Function at 0x445b70
Capabilities:
Check os version
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x183c
call fcn.0047bda0
push ebx
push esi
push edi
lea eax, [ebp - 0x5b8]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x80
push eax
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xbb8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x5b8]
lea eax, [ebp - 0x14cc]
push edx
push str._sdrivers_tcpip.sys
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x5b8]
lea edx, [ebp - 0x13cc]
push ecx
push str._sdriversipsec.sys
push edx
call fcn.0047a8f8
add esp, 0x18
mov dword [ebp - 0xd4c], 0x94
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0xd48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jge 0x445d32
mov eax, 0x49f164
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x12cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x7f8]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [edx + 1]
and ecx, 3
cmp al, 0x3a
rep movsb byte es:[edi], byte [esi]
je 0x44609a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x7f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
mov dword [ebp - 4], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x7f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
lea esi, [ebp + ecx - 0x7f8]
cmp edx, ecx
jge 0x445dec
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xf4c], al
jne 0x445de8
cmp edx, 2
jge 0x445dec
inc edx
dec esi
jmp 0x445dd2
mov al, byte [ebp - 0x7f8]
sub ecx, edx
cmp al, 0x22
mov esi, ecx
jne 0x445e1e
xor eax, eax
lea edi, [esi - 1]
cmp eax, edi
jge 0x445e14
mov cl, byte [ebp + eax - 0x7f7]
mov byte [ebp + eax - 0xb38], cl
inc eax
jmp 0x445dff
mov byte [ebp + esi - 0xb39], 0
jmp 0x445e3d
xor eax, eax
cmp eax, esi
jge 0x445e35
mov cl, byte [ebp + eax - 0x7f8]
mov byte [ebp + eax - 0xb38], cl
inc eax
jmp 0x445e20
mov byte [ebp + esi - 0xb38], 0
xor ecx, ecx
cmp ecx, edx
jge 0x445e65
lea eax, [ecx + esi]
mov al, byte [ebp + eax - 0x7f7]
cmp al, 0x5c
je 0x445e5a
mov byte [ebp + ecx - 0xf4c], al
jne 0x445e62
mov byte [ebp + ecx - 0xf4c], 0
inc ecx
jmp 0x445e3f
lea edi, [ebp - 0xf4c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0xf4c], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0xf4d]
mov cl, byte [ebp + ecx - 0xf4d]
cmp cl, 0x22
jne 0x445e93
mov byte [eax], 0
lea edi, [ebp - 0xb38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp eax, edi
jge 0x445eb6
cmp byte [ebp + eax - 0xb38], 0x3a
je 0x445eb6
inc eax
jmp 0x445ea5
mov esi, edi
xor edx, edx
sub esi, eax
lea ecx, [esi + 1]
cmp edx, ecx
jge 0x445ed7
lea ebx, [edx + eax]
inc edx
mov bl, byte [ebp + ebx - 0xb39]
mov byte [ebp + edx - 0x939], bl
jmp 0x445ebf
cmp eax, edi
mov byte [ebp + esi - 0x937], 0
jne 0x445f14
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x198]
push 0x80
push ecx
call esi
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x938]
push edx
push str._s_system32drivers
push eax
call fcn.0047a8f8
add esp, 0xc
jmp 0x445f1a
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0xb38]
push str.SystemRoot
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x445f5b
lea edx, [ebp - 0x198]
push 0x80
push edx
call esi
lea eax, [ebp - 0x198]
lea ecx, [ebp - 0x938]
push eax
push str._s_system32drivers
push ecx
call fcn.0047a8f8
add esp, 0xc
lea edx, [ebp - 0xb38]
push str.systemroot
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x445f9c
lea eax, [ebp - 0x198]
push 0x80
push eax
call esi
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x938]
push ecx
push str._s_system32drivers
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0xb38]
push str.Systemroot
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x445fdd
lea ecx, [ebp - 0x198]
push 0x80
push ecx
call esi
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x938]
push edx
push str._s_system32drivers
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0xb38]
push str.System32
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x446036
lea edx, [ebp - 0xb38]
push str.rivers
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x446036
lea eax, [ebp - 0x198]
push 0x80
push eax
call esi
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x938]
push ecx
push str._s_system32
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0xf4c]
push eax
call fcn.00483565
add esp, 4
lea ecx, [ebp - 0x938]
push eax
push ecx
call fcn.00483565
add esp, 4
lea edx, [ebp - 0x12cc]
push eax
push 0x4966e0
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x12cc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x7f8]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 4], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x7f8]
push ecx
push edx
call fcn.004290e0
movsx esi, ax
lea eax, [ebp - 0x7f8]
mov dword [ebp - 0x20], esi
push eax
call fcn.004246a0
mov edi, 1
add esp, 0xc
mov ebx, eax
cmp esi, edi
mov dword [ebp - 0x1c], ebx
jle 0x446114
cmp ebx, 0x32000
jle 0x446164
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x16cc]
push ecx
push 0x49f120
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x16cc]
push eax
call fcn.00483565
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x64000
jle 0x44613a
push 0x49e7d4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x400
jge 0x446164
cmp ebx, edi
jle 0x446164
push 0x49f10c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x5c]
push ecx
lea eax, [ebp - 0x7f8]
xor esi, esi
push edx
push eax
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x446192
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
je 0x446195
mov dword [ebp - 0x7c], edi
lea edx, [ebp - 0x218]
push str.Microsoft
push edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x74], esi
call fcn.0047bec0
add esp, 8
cmp eax, esi
je 0x4461ba
mov dword [ebp - 0x74], edi
lea eax, [ebp - 0x14cc]
lea ecx, [ebp - 0x7f8]
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4461f2
push 0x49f0f8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x13cc]
lea eax, [ebp - 0x7f8]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44622a
push 0x49f0f8
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x7f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jle 0x44625e
lea esi, [ebp + ecx - 0x7f8]
mov dl, byte [esi]
cmp dl, 0x5c
mov byte [ebp + eax - 0xf4c], dl
jne 0x446258
cmp eax, 2
jge 0x44625e
inc eax
dec esi
cmp eax, ecx
jl 0x446245
sub ecx, eax
mov edx, ecx
test edx, edx
jle 0x446283
mov ebx, ecx
lea esi, [ebp - 0x7f8]
lea edi, [ebp - 0xb38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + edx - 0xb38], 0
test eax, eax
jle 0x4462b6
lea esi, [ebp + edx - 0x7f7]
mov dl, byte [esi + ecx]
cmp dl, 0x5c
je 0x4462a9
mov byte [ebp + ecx - 0xf4c], dl
jne 0x4462b1
mov byte [ebp + ecx - 0xf4c], 0
inc ecx
cmp ecx, eax
jl 0x446298
mov byte [ebp + eax - 0xf4c], 0
mov al, byte [ebp - 0xb36]
cmp al, 0x5c
je 0x4462d6
mov byte [ebp - 0xb36], 0x5c
mov byte [ebp - 0xb35], 0
mov al, byte [ebp - 0xb37]
mov byte [ebp - 0x938], 0
cmp al, 0x3a
je 0x4463a1
lea edi, [ebp - 0xb38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
mov dword [ebp + 8], ecx
jle 0x446311
cmp byte [ebp + eax - 0xb38], 0x3a
je 0x446311
inc eax
cmp eax, ecx
jl 0x446302
mov edx, ecx
sub edx, eax
lea edi, [edx + 1]
test edi, edi
jle 0x44633f
mov ecx, edi
lea esi, [ebp + eax - 0xb39]
mov ebx, ecx
lea edi, [ebp - 0x938]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
cmp eax, ecx
mov byte [ebp + edx - 0x937], 0
jne 0x446378
lea ecx, [ebp - 0x198]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x938]
push edx
push 0x48b2f4
push eax
call fcn.0047a8f8
add esp, 0xc
lea edi, [ebp - 0x938]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xb36], 0x5c
je 0x4463b1
mov byte [ebp - 0xb36], 0x5c
lea ecx, [ebp - 0x7f8]
push ecx
call fcn.00429f20
add esp, 4
cmp eax, 1
je 0x4463e3
push 0x49f0e0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xb37], 0x3a
je 0x44640a
push 0x49f0cc
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xb36], 0x5c
je 0x44641a
mov byte [ebp - 0xb36], 0x5c
lea edi, [ebp - 0xf4c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x446448
cmp byte [ebp + eax - 0xf4c], 0x2e
jne 0x44643f
mov edx, 1
inc eax
cmp eax, ecx
jl 0x446430
test edx, edx
jne 0x446466
push 0x49f0b0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov byte [ebp + eax - 0xf48], 0
jge 0x446491
push 0x49f0b0
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x5b8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xbb8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x7f8]
push 0x100
lea edx, [ebp - 0x318]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0xf4c]
push 0x40
lea ecx, [ebp - 0x5f8]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0xb38]
push edx
call fcn.0046e290
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x7f8]
push eax
call fcn.00428d90
mov esi, eax
push 0x491c80
push esi
call fcn.0047fde0
add esp, 0x28
test eax, eax
jne 0x446532
push 0x49f094
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7f8]
push 0x80
lea edx, [ebp - 0xcb8]
push ecx
push edx
call fcn.0047b120
lea eax, [ebp - 0x7f8]
push 0x80
lea ecx, [ebp - 0xc38]
push eax
push ecx
call fcn.0047b120
lea edi, [ebp - 0xbb8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x5b8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xcb8], al
lea edx, [ebp - 0xbb8]
mov byte [ebp + ecx - 0xc38], al
lea eax, [ebp - 0xcb8]
push edx
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x4465da
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4465da
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x5b8]
lea edx, [ebp - 0xc38]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x446624
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x446624
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x7f8]
push str.System32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x44666c
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44666c
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7f8]
push str.system32
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4466b4
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4466b4
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x7f8]
push str.system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4466fc
push 0x491c80
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4466fc
push 0x49f07c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xf4c]
lea ecx, [ebp - 0x5b8]
push eax
push ecx
lea edx, [ebp - 0x15cc]
push 0x4966e0
push edx
call fcn.0047a8f8
xor edi, edi
push 0x650c60
mov dword [ebp - 4], 4
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x58], edi
call fcn.00404650
add esp, 0x14
lea eax, [ebp - 0x7f8]
push 0x650c60
push eax
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x44678e
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x7f8]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 1
mov dword [ebp - 0x58], esi
jmp 0x4467fe
mov edx, dword [0x650c68]
mov byte [ebp - 4], 5
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [0x650c68]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x90], eax
jne 0x44688e
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp - 0x58], 2
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], 4
mov edx, dword [0x650c68]
push edx
call fcn.00404680
add esp, 4
test eax, eax
jne 0x4470ca
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
lea eax, [ebp - 0x318]
cmp esi, 2
push 0x80
push eax
jne 0x44708a
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x318]
push edx
call fcn.00429e70
add esp, 4
push 0x49f050
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x108], edi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4467ee
mov ecx, dword [eax + 0xc]
mov edx, dword [0x650c68]
mov eax, dword [ebp - 0x114]
push ecx
push edx
push eax
call fcn.00404730
add esp, 0xc
mov ecx, 0x65cd80
mov esi, eax
push edi
call fcn.00479a12
push str.::DllName::
mov ecx, eax
call fcn.00479641
push esi
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
push str.ntoskrnl.exe
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44692f
push str.ntkrnlpa.exe
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x44692f
push str.ntkrnlmp.exe
push esi
call fcn.0047fde0
add esp, 8
mov dword [ebp - 0x110], 0
test eax, eax
jne 0x446939
mov dword [ebp - 0x110], 1
mov ecx, dword [0x650c68]
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x10c], 0
call fcn.004046b0
mov edx, dword [0x650c68]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0xcc], esi
call fcn.004047a0
lea ecx, [edi + edi*4]
add esp, 4
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x44697c
mov eax, dword [ecx + 0x10]
mov edx, dword [0x650c68]
push eax
push edx
push esi
mov dword [ebp - 0x6c], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
je 0x4467ee
mov eax, dword [eax]
test eax, eax
je 0x44702f
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x446a06
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x538]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x818]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x818]
jmp 0x446a8c
mov ecx, dword [0x650c68]
mov edx, dword [ebp - 0xcc]
push eax
push ecx
push edx
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x446a43
xor eax, eax
lea ecx, [ebp - 0x538]
mov ax, word [esi]
push eax
push str._04lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 2]
jmp 0x446a8c
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x538]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x838]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [ebp - 0x838]
xor esi, esi
mov edi, 1
cmp esi, 0x38
jge 0x446fb8
mov ecx, esi
shl ecx, 6
add ecx, str.RtlQueryRegistryValues
push ecx
push ebx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x446fb2
cmp esi, 0x45
jne 0x446b60
lea edx, [ebp - 0x198]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x198]
lea ecx, [ebp - 0x11cc]
push eax
push str._sMicrosoft.NETFramework
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x11cc]
push edx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x446b25
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x114c]
push eax
push 0x49efe8
push ecx
jmp 0x446b38
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x114c]
push edx
push 0x49efb0
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0x114c]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x446b77
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, edi
jne 0x446b8e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xac], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 2
jne 0x446ba6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 3
jne 0x446bbe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 4
jne 0x446bd6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 5
jne 0x446bee
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xbc], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 6
jne 0x446c06
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 7
jne 0x446c1e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 8
jne 0x446c36
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 9
jne 0x446c4e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0xa
jne 0x446c66
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0xb
jne 0x446c7e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x88], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0xc
jne 0x446c96
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0xd
jne 0x446cab
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0xe
jne 0x446cc7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], edi
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
inc eax
inc esi
mov dword [ebp - 0x38], eax
jmp 0x446a93
cmp esi, 0xf
jne 0x446cdc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x10
jne 0x446cf1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x11
jne 0x446d09
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x12
jne 0x446d21
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x13
jne 0x446d39
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x84], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x14
jne 0x446d4e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x15
jne 0x446d66
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x16
jne 0x446d7e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x17
jne 0x446d96
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x18
jne 0x446dae
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x19
jne 0x446dc6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x1a
jne 0x446dde
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x1b
je 0x446de8
cmp esi, 0x1c
jne 0x446df5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf8], edi
inc eax
mov dword [ebp - 0x14], eax
cmp esi, 0x1d
jne 0x446e0d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x1e
jne 0x446e25
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x1f
jne 0x446e36
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x446a93
cmp esi, 0x20
jne 0x446e44
mov dword [ebp - 0x80], edi
inc esi
jmp 0x446a93
cmp esi, 0x23
jne 0x446e5c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x24
jne 0x446e74
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x25
jne 0x446e8c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc0], edi
inc eax
inc esi
mov dword [ebp - 0x14], eax
jmp 0x446a93
cmp esi, 0x26
jne 0x446e9d
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x446a93
cmp esi, 0x27
jne 0x446eaf
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x446a93
cmp esi, 0x28
jne 0x446ec1
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x446a93
cmp esi, 0x29
jne 0x446ed3
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x446a93
cmp esi, 0x2a
jne 0x446ee5
mov eax, dword [ebp - 0x18]
inc eax
inc esi
mov dword [ebp - 0x18], eax
jmp 0x446a93
cmp esi, 0x2c
jne 0x446ef7
mov eax, dword [ebp - 0x78]
inc eax
inc esi
mov dword [ebp - 0x78], eax
jmp 0x446a93
cmp esi, 0x2d
jne 0x446f08
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x446a93
cmp esi, 0x2e
jne 0x446f1a
mov eax, dword [ebp - 0x2c]
inc eax
inc esi
mov dword [ebp - 0x2c], eax
jmp 0x446a93
cmp esi, 0x2f
jne 0x446f2c
mov eax, dword [ebp - 0x28]
inc eax
inc esi
mov dword [ebp - 0x28], eax
jmp 0x446a93
cmp esi, 0x30
jne 0x446f3e
mov eax, dword [ebp - 0x3c]
inc eax
inc esi
mov dword [ebp - 0x3c], eax
jmp 0x446a93
cmp esi, 0x31
jne 0x446f50
mov eax, dword [ebp - 0x44]
inc eax
inc esi
mov dword [ebp - 0x44], eax
jmp 0x446a93
cmp esi, 0x32
jne 0x446f62
mov eax, dword [ebp - 0x50]
inc eax
inc esi
mov dword [ebp - 0x50], eax
jmp 0x446a93
cmp esi, 0x33
jne 0x446f74
mov eax, dword [ebp - 0x4c]
inc eax
inc esi
mov dword [ebp - 0x4c], eax
jmp 0x446a93
cmp esi, 0x34
jne 0x446f86
mov eax, dword [ebp - 0x54]
inc eax
inc esi
mov dword [ebp - 0x54], eax
jmp 0x446a93
cmp esi, 0x35
jne 0x446f98
mov eax, dword [ebp - 0x40]
inc eax
inc esi
mov dword [ebp - 0x40], eax
jmp 0x446a93
cmp esi, 0x36
jne 0x446faa
mov eax, dword [ebp - 0x30]
inc eax
inc esi
mov dword [ebp - 0x30], eax
jmp 0x446a93
cmp esi, 0x37
jne 0x446fb2
inc dword [ebp - 0x34]
inc esi
jmp 0x446a93
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x110]
inc ecx
cmp eax, edi
mov dword [ebp - 0x24], ecx
jne 0x446fcc
inc dword [ebp - 0x60]
cmp dword [ebp - 0x24], 0xc350
jg 0x44702f
mov esi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp + 8]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x6c], edx
mov dword [ebp + 8], ecx
mov eax, ecx
jmp 0x44699b
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x90]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 5
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x90], eax
mov edi, ecx
jmp 0x446894
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x318]
push edx
call fcn.00429e70
add esp, 4
push 0x49ef80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x650c60
call fcn.00404650
add esp, 4
cmp esi, 1
jne 0x4470fa
push 0x49ef68
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x44715d
cmp ebx, 1
jle 0x447166
cmp ebx, 0x1400
jge 0x447166
cmp dword [ebp - 0x20], 1
jge 0x447166
lea eax, [ebp - 0x318]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x318]
push edx
call fcn.00429e70
add esp, 4
push 0x49f050
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jge 0x447872
test esi, esi
je 0x447872
push str.c:endpcachemonitor_sysPath66.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xb38]
push eax
call fcn.0047c0d3
push 0x5585b7cb
call fcn.004749bb
adc esi, 0x94656a47
mov esi, dword [ebp]
bt esp, edi
pushal
mov byte [esp], ch
bt edi, 0x17
add ebp, 4
mov byte [esp], 0xd6
pushal
lea esp, [esp + 0x40]
jmp fcn.00661771