Function at 0x487f20
Capabilities:
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x4efcec
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x65c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x674]
mov dword fs:[0], eax
mov esi, dword [esp + 0x684]
mov ebp, dword [esp + 0x688]
xor edi, edi
mov dword [esp + 0x44], edi
cmp byte [0x103b0fc], 0
mov dword [esp + 0x64], esi
je 0x487fe8
mov eax, dword [ebp + 0x604]
test al, 2
jne 0x487f96
test eax, 0x8000
jne 0x487f96
cmp byte [0x571aec], 0
jne 0x487fe8
mov ecx, dword [0x103a97c]
cmp ecx, 0x88
je 0x487fa9
cmp ecx, 0x77
jne 0x487fc7
lea ecx, [ebp + 0x60c]
push ecx
add ebp, 0x204
push ebp
push eax
push str.m_bEnableConfig_SendStatus_0x_08x___s___s_
push 8
call fcn.0043d500
add esp, 0x14
push 0x5116d8
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x67c], edi
mov dword [esp + 0x44], 1
jmp 0x489101
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x67c], 1
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], pe_nt_image_headers32
mov byte [esp + 0x67c], 3
push 0x20
push edi
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x28]
call fcn.00472680
mov byte [esp + 0x67c], 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.tc_transfer
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x680], 5
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x684], 4
call fcn.00486a00
mov eax, ebp
add esp, 8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488070
sub eax, edx
cmp eax, 0xa
jae 0x4880cc
push edi
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
push str._Y__m__d__H:_M:_S
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00409400
mov byte [esp + 0x67c], 6
mov ecx, dword [eax]
mov edx, ebp
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4880b0
mov byte [esp + 0x67c], 4
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, str.detect_time
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4880d4
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.detect_time
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, ebp
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488100
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push ebp
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.flag
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488130
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.flag
lea ecx, [esp + 0x24]
call fcn.004803e0
mov esi, dword [ebp + 0x604]
push 6
lea ecx, [esp + 0x20]
call fcn.0047f810
push esi
lea ecx, [esp + 0x20]
call fcn.0047e510
mov eax, str.action
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488178
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.action
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, dword [ebp + 0x604]
test al, 0x40
je 0x4881ce
mov eax, str.block__detect
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4881b0
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.block__detect
jmp 0x48821c
test al, 0x39
jne 0x4881f1
test eax, 0x20400
jne 0x4881f1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.detect
call fcn.00483b60
jmp 0x488225
mov eax, str.block
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488200
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.block
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.device_type
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488230
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.device_type
lea ecx, [esp + 0x24]
call fcn.004803e0
lea ecx, [esp + 0x1c]
call fcn.00480300
mov eax, dword [ebp + 0x604]
mov byte [esp + 0x1b], 0
mov ebx, str.personal_info
mov edi, 0x1000
test al, 8
je 0x4882af
mov eax, 0x502db4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488280
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push 0x502db4
lea ecx, [esp + 0x24]
call fcn.004803e0
mov esi, pe_nt_image_headers32
jmp 0x488519
mov esi, pe_nt_image_headers32
test esi, eax
je 0x4882cf
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00483b60
jmp 0x488519
test eax, 0x200
je 0x4882f1
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.backup_info
call fcn.00483b60
jmp 0x488519
test eax, 0x400
je 0x48830a
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.ransom
push edx
jmp 0x48850b
test eax, 0x8000
je 0x488474
test byte [ebp + 0x608], 1
je 0x488334
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_read_write_file
call fcn.00483b60
test byte [ebp + 0x608], 2
je 0x488353
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_read_file
call fcn.00483b60
test byte [ebp + 0x608], 4
je 0x488372
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_write_file
call fcn.00483b60
test byte [ebp + 0x608], 8
je 0x488391
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_rename_file
call fcn.00483b60
test byte [ebp + 0x608], 0x10
je 0x4883b0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_delete_file
call fcn.00483b60
test byte [ebp + 0x608], 0x20
je 0x4883cf
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_copy_file
call fcn.00483b60
test byte [ebp + 0x608], 0x40
je 0x4883ee
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_move_file
call fcn.00483b60
test byte [ebp + 0x608], 0x80
je 0x48840d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_replace_file
call fcn.00483b60
test dword [ebp + 0x608], esi
je 0x48842b
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_create_file
call fcn.00483b60
test dword [ebp + 0x608], 0x200
je 0x48844d
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_edit_file
call fcn.00483b60
test dword [ebp + 0x608], edi
je 0x488519
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.edrl_create_process
call fcn.00483b60
jmp 0x488519
test eax, 0x40000
je 0x48848d
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.ransom_filter
push edx
jmp 0x48850b
test eax, 0x80000
je 0x4884a3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.windows_defender
push eax
jmp 0x48850b
test eax, 0x200000
je 0x4884b4
mov dword [esp + 0x14], str.wmi_data
jmp 0x488506
test eax, 0x10000000
je 0x4884ca
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.outlook_mail_body
push edx
jmp 0x48850b
test eax, 0x10000
je 0x488519
test byte [ebp + 0x608], 1
je 0x4884f5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.except_by_user
call fcn.00483b60
mov byte [esp + 0x1b], 1
test byte [ebp + 0x608], 2
je 0x488519
mov dword [esp + 0x14], str.except_by_stack_over
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.00483b60
mov byte [esp + 0x1b], 1
mov eax, dword [ebp + 0x608]
cmp eax, 0x79fad68
jne 0x488545
test dword [ebp + 0x604], esi
jne 0x488545
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00483b60
jmp 0x4889c3
cmp eax, 0x83924da0
jne 0x48857e
mov eax, str.ransom_decoy
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488554
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.ransom_decoy
lea ecx, [esp + 0x24]
call fcn.004803e0
jmp 0x4889be
test al, 1
je 0x488594
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.00483b60
test byte [ebp + 0x608], 2
je 0x4885b8
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.password
call fcn.00483b60
mov byte [esp + 0x1b], 1
test byte [ebp + 0x608], 4
je 0x4885d7
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.tethering
call fcn.00483b60
test byte [ebp + 0x608], 0x10
je 0x4885f6
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.removal_disk
call fcn.00483b60
test byte [ebp + 0x608], 0x20
je 0x488615
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.network
call fcn.00483b60
test byte [ebp + 0x608], 0x40
je 0x488634
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.remote_drv
call fcn.00483b60
test byte [ebp + 0x608], 0x80
je 0x488653
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.cdrom
call fcn.00483b60
test dword [ebp + 0x608], esi
je 0x488671
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.sharefolder
call fcn.00483b60
test dword [ebp + 0x608], 0x200
je 0x488693
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.email
call fcn.00483b60
test dword [ebp + 0x608], 0x400
je 0x4886b5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x515484
call fcn.00483b60
test dword [ebp + 0x608], 0x800
je 0x4886d7
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x515480
call fcn.00483b60
test dword [ebp + 0x608], edi
je 0x4886f5
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.bluetooth
call fcn.00483b60
test dword [ebp + 0x608], 0x2000
je 0x488717
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x515470
call fcn.00483b60
test dword [ebp + 0x608], 0x4000
je 0x488739
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.printer
call fcn.00483b60
test dword [ebp + 0x608], 0x8000
je 0x488760
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.wifi
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x10000
je 0x488787
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.email_title
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x20000
je 0x4887a9
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.messenger
call fcn.00483b60
test dword [ebp + 0x608], 0x40000
je 0x4887cb
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.secure
call fcn.00483b60
test dword [ebp + 0x608], 0x80000
je 0x4887f2
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x51543c
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x100000
je 0x488819
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.serial_parallel
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x200000
je 0x48883b
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.android_debug_bridge
call fcn.00483b60
test dword [ebp + 0x608], 0x400000
je 0x488862
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.screen_shot
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x800000
je 0x488889
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.pcmcia_esata
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x1000000
je 0x4888b0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.ieee1394_irda
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x2000000
je 0x4888d7
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.messenger_title
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x4000000
je 0x4888f9
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.handset
call fcn.00483b60
test dword [ebp + 0x608], 0x8000000
je 0x488920
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.remote_shell
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x10000000
je 0x488947
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x5153bc
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x20000000
je 0x488969
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.usb_data_link
call fcn.00483b60
test dword [ebp + 0x608], 0x40000000
je 0x488990
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.black
call fcn.00483b60
mov byte [esp + 0x1b], 1
test dword [ebp + 0x608], 0x80000000
je 0x4889c3
test dword [ebp + 0x604], 0x400
jne 0x4889c3
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.ransom
call fcn.00483b60
mov byte [esp + 0x1b], 1
sub dword [esp + 0x2c], 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x10]
sub edx, dword [ecx + 0xc]
lea esi, [ecx + 0xc]
cmp edx, 1
jge 0x4889e1
push 1
call fcn.00472b80
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], 0x5d
mov eax, str.process_name
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4889f3
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.process_name
lea ecx, [esp + 0x24]
call fcn.004803e0
mov esi, dword [sym.imp.MSVCR90.dll_strchr]
lea ebx, [ebp + 0x204]
push 0x3e
push ebx
call esi
add esp, 8
test eax, eax
je 0x488a33
mov byte [eax], 0
push 0x3a
push ebx
call esi
add esp, 8
push ebx
lea ecx, [esp + 0x44]
mov esi, eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x67c], 7
lea edx, [ebp + 0x205]
cmp edx, esi
jae 0x488a66
dec esi
push esi
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x40]
mov edx, ebx
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x488a70
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488a80
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push ebx
lea ecx, [esp + 0x24]
call fcn.004803e0
push 0
push 1
push ebx
call fcn.0046aae0
add esp, 0xc
test eax, eax
je 0x488d21
push 0x200
lea eax, [esp + 0x74]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0x200
lea ecx, [esp + 0x280]
push 0
push ecx
call sub.MSVCR90.dll_memset
push 0x200
lea edx, [esp + 0x48c]
push 0
push edx
call sub.MSVCR90.dll_memset
push 0x200
lea eax, [esp + 0x98]
push eax
push 0x50aa74
push ebx
call fcn.0044dde0
push 0x200
lea ecx, [esp + 0x2a8]
push ecx
push 0x50d3b0
push ebx
call fcn.0044dde0
add esp, 0x44
push 0x200
lea edx, [esp + 0x474]
push edx
push 0x50d3a0
push ebx
call fcn.0044dde0
mov eax, str.process_file_description
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488b45
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.process_file_description
lea ecx, [esp + 0x24]
call fcn.004803e0
lea eax, [esp + 0x70]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488b71
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.process_original_filename
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488ba0
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.process_original_filename
lea ecx, [esp + 0x24]
call fcn.004803e0
lea eax, [esp + 0x270]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488bd0
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
lea ecx, [esp + 0x274]
push ecx
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.process_legal_copyright
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488c00
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.process_legal_copyright
lea ecx, [esp + 0x24]
call fcn.004803e0
lea eax, [esp + 0x470]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488c30
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
lea edx, [esp + 0x474]
push edx
lea ecx, [esp + 0x24]
call fcn.004803e0
cmp byte [ebp + 0x1b2c], 0
lea esi, [ebp + 0x1b2c]
jne 0x488ccc
push str._System_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x488ccc
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push ebx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x684], 8
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x688], 7
call fcn.00447e60
add esp, 0xc
mov byte [esp + 0x67c], 9
mov ecx, dword [eax]
mov edx, esi
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x488cb0
mov byte [esp + 0x67c], 7
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, str.process_hash
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488cd4
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0047f810
push edi
push str.process_hash
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488d00
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0047f810
push edi
push esi
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.dest_ip
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488d30
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.dest_ip
lea ecx, [esp + 0x24]
call fcn.004803e0
lea esi, [ebp + 0x100c]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488d60
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0047f810
push edi
push esi
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, str.dest_port
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488d90
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.dest_port
lea ecx, [esp + 0x24]
call fcn.004803e0
mov esi, dword [ebp + 0x120c]
push 6
lea ecx, [esp + 0x20]
call fcn.0047f810
push esi
lea ecx, [esp + 0x20]
call fcn.0047e510
mov eax, str.edrl_key
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x488dd8
sub eax, ecx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.edrl_key
lea ecx, [esp + 0x24]
call fcn.004803e0
lea esi, [ebp + 0x1a28]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488e08
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0047f810
push edi
push esi
lea ecx, [esp + 0x24]
call fcn.004803e0
test dword [0x1042d84], 0x200000
je 0x488e4c
lea ecx, [ebp + 0x60c]
push ecx
lea edx, [ebp + 0x1210]
push ebx
push edx
call fcn.0043d040
add esp, 0xc
test byte [ebp + 0x604], 8
je 0x488f9a
mov eax, str.attack_type
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488e61
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.attack_type
lea ecx, [esp + 0x24]
call fcn.004803e0
mov eax, dword [ebp + 0x1814]
cmp eax, 1
jne 0x488e9e
mov dword [esp + 0x14], str.http_req
jmp 0x488f46
cmp eax, 2
jne 0x488eb5
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], str.http_syn
push ecx
jmp 0x488f4b
cmp eax, 4
jne 0x488ecc
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.http_get
push edx
jmp 0x488f4b
cmp eax, 8
jne 0x488edb
mov dword [esp + 0x14], str.tcp_connect
jmp 0x488f46
cmp eax, 0x10
jne 0x488eef
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], str.tcp_syn
push ecx
jmp 0x488f4b
cmp eax, 0x20
jne 0x488f03
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.udp_send
push edx
jmp 0x488f4b
cmp eax, 0x40
jne 0x488f12
mov dword [esp + 0x14], str.icmp
jmp 0x488f46
cmp eax, 0x80
jne 0x488f28
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], str.ip_spoof
push ecx
jmp 0x488f4b
cmp eax, 0x100
jne 0x488f3e
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.ip_arp
push edx
jmp 0x488f4b
mov dword [esp + 0x14], str.connect
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.00483b60
mov eax, str.attack_count
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488f60
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push str.attack_count
lea ecx, [esp + 0x24]
call fcn.004803e0
mov ecx, dword [ebp + 0x181c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00480160
jmp 0x489052
mov bl, byte [esp + 0x1b]
lea ecx, [esp + 0x1c]
test bl, bl
je 0x488fb5
lea edx, [esp + 0x14]
mov dword [esp + 0x14], str.context
push edx
jmp 0x488fc2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.file_name
push eax
call fcn.00483b60
lea edi, [ebp + 0x60c]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488fd2
sub eax, edx
push 5
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0047f810
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.004803e0
test bl, bl
jne 0x489052
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.file_size
call fcn.00483b60
mov edx, dword [ebp + 0x1824]
mov eax, dword [ebp + 0x1820]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.004801d0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], str.file_hash
call fcn.00483b60
lea edx, [esp + 0x14]
add ebp, 0x1b54
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebp
call fcn.00483b60
sub dword [esp + 0x2c], 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
lea esi, [ecx + 0xc]
mov edi, 1
cmp eax, edi
jge 0x489073
push edi
call fcn.00472b80
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], 0x7d
mov edx, dword [esp + 0x58]
sub edx, dword [esp + 0x54]
cmp edx, edi
jge 0x489093
push edi
lea ecx, [esp + 0x4c]
call fcn.00472b80
mov ecx, dword [esp + 0x54]
mov eax, ecx
add ecx, edi
mov dword [esp + 0x54], ecx
mov esi, dword [esp + 0x64]
mov byte [eax], 0
mov eax, dword [esp + 0x50]
sub dword [esp + 0x54], edi
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x44], edi
mov byte [esp + 0x67c], 4
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x67c], 3
lea ecx, [esp + 0x1c]
call fcn.00472e10
mov byte [esp + 0x67c], 1
lea ecx, [esp + 0x48]
call fcn.00472c40
mov byte [esp + 0x67c], 0
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x674]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.004e0148
add esp, 0x66c
ret