Function at 0x415640
Capabilities:
Delete file
Encode data using base64
Get common file path
Get file attributes
Parse credit card information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x163c
call fcn.004f2630
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x180], ebx
lea eax, [ebp - 0x144c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x42c]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [ebp - 0x30], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x15c], ebx
cmp ecx, 3
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp + 8], ecx
jge 0x41588e
push edx
lea ecx, [ebp - 0x42c]
push 0x515880
push ecx
call fcn.004f175f
lea edx, [ebp - 0x42c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x42c]
push str.svchost__k_DcomLaunch
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4158b0
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push str..exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4158f1
lea edx, [ebp - 0x42c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5168b0
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push str..Exe_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x415921
lea ecx, [ebp - 0x42c]
push str..EXE_temp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415957
lea edx, [ebp - 0x42c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0xe56c80]
push 0x5168b0
inc esi
mov dword [0xe56c80], esi
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push 0x51688c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x415987
lea edx, [ebp - 0x42c]
push str.Rundll32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415991
mov dword [ebp - 0x184], 1
lea eax, [ebp - 0x42c]
push 0x516878
push eax
mov esi, 1
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4159b1
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x42c]
push str..Dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4159cc
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x42c]
push str..DLL
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4159e7
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x42c]
push 0x516860
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a05
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x42c]
push str..Tmp
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a23
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x42c]
push str..TMP
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a41
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x42c]
push str._temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a5f
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x42c]
push str.RECYCLER_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a7d
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x42c]
push str.Recycled_
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415a9b
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x42c]
push str.Temp_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415ab9
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x42c]
push str.TEMP_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415ad7
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x42c]
push str.Program_FilesMicrosoft
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415af2
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0x42c]
push str.Program_FilesWindows
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b13
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x164], esi
lea ecx, [ebp - 0x42c]
push str.Program_FilesOutlook
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b2e
mov dword [ebp - 0x64], esi
lea edx, [ebp - 0x42c]
push str.Program_FilesNetMeeting
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b49
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0x42c]
push str.Program_FilesMSN
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b64
mov dword [ebp - 0x64], esi
lea ecx, [ebp - 0x42c]
push str.Documents_and_Settings_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b9d
lea edx, [ebp - 0x42c]
push str.Application_Data_
push edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415b9d
mov dword [ebp - 0x5c], esi
lea eax, [ebp - 0x42c]
push str.documents_and_settings_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415bd6
lea ecx, [ebp - 0x42c]
push str.Application_Data_
push ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415bd6
mov dword [ebp - 0x5c], esi
lea edx, [ebp - 0x42c]
push str.Program_FilesCommon_Files
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415bf1
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x42c]
push str.program_Filescommon_Files
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415c0c
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x42c]
push str.program_filesWindows_NT
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415c33
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x164], esi
lea edx, [ebp - 0x42c]
push str.Program_FilesOutlook_Express
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415c51
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x42c]
push str._windir_
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415d2a
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x4ac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x42c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4ac]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x72c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x58], edx
mov eax, ecx
lea ecx, [eax - 8]
test ecx, ecx
jle 0x415d1b
lea edi, [ebp + edx - 0x42c]
mov edx, ecx
lea esi, [ebp - 0x724]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x58]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
mov esi, 1
mov byte [ebp + eax - 0x434], 0
lea eax, [ebp - 0x42c]
push 0x5147e0
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415da9
lea ecx, [ebp - 0x42c]
push 0x5166d4
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415da9
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
mov esi, ecx
xor ecx, ecx
test esi, esi
jle 0x415d9c
mov al, byte [ebp + edx - 0x42c]
cmp al, 0x3a
jne 0x415d8a
mov ecx, 1
cmp edi, ecx
je 0x415d9c
cmp al, 0x25
jne 0x415d97
mov edi, 1
cmp ecx, edi
je 0x415d9c
inc edx
cmp edx, esi
jl 0x415d76
mov byte [ebp + edx - 0x42d], 0
mov esi, 1
lea edx, [ebp - 0x42c]
push 0x5166d4
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415df6
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x415df6
cmp byte [ebp + eax - 0x42c], 0x25
jne 0x415de7
inc edx
cmp edx, 2
jg 0x415dee
inc eax
cmp eax, ecx
jl 0x415dd7
jmp 0x415df6
mov byte [ebp + eax - 0x42d], 0
lea eax, [ebp - 0x42c]
push 0x5147e0
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415e60
