eax, [ebp - 0x544]
push eax
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41fe27
push esi
jmp 0x421fcb
lea ecx, [ebp - 0xfe4]
push str.smss.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea edx, [ebp - 0xfe4]
push str.winlogon.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea eax, [ebp - 0xfe4]
push str.csrss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea ecx, [ebp - 0xfe4]
push str.services.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea edx, [ebp - 0xfe4]
push str.lsass.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea eax, [ebp - 0xfe4]
push str.svchost.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea ecx, [ebp - 0xfe4]
push str.taskmgr.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea edx, [ebp - 0xfe4]
push str.spoolsv.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
lea eax, [ebp - 0xfe4]
push str.explorer.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x421ed7
xor edi, edi
xor ebx, ebx
push 0xd8a430
mov dword [ebp - 4], edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0x30], edi
mov dword [ebp + 8], edi
call fcn.004a6b50
add esp, 4
lea ecx, [ebp - 0x544]
push 0xd8a430
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, edi
jne 0x41ffaf
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x544]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 1
jmp 0x4208d3
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 1
push eax
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov dword [ebp - 0x144], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, edi
mov dword [ebp - 0xd4], eax
jne 0x42003f
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
mov edx, dword [0xd8a438]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004a6bd0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x118], esi
jne 0x420797
mov dword [ebp + 8], 6
jmp 0x4208c3
mov dword [ebp - 0x110], edi
cmp dword [eax + 0x10], edi
je 0x42000b
mov edx, dword [eax + 0xc]
mov eax, dword [0xd8a438]
mov ecx, dword [ebp - 0x144]
push edx
push eax
push ecx
call fcn.004a6c30
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov edi, eax
inc ecx
push 0x515c98
push edi
mov dword [ebp - 0x20], ecx
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x134], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc42.dll
inc eax
push edi
mov dword [ebp - 0x130], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.mfc71.dll
inc eax
push edi
mov dword [ebp - 0x13c], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push 0x516b00
inc eax
push edi
mov dword [ebp - 0x138], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.comdlg32.dll
inc eax
push edi
mov dword [ebp - 0x118], eax
call fcn.004f61e0
add esp, 0x30
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x140], eax
cmp esi, 0x69
jge 0x42018f
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x420189
cmp esi, 0xf
jle 0x42012a
cmp esi, 0x12
jge 0x42012a
mov dword [ebp - 0x58], ebx
cmp esi, 0x1d
je 0x420139
cmp esi, 0x1e
je 0x420139
cmp esi, 0x39
jne 0x42013c
mov dword [ebp - 0x74], ebx
cmp esi, 0x1f
je 0x420146
cmp esi, 0x20
jne 0x420149
mov dword [ebp - 0x50], ebx
cmp esi, 0x21
je 0x420153
cmp esi, 0x22
jne 0x420156
mov dword [ebp - 0x48], ebx
cmp esi, 0x23
je 0x420160
cmp esi, 0x24
jne 0x420163
mov dword [ebp - 0x38], ebx
cmp esi, 0x2c
jne 0x42016e
mov dword [ebp - 0x6c], ebx
inc esi
jmp 0x4200fa
cmp esi, 0x2d
je 0x420186
cmp esi, 0x2e
jne 0x420181
mov dword [ebp - 0x5c], ebx
inc esi
jmp 0x4200fa
cmp esi, 0x3d
jne 0x420189
mov dword [ebp - 0x28], ebx
inc esi
jmp 0x4200fa
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0xa0], 0
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov esi, eax
push ecx
mov dword [ebp - 0x128], esi
call fcn.004a6ca0
mov ecx, dword [ebp - 0x110]
add esp, 4
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
test eax, eax
jne 0x4201d8
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x40], eax
push eax
mov eax, dword [0xd8a438]
push eax
push esi
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x42000b
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4206d9
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x420268
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x964]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x964]
jmp 0x4202e9
mov edx, dword [0xd8a438]
push eax
mov eax, dword [ebp - 0x128]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4202a4
xor ecx, ecx
lea edx, [ebp - 0x7e4]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x18], esi
jmp 0x4202f1
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x944]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x944]
mov dword [ebp - 0x18], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x69
jge 0x420650
mov eax, dword [ebp - 0x18]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x42064a
cmp esi, 0x45
jne 0x4203c0
lea ecx, [ebp - 0xd64]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0xd64]
lea eax, [ebp - 0x244]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x244]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x42039a
lea edx, [ebp - 0x7c4]
lea eax, [ebp - 0xce4]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xce4]
jmp 0x421fca
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0xce4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0xce4]
jmp 0x421fca
test esi, esi
jne 0x4203cd
mov dword [ebp - 0x44], edi
inc esi
jmp 0x4202f3
cmp esi, edi
jne 0x4203da
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x4202f3
cmp esi, 2
je 0x42064a
cmp esi, 4
jne 0x4203f4
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x4202f3
cmp esi, 5
jne 0x420405
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x4202f3
cmp esi, 6
jne 0x420416
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x4202f3
cmp esi, 7
jne 0x420427
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x4202f3
cmp esi, 8
jne 0x420438
mov dword [ebp - 0xac], edi
inc esi
jmp 0x4202f3
cmp esi, 9
jne 0x420449
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x4202f3
cmp esi, 0xa
jne 0x420457
mov dword [ebp - 0x68], edi
inc esi
jmp 0x4202f3
cmp esi, 0xb
jne 0x420468
mov dword [ebp - 0x94], edi
inc esi
jmp 0x4202f3
jle 0x420472
cmp esi, 0xf
jge 0x420475
mov dword [ebp - 0x34], edi
cmp esi, 0xf
jne 0x420480
mov dword [ebp - 0x70], edi
inc esi
jmp 0x4202f3
jle 0x42048a
cmp esi, 0x12
jge 0x42048a
mov dword [ebp - 0x58], edi
cmp esi, 0x1b
jne 0x42049b
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x4202f3
cmp esi, 0x1c
jne 0x4204ac
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x4202f3
cmp esi, 0x1d
je 0x4204bb
cmp esi, 0x1e
je 0x4204bb
cmp esi, 0x39
jne 0x4204be
mov dword [ebp - 0x74], edi
cmp esi, 0x1f
je 0x4204c8
cmp esi, 0x20
jne 0x4204cb
mov dword [ebp - 0x50], edi
cmp esi, 0x21
je 0x4204d5
cmp esi, 0x22
jne 0x4204d8
mov dword [ebp - 0x48], edi
cmp esi, 0x23
je 0x4204e2
cmp esi, 0x24
jne 0x4204e5
mov dword [ebp - 0x38], edi
cmp esi, 0x25
je 0x4204ef
cmp esi, 0x26
jne 0x4204f5
mov dword [ebp - 0xec], edi
cmp esi, 0x27
jne 0x420506
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x4202f3
cmp esi, 0x28
jne 0x420517
mov dword [ebp - 0x104], edi
inc esi
jmp 0x4202f3
cmp esi, 0x29
jne 0x420528
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x4202f3
cmp esi, 0x2c
jne 0x420536
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x4202f3
cmp esi, 0x2d
jne 0x420544
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4202f3
cmp esi, 0x2e
jne 0x420552
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x4202f3
cmp esi, 0x2f
jne 0x420563
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x4202f3
cmp esi, 0x30
jne 0x420574
mov dword [ebp - 0x90], edi
inc esi
jmp 0x4202f3
cmp esi, 0x31
jne 0x420585
mov dword [ebp - 0x98], edi
inc esi
jmp 0x4202f3
cmp esi, 0x32
jne 0x420596
mov dword [ebp - 0x88], edi
inc esi
jmp 0x4202f3
cmp esi, 0x34
jne 0x4205a7
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x4202f3
cmp esi, 0x35
jne 0x4205b8
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x4202f3
cmp esi, 0x36
jne 0x4205c9
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x4202f3
cmp esi, 0x37
jne 0x4205de
mov dword [ebp - 0xd0], 0
inc esi
jmp 0x4202f3
cmp esi, 0x38
jne 0x4205ef
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x4202f3
cmp esi, 0x3a
je 0x4205fe
cmp esi, 0x3b
je 0x4205fe
cmp esi, 0x3c
