Function at 0x4f4100
Capabilities:
Check if file exists
Copy file
Create directory
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x591710
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 1
call fcn.0056b366
test eax, eax
je 0x4f5580
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x15c]
mov dword [eax + 0x198], ecx
mov edx, dword [ebp + 0x5c]
mov eax, dword [ebp + 0x160]
mov dword [edx + 0x19c], eax
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x164]
mov dword [ecx + 0x1a0], edx
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x168]
mov dword [eax + 0x1b4], ecx
mov edx, dword [ebp + 0x5c]
mov eax, dword [ebp + 0x16c]
mov dword [edx + 0x4d54], eax
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x178]
mov dword [ecx + 0x4680], edx
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x1b8]
mov dword [eax + 0x184], ecx
mov edx, dword [ebp + 0x5c]
mov eax, dword [ebp + 0x1bc]
mov dword [edx + 0x17c], eax
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x1d0]
mov dword [ecx + 0x180], edx
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x1c0]
lea edx, [eax + 0x53de]
mov esi, edi
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4f41ee
test cl, cl
je 0x4f41ea
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4f41ee
add eax, 2
add esi, 2
test cl, cl
jne 0x4f41ca
xor eax, eax
jmp 0x4f41f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f421b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x68], 1
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x1c4]
mov esi, edi
lea edx, [eax + 0x54e2]
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4f4252
test cl, cl
je 0x4f424e
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4f4252
add eax, 2
add esi, 2
test cl, cl
jne 0x4f422e
xor eax, eax
jmp 0x4f4257
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f427f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x68], 1
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x1c8]
mov esi, edi
lea edx, [eax + 0x55e6]
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4f42b6
test cl, cl
je 0x4f42b2
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4f42b6
add eax, 2
add esi, 2
test cl, cl
jne 0x4f4292
xor eax, eax
jmp 0x4f42bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f42e3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x68], 1
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x1cc]
mov esi, edi
lea edx, [eax + 0x56ea]
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4f431a
test cl, cl
je 0x4f4316
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4f431a
add eax, 2
add esi, 2
test cl, cl
jne 0x4f42f6
xor eax, eax
jmp 0x4f431f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f4347
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x68], 1
lea ecx, [esp + 0x40]
call fcn.00548510
mov eax, dword [ebp + 0x174]
lea ebx, [ebp + 0x174]
push 0
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x138], 0
call fcn.005485d3
xor esi, esi
test eax, eax
je 0x4f4398
lea ecx, [esp + 0x40]
call fcn.005487f3
mov edx, dword [esp + 0x40]
push 0x10
lea ecx, [esp + 0x44]
call dword [edx + 0x38]
test eax, eax
je 0x4f4398
mov esi, 1
lea ecx, [esp + 0x40]
call fcn.00548589
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
jne 0x4f447e
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4f447e
push ebx
lea eax, [esp + 0x34]
push 0x5f3058
push eax
call fcn.00568a15
push 0x5f3028
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x13c], 1
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.0056870c
lea ecx, [esp + 0x30]
mov byte [esp + 0x130], 0
call fcn.0056870c
cmp esi, 6
jne 0x4f556c
mov eax, dword [ebx]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4f447e
push ebx
lea eax, [esp + 0x34]
push 0x5f3018
push eax
call fcn.00568a15
push 0x5f3010
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x13c], 2
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x24]
call fcn.0056870c
mov byte [esp + 0x130], 0
lea ecx, [esp + 0x30]
jmp 0x4f5567
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x3c]
add eax, 0x5168
push eax
call fcn.0056877a
mov eax, dword [ebx]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x138], 3
call fcn.005503ed
add esp, 8
test eax, eax
je 0x4f5031
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x170]
lea esi, [ebp + 0x170]
add eax, 0x4d58
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [eax]
jne 0x4f44e8
test dl, dl
je 0x4f44e4
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [eax + 1]
jne 0x4f44e8
add ecx, 2
add eax, 2
test dl, dl
jne 0x4f44c4
xor eax, eax
jmp 0x4f44ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4f4a51
push 1
push ecx
mov edx, esp
mov dword [esp + 0x20], esp
lea ebx, [ebp + 0x174]
push 0x5e7ad0
push ebx
push edx
call fcn.005689a1
call fcn.004416c0
mov eax, dword [ebp + 0x5c]
add esp, 8
add eax, 0x4d58
lea ecx, [esp + 0x30]
push eax
call fcn.0056877a
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x138], 4
call fcn.004cd470
add esp, 8
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x134], 5
call fcn.00568845
lea ecx, [esp + 0x38]
mov byte [esp + 0x130], 4
call fcn.0056870c
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x24]
add eax, 0x4d58
push eax
call fcn.0056877a
mov ecx, dword [esp + 0x30]
push 0x5fe7d8
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x138], 6
call fcn.005637fc
push 0x5e7ad0
lea edx, [esp + 0x3c]
push ebx
push edx
call fcn.005689a1
lea ecx, [esp + 0x24]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 7
call fcn.0056893b
mov bl, 9
lea ecx, [esp + 0x38]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x28]
add eax, 0x5168
push eax
call fcn.0056877a
push 0x5e7ad0
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x13c], 0xa
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [esp + 0x30]
push eax
mov byte [esp + 0x134], 0xb
push edx
call fcn.005503ed
add esp, 8
test eax, eax
jne 0x4f462f
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043ea50
add esp, 4
mov byte [esp + 0x17], 1
test al, al
sete al
test al, al
jne 0x4f4634
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x34]
mov byte [esp + 0x130], 0xa
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov al, byte [esp + 0x17]
test al, al
je 0x4f4a1e
push esi
lea ecx, [esp + 0x14]
push 0x5f2fe4
push ecx
call fcn.00568a15
push 0x5f2fd8
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0xc
call fcn.005689a1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x34]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0xd
call fcn.0056893b
push 0x5f2fd4
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x138], 0xe
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
call fcn.0056870c
lea ecx, [esp + 0x34]
mov byte [esp + 0x130], 0xd
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xc
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.0056870c
cmp dword [esp + 0x18], 6
jne 0x4f4a1e
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.00568845
push esi
lea eax, [esp + 0x2c]
push 0x5f2fb4
push eax
call fcn.00568a15
push 0x5f2fa0
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x13c], 0xf
call fcn.005689a1
lea edx, [esp + 0x1c]
mov byte [esp + 0x130], 0x10
push edx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0056893b
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x11
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x10
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0xf
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov eax, dword [esp + 0x34]
push 0
cmp eax, 6
jne 0x4f4999
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x4d58
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x4f48d1
add edx, 0x4d58
mov ecx, esi
push edx
call fcn.00568895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x34]
add eax, 0x4d58
push eax
call fcn.0056877a
push eax
lea ecx, [esp + 0x2c]
push 0x5f2f8c
push ecx
mov byte [esp + 0x13c], 0x12
call fcn.00568a15
push 0x5f2f84
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x13c], 0x13
call fcn.005689a1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0x14
call fcn.0056893b
push 0x5f2f7c
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x15
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x14
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0x13
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], 0x12
call fcn.0056870c
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x34]
jmp 0x4f4a19
add edx, 0x4d58
lea ecx, [esp + 0x20]
push edx
call fcn.0056877a
push eax
lea eax, [esp + 0x14]
push 0x5f2f5c
push eax
mov byte [esp + 0x13c], 0x16
call fcn.00568a15
push 0x5f2fd4
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x13c], 0x17
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x16
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], bl
call fcn.0056870c
cmp esi, 6
jne 0x4f4a1e
mov eax, dword [ebp + 0x5c]
push 0
add eax, 0x4d58
mov ecx, ebp
push eax
call fcn.00429f70
test eax, eax
je 0x4f4984
push 0x40
push 0x5e7590
push 0x5e9d2c
mov ecx, ebp
call fcn.0056a944
jmp 0x4f4a1e
mov ecx, dword [ebp + 0x5c]
add ecx, 0x4d58
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4f4a1e
mov edx, dword [esp + 0x20]
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4f4a1e
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x4d58
push eax
call fcn.00568895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push 0x5f2f48
push edx
call fcn.00568a15
push 0x5f2f40
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x138], 0x18
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x18]
call fcn.0056870c
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x10]
call fcn.0056870c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x130], 6
call fcn.0056870c
lea ecx, [esp + 0x24]
mov byte [esp + 0x130], 4
call fcn.0056870c
lea ecx, [esp + 0x30]
mov byte [esp + 0x130], 3
call fcn.0056870c
mov eax, dword [ebp + 0x1d4]
test eax, eax
je 0x4f4ff2
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x1d8]
lea esi, [ebp + 0x1d8]
add eax, 0x54
mov dl, byte [edi]
mov bl, byte [eax]
mov cl, dl
cmp dl, bl
jne 0x4f4a99
test cl, cl
je 0x4f4a95
mov dl, byte [edi + 1]
mov bl, byte [eax + 1]
mov cl, dl
cmp dl, bl
jne 0x4f4a99
add edi, 2
add eax, 2
test cl, cl
jne 0x4f4a71
xor eax, eax
jmp 0x4f4a9e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4f4ff2
push 1
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
lea edi, [ebp + 0x174]
push 0x5e7ad0
push edi
push eax
call fcn.005689a1
call fcn.004416c0
mov ecx, dword [ebp + 0x5c]
add esp, 8
add ecx, 0x54
push ecx
lea ecx, [esp + 0x34]
call fcn.0056877a
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x138], 0x19
call fcn.004cd470
add esp, 8
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x134], 0x1a
call fcn.00568845
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], 0x19
call fcn.0056870c
mov ecx, dword [ebp + 0x5c]
add ecx, 0x54
push ecx
lea ecx, [esp + 0x28]
call fcn.0056877a
mov edx, dword [esp + 0x30]
push 0x5fe7d8
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x138], 0x1b
call fcn.005637fc
push 0x5e7ad0
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.005689a1
lea ecx, [esp + 0x24]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0x1c
call fcn.0056893b
mov bl, 0x1e
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x20]
add eax, 0x5168
push eax
call fcn.0056877a
push 0x5e7ad0
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x13c], 0x1f
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [esp + 0x30]
push eax
mov byte [esp + 0x134], 0x20
push edx
call fcn.005503ed
add esp, 8
test eax, eax
jne 0x4f4bdc
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043ea50
add esp, 4
mov byte [esp + 0x17], 1
test al, al
sete al
test al, al
jne 0x4f4be1
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0x1f
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov al, byte [esp + 0x17]
test al, al
je 0x4f4fbf
push esi
lea ecx, [esp + 0x38]
push 0x5f2f0c
push ecx
call fcn.00568a15
push 0x5f2fd8
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x13c], 0x21
call fcn.005689a1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0x22
call fcn.0056893b
push 0x5f2fd4
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x138], 0x23
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], eax
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0x22
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], 0x21
call fcn.0056870c
lea ecx, [esp + 0x34]
mov byte [esp + 0x130], bl
call fcn.0056870c
cmp dword [esp + 0x38], 6
jne 0x4f4fbf
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.00568845
push esi
lea eax, [esp + 0x38]
push 0x5f2eec
push eax
call fcn.00568a15
push 0x5f2fa0
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x13c], 0x24
call fcn.005689a1
lea edx, [esp + 0x1c]
mov byte [esp + 0x130], 0x25
push edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0056893b
push 0x5f2fd4
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x13c], 0x26
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], eax
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0x25
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], 0x24
call fcn.0056870c
lea ecx, [esp + 0x34]
mov byte [esp + 0x130], bl
call fcn.0056870c
mov eax, dword [esp + 0x38]
push 0
cmp eax, 6
jne 0x4f4f3c
mov ecx, dword [ebp + 0x5c]
mov eax, dword [esp + 0x20]
add ecx, 0x54
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp + 0x5c]
test eax, eax
jne 0x4f4e7c
add edx, 0x54
mov ecx, esi
push edx
call fcn.00568895
mov eax, dword [ebp + 0x5c]
lea ecx, [esp + 0x38]
add eax, 0x54
push eax
call fcn.0056877a
push eax
lea ecx, [esp + 0x38]
push 0x5f2ed8
push ecx
mov byte [esp + 0x13c], 0x27
call fcn.00568a15
push 0x5f2f84
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x13c], 0x28
call fcn.005689a1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x13c], 0x29
call fcn.0056893b
push 0x5f2f7c
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x138], 0x2a
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x10]
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0x29
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], 0x28
call fcn.0056870c
lea ecx, [esp + 0x34]
mov byte [esp + 0x130], 0x27
call fcn.0056870c
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x38]
jmp 0x4f4fba
add edx, 0x54
lea ecx, [esp + 0x28]
push edx
call fcn.0056877a
push eax
lea eax, [esp + 0x24]
push 0x5f2eb8
push eax
mov byte [esp + 0x13c], 0x2b
call fcn.00568a15
push 0x5f2fd4
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x13c], 0x2c
call fcn.005689a1
mov eax, dword [eax]
mov edx, dword [ebp + 0x1c]
push 0x24
push 0x5e7590
push eax
push edx
call edi
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x130], 0x2b
call fcn.0056870c
lea ecx, [esp + 0x28]
mov byte [esp + 0x130], bl
call fcn.0056870c
cmp esi, 6
jne 0x4f4fbf
mov eax, dword [ebp + 0x5c]
push 0
add eax, 0x54
mov ecx, ebp
push eax
call fcn.00429f70
test eax, eax
je 0x4f4f2a
push 0x40
push 0x5e7590
push 0x5e9d2c
mov ecx, ebp
call fcn.0056a944
jmp 0x4f4fbf
mov ecx, dword [ebp + 0x5c]
add ecx, 0x54
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4f4fbf
mov edx, dword [esp + 0x20]
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4f4fbf
mov eax, dword [ebp + 0x5c]
mov ecx, esi
add eax, 0x54
push eax
call fcn.00568895
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push 0x5f2f48
push edx
call fcn.00568a15
push 0x5f2f40
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x138], 0x2d
push eax
call fcn.005689a1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push eax
push ecx
call edi
lea ecx, [esp + 0x10]
call fcn.0056870c
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x20]
call fcn.0056870c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x130], 0x1b
call fcn.0056870c
lea ecx, [esp + 0x24]
mov byte [esp + 0x130], 0x19
call fcn.0056870c
lea ecx, [esp + 0x30]
mov byte [esp + 0x130], 3
call fcn.0056870c
mov edx, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x174]
lea ebx, [ebp + 0x174]
or ecx, 0xffffffff
xor eax, eax
add edx, 0x5168
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00578d59
mov ecx, dword [eax + 4]
call fcn.00475050
mov ebx, dword [ebx]
mov edx, dword [ebp + 0x5c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add edx, 0x5168
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x170]
or ecx, 0xffffffff
add edx, 0x4d58
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x2e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
lea ecx, [ebp + 0x17c]
call fcn.00565658
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x2e]
mov edi, dword [sym.imp.USER32.dll_RegisterHotKey]
mov esi, dword [sym.imp.USER32.dll_UnregisterHotKey]
cmp cx, word [eax + 0x4d1e]
jne 0x4f50c7
mov dx, word [esp + 0x14]
cmp dx, word [eax + 0x4d1c]
je 0x4f513b
mov word [eax + 0x4d1e], cx
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x14]
push 0x2006
mov word [eax + 0x4d1c], cx
mov edx, dword [ebp + 0x60]
mov eax, dword [edx + 0x7c]
mov ecx, dword [eax + 0x1c]
push ecx
call esi
mov ecx, dword [ebp + 0x5c]
mov ax, word [ecx + 0x4d1c]
test ax, ax
jne 0x4f5106
cmp word [ecx + 0x4d1e], ax
je 0x4f513b
xor edx, edx
test al, 4
je 0x4f5111
mov edx, 1
test al, 2
je 0x4f5118
or edx, 2
test al, 1
je 0x4f511f
or edx, 4
xor eax, eax
mov ax, word [ecx + 0x4d1e]
mov ecx, dword [ebp + 0x60]
push eax
push edx
mov edx, dword [ecx + 0x7c]
push 0x2006
mov eax, dword [edx + 0x1c]
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2e]
push ecx
push edx
lea ecx, [ebp + 0xe4]
call fcn.00565658
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x2e]
cmp cx, word [eax + 0x4d22]
jne 0x4f516f
mov dx, word [esp + 0x14]
cmp dx, word [eax + 0x4d20]
je 0x4f51e3
mov word [eax + 0x4d22], cx
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x14]
push 0x2005
mov word [eax + 0x4d20], cx
mov edx, dword [ebp + 0x60]
mov eax, dword [edx + 0x7c]
mov ecx, dword [eax + 0x1c]
push ecx
call esi
mov ecx, dword [ebp + 0x5c]
mov ax, word [ecx + 0x4d20]
test ax, ax
jne 0x4f51ae
cmp word [ecx + 0x4d22], ax
je 0x4f51e3
xor edx, edx
test al, 4
je 0x4f51b9
mov edx, 1
test al, 2
je 0x4f51c0
or edx, 2
test al, 1
je 0x4f51c7
or edx, 4
xor eax, eax
mov ax, word [ecx + 0x4d22]
mov ecx, dword [ebp + 0x60]
push eax
push edx
mov edx, dword [ecx + 0x7c]
push 0x2005
mov eax, dword [edx + 0x1c]
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2e]
push ecx
push edx
lea ecx, [ebp + 0xa8]
call fcn.00565658
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x2e]
cmp cx, word [eax + 0x4d26]
jne 0x4f5217
mov dx, word [esp + 0x14]
cmp dx, word [eax + 0x4d24]
je 0x4f528b
mov word [eax + 0x4d26], cx
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x14]
push 0x2004
mov word [eax + 0x4d24], cx
mov edx, dword [ebp + 0x60]
mov eax, dword [edx + 0x7c]
mov ecx, dword [eax + 0x1c]
push ecx
call esi
mov ecx, dword [ebp + 0x5c]
mov ax, word [ecx + 0x4d24]
test ax, ax
jne 0x4f5256
cmp word [ecx + 0x4d26], ax
je 0x4f528b
xor edx, edx
test al, 4
je 0x4f5261
mov edx, 1
test al, 2
je 0x4f5268
or edx, 2
test al, 1
je 0x4f526f
or edx, 4
xor eax, eax
mov ax, word [ecx + 0x4d26]
mov ecx, dword [ebp + 0x60]
push eax
push edx
mov edx, dword [ecx + 0x7c]
push 0x2004
mov eax, dword [edx + 0x1c]
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2e]
push ecx
push edx
lea ecx, [ebp + 0x6c]
call fcn.00565658
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x2e]
cmp cx, word [eax + 0x4d2a]
jne 0x4f52bc
mov dx, word [esp + 0x14]
cmp dx, word [eax + 0x4d28]
je 0x4f5330
mov word [eax + 0x4d2a], cx
mov eax, dword [ebp + 0x5c]
mov cx, word [esp + 0x14]
push 0x2003
mov word [eax + 0x4d28], cx
mov edx, dword [ebp + 0x60]
mov eax, dword [edx + 0x7c]
mov ecx, dword [eax + 0x1c]
push ecx
call esi
mov ecx, dword [ebp + 0x5c]
mov ax, word [ecx + 0x4d28]
test ax, ax
jne 0x4f52fb
cmp word [ecx + 0x4d2a], ax
je 0x4f5330
xor edx, edx
test al, 4
je 0x4f5306
mov edx, 1
test al, 2
je 0x4f530d
or edx, 2
test al, 1
je 0x4f5314
or edx, 4
xor eax, eax
mov ax, word [ecx + 0x4d2a]
mov ecx, dword [ebp + 0x60]
push eax
push edx
mov edx, dword [ecx + 0x7c]
push 0x2003
mov eax, dword [edx + 0x1c]
push eax
call edi
mov eax, dword [ebp + 0x1d4]
test eax, eax
je 0x4f5480
lea esi, [ebp + 0x1d8]
mov ecx, esi
call fcn.00563ec7
mov eax, dword [esi]
push 0x5fe7d8
push eax
call fcn.005503ed
add esp, 8
test eax, eax
jne 0x4f53a1
mov ecx, dword [ebp + 0x1c]
push 0x40
push 0x5e7590
push 0x5f2e9c
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x130], 0
call fcn.0056870c
lea ecx, [esp + 0x40]
mov dword [esp + 0x130], 0xffffffff
call fcn.0054854d
xor eax, eax
jmp 0x4f568c
mov eax, dword [esi]
lea edx, [esp + 0x24]
push eax
push edx
call fcn.004cd470
add esp, 8
push 0
push ecx
lea eax, [esp + 0x2c]
mov bl, 0x2e
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x13c], bl
call fcn.00568481
call fcn.004416c0
add esp, 8
test eax, eax
jne 0x4f546f
push esi
lea ecx, [esp + 0x14]
push 0x5f2e84
push ecx
call fcn.00568a15
push 0x5f2e64
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x13c], 0x2f
call fcn.005689a1
mov eax, dword [eax]
push 0x40
push 0x5e7590
push eax
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x18]
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.0056870c
lea ecx, [esp + 0x24]
mov byte [esp + 0x130], 3
call fcn.0056870c
lea ecx, [esp + 0x3c]
mov byte [esp + 0x130], 0
call fcn.0056870c
lea ecx, [esp + 0x40]
mov dword [esp + 0x130], 0xffffffff
call fcn.0054854d
xor eax, eax
jmp 0x4f568c
lea ecx, [esp + 0x24]
mov byte [esp + 0x130], 3
call fcn.0056870c
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x1d4]
cmp dword [eax + 0x50], ecx
je 0x4f5647
test ecx, ecx
je 0x4f5632
mov eax, dword [ebp + 0x1d8]
lea ebx, [ebp + 0x1d8]
push eax
call fcn.0043ea50
add esp, 4
test al, al
je 0x4f5540
push ebx
lea ecx, [esp + 0x14]
push 0x5f2e2c
push ecx
call fcn.00568a15
push 0x5f2df4
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x13c], 0x30
call fcn.005689a1
mov eax, dword [eax]
push 0x21
push 0x5e7590
push eax
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0056870c
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 3
call fcn.0056870c
cmp esi, 2
jne 0x4f5540
lea ecx, [esp + 0x3c]
mov byte [esp + 0x130], 0
call fcn.0056870c
lea ecx, [esp + 0x40]
mov dword [esp + 0x130], 0xffffffff
call fcn.0054854d
xor eax, eax
jmp 0x4f568c
mov ecx, dword [ebp + 0x1c]
push 0x23
push 0x5e7590
push 0x5f2d54
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4f5587
mov byte [esp + 0x130], 0
lea ecx, [esp + 0x3c]
call fcn.0056870c
lea ecx, [esp + 0x40]
mov dword [esp + 0x130], 0xffffffff
call fcn.0054854d
xor eax, eax
jmp 0x4f568c
cmp eax, 6
jne 0x4f5609
mov edi, 0x5e882c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5fe7d8
call fcn.0056877a
push 0
push 0x5e871c
lea ecx, [esp + 0x6c]
call fcn.005076d0
push 0
push 0
lea ecx, [esp + 0x64]
mov byte [esp + 0x138], 0x31
call fcn.005079f0
push 0x5e871c
lea ecx, [esp + 0x60]
call fcn.00508670
lea ecx, [esp + 0x5c]
mov byte [esp + 0x130], 3
call fcn.00507890
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x1d4]
push 0x104
mov dword [ecx + 0x50], edx
mov eax, dword [ebp + 0x5c]
mov ebx, dword [ebx]
add eax, 0x54
push ebx
push eax
call fcn.0043a0b0
add esp, 0xc
push 0
push 1
jmp 0x4f563d
push 1
mov dword [eax + 0x50], 0
push 0
mov ecx, dword [ebp + 0x5c]
push 0xffffffffffffffff
call fcn.0040d400
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebp + 0x1d8]
push 0x104
add ecx, 0x54
push eax
push ecx
call fcn.0043a0b0
add esp, 0xc
lea ecx, [esp + 0x3c]
mov byte [esp + 0x130], 0
call fcn.0056870c
lea ecx, [esp + 0x40]
mov dword [esp + 0x130], 0xffffffff
call fcn.0054854d
mov eax, 1
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x124
ret