lea ecx, [ebp - 0x42c]
push 0x5166d4
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415e60
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
test ecx, ecx
jle 0x415e60
mov dl, byte [ebp + eax - 0x42c]
cmp dl, 0x3a
jne 0x415e4a
mov edi, esi
cmp dl, 0x25
je 0x415e54
inc eax
cmp eax, ecx
jl 0x415e3c
cmp edi, esi
jne 0x415e60
mov byte [ebp + eax - 0x42c], 0
lea edx, [ebp - 0x42c]
push 0x5147e0
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41613b
lea eax, [ebp - 0x42c]
push 0x5166d4
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41613b
lea ecx, [ebp - 0x42c]
push str.SystemRoot_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x415f79
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x415f1c
mov dl, byte [ebp + eax - 0x72c]
cmp dl, 0x53
je 0x415f1c
cmp dl, 0x73
je 0x415f1c
inc eax
cmp eax, esi
jl 0x415f06
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x415f48
lea eax, [ebp + eax - 0x722]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x5ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
push edx
lea eax, [ebp - 0x42c]
push 0x50e0ec
push eax
mov byte [ebp + esi - 0x5ac], 0
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x42c]
push str.systemroot_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41605a
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x415ffd
mov dl, byte [ebp + eax - 0x72c]
cmp dl, 0x53
je 0x415ffd
cmp dl, 0x73
je 0x415ffd
inc eax
cmp eax, esi
jl 0x415fe7
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x416029
lea eax, [ebp + eax - 0x722]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x5ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
push edx
lea eax, [ebp - 0x42c]
push 0x50e0ec
push eax
mov byte [ebp + esi - 0x5ac], 0
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x42c]
push str.Systemroot_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41613b
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx - 0xa]
test esi, esi
jle 0x4160de
mov dl, byte [ebp + eax - 0x72c]
cmp dl, 0x53
je 0x4160de
cmp dl, 0x73
je 0x4160de
inc eax
cmp eax, esi
jl 0x4160c8
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xa]
test edx, edx
jle 0x41610a
lea eax, [ebp + eax - 0x722]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x5ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
push edx
lea eax, [ebp - 0x42c]
push 0x50e0ec
push eax
mov byte [ebp + esi - 0x5ac], 0
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x42c]
push 0x50d39c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x416215
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x4161b8
cmp byte [ebp + eax - 0x72c], 0x25
je 0x4161b8
inc eax
cmp eax, edx
jl 0x4161a9
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x4161e4
lea eax, [ebp + eax - 0x720]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x5ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
push edx
lea eax, [ebp - 0x42c]
push 0x50e0ec
push eax
mov byte [ebp + esi - 0x5ac], 0
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x42c]
push 0x5166ac
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4162ef
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xc]
test edx, edx
jle 0x416292
cmp byte [ebp + eax - 0x72c], 0x25
je 0x416292
inc eax
cmp eax, edx
jl 0x416283
sub ecx, eax
xor esi, esi
lea edx, [ecx - 0xc]
test edx, edx
jle 0x4162be
lea eax, [ebp + eax - 0x720]
mov ecx, edx
mov esi, eax
mov eax, ecx
lea edi, [ebp - 0x5ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
push edx
lea eax, [ebp - 0x42c]
push 0x50e0ec
push eax
mov byte [ebp + esi - 0x5ac], 0
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
mov byte [ebp + ecx - 0x42c], al
jle 0x41668f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x5ac]
mov eax, ecx
mov esi, edi
mov edi, edx
push str._programfiles_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 0x59e], 0
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416402
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x4aa], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xe]
test edx, edx
jle 0x4163d1
lea eax, [ecx - 0xe]
lea esi, [ebp - 0x71e]
mov ecx, eax
lea edi, [ebp - 0xd4c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xd4c], 0
lea eax, [ebp - 0xd4c]
lea ecx, [ebp - 0x4ac]
push eax
push ecx
lea edx, [ebp - 0x42c]
push str._sProgram_Files_s
push edx
mov byte [ebp - 0x42c], 0
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x5ac]
push str.Systemroot
push eax
mov byte [ebp - 0x5a2], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4164de
lea ecx, [ebp - 0x4ac]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x416496
lea eax, [ecx - 0xa]
lea esi, [ebp - 0x722]
mov ecx, eax
lea edi, [ebp - 0xd4c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xd4c], 0
lea eax, [ebp - 0xd4c]
lea ecx, [ebp - 0x4ac]
push eax
push ecx
lea edx, [ebp - 0x42c]
push 0x50e0ec
push edx
mov byte [ebp - 0x42c], 0
call fcn.004f175f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x42c], al
lea eax, [ebp - 0x5ac]
push str.system32
push eax
mov byte [ebp - 0x5a4], 0
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4165ba
lea ecx, [ebp - 0x4ac]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x416572
lea eax, [ecx - 8]
lea esi, [ebp - 0x724]
mov ecx, eax
lea edi, [ebp - 0xd4c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xd4c], 0
lea eax, [ebp - 0xd4c]
lea ecx, [ebp - 0x4ac]
push eax
push ecx
lea edx, [ebp - 0x42c]
push 0x50e0ec
push edx
mov byte [ebp - 0x42c], 0
call fcn.004f175f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x42c], al
lea eax, [ebp - 0x5ac]
push str._Windir_
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41668f
lea ecx, [ebp - 0x4ac]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x72c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x72c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 8]
test edx, edx
jle 0x416647
lea eax, [ecx - 8]
lea esi, [ebp - 0x724]
mov ecx, eax
lea edi, [ebp - 0xd4c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xd4c], 0
lea eax, [ebp - 0xd4c]
lea ecx, [ebp - 0x4ac]
push eax
push ecx
lea edx, [ebp - 0x42c]
push 0x50e0ec
push edx
mov byte [ebp - 0x42c], 0
call fcn.004f175f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + ecx - 0x42c], al
cmp byte [ebp - 0x42c], 0x22
jne 0x4166e3
mov esi, dword [ebp + 8]
xor ecx, ecx
test esi, esi
jle 0x4166ba
lea edx, [ebp - 0xa2c]
mov al, byte [ebp + ecx - 0x42c]
cmp al, 0x22
je 0x4166b5
mov byte [edx], al
inc edx
inc ecx
cmp ecx, esi
jl 0x4166a7
lea edi, [ebp - 0xa2c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x42c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push 0x5147e0
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41678f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x41673e