jne 0x420604
mov dword [ebp - 0xe8], edi
cmp esi, 0x3d
jne 0x420612
mov dword [ebp - 0x28], edi
inc esi
jmp 0x4202f3
cmp esi, 0x3e
jne 0x420623
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x4202f3
cmp esi, 0x3f
jne 0x420631
mov dword [ebp - 0x60], edi
inc esi
jmp 0x4202f3
cmp esi, 0x40
jne 0x42063f
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x4202f3
cmp esi, 0x41
jne 0x42064a
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x4202f3
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x134]
inc ecx
cmp eax, edi
mov dword [ebp - 0x30], ecx
jne 0x420664
inc dword [ebp - 0x78]
cmp dword [ebp - 0x130], edi
jne 0x420672
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x13c], edi
jne 0x420680
inc dword [ebp - 0x120]
cmp dword [ebp - 0x138], edi
jne 0x42068b
inc dword [ebp - 0x64]
cmp dword [ebp - 0x140], edi
jne 0x420699
inc dword [ebp - 0xdc]
cmp dword [ebp - 0x118], edi
jne 0x4206a7
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x30], 0x4e20
jg 0x4206d9
mov esi, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x1c], ecx
mov eax, ecx
jmp 0x420201
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0xa0]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0xd4]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0xd4], eax
xor edi, edi
jmp 0x420045
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
mov dword [ebp - 0x40], ebx
cmp bx, word [esi + 2]
jae 0x4208c3
xor ecx, ecx
push str..asp
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x7c], cl
mov edx, dword [edi]
mov dword [ebp - 0x84], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x80], eax
push ecx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x4207f0
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x84]
push str..upx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42080b
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x84]
push str..upack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x420826
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x84]
push str..Pecompact
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x420841
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x84]
push str..aspack
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x42085c
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x84]
push str..fsg
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x420877
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x40]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x40], eax
jg 0x4208c3
mov esi, dword [ebp - 0x118]
add edi, 0x28
inc ebx
jmp 0x4207aa
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x78]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 4], 0
mov ecx, dword [0xd8a438]
push ecx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x42090f
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp esi, 1
jne 0x42092b
push 0x515b6c
jmp 0x421fcb
test esi, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
je 0x42105d
cmp edi, 1
jge 0x42105d
lea edx, [ebp - 0x12e4]
xor esi, esi
push edx
mov dword [ebp - 0x20], esi
call fcn.004f2beb
jmp 0x420965
lea eax, [ebp - 0xfe4]
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xce4]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x420996
push 1
lea ecx, [ebp - 0x20c]
call fcn.004f0653
mov byte [ebp - 4], 7
call fcn.004abd90
cmp eax, 1
jne 0x4209c2
lea edx, [ebp - 0xce4]
push edx
call fcn.004f2ce2
add esp, 4
jmp 0x4209d6
lea eax, [ebp - 0xae4]
push str.c:endpcachemonitor_procPath5.txt
push eax
call fcn.00403af0
add esp, 8
mov ecx, dword [0x4fe4e8]
mov dword [ebp + 8], esi
push ecx
push 1
push str.c:endpcachemonitor_procPath5.txt
lea ecx, [ebp - 0x20c]
call fcn.004f0727
mov edx, dword [ebp - 0x20c]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x208]
cmp dword [eax + 0x30], 0xffffffff
jne 0x420a4e
push str.c:endpcache
call fcn.004f2beb
push 0x515478
call fcn.004fa6c0
add esp, 8
lea ecx, [ebp - 0x1f8]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x1f8]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x12c]
mov esi, 1
mov edi, dword [ebp - 0x208]
push 0xa
lea ecx, [ebp - 0x8e4]
push 0x100
inc edi
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x208], edi
call fcn.004f0ae9
lea edi, [ebp - 0x8e4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x420fec
lea edx, [ebp - 0x8e4]
push str.Summary
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x420ab6
mov dword [ebp - 0x124], esi
lea eax, [ebp - 0x8e4]
push str.Bound_to
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x420fec
lea ecx, [ebp - 0x8e4]
push str.File_Type
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x420fec
lea edx, [ebp - 0x8e4]
push str.Dump_of_file
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x420fec
cmp dword [ebp - 0x54], esi
jne 0x420b12
inc dword [ebp - 0x18]
cmp ebx, esi
jne 0x420b19
inc dword [ebp - 0x1c]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x420fe0
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x8e4]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x420fda
mov ecx, dword [ebp - 0xa4]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0xa4], ecx
jne 0x420c20
lea edx, [ebp - 0xd64]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0xd64]
lea ecx, [ebp - 0x1364]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1364]
push edx
call fcn.004f2beb
xor ecx, ecx
push str.c:endpcache
test eax, eax
sete cl
mov esi, ecx
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x420bc7
lea edx, [ebp - 0x7c4]
lea eax, [ebp - 0x10e4]
push edx
push 0x5153f4
push eax
jmp 0x420bda
lea ecx, [ebp - 0x7c4]
lea edx, [ebp - 0x10e4]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x10e4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1f8]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x1f8]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x19
jne 0x420c99
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x20], edx
jle 0x420c40
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x8e4]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x8e4]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x8e4]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x420d0a
test ebx, ebx
jne 0x420d0a
test eax, eax
jne 0x420d0a
mov edi, 1
inc esi
jmp 0x420b20
cmp esi, 0x1a
jne 0x420d17
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x20], edx
jle 0x420cb9
sub ecx, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x8e4]
push str.KERNEL32
push ecx
call fcn.004f2d80
lea edx, [ebp - 0x8e4]
push 0x5153ac
push edx
mov edi, eax
call fcn.004f2d80
mov ebx, eax
lea eax, [ebp - 0x8e4]
push str.Kernel32
push eax
call fcn.004f2d80
add esp, 0x18
test edi, edi
jne 0x420d0a
test ebx, ebx
jne 0x420d0a
test eax, eax
jne 0x420d0a
mov edi, 1
inc esi
jmp 0x420b20
mov ebx, 1
inc esi
mov edi, ebx
jmp 0x420b20
cmp esi, 0x2a
jne 0x420d2d
xor ebx, ebx
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x420b20
cmp esi, 0x2b
jne 0x420d43
xor ebx, ebx
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x54], ebx
inc esi
jmp 0x420b20
test esi, esi
jne 0x420d50
mov dword [ebp - 0x44], edi
inc esi
jmp 0x420b20
cmp esi, edi
jne 0x420d5d
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x420b20
cmp esi, 2
je 0x420fda
cmp esi, 4
jne 0x420d77
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x420b20
cmp esi, 5
jne 0x420d88
mov dword [ebp - 0xb4], edi
inc esi
jmp 0x420b20
cmp esi, 6
jne 0x420d99
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x420b20
cmp esi, 7
jne 0x420daa
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x420b20
cmp esi, 8
jne 0x420dbb
mov dword [ebp - 0xac], edi
inc esi
jmp 0x420b20
cmp esi, 9
jne 0x420dcc
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x420b20
cmp esi, 0xa
jne 0x420dda
mov dword [ebp - 0x68], edi
inc esi
jmp 0x420b20
cmp esi, 0xb
jne 0x420deb
mov dword [ebp - 0x94], edi
inc esi
jmp 0x420b20
jle 0x420df5
cmp esi, 0xf
jge 0x420df8
mov dword [ebp - 0x34], edi
cmp esi, 0xf
jne 0x420e03
mov dword [ebp - 0x70], edi
inc esi
jmp 0x420b20
jle 0x420e0d
cmp esi, 0x12
jge 0x420e0d
mov dword [ebp - 0x58], edi
cmp esi, 0x11
jle 0x420e1a
cmp esi, 0x19
jge 0x420e1a
mov dword [ebp - 0x24], edi
cmp esi, 0x1b
jne 0x420e2b
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x420b20
cmp esi, 0x1c
jne 0x420e3c
mov dword [ebp - 0xb0], edi
inc esi
jmp 0x420b20
cmp esi, 0x1d
je 0x420e4b
cmp esi, 0x1e
je 0x420e4b
cmp esi, 0x39
jne 0x420e4e
mov dword [ebp - 0x74], edi
cmp esi, 0x1f
je 0x420e58
cmp esi, 0x20
jne 0x420e5b
mov dword [ebp - 0x50], edi
cmp esi, 0x21
je 0x420e65
cmp esi, 0x22
jne 0x420e68
mov dword [ebp - 0x48], edi
cmp esi, 0x23
je 0x420e72
cmp esi, 0x24
jne 0x420e75
mov dword [ebp - 0x38], edi
cmp esi, 0x25
je 0x420e7f
cmp esi, 0x26
jne 0x420e85
mov dword [ebp - 0xec], edi
cmp esi, 0x27
jne 0x420e96
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x420b20
cmp esi, 0x28
jne 0x420ea7
mov dword [ebp - 0x104], edi
inc esi
jmp 0x420b20
cmp esi, 0x29
jne 0x420eb8
mov dword [ebp - 0x8c], edi
inc esi
jmp 0x420b20
cmp esi, 0x2c
jne 0x420ec6
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x420b20
cmp esi, 0x2d
jne 0x420ed4
mov dword [ebp - 0x28], edi
inc esi
jmp 0x420b20
cmp esi, 0x2e
jne 0x420ee2
mov dword [ebp - 0x5c], edi
inc esi
jmp 0x420b20
cmp esi, 0x2f
jne 0x420ef3
mov dword [ebp - 0xa8], edi
inc esi
jmp 0x420b20
cmp esi, 0x30
jne 0x420f04
mov dword [ebp - 0x90], edi
inc esi
jmp 0x420b20
cmp esi, 0x31
jne 0x420f15
mov dword [ebp - 0x98], edi
inc esi
jmp 0x420b20
cmp esi, 0x32
jne 0x420f26
mov dword [ebp - 0x88], edi
inc esi
jmp 0x420b20
cmp esi, 0x34
jne 0x420f37
mov dword [ebp - 0xb8], edi
inc esi
jmp 0x420b20
cmp esi, 0x35
jne 0x420f48
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x420b20
cmp esi, 0x36
jne 0x420f59
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x420b20
cmp esi, 0x37
jne 0x420f6e
mov dword [ebp - 0xd0], 0
inc esi
jmp 0x420b20
cmp esi, 0x38
jne 0x420f7f
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x420b20
cmp esi, 0x3a
je 0x420f8e
cmp esi, 0x3b
je 0x420f8e
cmp esi, 0x3c
jne 0x420f94
mov dword [ebp - 0xe8], edi
cmp esi, 0x3d
jne 0x420fa2
mov dword [ebp - 0x28], edi
inc esi
jmp 0x420b20
cmp esi, 0x3e
jne 0x420fb3
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x420b20
cmp esi, 0x3f
jne 0x420fc1
mov dword [ebp - 0x60], edi
inc esi
jmp 0x420b20
cmp esi, 0x40
jne 0x420fcf
mov dword [ebp - 0x4c], edi
inc esi
jmp 0x420b20
cmp esi, 0x41
jne 0x420fda
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x420b20
mov eax, dword [ebp + 8]
mov esi, 1
inc eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0x204], 1
je 0x420a59
lea ecx, [ebp - 0x20c]
call fcn.004f076e
mov eax, dword [ebp - 0x1c]
mov ecx, 5
cmp eax, ecx
jle 0x42101f
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jle 0x42102b
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x108]
test ecx, ecx
jne 0x421040
cmp eax, 6
jle 0x421040
sub eax, 6
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x1f8]
call fcn.004f05fb
mov ebx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x114]
cmp ecx, 1
jne 0x4210ce
mov edi, 0x515b20
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x3c]
and ecx, 3
cmp edx, 1
rep movsb byte es:[edi], byte [esi]
jge 0x4210bd
mov eax, dword [ebp - 0x114]
cmp eax, 0x4b000
jle 0x4210d1
push 0x515b0c
jmp 0x421fcb
lea eax, [ebp - 0x7c4]
push eax
push 0x515af0
jmp 0x421174
mov edx, dword [ebp - 0x3c]
cmp eax, 0x32000
jle 0x4211a0
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x64
jle 0x4210ee
cmp ebx, 0x64
jle 0x421131
jmp 0x421168
cmp ebx, 0x64
jle 0x421131
cmp ecx, 0x50
jle 0x42110d
cmp eax, 0x37000
jle 0x42110d
lea eax, [ebp - 0x7c4]
push eax
push 0x516ad4
jmp 0x421174
cmp eax, 0x3e800
jle 0x421119
cmp edx, 1
jg 0x421168
cmp eax, 0x70800
jg 0x421168
cmp eax, 0x64000
jle 0x421131
mov ecx, dword [ebp - 0xdc]
test ecx, ecx
jg 0x421168
cmp edx, 1
jle 0x421148
cmp dword [ebp - 0x64], 0x96
jle 0x421158
cmp dword [ebp - 0x30], 0x12c
jg 0x421168
cmp dword [ebp - 0x64], 0x96
jle 0x421158
cmp eax, 0x64000
jg 0x421168
cmp dword [ebp - 0x30], 0x15e
jle 0x4211a0
cmp eax, 0x64000
jle 0x4211a0
lea eax, [ebp - 0x7c4]
push eax
push 0x515a74
lea ecx, [ebp - 0x744]
push ecx
call fcn.004f175f
lea edx, [ebp - 0x744]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 0x744], 0
cmp eax, 1
mov dword [ebp + 8], 0
jle 0x4211e8
mov edi, 0x515348
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xfc], 1
jne 0x421221
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x544]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x421269
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xac]
mov ebx, 1
cmp eax, ebx
jne 0x4212a8
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x4c], ebx
jne 0x4212e4
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe4], ebx
jne 0x421323
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xb4], ebx
je 0x421333
cmp dword [ebp - 0x10c], ebx
jne 0x421363
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xbc], ebx
jne 0x4213a2
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xec], ebx
jne 0x4213da
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc4], ebx
jne 0x421412
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x44], ebx
jne 0x42144e
mov edi, 0x5152bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x104], ebx
jne 0x421490
mov edi, 0x5152a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xcc], ebx
jne 0x4214cf
mov edi, 0x51529c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf4], ebx
jne 0x42150e
mov edi, 0x515290
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x8c], ebx
jne 0x42154d
mov edi, 0x515284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x34], ebx
jne 0x4215e9
cmp dword [ebp - 0x90], ebx
je 0x421573
cmp dword [ebp - 0x98], ebx
je 0x421573
lea edx, [ebp - 0x744]
mov edi, 0x515278
jmp 0x4215bd
mov edi, 0x51526c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x88]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x744]
mov edi, 0x515258
je 0x4215bd
mov edi, 0x515248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xa8], ebx
jne 0x421628
mov edi, 0x515238
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x70], ebx
jne 0x421664
mov edi, 0x51522c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x58], ebx
jne 0x4216a0
mov edi, 0x51521c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], ebx
jne 0x421719
mov edi, 0x51520c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x100]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x421719
mov edi, 0x515200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xb0], ebx
jne 0x4217d3
cmp dword [ebp - 0xb8], ebx
jne 0x4217d3
cmp dword [ebp - 0xc0], ebx
jne 0x4217d3
cmp dword [ebp - 0xc8], ebx
jne 0x421788
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x744]
cmp eax, ebx
mov edi, 0x5151ec
je 0x42175c
mov edi, 0x5151dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd0], ebx
jne 0x4217d3
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x744]
cmp eax, ebx
mov edi, 0x5151c4
je 0x4217a7
mov edi, 0x5151b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xd8], ebx
jne 0x42180b
mov edi, 0x5151a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74], ebx
jne 0x421847
mov edi, 0x515190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x50], ebx
jne 0x421883
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x48], ebx
jne 0x4218bf
mov edi, 0x515174
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x38], ebx
jne 0x4218fb
mov edi, 0x515168
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x421948
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x421948
mov edi, 0x515154
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xe0], ebx
jle 0x42198c
mov edi, 0x515144
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x6c], ebx
jne 0x4219cd
mov edi, 0x515138
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x28], ebx
jne 0x421a0e
mov edi, 0x51512c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x5c], ebx
jne 0x421a48
mov edi, 0x515124
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], ebx
jne 0x421a8c
mov edi, 0x515118
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0xf0], ebx
jne 0x421ac9
mov edi, 0x515108
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, ebx
mov eax, 4
je 0x421ad9
lea eax, [edx*4]
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
jl 0x421ae7
cmp ecx, 7
jge 0x421b2f
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x744]
cmp eax, ebx
mov edi, 0x5150f8
je 0x421afe
mov edi, 0x5150e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edx, ebx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x1c]
mov edi, 1
cmp ebx, edi
jle 0x421b81
cmp dword [ebp - 0x20], edi
jne 0x421b81
mov edi, 0x5150d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
mov edx, 1
rep movsb byte es:[edi], byte [esi]
inc eax
mov dword [ebp + 8], edx
mov dword [ebp - 0x14], eax
mov edi, edx
cmp dword [ebp - 0x68], edi
jne 0x421bc6
cmp ebx, 5
jge 0x421bc6
test ebx, ebx
jle 0x421bc6
mov edi, 0x5150b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x744]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov edx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jge 0x421cb2
cmp dword [ebp - 0x2c], edi
jne 0x421c55
cmp ecx, edi
lea ebx, [ebp - 0x744]
jge 0x421c1f
mov edi, 0x5150a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x421c9b
mov dword [ebp + 8], 1
jmp 0x421c9b
mov edi, 0x515a08
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x421c9b
jmp 0x421c98
cmp ecx, edi
lea ebx, [ebp - 0x744]
mov edi, 0x515078
jl 0x421c69
mov edi, 0x515068
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x34], eax
jne 0x421c9b
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
inc eax
mov edi, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xf8]
jmp 0x421cb8
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x50], edi
jne 0x421cde
cmp dword [ebp - 0x48], edi
jne 0x421cc5
mov dword [ebp + 8], edi
cmp dword [ebp - 0x38], edi
jne 0x421ccd
mov dword [ebp + 8], edi
cmp dword [ebp - 0x34], 0xb
jne 0x421cd6
mov dword [ebp + 8], edi
cmp dword [ebp - 0x70], edi
jne 0x421cde
mov dword [ebp + 8], edi
test eax, eax
jne 0x421d4a
mov edi, 0x51505c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x744]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xf8]
mov edi, 1
cmp ecx, 6
jle 0x421d58
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x421d58
mov ebx, dword [ebp - 0x44]
test ebx, ebx
jne 0x421d5b
test edx, edx
jne 0x421d5b
test eax, eax
jle 0x421d5b
push 0x5147b4
jmp 0x421fcb
cmp eax, edi
jle 0x421d25
push 0x5147b4
jmp 0x421fcb
mov ebx, dword [ebp - 0x44]
cmp eax, 0xfffffffe
je 0x421d6a
cmp eax, 0xffffffff
je 0x421d6a
cmp eax, 0xfffffffd
jne 0x421d8c
cmp ecx, 6
jle 0x421d8c
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x421d8c
test ebx, ebx
jne 0x421e50
test edx, edx
jne 0x421d94
push 0x5147b4
jmp 0x421fcb
test ebx, ebx
jne 0x421e50
mov eax, dword [ebp + 8]
test eax, eax
jne 0x421e50
cmp ecx, 6
jle 0x421e50
cmp dword [ebp - 0x100], edi
jne 0x421e99
push 0xd9b940
push 0xd6d890
lea eax, [ebp - 0x544]
push 0xd56eac
push eax
call fcn.004b7fe0
add esp, 0x10
lea ecx, [ebp - 0x544]
movsx esi, ax
push 0xd4f1d0
push ecx
call fcn.004b83e0
add esp, 8
cmp esi, 6
jle 0x421e50
push 0xd56eac
push 0xd9b8c0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x421e50
push 0xd6d890
push 0xe56a50
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x421e50
push 0xd9b940
push 0xdb1c0c
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x421e50
push 0xd4f1d0
push 0xd4f350
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x421e50
push 0x515044
jmp 0x421fcb
push str.c:endpcache
call fcn.004f2beb
mov eax, dword [ebp - 0x14]
add esp, 4
test eax, eax
jne 0x421e6e
push 0x5147b4
jmp 0x421fcb
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421e7e
cmp ebx, edi
je 0x421e7e
cmp dword [ebp + 8], edi
jne 0x421e99
lea edx, [ebp - 0x744]
lea eax, [ebp - 0x1564]
push edx
push 0x516a9c
push eax
call fcn.004f175f
add esp, 0xc
push 0x5147b4
jmp 0x421fcb
lea ecx, [ebp - 0xae4]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x421efe
lea edx, [ebp - 0xae4]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xae4]
push eax
call esi
lea ecx, [ebp - 0xae4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x421f6b
lea edx, [ebp - 0xae4]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0xae4]
push eax
call esi
test eax, eax
jne 0x421f6b
lea ecx, [ebp - 0xae4]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, ebx
jne 0x421f6b
lea edx, [ebp - 0xae4]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x744]
mov edi, 0x5158dc
jmp 0x421f76
lea edx, [ebp - 0x744]
mov edi, 0x515894
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56d20], eax
lea edi, [ebp - 0xae4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x744]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret