Function at 0x4607f0
Capabilities:
Delete file
Encode data using base64
Get common file path
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483f6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1928
call fcn.0047bda0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x1338]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x958]
push 0x80
push ecx
call ebx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x458]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
mov dword [ebp + 8], ecx
jge 0x4609ed
push str.NULL
call fcn.00483565
mov ecx, dword [ebp + 0xc]
push 0x49bbd4
mov dword [ecx], eax
call fcn.00483565
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x458]
push str.rundll32.exe
push edx
call fcn.0047bec0
lea eax, [ebp - 0x458]
push str.rundll32.
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
jne 0x460a4a
lea ecx, [ebp - 0x458]
push str.RUNDLL32.
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x460a4a
lea edx, [ebp - 0x458]
push str.Rundll32.
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460ad8
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x658]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x658]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x460aaa
cmp byte [ebp + eax - 0x658], 0x33
jne 0x460aa5
cmp byte [ebp + eax - 0x657], 0x32
jne 0x460aa5
cmp byte [ebp + eax - 0x656], 0x2e
je 0x460aaa
inc eax
cmp eax, ecx
jl 0x460a87
mov edx, ecx
sub edx, eax
lea ecx, [edx - 7]
test ecx, ecx
jle 0x460ad0
lea esi, [ebp + eax - 0x651]
mov eax, ecx
lea edi, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + edx - 0x45f], 0
lea ecx, [ebp - 0x458]
push str..dll
push ecx
call fcn.0047bec0
add esp, 8
mov esi, 1
test eax, eax
je 0x460af8
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push str..DLL
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460b13
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x458]
push str..Dll
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460b2e
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x458]
push str..tmp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460b4c
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push str..Tmp
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460b6a
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x458]
push str..TMP
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460b88
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x458]
push str._temp_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460ba6
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push str.TEMP_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460bc4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x458]
push str.RECYCLER_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460be8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x84], esi
lea ecx, [ebp - 0x458]
push str.Documents_and_Settings_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460c0c
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x8c], esi
lea edx, [ebp - 0x458]
push str.Program_FilesCommon_Files
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460c2a
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x458]
push str.documents_and_settings_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460c4e
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x8c], esi
lea ecx, [ebp - 0x458]
push str.program_filescommon_Files
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460c6c
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push 0x492024
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x460db7
lea eax, [ebp - 0x458]
push 0x492288
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x460db7
lea ecx, [ebp - 0x458]
push str.tem32_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460db7
lea edx, [ebp - 0x458]
push str.root_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x460db7
lea eax, [ebp - 0x458]
push str.Root_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x460db7
lea ecx, [ebp - 0x1d8]
push 0x80
push ecx
call ebx
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 8]
test esi, esi
jle 0x460d5c
mov dl, byte [ebp + eax - 0x558]
cmp dl, 0x53
je 0x460d5c
cmp dl, 0x73
je 0x460d5c
inc eax
cmp eax, esi
jl 0x460d46
sub ecx, eax
xor esi, esi
lea edx, [ecx - 8]
test edx, edx
jle 0x460d86
mov ecx, edx
lea esi, [ebp + eax - 0x550]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push 0x492024
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x46108c
lea edx, [ebp - 0x458]
push 0x492288
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x46108c
lea eax, [ebp - 0x458]
push str.SystemRoot_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460ece
lea ecx, [ebp - 0x1d8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x460e73
mov dl, byte [ebp + eax - 0x558]
cmp dl, 0x53
je 0x460e73
cmp dl, 0x73
je 0x460e73
inc eax
cmp eax, esi
jl 0x460e5d
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x460e9d
mov ecx, edx
lea esi, [ebp + eax - 0x54e]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push str.systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x460fad
lea edx, [ebp - 0x1d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x460f52
mov dl, byte [ebp + eax - 0x558]
cmp dl, 0x53
je 0x460f52
cmp dl, 0x73
je 0x460f52
inc eax
cmp eax, esi
jl 0x460f3c
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x460f7c
mov ecx, edx
lea esi, [ebp + eax - 0x54e]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push str.Systemroot_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46108c
lea edx, [ebp - 0x1d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x461031
mov dl, byte [ebp + eax - 0x558]
cmp dl, 0x53
je 0x461031
cmp dl, 0x73
je 0x461031
inc eax
cmp eax, esi
jl 0x46101b
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x46105b
mov ecx, edx
lea esi, [ebp + eax - 0x54e]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push 0x48b2f4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461164
lea edx, [ebp - 0x1d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x461109
cmp byte [ebp + eax - 0x558], 0x25
je 0x461109
inc eax
cmp eax, edx
jl 0x4610fa
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x461133
mov ecx, edx
lea esi, [ebp + eax - 0x54c]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push 0x49bba4
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46123c
lea edx, [ebp - 0x1d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x4611e1
cmp byte [ebp + eax - 0x558], 0x25
je 0x4611e1
inc eax
cmp eax, edx
jl 0x4611d2
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x46120b
mov ecx, edx
lea esi, [ebp + eax - 0x54c]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x458]
push str..RECYCLER
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461324
lea edx, [ebp - 0x1d8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x558]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x1d6], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x558]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xc]
test esi, esi
jle 0x4612c0
cmp byte [ebp + eax - 0x558], 0x5c
je 0x4612c0
inc eax
cmp eax, esi
jl 0x4612b1
mov edx, ecx
xor esi, esi
sub edx, eax
test edx, edx
jle 0x4612e9
mov ecx, edx
lea esi, [ebp + eax - 0x558]
mov eax, ecx
lea edi, [ebp - 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x1d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push str._s_s
push eax
mov byte [ebp + esi - 0x658], 0
mov byte [ebp - 0x458], 0
call fcn.0047a8f8
add esp, 0x10
mov dword [ebp - 0x84], 1
cmp byte [ebp - 0x458], 0x22
jne 0x461378
mov esi, dword [ebp + 8]
xor ecx, ecx
test esi, esi
jle 0x46134f
lea edx, [ebp - 0xc78]
mov al, byte [ebp + ecx - 0x458]
cmp al, 0x22
je 0x46134a
mov byte [edx], al
inc edx
inc ecx
cmp ecx, esi
jl 0x46133c
lea edi, [ebp - 0xc78]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x458]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x458]
push 0x48b7ec
push ecx
call fcn.0047bec0
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
lea ebx, [edx - 2]
test ebx, ebx
jle 0x4613c0
cmp byte [ebp + ebx - 0x458], 0x3a
jne 0x4613b9
cmp byte [ebp + ebx - 0x457], 0x5c
je 0x4613be
dec ebx
test ebx, ebx
jg 0x4613a5
test ebx, ebx
je 0x46146a
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0xc78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
jle 0x461408
cmp byte [ebp + eax - 0x458], 0x2e
je 0x461408
dec eax
test eax, eax
jg 0x4613f9
sub eax, ebx
mov byte [ebp - 0x458], 0
lea ecx, [eax + 5]
test ecx, ecx
jle 0x461435
lea ebx, [ebp + ebx - 0xc79]
mov edx, ecx
mov esi, ebx
lea edi, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x453], 0
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
test ebx, ebx
jle 0x461462
cmp byte [ebp + ebx - 0x458], 0x2e
je 0x461462
dec ebx
test ebx, ebx
jg 0x461453
mov byte [ebp + ebx - 0x454], 0
lea eax, [ebp - 0x8d8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test ebx, ebx
jne 0x461551
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1d8]
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x461504
lea edx, [ebp - 0x1d8]
push str.system32
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x461504
lea eax, [ebp - 0x1d8]
push str.SYSTEM32
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x461504
lea ecx, [ebp - 0x1d8]
lea edx, [ebp - 0x958]
push ecx
jmp 0x461511
lea ecx, [ebp - 0x1d8]
lea edx, [ebp - 0x8d8]
push ecx
push edx
lea eax, [ebp - 0x458]
push 0x4966e0
push eax
call fcn.0047a8f8
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x461549
cmp byte [ebp + ecx - 0x458], 0x2e
je 0x461549
dec ecx
test ecx, ecx
jg 0x46153a
mov byte [ebp + ecx - 0x454], 0
lea ecx, [ebp - 0x458]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x458]
push eax
call fcn.00429f20
add esp, 8
cmp eax, 1
je 0x461649
mov edx, dword [0x65cd64]
test edx, edx
jle 0x4615e7
shl edx, 8
lea ecx, [ebp - 0x458]
lea edx, [edx + 0x62a3e4]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46162b
mov edx, dword [0x65cd64]
lea edi, [ebp - 0x458]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x46162b
jmp 0x461621
mov ebx, edx
lea edi, [ebp - 0x458]
shl ebx, 8
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x62a4e4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x64
mov dword [0x65cd64], edx
rep movsb byte es:[edi], byte [esi]
jne 0x46162b
mov dword [0x65cd64], 0
push 0x49e7e4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x458]
push ecx
call fcn.004246a0
lea edx, [ebp - 0x458]
push str..sys
push edx
call fcn.0047bec0
add esp, 0xc
test eax, eax
je 0x4617cf
lea eax, [ebp - 0x458]
push eax
call fcn.00428d90
lea ecx, [ebp - 0xa78]
mov ebx, eax
lea edx, [ebp - 0x9f8]
push ecx
lea eax, [ebp - 0x1d8]
push edx
lea ecx, [ebp - 0x458]
push eax
push ecx
call fcn.004456c0
lea edx, [ebp - 0xa78]
lea eax, [ebp - 0x9f8]
push edx
lea ecx, [ebp - 0x1d8]
push eax
push ecx
push ebx
lea edx, [ebp - 0xd78]
push 0x49bafc
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1d8]
push 0x491b90
push eax
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x4617af
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x558]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x558]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x558], al
lea ecx, [ebp - 0x8d8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4617af
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4617af
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x5d8]
push eax
lea edx, [ebp - 0x458]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x4617af
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xd78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1d8]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xd78]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x458]
push str..SYS
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461949
lea edx, [ebp - 0x458]
push edx
call fcn.00428d90
mov ebx, eax
lea eax, [ebp - 0x9f8]
lea ecx, [ebp - 0xa78]
push eax
lea edx, [ebp - 0x1d8]
push ecx
lea eax, [ebp - 0x458]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0x9f8]
lea edx, [ebp - 0xa78]
push ecx
lea eax, [ebp - 0x1d8]
push edx
push eax
push ebx
lea ecx, [ebp - 0xd78]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1d8]
push 0x491b90
push edx
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x461929
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x558]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x558]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x558], al
lea ecx, [ebp - 0x8d8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x461929
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x461929
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x5d8]
push eax
lea edx, [ebp - 0x458]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x461929
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xd78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1d8]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xd78]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x458]
push str..Sys
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461ac3
lea edx, [ebp - 0x458]
push edx
call fcn.00428d90
mov ebx, eax
lea eax, [ebp - 0x9f8]
lea ecx, [ebp - 0xa78]
push eax
lea edx, [ebp - 0x1d8]
push ecx
lea eax, [ebp - 0x458]
push edx
push eax
call fcn.004456c0
lea ecx, [ebp - 0x9f8]
lea edx, [ebp - 0xa78]
push ecx
lea eax, [ebp - 0x1d8]
push edx
push eax
push ebx
lea ecx, [ebp - 0xd78]
push 0x49bafc
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x1d8]
push 0x491b90
push edx
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x461aa3
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x558]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x558]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8d8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x558], al
lea ecx, [ebp - 0x8d8]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x461aa3
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x461aa3
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x5d8]
push eax
lea edx, [ebp - 0x458]
push ecx
push edx
mov dword [ebp + 0xc], 0
call fcn.0044aaf0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 5
jle 0x461aa3
mov edi, 0x49e7d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xd78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1d8]
push ecx
push ebx
push 0x49e7c0
push edx
call fcn.0047a8f8
add esp, 0x10
lea eax, [ebp - 0xd78]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x958]
lea edx, [ebp - 0xb78]
push ecx
push str._swinlogon.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x458]
lea ecx, [ebp - 0xb78]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461b13
push 0x49bab4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x958]
lea eax, [ebp - 0xb78]
push edx
push str._scsrss.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x458]
lea edx, [ebp - 0xb78]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461b63
push 0x49bab4
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x958]
lea ecx, [ebp - 0xb78]
push eax
push str._s_services.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x458]
lea eax, [ebp - 0xb78]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461bb3
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x958]
lea edx, [ebp - 0xb78]
push ecx
push str._slsass.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x458]
lea ecx, [ebp - 0xb78]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461c03
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x958]
lea eax, [ebp - 0xb78]
push edx
push str._s_svchost.exe
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x458]
lea edx, [ebp - 0xb78]
push ecx
push edx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461c53
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x958]
lea ecx, [ebp - 0xb78]
push eax
push str._sctfmon.exe
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x458]
lea eax, [ebp - 0xb78]
push edx
push eax
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461ca3
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x958]
lea edx, [ebp - 0xb78]
push ecx
push str._s_rundll32.exe
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x458]
lea ecx, [ebp - 0xb78]
push eax
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x461cf3
push 0x49ba7c
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x458]
push edx
push eax
call fcn.004290e0
movsx ecx, ax
lea edx, [ebp - 0x1438]
mov dword [ebp - 0x150], ecx
lea eax, [ebp - 0x13b8]
push edx
lea ecx, [ebp - 0x458]
push eax
push ecx
call fcn.00455090
lea edx, [ebp - 0x258]
push str.Microsoft
push edx
mov dword [ebp - 0x4c], 0
call fcn.0047bec0
add esp, 0x1c
test eax, eax
je 0x461d4f
mov dword [ebp - 0x4c], 1
lea eax, [ebp - 0x258]
push str.Beijing_Rising
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461df6
mov edi, 0x49e634
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x558]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x558]
push str.Beijing
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x461df6
lea ecx, [ebp - 0x558]
push str.Rising
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461df6
lea edx, [ebp - 0x258]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x258]
push 0x49b940
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461e2c
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x458]
push str.32A6Wizard_
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461e62
push 0x49b934
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Trend_Micro_Inc
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461f09
mov edi, 0x49f60c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x558]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0x558]
push str.Trend
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x461f09
lea ecx, [ebp - 0x558]
push str.Trend
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461f09
lea edx, [ebp - 0x258]
push edx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x258]
push str.Jiangmin_Co
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x461f94
mov edi, 0x49e624
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Jiangmin
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x461f94
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Symantec_Corporation
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46201f
mov edi, 0x49e600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x46201f
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Eset
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4620aa
mov edi, 0x49e614
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Symantec
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x4620aa
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Network_Associates
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462135
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Networks_Associates_Technology__Inc
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x462135
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.McAfee_Inc
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4621c0
mov edi, 0x49e5d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push 0x49b830
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x4621c0
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Kingsoft_Corporation
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46224b
mov edi, 0x49e5c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Kingsoft
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x46224b
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Panda_Software
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4622d6
mov edi, 0x49e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Panda
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x4622d6
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x258]
push str.Kaspersky_Lab
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462361
mov edi, 0x49e5a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x258]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x458]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc78]
push ecx
push edx
call fcn.004294c0
lea eax, [ebp - 0xc78]
push str.Kaspersky
push eax
call fcn.0047bec0
add esp, 0x10
test eax, eax
je 0x462361
lea ecx, [ebp - 0x258]
push ecx
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x958]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x8d8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x8d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xfb8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x10b8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xfb8]
mov byte [ebp - 0xfb6], 0
push ecx
push str._sProgram_Files
push edx
call fcn.0047a8f8
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor ebx, ebx
test ecx, ecx
jle 0x462405
lea edx, [ebp + ecx - 0x458]
mov al, byte [edx]
cmp al, 0x5c
mov byte [ebp + ebx - 0x12b8], al
jne 0x4623ff
cmp ebx, 2
jge 0x462405
inc ebx
dec edx
cmp ebx, ecx
jl 0x4623ed
sub ecx, ebx
cmp ecx, 4
mov dword [ebp + 8], ecx
jge 0x46241d
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x120], eax
test ecx, ecx
jle 0x46243b
mov eax, ecx
lea esi, [ebp - 0x458]
lea edi, [ebp - 0x1638]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x1638]
lea edx, [ebp - 0x10b8]
push ecx
push edx
mov byte [ebp + edi - 0x1638], 0
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x462468
mov dword [ebp - 0x18], esi
xor ecx, ecx
test ebx, ebx
jle 0x4624aa
lea edx, [ebp + edi - 0x457]
mov edi, dword [ebp - 0x100]
mov al, byte [ecx + edx]
cmp al, 0x5c
je 0x462489
mov byte [ebp + ecx - 0x12b8], al
cmp al, 0x2e
jne 0x46248e
inc edi
cmp al, 0x20
jne 0x462493
inc edi
cmp al, 0x5c
jne 0x46249f
mov byte [ebp + ecx - 0x12b8], 0
inc ecx
cmp ecx, ebx
jl 0x46247b
mov dword [ebp - 0x100], edi
mov al, byte [ebp - 0x1637]
mov byte [ebp + ebx - 0x12b8], 0
cmp al, 0x3a
je 0x4624da
push 0x49b790
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x1636], 0x5c
je 0x4624f1
mov byte [ebp - 0x1636], 0x5c
mov byte [ebp - 0x1635], 0
lea eax, [ebp - 0x458]
push 0x100
lea ecx, [ebp - 0xe78]
push eax
push ecx
call fcn.0047b120
lea edx, [ebp - 0x12b8]
push 0x40
lea eax, [ebp - 0x1738]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x458]
push ecx
call fcn.00483565
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x458]
push eax
call fcn.00428d90
mov ebx, eax
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 0x28
test eax, eax
jne 0x462576
cmp dword [ebp - 0x4c], esi
jne 0x46281c
push 0x49b774
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x458]
push str.LOCALS1Temp
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462591
mov dword [ebp - 0x48], esi
lea edx, [ebp - 0x458]
push str._temp_
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4625ac
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x458]
push str.Temp_
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4625c7
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x458]
push str.Application_Data
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4625e2
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push str.Microsoft_SharedMSINFO
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4625fd
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x458]
push str.Microsoft_SharedMSInfo
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462618
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x458]
push str.Documents_and_Settings
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462633
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x458]
push 0x80
lea eax, [ebp - 0xf38]
push edx
push eax
call fcn.0047b120
lea ecx, [ebp - 0x458]
push 0x80
lea edx, [ebp - 0x1038]
push ecx
push edx
call fcn.0047b120
lea edi, [ebp - 0x8d8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x958]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0xf38], al
mov dword [ebp - 0x34], eax
mov byte [ebp + ecx - 0x1038], al
lea eax, [ebp - 0x8d8]
lea ecx, [ebp - 0xf38]
push eax
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x46270f
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4626de
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x458]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x44], esi
test ecx, ecx
jle 0x46270f
cmp byte [ebp + eax - 0x458], 0x5c
jne 0x462702
inc edx
inc eax
cmp eax, ecx
jl 0x4626f7
cmp edx, 2
jne 0x46270f
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x958]
lea eax, [ebp - 0x1038]
push edx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46275c
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x462759
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x458]
push str.System
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4627a7
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4627a4
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0x458]
push str._system
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4627f2
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4627ef
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x458]
push str.SYSTEM
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x46283d
push 0x491c80
push ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46283a
push 0x491c80
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x12b8]
push str.smss.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea edx, [ebp - 0x12b8]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea eax, [ebp - 0x12b8]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea ecx, [ebp - 0x12b8]
push str.services.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea edx, [ebp - 0x12b8]
push str.lsass.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea eax, [ebp - 0x12b8]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea ecx, [ebp - 0x12b8]
push str.taskmgr.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea edx, [ebp - 0x12b8]
push str.spoolsv.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea eax, [ebp - 0x12b8]
push 0x48ba7c
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x46293d
lea ecx, [ebp - 0x12b8]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x462943
mov dword [ebp - 0xb4], esi
xor edi, edi
push 0x62a450
mov dword [ebp - 4], edi
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x94], edi
mov dword [ebp + 8], edi
call fcn.00404650
add esp, 4
lea edx, [ebp - 0x458]
push 0x62a450
push edx
call fcn.004045b0
add esp, 8
cmp eax, edi
jne 0x4629b3
push str.Load_file_faild_
mov ecx, 0x65cd80
call fcn.00479641
lea ecx, [ebp - 0x458]
push ecx
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
jmp 0x4632e6
mov edx, dword [0x62a458]
mov byte [ebp - 4], 1
push edx
call fcn.004046b0
add esp, 4
mov dword [ebp - 0x154], eax
mov eax, dword [0x62a458]
push eax
call fcn.004047a0
add esp, 4
cmp eax, edi
mov dword [ebp - 0x140], eax
jne 0x462a43
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov dword [ebp + 8], 2
mov edx, dword [0x62a458]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edx
mov byte [ebp - 4], 5
call fcn.004046d0
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x148], esi
jne 0x4631a1
mov dword [ebp + 8], 6
jmp 0x4632d6
mov dword [ebp - 0x110], edi
cmp dword [eax + 0x10], edi
je 0x462a0f
mov ecx, dword [eax + 0xc]
mov edx, dword [0x62a458]
mov eax, dword [ebp - 0x154]
push ecx
push edx
push eax
call fcn.00404730
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
mov edi, eax
inc ecx
push 0x49b730
push edi
mov dword [ebp - 0x2c], ecx
call fcn.0047fde0
add esp, 8
mov ebx, 1
neg eax
sbb eax, eax
inc eax
xor esi, esi
mov dword [ebp - 0x14c], eax
cmp esi, 0x66
jge 0x462b2c
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.CreateRemoteThread
push ecx
push edi
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x462b26
cmp esi, 0xf
jle 0x462ac4
cmp esi, 0x12
jge 0x462ac4
mov dword [ebp - 0x9c], ebx
cmp esi, 0x1d
je 0x462ad3
cmp esi, 0x1e
je 0x462ad3
cmp esi, 0x39
jne 0x462ad6
mov dword [ebp - 0x64], ebx
cmp esi, 0x1f
je 0x462ae0
cmp esi, 0x20
jne 0x462ae3
mov dword [ebp - 0x5c], ebx
cmp esi, 0x21
je 0x462aed
cmp esi, 0x22
jne 0x462af0
mov dword [ebp - 0x7c], ebx
cmp esi, 0x23
je 0x462afa
cmp esi, 0x24
jne 0x462b00
mov dword [ebp - 0x90], ebx
cmp esi, 0x2c
jne 0x462b0b
mov dword [ebp - 0x68], ebx
inc esi
jmp 0x462a91
cmp esi, 0x2d
je 0x462b23
cmp esi, 0x2e
jne 0x462b1e
mov dword [ebp - 0x70], ebx
inc esi
jmp 0x462a91
cmp esi, 0x3d
jne 0x462b26
mov dword [ebp - 0x3c], ebx
inc esi
jmp 0x462a91
mov edx, dword [0x62a458]
mov byte [ebp - 4], 2
push edx
mov dword [ebp - 0xf4], 0
call fcn.004046b0
add esp, 4
mov esi, eax
mov eax, dword [0x62a458]
mov dword [ebp - 0x148], esi
push eax
call fcn.004047a0
mov ecx, dword [ebp - 0x110]
add esp, 4
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x462b74
mov eax, dword [ecx + 0x10]
mov edx, dword [0x62a458]
push eax
push edx
push esi
mov dword [ebp - 0x54], eax
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x462a0f
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov eax, dword [eax]
test eax, eax
je 0x4630e3
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x462c05
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x978]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xe98]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xe98]
jmp 0x462c86
mov edx, dword [0x62a458]
push eax
mov eax, dword [ebp - 0x148]
push edx
push eax
call fcn.00404730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x462c41
xor ecx, ecx
lea edx, [ebp - 0x978]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call ebx
add esp, 0xc
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x462c8e
mov edi, 0x49b72c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x978]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xeb8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0xeb8]
mov dword [ebp - 0x1c], ecx
mov edi, 1
xor esi, esi
cmp esi, 0x66
jge 0x46300f
mov eax, dword [ebp - 0x1c]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x463009
cmp esi, 0x45
jne 0x462d61
lea ecx, [ebp - 0x9f8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x9f8]
lea eax, [ebp - 0xa78]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xa78]
push ecx
call fcn.0047c0d3
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.0047c0d3
add esp, 0x14
cmp esi, edi
jne 0x462d26
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x558]
push edx
push 0x49b6c8
push eax
jmp 0x462d39
lea ecx, [ebp - 0x258]
lea edx, [ebp - 0x558]
push ecx
push 0x49b698
push edx
call fcn.0047a8f8
add esp, 0xc
lea eax, [ebp - 0x558]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x462d6e
mov dword [ebp - 0x78], edi
inc esi
jmp 0x462c90
cmp esi, edi
jne 0x462d7b
mov dword [ebp - 0x60], edi
inc esi
jmp 0x462c90
cmp esi, 2
je 0x463009
cmp esi, 4
jne 0x462d95
mov dword [ebp - 0xfc], edi
inc esi
jmp 0x462c90
cmp esi, 5
jne 0x462da6
mov dword [ebp - 0xe4], edi
inc esi
jmp 0x462c90
cmp esi, 6
jne 0x462db7
mov dword [ebp - 0x138], edi
inc esi
jmp 0x462c90
cmp esi, 7
jne 0x462dc8
mov dword [ebp - 0xac], edi
inc esi
jmp 0x462c90
cmp esi, 8
jne 0x462dd9
mov dword [ebp - 0xdc], edi
inc esi
jmp 0x462c90
cmp esi, 9
jne 0x462dea
mov dword [ebp - 0x124], edi
inc esi
jmp 0x462c90
cmp esi, 0xa
jne 0x462df8
mov dword [ebp - 0x50], edi
inc esi
jmp 0x462c90
cmp esi, 0xb
jne 0x462e09
mov dword [ebp - 0x130], edi
inc esi
jmp 0x462c90
jle 0x462e13
cmp esi, 0xf
jge 0x462e16
mov dword [ebp - 0x40], edi
cmp esi, 0xf
jne 0x462e24
mov dword [ebp - 0xd8], edi
inc esi
jmp 0x462c90
jle 0x462e31
cmp esi, 0x12
jge 0x462e31
mov dword [ebp - 0x9c], edi
cmp esi, 0x1b
jne 0x462e42
mov dword [ebp - 0x114], edi
inc esi
jmp 0x462c90
cmp esi, 0x1c
jne 0x462e50
mov dword [ebp - 0x6c], edi
inc esi
jmp 0x462c90
cmp esi, 0x1d
je 0x462e5f
cmp esi, 0x1e
je 0x462e5f
cmp esi, 0x39
jne 0x462e62
mov dword [ebp - 0x64], edi
cmp esi, 0x1f
je 0x462e6c
cmp esi, 0x20
jne 0x462e6f
mov dword [ebp - 0x5c], edi
cmp esi, 0x21
je 0x462e79
cmp esi, 0x22
jne 0x462e7c
mov dword [ebp - 0x7c], edi
cmp esi, 0x23
je 0x462e86
cmp esi, 0x24
jne 0x462e8c
mov dword [ebp - 0x90], edi
cmp esi, 0x25
je 0x462e96
cmp esi, 0x26
jne 0x462e9c
mov dword [ebp - 0x11c], edi
cmp esi, 0x27
jne 0x462ead
mov dword [ebp - 0x13c], edi
inc esi
jmp 0x462c90
cmp esi, 0x28
jne 0x462ebe
mov dword [ebp - 0x134], edi
inc esi
jmp 0x462c90
cmp esi, 0x2c
jne 0x462ecc
mov dword [ebp - 0x68], edi
inc esi
jmp 0x462c90
cmp esi, 0x2d
jne 0x462eda
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x462c90
cmp esi, 0x2e
jne 0x462ee8
mov dword [ebp - 0x70], edi
inc esi
jmp 0x462c90
cmp esi, 0x2f
jne 0x462ef9
mov dword [ebp - 0xd0], edi
inc esi
jmp 0x462c90
cmp esi, 0x30
jne 0x462f0a
mov dword [ebp - 0xbc], edi
inc esi
jmp 0x462c90
cmp esi, 0x31
jne 0x462f1b
mov dword [ebp - 0xc0], edi
inc esi
jmp 0x462c90
cmp esi, 0x32
jne 0x462f2c
mov dword [ebp - 0xc8], edi
inc esi
jmp 0x462c90
cmp esi, 0x34
jne 0x462f3d
mov dword [ebp - 0x88], edi
inc esi
jmp 0x462c90
cmp esi, 0x35
jne 0x462f4b
mov dword [ebp - 0x74], edi
inc esi
jmp 0x462c90
cmp esi, 0x36
jne 0x462f5c
mov dword [ebp - 0x98], edi
inc esi
jmp 0x462c90
cmp esi, 0x37
jne 0x462f71
mov dword [ebp - 0xe0], 0
inc esi
jmp 0x462c90
cmp esi, 0x38
jne 0x462f82
mov dword [ebp - 0xf0], edi
inc esi
jmp 0x462c90
cmp esi, 0x3a
je 0x462f91
cmp esi, 0x3b
je 0x462f91
cmp esi, 0x3c
jne 0x462f97
mov dword [ebp - 0x108], edi
cmp esi, 0x3d
jne 0x462fa5
mov dword [ebp - 0x3c], edi
inc esi
jmp 0x462c90
cmp esi, 0x3e
jne 0x462fb3
mov dword [ebp - 0x38], edi
inc esi
jmp 0x462c90
cmp esi, 0x3f
jne 0x462fc1
mov dword [ebp - 0x80], edi
inc esi
jmp 0x462c90
cmp esi, 0x40
jne 0x462fcf
mov dword [ebp - 0x60], edi
inc esi
jmp 0x462c90
cmp esi, 0x41
jne 0x462fe0
mov dword [ebp - 0xec], edi
inc esi
jmp 0x462c90
cmp esi, 0x42
jne 0x462ff1
mov dword [ebp - 0xe8], edi
inc esi
jmp 0x462c90
cmp esi, 0x43
je 0x462ffb
cmp esi, 0x44
jne 0x463001
mov dword [ebp - 0xf8], edi
cmp esi, 0x4a
jne 0x463009
mov dword [ebp - 0x40], edi
inc esi
jmp 0x462c90
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x14c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x94], ecx
jne 0x46302c
inc dword [ebp - 0x104]
cmp dword [ebp - 0x94], 0xc350
jg 0x4630e3
cmp dword [ebp - 0x14c], edi
jne 0x4630ba
xor esi, esi
cmp esi, 6
jge 0x4630ba
mov edx, dword [ebp - 0x1c]
lea ecx, [esi + esi*2]
shl ecx, 4
add ecx, str.VirtualProtectEx
push ecx
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4630b7
test esi, esi
jne 0x463075
mov dword [ebp - 0xc4], edi
inc esi
jmp 0x463046
cmp esi, edi
jne 0x463082
mov dword [ebp - 0x144], edi
inc esi
jmp 0x463046
cmp esi, 2
jne 0x463090
mov dword [ebp - 0xcc], edi
inc esi
jmp 0x463046
cmp esi, 3
jne 0x46309e
mov dword [ebp - 0x10c], edi
inc esi
jmp 0x463046
cmp esi, 4
jne 0x4630ac
mov dword [ebp - 0xd4], edi
inc esi
jmp 0x463046
cmp esi, 5
jne 0x4630b7
mov dword [ebp - 0x12c], edi
inc esi
jmp 0x463046
mov esi, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x20]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x20], ecx
mov eax, ecx
jmp 0x462b9e
push str.function_sum::
mov ecx, 0x65cd80
call fcn.00479641
mov ecx, dword [ebp - 0xf4]
push ecx
mov ecx, eax
call fcn.00479a12
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x140]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 1
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x140], eax
xor edi, edi
jmp 0x462a49
mov eax, dword [0x62a458]
push eax
call fcn.00404710
add esp, 4
mov edi, eax
mov dword [ebp - 0x54], ebx
cmp bx, word [esi + 2]
jae 0x4632d6
xor ecx, ecx
push str..asp
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov byte [ebp - 0xa0], cl
mov edx, dword [edi]
mov dword [ebp - 0xa8], edx
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa4], eax
push ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x463203
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xa8]
push str..upx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46321e
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xa8]
push str..upack
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x463239
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xa8]
push str..Pecompact
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x463254
mov dword [ebp - 0x30], esi
lea edx, [ebp - 0xa8]
push str..aspack
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46326f
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0xa8]
push str..fsg
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x46328a
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x54]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x54], eax
jg 0x4632d6
mov esi, dword [ebp - 0x148]
add edi, 0x28
inc ebx
jmp 0x4631b4
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x94]
mov dword [ebp - 4], 0
mov ecx, dword [0x62a458]
push ecx
call fcn.00404680
xor ebx, ebx
add esp, 4
cmp eax, ebx
jne 0x463324
push str.Invalid_PE_Format_file_:
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov esi, 3
push 0x62a450
call fcn.00404650
mov eax, 1
add esp, 4
cmp esi, eax
jne 0x463358
push 0x49b598
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x104]
cmp esi, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edx
je 0x463b19
cmp edi, eax
jge 0x463b19
lea eax, [ebp - 0x1638]
mov dword [ebp - 0x2c], ebx
push eax
call fcn.0047c0d3
push 0x5585b727
call fcn.006614e4
and al, 0x5d
aad 0xbc
pushfd
shrd ax, bp, cl
mov eax, ebp
mov byte [esp], al
pushfd
sub ebp, 4
mov byte [esp], ch
mov dword [ebp], eax
push 0xafbb4614
pushfd
push edx
pushal
lea esp, [esp + 0x34]
jmp fcn.00661a55
mov ecx, dword [ebp - 0xb8]
mov byte [ebp - 0x858], 0
cmp ecx, eax
jle 0x463b5e
mov edi, 0x49e558
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x130], eax
jne 0x463b9b
mov edi, 0x49e474
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x138], eax
jne 0x463bd8
mov edi, 0x49b3b4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xc4], eax
jne 0x463c2b
cmp dword [ebp - 0x144], eax
jne 0x463c2b
mov edi, 0x4a060c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
mov dword [ebp - 0x14], eax
mov eax, 1
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcc], eax
jne 0x463c77
cmp dword [ebp - 0x10c], eax
jne 0x463c77
mov edi, 0x4a05f8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
mov dword [ebp - 0x14], eax
mov eax, 1
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xd4], eax
jne 0x463cbe
cmp dword [ebp - 0x12c], eax
jne 0x463cbe
mov edi, 0x4a05e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x463d14
mov edi, 0x49b3a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
mov eax, dword [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
inc eax
mov dword [ebp - 0x14], eax
mov eax, 1
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xb0], eax
mov al, byte [ebp - 0x12b8]
cmp al, 0x30
je 0x463d42
cmp al, 0x31
je 0x463d42
cmp al, 0x32
je 0x463d42
cmp al, 0x33
je 0x463d42
cmp al, 0x34
je 0x463d42
cmp al, 0x35
je 0x463d42
cmp al, 0x36
je 0x463d42
cmp al, 0x37
je 0x463d42
cmp al, 0x38
je 0x463d42
cmp al, 0x39
jne 0x463d79
mov edi, 0x49b3a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xb4]
mov esi, 1
cmp eax, esi
mov dword [ebp + 8], 0
jne 0x463dcc
mov edi, 0x49b390
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
mov dword [ebp + 8], eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x28], eax
mov esi, eax
cmp dword [ebp - 0x4c], esi
jne 0x463e3b
lea eax, [ebp - 0xc78]
lea ecx, [ebp - 0x458]
push eax
push ecx
call fcn.004294c0
movsx eax, ax
add esp, 8
test eax, eax
je 0x463e06
lea edx, [ebp - 0xc78]
push 0x49e4a8
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x463e3b
mov edi, 0x49e48c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xdc], esi
jne 0x463e78
mov edi, 0x49b380
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x60], esi
jne 0x463eb9
mov edi, 0x49b370
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x114], esi
jne 0x463efd
mov edi, 0x49b360
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xe4], esi
je 0x463f0d
cmp dword [ebp - 0x13c], esi
jne 0x463f42
mov edi, 0x49b354
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xec], esi
jne 0x463f86
mov edi, 0x49b344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x11c], esi
jne 0x463fc3
mov edi, 0x49b338
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0xac], esi
jne 0x464000
mov edi, 0x49b32c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x78], esi
jne 0x464048
mov edi, 0x49b31c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x134], esi
jne 0x464093
mov edi, 0x49b308
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xfc], esi
jne 0x4640d7
mov edi, 0x49b2fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x124], esi
jne 0x46411b
mov edi, 0x49b2f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0x50], esi
jne 0x464155
mov edi, 0x49b2e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
cmp dword [ebp - 0x40], esi
jne 0x4641f7
cmp dword [ebp - 0xbc], esi
je 0x46417b
cmp dword [ebp - 0xc0], esi
je 0x46417b
lea edx, [ebp - 0x858]
mov edi, 0x49b2d8
jmp 0x4641c6
mov edi, 0x49b2cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc8]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x858]
mov edi, 0x49b2b8
je 0x4641c6
mov edi, 0x49b2a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xd0], esi
jne 0x46423b
mov edi, 0x49b298
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov esi, 1
cmp dword [ebp - 0xd8], esi
jne 0x46428b
mov edi, 0x49b28c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov ecx, ebx
and ecx, 3
mov ebx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x464290
mov dword [ebp - 0x28], ebx
jmp 0x464290
mov ebx, 1
cmp dword [ebp - 0x9c], ebx
jne 0x4642cf
mov edi, 0x49b27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x30], ebx
jne 0x464348
mov edi, 0x49b26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x28], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x4c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x464348
mov edi, 0x49b260
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x6c], ebx
jne 0x4643fc
cmp dword [ebp - 0x88], ebx
jne 0x4643fc
cmp dword [ebp - 0x74], ebx
jne 0x4643fc
cmp dword [ebp - 0x98], ebx
jne 0x4643b1
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x858]
cmp eax, ebx
mov edi, 0x49b24c
je 0x464385
mov edi, 0x49b23c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe0], ebx
jne 0x4643fc
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x858]
cmp eax, ebx
mov edi, 0x49b224
je 0x4643d0
mov edi, 0x49b210
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xe8], ebx
jne 0x464462
cmp dword [ebp - 0x6c], ebx
jne 0x46442b
cmp dword [ebp - 0x88], ebx
jne 0x46442b
cmp dword [ebp - 0x74], ebx
jne 0x46442b
cmp dword [ebp - 0x98], ebx
jne 0x46442b
lea edx, [ebp - 0x858]
mov edi, 0x49b204
jmp 0x464436
lea edx, [ebp - 0x858]
mov edi, 0x49b1f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf0], ebx
jne 0x46449a
mov edi, 0x49b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x64], ebx
jne 0x4644d6
mov edi, 0x49b1d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xf8], ebx
jne 0x464515
mov edi, 0x49b1c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x5c], ebx
jne 0x46455b
mov edi, str.internetl
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
inc ecx
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x46455b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x7c], ebx
jne 0x464597
mov edi, 0x49b1a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x90], ebx
jne 0x4645d6
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x68], ebx
jne 0x464612
mov edi, 0x49b190
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x464655
mov edi, 0x49b17c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x100], ebx
je 0x464699
mov edi, 0x49b16c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x3c], ebx
jne 0x4646da
mov edi, 0x49b160
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
mov ebx, 1
cmp dword [ebp - 0x70], ebx
jne 0x464714
mov edi, 0x49b158
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x108], ebx
jne 0x464751
mov edi, 0x49b14c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x38], ebx
jne 0x46478b
mov edi, 0x49b13c
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, ebx
mov eax, 6
je 0x46479b
lea eax, [edx*4]
cmp dword [ebp - 0x1c], eax
jge 0x4647f1
mov eax, dword [ebp - 0x50]
mov edi, 0x49b12c
cmp eax, ebx
lea ebx, [ebp - 0x858]
je 0x4647b7
mov edi, 0x49b11c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov ecx, ebx
mov ebx, 1
and ecx, 3
cmp eax, ebx
mov dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4647ee
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jle 0x464832
cmp edx, ebx
jne 0x464832
mov edi, 0x49b108
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x50], ebx
jne 0x464873
cmp eax, 5
jge 0x464873
test eax, eax
jle 0x464873
mov edi, 0x49b0ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp - 0x150]
cmp ebx, 7
jge 0x4649a8
cmp dword [ebp - 0x34], 1
jne 0x46492a
cmp ebx, 1
lea edx, [ebp - 0x858]
jge 0x4648db
mov edi, 0x49b0d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, 1
mov ecx, edx
mov dword [ebp - 0x118], eax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], eax
jmp 0x4649d9
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
jne 0x464912
cmp ebx, 1
lea edx, [ebp - 0x858]
jge 0x46496c
mov edi, 0x49b0ac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp - 0x118], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x46499b
mov edi, 0x49b09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x40], eax
jne 0x4649a3
lea edi, [ebp - 0x258]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x458]
push eax
call fcn.00434030
movsx eax, ax
add esp, 4
cmp eax, 2
jle 0x464a32
mov edi, 0x49f600
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x858]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jle 0x464a37
dec ecx
mov dword [ebp - 0x14], ecx
jmp 0x464a37
mov eax, 1
cmp dword [ebp - 0x24], eax
jne 0x464a46
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jle 0x464a46
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x464b84