cmp byte [ebp + eax - 0x42c], 0x2e
je 0x41673e
dec eax
test eax, eax
jg 0x41672f
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x416772
cmp byte [ebp + eax - 0x42c], 0x2e
jne 0x41676d
mov dl, byte [ebp + eax - 0x42b]
cmp dl, 0x65
je 0x416787
cmp dl, 0x45
je 0x416787
inc eax
cmp eax, ecx
jl 0x416752
test ecx, ecx
mov eax, ecx
jle 0x416787
cmp byte [ebp + eax - 0x42c], 0x2e
je 0x416787
dec eax
test eax, eax
jg 0x416778
mov byte [ebp + eax - 0x428], 0
lea ecx, [ebp - 0x42c]
push 0x5147e0
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x416871
lea edx, [ebp - 0x4ac]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x13cc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.System32
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x5ac]
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41684f
lea edx, [ebp - 0x5ac]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41684f
lea eax, [ebp - 0x5ac]
push str.SYSTEM32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x41684f
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x4ac]
push ecx
jmp 0x41685c
lea ecx, [ebp - 0x5ac]
lea edx, [ebp - 0x13cc]
push ecx
push edx
lea eax, [ebp - 0x42c]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x416894
cmp byte [ebp + ecx - 0x42c], 0x2e
je 0x416894
dec ecx
test ecx, ecx
jg 0x416885
mov byte [ebp + ecx - 0x428], 0
lea ecx, [ebp - 0x62c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x10cc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xc2c]
push eax
push str._swinlogon.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x42c]
lea eax, [ebp - 0xc2c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4168fc
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xc2c]
push ecx
push str._scsrss.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0xc2c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416938
push 0x5147b4
jmp 0x41af47
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0xc2c]
push edx
push str._s_services.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x42c]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416974
push 0x5147b4
jmp 0x41af47
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xc2c]
push eax
push str._slsass.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x42c]
lea eax, [ebp - 0xc2c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4169b0
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xc2c]
push ecx
push str._s_svchost.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0xc2c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x4169ec
push 0x5147b4
jmp 0x41af47
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0xc2c]
push edx
push str._s_spoolsv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x42c]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416a28
push 0x5147b4
jmp 0x41af47
lea eax, [ebp - 0x42c]
push eax
push str.SystemRootSystem32_smss.exe
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416a4a
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xc2c]
push ecx
push str._s_svchost__k_DcomLaunch
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0xc2c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416a86
push 0x5147b4
jmp 0x41af47
cmp dword [0xe56be4], 1
jne 0x416b23
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0xc2c]
push edx
push str._sigSvc.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0x42c]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416b23
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xa2c]
push eax
push str._sigAgent.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xa2c]
push edx
call fcn.004abe70
mov esi, eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x72c]
push str._sigTerm.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x72c]
push edx
call fcn.004abe70
add eax, esi
add esp, 0x20
cmp eax, 1
jle 0x416b23
push 0x51663c
jmp 0x41af47
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xc2c]
push eax
push str._sServerNT.EXE
push ecx
call fcn.004f175f
lea edx, [ebp - 0x42c]
lea eax, [ebp - 0xc2c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416bdf
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xa2c]
push ecx
push str._sU8SMSSrv.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0xa2c]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x72c]
push ecx
push str._sAlertService.exe
push edx
mov esi, eax
call fcn.004f175f
lea eax, [ebp - 0x72c]
push eax
call fcn.004abe70
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x5ac]
push ecx
push str._sServerNT.EXE
push edx
mov edi, eax
call fcn.004f175f
lea eax, [ebp - 0x5ac]
push eax
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x416bdf
push 0x5165f0
jmp 0x41af47
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xc2c]
push ecx
push str._sU8SMSSrv.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0xc2c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416c9b
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0xa2c]
push edx
push str._sU8SMSSrv.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0xa2c]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x62c]
mov esi, eax
push edx
lea eax, [ebp - 0x72c]
push str._sAlertService.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x72c]
push ecx
call fcn.004abe70
lea edx, [ebp - 0x62c]
mov edi, eax
push edx
lea eax, [ebp - 0x5ac]
push str._sServerNT.EXE
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5ac]
push ecx
call fcn.004abe70
add eax, edi
add esp, 0x30
add eax, esi
cmp eax, 1
jle 0x416c9b
push 0x5165f0
jmp 0x41af47
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0xc2c]
push edx
push str._sAlertService.exe
push eax
call fcn.004f175f
lea ecx, [ebp - 0x42c]
lea edx, [ebp - 0xc2c]
push ecx
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416d57
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xa2c]
push eax
push str._sU8SMSSrv.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0xa2c]
push edx
call fcn.004abe70
mov edi, eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x72c]
push str._sAlertService.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x72c]
push edx
call fcn.004abe70
mov esi, eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x5ac]
push str._sServerNT.EXE
push ecx
call fcn.004f175f
lea edx, [ebp - 0x5ac]
push edx
call fcn.004abe70
add eax, esi
add esp, 0x30
add eax, edi
cmp eax, 1
jle 0x416d57
push 0x5165f0
jmp 0x41af47
lea eax, [ebp - 0x62c]
lea ecx, [ebp - 0xc2c]
push eax
push str._s_svchost__k_DcomLaunch
push ecx
call fcn.004f175f
lea edx, [ebp - 0x42c]
lea eax, [ebp - 0xc2c]
push edx
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416d93
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0xc2c]
push ecx
push str._s_svchost__k_rpcss
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0xc2c]
push eax
push ecx
call fcn.004f61e0
add esp, 0x14
test eax, eax
jne 0x416dcf
push 0x5147b4
jmp 0x41af47
mov edi, str._SystemRoot__system32_svchost.exe__k_netsvcs
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xc2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416e1b
push 0x5147b4
jmp 0x41af47
mov edi, str._SystemRoot__system32_svchost.exe__k_NetworkService
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xc2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416e67
push 0x5147b4
jmp 0x41af47
mov edi, str._SystemRoot__system32_svchost.exe__k_LocalService
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xc2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416eb3
push 0x5147b4
jmp 0x41af47
mov edi, str._SystemRoot__system32_svchost__k_DcomLaunch
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xc2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x416eff
push 0x5147b4
jmp 0x41af47
lea eax, [ebp - 0x42c]
push eax
call fcn.004abe70
add esp, 4
cmp eax, 1
je 0x416f1d
push 0x516500
jmp 0x41af47
xor edi, edi
mov esi, str.WatchClient.exe
lea ecx, [ebp - 0x144c]
push esi
push ecx
lea edx, [ebp - 0x5ac]
push str._s_system32_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0x5ac]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x416fd5
lea edx, [ebp - 0x42c]
push esi
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x417010
add esi, 0x100
inc edi
cmp esi, 0x50f4a4
jl 0x416f24
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x42c]
push ecx
push edx
call fcn.004d9590
movsx esi, ax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x28], esi
push eax
call fcn.004ab3c0
add esp, 0xc
cmp eax, 0xc8000
mov dword [ebp - 0xb8], eax
jle 0x417083
cmp esi, 1
jge 0x41704b
cmp eax, 0x177000
jle 0x41704b
push 0x5164d8
jmp 0x41af47
shl edi, 8
add edi, 0x50f4a4
lea eax, [ebp - 0x5ac]
push edi
push 0x5164bc
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5ac]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl edi, 8
add edi, 0x50f4a4
lea edx, [ebp - 0x5ac]
push edi
push 0x5164bc
push edx
call fcn.004f175f
lea eax, [ebp - 0x5ac]
push eax
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
cmp esi, edi
jle 0x417085
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x92c]
push ecx
push 0x51649c
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x92c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
lea eax, [ebp - 0x42c]
push str.MySQLMySQL
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4170a7
push str.MYSQL
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push str.mysqld_nt
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4170c9
push 0x51644c
jmp 0x41af47
lea edx, [ebp - 0x42c]
push str._mysqld_nt
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4170eb
push 0x51644c
jmp 0x41af47
cmp dword [0xe56be0], 1
jne 0x417138
lea eax, [ebp - 0x42c]
push str.mcnstart.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417116
push 0x5147b4
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push str.gmcstart.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417138
push 0x5147b4
jmp 0x41af47
cmp esi, 2
jle 0x41715f
lea edx, [ebp - 0x42c]
push str.System32_smss.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41715f
push 0x5147b4
jmp 0x41af47
lea eax, [ebp - 0x218]
push str.Microsoft
push eax
mov dword [ebp - 0x44], edi
call fcn.004f2d80
add esp, 8
cmp eax, edi
mov esi, 1
je 0x417182
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0x80]
push ecx
lea eax, [ebp - 0x42c]
push edx
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0xa0], edi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x4171ba
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
cmp ecx, eax
je 0x4171c0
mov dword [ebp - 0xa0], esi
or ecx, 0xffffffff
lea edi, [ebp - 0x42c]
xor eax, eax
mov dword [ebp - 4], ecx
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x38], edx
cmp ecx, edx
jle 0x4171fb
lea esi, [ebp + ecx - 0x42c]
mov al, byte [esi]
cmp al, 0x5c
mov byte [ebp + edx - 0xfcc], al
jne 0x4171f5
cmp edx, 2
jge 0x4171fb
inc edx
dec esi
cmp edx, ecx
jl 0x4171e3
mov eax, ecx
sub eax, edx
cmp eax, 4
jge 0x417212
mov ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18c], ecx
test eax, eax
jle 0x417238
mov ecx, eax
lea esi, [ebp - 0x42c]
mov ebx, ecx
lea edi, [ebp - 0x134c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov byte [ebp + eax - 0x134c], 0
test edx, edx
jle 0x417282
mov edi, dword [ebp - 0x134]
lea esi, [ebp + eax - 0x42b]
mov al, byte [ecx + esi]
cmp al, 0x5c
je 0x417261
mov byte [ebp + ecx - 0xfcc], al
cmp al, 0x2e
jne 0x417266
inc edi
cmp al, 0x20
jne 0x41726b
inc edi
cmp al, 0x5c
jne 0x417277
mov byte [ebp + ecx - 0xfcc], 0
inc ecx
cmp ecx, edx
jl 0x417253
mov dword [ebp - 0x134], edi
mov al, byte [ebp - 0x134a]
mov byte [ebp + edx - 0xfcc], 0
cmp al, 0x5c
je 0x4172a2
mov byte [ebp - 0x134a], 0x5c
mov byte [ebp - 0x1349], 0
lea edx, [ebp - 0x42c]
push 0x100
lea eax, [ebp - 0xb2c]
push edx
push eax
call fcn.004f27c0
lea ecx, [ebp - 0xfcc]
push 0x40
lea edx, [ebp - 0xd8c]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x134c]
push eax
call fcn.004cbd70
add esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x228], eax
jne 0x417383
lea ecx, [ebp - 0xb2c]
push ecx
call fcn.004ab990
add esp, 4
lea edx, [ebp - 0xb2c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0xb2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41734f
lea ecx, [ebp - 0xb2c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x41734f
lea edx, [ebp - 0xb2c]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x92c]
mov edi, 0x5163e8
jmp 0x41735a
lea edx, [ebp - 0x92c]
mov edi, 0x5163b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x92c]
push ecx
jmp 0x41af47
mov edi, 1
cmp eax, edi
jne 0x41738f
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x42c]
push edx
call fcn.004bd410
mov esi, eax
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4173b9
push 0x5144fc
jmp 0x41af47
cmp dword [ebp - 0x44], edi
jne 0x4173ef
mov eax, dword [0xe56be0]
test eax, eax
jle 0x4173ef
lea eax, [ebp - 0x42c]
push eax
call fcn.004bd760
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4173ef
push 0x5144fc
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push 0x515d14
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41740a
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x42c]
push str.application_data
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417425
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x42c]
push str.Microsoft_SharedMSINFO
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417440
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x42c]
push str.microsoft_sharedmsinfo
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41745b
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x42c]
push str.Microsoft_SharedMSInfo
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417476
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x42c]
push str.Documents_and_Settings
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417491
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x42c]
push 0x80
lea edx, [ebp - 0x114c]
push ecx
push edx
call fcn.004f27c0
lea eax, [ebp - 0x42c]
push 0x80
lea ecx, [ebp - 0x104c]
push eax
push ecx
call fcn.004f27c0
lea edi, [ebp - 0x10cc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x62c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp + edx - 0x114c], al
lea edx, [ebp - 0x10cc]
mov byte [ebp + ecx - 0x104c], al
lea eax, [ebp - 0x114c]
push edx
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x41755d
push 0x5144fc
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x417521
push esi
jmp 0x41af47
lea edi, [ebp - 0x42c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x3c], 1
test ecx, ecx
jle 0x41755d
cmp byte [ebp + eax - 0x42c], 0x5c
jne 0x417549
inc edx
inc eax
cmp eax, ecx
jl 0x41753e
cmp edx, 2
jne 0x41755d
mov edi, 1
mov dword [ebp - 0x30], edi
jmp 0x417562
mov edi, 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x104c]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x417597
push 0x5144fc
push esi
mov dword [ebp - 0x38], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x417597
push esi
jmp 0x41af47
lea eax, [ebp - 0x42c]
push str.System32
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4175f5
push 0x5144fc
push esi
mov dword [ebp - 0x38], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4175ca
push esi
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4175f0
push edi
jmp 0x41af47
mov edi, 1
lea edx, [ebp - 0x42c]
push str.system32
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41764e
push 0x5144fc
push esi
mov dword [ebp - 0x38], edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x417628
push esi
jmp 0x41af47
lea eax, [ebp - 0x42c]
push eax
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x41764e
push edi
jmp 0x41af47
lea ecx, [ebp - 0x42c]
push str.system
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4176ab
push 0x5144fc
push esi
mov dword [ebp - 0x38], 1
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x417685
push esi
jmp 0x41af47
lea edx, [ebp - 0x42c]
push edx
call fcn.004bd410
mov edi, eax
push 0x5144fc
push edi
call fcn.004f61e0
add esp, 0xc
test eax, eax
jne 0x4176ab
push edi
jmp 0x41af47
cmp dword [ebp - 0x28], 1
jle 0x417d76
lea eax, [ebp - 0x218]
push str.Beijing_Rising
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417772
mov edi, 0x51635c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x72c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0x72c]
push str.Beijing
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417772
lea ecx, [ebp - 0x72c]
push str.Rising
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417772
mov edi, 0x51635c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Jiangmin_Co
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417817
mov edi, 0x51633c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Jiangmin
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417817
mov edi, 0x51633c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Eset
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4178bc
mov edi, 0x516320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Eset
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x4178bc
mov edi, 0x516320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Symantec_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4179ad
mov edi, 0x51630c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Symantec
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417961
mov edi, 0x51630c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x42c]
push str.SYMANT1Rtvscan.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4179ad
mov edi, 0x51630c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
jmp 0x41af47
lea edx, [ebp - 0x218]
push str.Network_Associates
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417a52
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Networks_Associates_Technology__Inc
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417a52
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.McAfee_Inc
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417af7
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push 0x5162ac
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417af7
mov edi, 0x5162d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Kingsoft_Corporation
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417b9c
mov edi, 0x51629c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Kingsoft
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417b9c
mov edi, 0x51629c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Panda_Software
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417c41
mov edi, 0x516280
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Panda
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417c41
mov edi, 0x516280
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push str.Kaspersky_Lab
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x417ce2
mov edi, 0x516264
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call fcn.004c23b0
lea eax, [ebp - 0xa2c]
push str.Kaspersky
push eax
call fcn.004f2d80
add esp, 0x10
test eax, eax
je 0x417cec
mov edi, 0x516264
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
mov dword [ebp - 0x24], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x417cf1
cmp dword [ebp - 0x18], 1
jne 0x417d76
mov eax, 1
cmp dword [ebp - 0x3c], eax
jne 0x417d34
mov dword [ebp - 0xe4], eax
mov edi, 0x516250
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x218]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x24], eax
and ecx, 3
mov eax, 1
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x14], eax
jne 0x417d76
mov edi, 0x516250
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0xe4], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x24], eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xfcc]
push str.smss.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea ecx, [ebp - 0xfcc]
push str.winlogon.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea edx, [ebp - 0xfcc]
push str.csrss.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea eax, [ebp - 0xfcc]
push str.services.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea ecx, [ebp - 0xfcc]
push str.lsass.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea edx, [ebp - 0xfcc]
push str.svchost.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea eax, [ebp - 0xfcc]
push str.taskmgr.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea ecx, [ebp - 0xfcc]
push str.spoolsv.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea edx, [ebp - 0xfcc]
push str.explorer.exe
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
lea eax, [ebp - 0xfcc]
push str.conime.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x41ae44
xor esi, esi
push 0xd8a430
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 4], 2
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x70], esi
mov dword [ebp + 8], esi
call fcn.004a6b50
add esp, 4
lea ecx, [ebp - 0x42c]
push 0xd8a430
push ecx
call fcn.004a6ab0
add esp, 8
cmp eax, esi
jne 0x417f13
push str.Load_file_faild_
mov ecx, 0xf558a0
call fcn.004f0087
lea edx, [ebp - 0x42c]
mov ecx, eax
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, 1
jmp 0x41896e
mov eax, dword [0xd8a438]
mov byte [ebp - 4], 3
push eax
call fcn.004a6bb0
mov ecx, dword [0xd8a438]
add esp, 4
mov dword [ebp - 0x224], eax
push ecx
call fcn.004a6ca0
add esp, 4
cmp eax, esi
mov dword [ebp - 0xbc], eax
jne 0x417f74
push str.Cant_get_ImportDesc:_PEInfo_Example
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 8], 2
jmp 0x4187e5
mov dword [ebp - 0x60], esi
cmp dword [eax + 0x10], esi
je 0x4187e5
mov edx, dword [ebp - 0xbc]
mov ecx, dword [0xd8a438]
mov eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x224]
push eax
push ecx
push edx
call fcn.004a6c30
add esp, 0xc
mov edi, eax
mov eax, dword [ebp - 0x40]
inc eax
push 0x515c98
push edi
mov dword [ebp - 0x40], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.user32.dll
inc eax
push edi
mov dword [ebp - 0x21c], eax
call fcn.004f61e0
neg eax
sbb eax, eax
push str.wtsapi32.dll
inc eax
push edi
mov dword [ebp - 0x17c], eax
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x417ff1
mov dword [ebp - 0x190], 1
push str.WSTSecDvc.dll
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41800d
mov dword [ebp - 0x180], 1
xor esi, esi
cmp esi, 0x69
jge 0x4180c8
lea eax, [esi + esi*2]
shl eax, 4
add eax, str.CreateRemoteThread
push eax
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4180c2
cmp esi, 0xf
jle 0x41804c
cmp esi, 0x12
jge 0x41804c
mov eax, 1
mov dword [ebp - 0xe0], eax
jmp 0x418051
mov eax, 1
cmp esi, 0x1d
je 0x418060
cmp esi, 0x1e
je 0x418060
cmp esi, 0x39
jne 0x418066
mov dword [ebp - 0xd4], eax
cmp esi, 0x1f
je 0x418070
cmp esi, 0x20
jne 0x418076
mov dword [ebp - 0x9c], eax
cmp esi, 0x21
je 0x418080
cmp esi, 0x22
jne 0x418086
mov dword [ebp - 0xa4], eax
cmp esi, 0x23
je 0x418090
cmp esi, 0x24
jne 0x418096
mov dword [ebp - 0x90], eax
cmp esi, 0x2c
jne 0x4180a7
mov dword [ebp - 0xc4], eax
inc esi
jmp 0x41800f
cmp esi, 0x2d
je 0x4180bf
cmp esi, 0x2e
jne 0x4180ba
mov dword [ebp - 0x48], eax
inc esi
jmp 0x41800f
cmp esi, 0x3d
jne 0x4180c2
mov dword [ebp - 0x54], eax
inc esi
jmp 0x41800f
mov ecx, dword [0xd8a438]
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0x148], 0
call fcn.004a6bb0
mov edx, dword [0xd8a438]
add esp, 4
mov esi, eax
push edx
mov dword [ebp - 0x220], esi
call fcn.004a6ca0
mov edx, dword [ebp - 0x60]
add esp, 4
lea ecx, [edx + edx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
test eax, eax
jne 0x41810e
mov eax, dword [ecx + 0x10]
mov edx, dword [0xd8a438]
push eax
push edx
push esi
mov dword [ebp - 0x58], eax
call fcn.004a6c30
add esp, 0xc
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4187e5
mov edi, 1
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
test eax, eax
je 0x41871f
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x8000
jne 0x4181a0
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xdac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
and edx, 0xffff
push edx
push str.Ord:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0xdac]
jmp 0x418229
mov edx, dword [0xd8a438]
push eax
mov eax, dword [ebp - 0x220]
push edx
push eax
call fcn.004a6c30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4181e0
xor ecx, ecx
lea edx, [ebp - 0xc4c]
mov cx, word [esi]
push ecx
push str._04lX
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add esi, 2
mov dword [ebp - 0x18], esi
jmp 0x418231
mov edi, 0x50de3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xdcc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
push edx
push str.MemAddr:_08lX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0xdcc]
mov dword [ebp - 0x18], ecx
mov edi, 1
mov esi, dword [ebp - 0x18]
push str.SetupCopyOEMInf
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x41824c
mov dword [ebp - 0x140], edi
push str.WTSEnumerateSessions
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x418264
mov dword [ebp - 0x108], edi
xor esi, esi
cmp esi, 0x69
jge 0x4186cd
mov eax, dword [ebp - 0x18]
lea edx, [esi + esi*2]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4186c7
cmp esi, 0x45
jne 0x418333
lea ecx, [ebp - 0x13cc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x13cc]
lea eax, [ebp - 0x4ac]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4ac]
push ecx
call fcn.004f2beb
mov esi, eax
push str.c:endpcache
neg esi
sbb esi, esi
inc esi
call fcn.004f2beb
add esp, 0x14
cmp esi, edi
jne 0x41830d
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x72c]
push edx
push 0x5153f4
push eax
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x72c]
jmp 0x41af46
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x72c]
push ecx
push 0x5153c4
push edx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x72c]
jmp 0x41af46
test esi, esi
jne 0x418340
mov dword [ebp - 0x74], edi
inc esi
jmp 0x418266
cmp esi, edi
jne 0x418350
mov dword [ebp - 0x94], edi
inc esi
jmp 0x418266
cmp esi, 2
je 0x4186c7
cmp esi, 4
jne 0x41836a
mov dword [ebp - 0x168], edi
inc esi
jmp 0x418266
cmp esi, 5
jne 0x41837b
mov dword [ebp - 0xf4], edi
inc esi
jmp 0x418266
cmp esi, 6
jne 0x41838c
mov dword [ebp - 0x100], edi
inc esi
jmp 0x418266
cmp esi, 7
jne 0x41839d
mov dword [ebp - 0x150], edi
inc esi
jmp 0x418266
cmp esi, 8
jne 0x4183ae
mov dword [ebp - 0x160], edi
inc esi
jmp 0x418266
cmp esi, 9
jne 0x4183bf
mov dword [ebp - 0x130], edi
inc esi
jmp 0x418266
cmp esi, 0xa
jne 0x4183d0
mov dword [ebp - 0xac], edi
inc esi
jmp 0x418266
cmp esi, 0xb
jne 0x4183e1
mov dword [ebp - 0x144], edi
inc esi
jmp 0x418266
jle 0x4183eb
inc esi
jmp 0x418266
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x21c]
inc ecx
cmp eax, edi
mov dword [ebp - 0x70], ecx
jne 0x4186e1
inc dword [ebp - 0x78]
cmp dword [ebp - 0x17c], edi
jne 0x4186ef
inc dword [ebp - 0x98]
cmp dword [ebp - 0x70], 0x2710
jg 0x41871f
mov esi, dword [ebp - 0x148]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x34]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x34], ecx
jmp 0x418132
push str.function_sum::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x41878a
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xbc]
inc ecx
add eax, 0x14
mov dword [ebp - 4], 3
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0xbc], eax
xor esi, esi
jmp 0x417f77
mov edx, dword [0xd8a438]
mov dword [ebp - 4], 2
push edx
mov byte [ebp - 4], 7
call fcn.004a6bd0
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebp - 0x17c], esi
jne 0x418817
mov dword [ebp + 8], 6
jmp 0x418961
mov eax, dword [0xd8a438]
push eax
call fcn.004a6c10
add esp, 4
mov edi, eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], eax
mov cx, word [ebp - 0x60]
cmp cx, word [esi + 2]
jae 0x418961
xor edx, edx
push str..asp
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], edx
mov byte [ebp - 0xe8], dl
mov eax, dword [edi]
mov dword [ebp - 0xf0], eax
mov ecx, dword [edi + 4]
lea edx, [ebp - 0xf0]
mov dword [ebp - 0xec], ecx
push edx
call fcn.004f61e0
add esp, 8
mov esi, 1
test eax, eax
jne 0x418882
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0xf0]
push str..upx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41889d
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0xf0]
push str..upack
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4188b8
mov dword [ebp - 0x50], esi
lea edx, [ebp - 0xf0]
push str..Pecompact
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4188d3
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0xf0]
push str..aspack
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4188ee
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0xf0]
push str..fsg
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x418909
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x58]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x58], eax
jg 0x418961
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x17c]
add edi, 0x28
inc eax
mov dword [ebp - 0x60], eax
jmp 0x41882f
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov edx, dword [0xd8a438]
push edx
call fcn.004a6b80
add esp, 4
test eax, eax
jne 0x4189aa
push str.Invalid_PE_Format_file_:
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, 3
push 0xd8a430
call fcn.004a6b50
add esp, 4
cmp edi, 1
jne 0x4189c6
push 0x515b6c
jmp 0x41af47
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18], esi
test edi, edi
mov dword [ebp - 0x34], eax
je 0x4191cc
cmp esi, 1
jge 0x4191cc
lea ecx, [ebp - 0x134c]
xor edi, edi
push ecx
mov dword [ebp - 0x40], edi
call fcn.004f2beb
jmp 0x418a03
lea edx, [ebp - 0xfcc]
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x72c]
push str.c:endpcachedumpbin.exe__imports__s__c:endpcachemonitor_procPath5.txt
push eax
call fcn.004f175f
add esp, 0x14
jmp 0x418a34
mov esi, 1
lea ecx, [ebp - 0x474]
push esi
call fcn.004f0653
mov byte [ebp - 4], 9
call fcn.004abd90
cmp eax, esi
jne 0x418a63
lea ecx, [ebp - 0x72c]
push ecx
call fcn.004f2ce2
add esp, 4
jmp 0x418a77
lea edx, [ebp - 0xb2c]
push str.c:endpcachemonitor_procPath5.txt
push edx
call fcn.00403af0
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x474]
push eax
push esi
push str.c:endpcachemonitor_procPath5.txt
mov dword [ebp + 8], edi
call fcn.004f0727
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x470]
cmp dword [eax + 0x30], 0xffffffff
jne 0x418afb
push str.c:endpcache
call fcn.004f2beb
add esp, 4
push str.monitor_procPath5.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x515478
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x460]
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x460]
call fcn.004f05fb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x470]
push 0xa
inc eax
push 0x100
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x5ac]
push eax
lea ecx, [ebp - 0x474]
call fcn.004f0ae9
lea edi, [ebp - 0x5ac]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x419161
lea ecx, [ebp - 0x5ac]
push str.Summary
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x418b58
mov dword [ebp - 0x194], esi
lea edx, [ebp - 0x5ac]
push str.Bound_to
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x419161
lea eax, [ebp - 0x5ac]
push str.File_Type
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x419161
lea ecx, [ebp - 0x5ac]
push str.Dump_of_file
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x419161
lea edx, [ebp - 0x5ac]
push str.SetupCopyOEMInf
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x418bcf
mov dword [ebp - 0x140], esi
jmp 0x419161
lea eax, [ebp - 0x5ac]
push str.WTSEnumerateSessions
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x418bf2
mov dword [ebp - 0x108], esi
jmp 0x419161
lea ecx, [ebp - 0x5ac]
push str.invalid_file
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x419178
cmp dword [ebp - 0x1c], esi
jne 0x418c16
inc dword [ebp - 0x18]
cmp ebx, esi
jne 0x418c1d
inc dword [ebp - 0x34]
xor esi, esi
mov edi, 1
cmp esi, 0x69
jge 0x419155
lea edx, [esi + esi*2]
lea eax, [ebp - 0x5ac]
shl edx, 4
add edx, str.CreateRemoteThread
push edx
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x418d6e
mov ecx, dword [ebp - 0x198]
inc ecx
cmp esi, 0x45
mov dword [ebp - 0x198], ecx
jne 0x418cfe
lea ecx, [ebp - 0x13cc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x13cc]
lea eax, [ebp - 0xccc]
push edx
push str._sMicrosoft.NETFramework
push eax
call fcn.004f175f
lea ecx, [ebp - 0xccc]
push ecx
call fcn.004f2beb
xor edx, edx
push str.c:endpcache
test eax, eax
sete dl
mov edi, edx
call fcn.004f2beb
add esp, 0x14
cmp edi, 1
jne 0x418ccd
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0xa2c]
push eax
push 0x5153f4
push ecx
jmp 0x418ce0
lea edx, [ebp - 0x218]
lea eax, [ebp - 0xa2c]
push edx
push 0x5153c4
push eax
call fcn.004f175f
mov eax, dword [ebp - 0xe4]
add esp, 0xc
test eax, eax
jne 0x418d69
cmp esi, 0x19
je 0x418d08
cmp esi, 0x1a
jne 0x418d81
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov eax, 5
inc edx
cmp ecx, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], edx
jle 0x418d23
inc esi
jmp 0x418c24
mov eax, dword [ebp + 8]
mov esi, 1
inc eax
mov dword [ebp + 8], eax
mov edx, dword [ebp - 0x474]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x46c], 1
je 0x418afb
lea ecx, [ebp - 0x474]
call fcn.004f076e
mov eax, dword [ebp - 0x34]
mov ecx, 5
cmp eax, ecx
jle 0x419194
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jle 0x4191a0
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x68]
test ecx, ecx
jne 0x4191b2
cmp eax, 6
jle 0x4191b2
sub eax, 6
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x460]
call fcn.004f05fb
lea ecx, [ebp - 0x42c]
xor ebx, ebx
push ecx
mov byte [ebp - 0x92c], 0
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x68], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x419244
mov edi, 0x515330
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
mov dword [ebp + 8], eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x30], eax
cmp ecx, eax
mov dword [ebp - 0x15c], eax
jne 0x419244
cmp dword [ebp - 0x28], eax
jge 0x419244
mov ebx, eax
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp - 0xe4]
mov edi, 1
cmp eax, edi
jne 0x419296
mov edi, 0x5161e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x30], 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0x144], edi
jne 0x419322
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x419322
mov eax, dword [ebp - 0x15c]
test eax, eax
jne 0x419322
test ebx, ebx
jne 0x419322
mov esi, dword [ebp - 0x4c]
test esi, esi
jne 0x419325
cmp dword [ebp - 0x14c], edi
jne 0x419325
cmp dword [ebp - 0x28], edi
jge 0x4192ea
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x419325
mov edx, dword [ebp - 0xb8]
cmp edx, 0x4b000
jle 0x41932b
push 0x5161c8
jmp 0x41af47
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x92c]
push eax
push 0x5161a0
push ecx
call fcn.004f175f
lea edx, [ebp - 0x92c]
push edx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x4c]
mov edx, dword [ebp - 0xb8]
cmp dword [ebp - 0x190], edi
jne 0x419385
cmp edx, 0xc800
jle 0x419385
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x3c
jle 0x419388
test ebx, ebx
jne 0x419388
test esi, esi
jne 0x419388
cmp dword [0xe56be4], edi
jne 0x419388
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x92c]
push eax
push 0x516174
push ecx
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x92c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x78]
cmp edx, 0x32000
jle 0x419474
test ebx, ebx
jne 0x419474
test esi, esi
jne 0x419474
cmp edx, 0x7d000
jle 0x4193e9
cmp ecx, 0x64
jle 0x4193e9
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x92c]
push edx
push 0x51615c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x92c]
push ecx
call fcn.004fa6c0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 0x57800
jle 0x419409
cmp ecx, 0x64
jle 0x419409
cmp dword [ebp - 0x28], edi
jg 0x4193b1
cmp ecx, 0x64
jle 0x419409
cmp dword [ebp - 0x98], 0x50
jg 0x4193b1
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x419474
cmp dword [ebp - 0x16c], edi
jne 0x41942c
cmp ecx, 0x50
jle 0x41942c
cmp edx, 0x4b000
jg 0x4193b1
mov eax, dword [ebp - 0x28]
test eax, eax
jg 0x4193b1
mov eax, dword [ebp - 0x178]
cmp eax, edi
jne 0x419457
cmp ecx, 0x50
jle 0x419474
cmp edx, 0x4b000
jg 0x4193b1
mov edi, dword [ebp - 0x28]
test edi, edi
jg 0x4193b1
mov edi, 1
cmp ecx, 0x50
jle 0x419474
mov edi, dword [ebp - 0x98]
cmp edi, 0x50
mov edi, 1
jle 0x419474
cmp eax, edi
je 0x4193b1
cmp ecx, 0x64
jle 0x4194a7
cmp dword [ebp - 0x98], 0x50
jle 0x4194a7
cmp dword [ebp - 0x70], 0xc8
jle 0x4194a7
cmp edx, 0x32000
jle 0x4194a7
test ebx, ebx
jne 0x4194a7
test esi, esi
jne 0x4194a7
cmp dword [ebp - 0x174], edi
je 0x4193b1
mov eax, dword [ebp - 0x8c]
test eax, eax
jle 0x4194cb
cmp dword [ebp - 0x70], 0x28
jle 0x4194cb
test ebx, ebx
jne 0x4194cb
test esi, esi
jne 0x4194cb
cmp dword [ebp - 0x180], edi
je 0x4193b1
cmp dword [ebp - 0x100], edi
jne 0x419508
mov edi, 0x51533c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x44], edi
jne 0x4195d5
lea eax, [ebp - 0xa2c]
lea ecx, [ebp - 0x42c]
push eax
push ecx
call fcn.004c23b0
movsx eax, ax
add esp, 8
test eax, eax
je 0x419546
lea edx, [ebp - 0xa2c]
push 0x516158
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x419582
mov edi, 0x51613c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0x28], 7
jle 0x4195d5
lea eax, [ebp - 0xa2c]
push 0x516138
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4195d5
mov edi, 0x51612c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
mov al, byte [ebp - 0xfcc]
cmp al, 0x30
je 0x419603
cmp al, 0x31
je 0x419603
cmp al, 0x32
je 0x419603
cmp al, 0x33
je 0x419603
cmp al, 0x34
je 0x419603
cmp al, 0x35
je 0x419603
cmp al, 0x36
je 0x419603
cmp al, 0x37
je 0x419603
cmp al, 0x38
je 0x419603
cmp al, 0x39
jne 0x41963f
mov edi, 0x516124
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0x140], edi
jne 0x419669
lea eax, [ebp - 0xfcc]
push str.AegisI5.exe
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x419669
push 0x516100
jmp 0x41af47
cmp dword [ebp - 0x108], edi
jne 0x419693
lea ecx, [ebp - 0xfcc]
push str.wltrysvc.exe
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x419693
push str.Broadcom
jmp 0x41af47
cmp dword [ebp - 0x160], edi
jne 0x4196d0
mov edi, 0x515320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x94], edi
jne 0x419714
mov edi, 0x515310
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0x110], edi
jne 0x419758
mov edi, 0x515300
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0xf4], edi
je 0x419768
cmp dword [ebp - 0x118], edi
jne 0x41979d
mov edi, 0x5152f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x170], edi
jne 0x4197e1
mov edi, 0x5152e4
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, ebx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov edi, 1
cmp dword [ebp - 0x120], edi
jne 0x41981e
mov edi, 0x5152d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x150], edi
jne 0x41985b
mov edi, 0x5152cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x92c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
cmp dword [ebp - 0x74], edi
jne 0x4198a3
lea ecx, [ebp - 0xb2c]
push 0xdb198c
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x41ae6b
lea edx, [ebp - 0xb2c]
push edx
call fcn.004abcc0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xb2c]
push eax
call esi
lea ecx, [ebp - 0xb2c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x41aeda
lea edx, [ebp - 0xb2c]
push edx
call fcn.004ab990
add esp, 4
lea eax, [ebp - 0xb2c]
push eax
call esi
test eax, eax
jne 0x41aeda
lea ecx, [ebp - 0xb2c]
push ecx
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x41aeda
lea edx, [ebp - 0xb2c]
push edx
call fcn.004abcc0
add esp, 4
lea edx, [ebp - 0x92c]
mov edi, 0x515f20
jmp 0x41aee5
lea edx, [ebp - 0x92c]
mov edi, 0x515edc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xe56d20]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0xe56c80]
mov dword [0xe56d20], eax
inc edi
mov dword [0xe56c80], edi
lea edi, [ebp - 0xb2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x92c]
mov edx, ecx
mov esi, edi
mov edi, 0xdb198c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret