Function at 0x438fb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca285
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
push esi
mov eax, dword [0x50545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00452618
mov byte [ebp - 4], 2
push 0x4d3b3c
lea ecx, [ebp - 0x120]
call fcn.00412370
mov byte [ebp - 4], 3
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x120]
sub eax, 0x10
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2bc]
call fcn.004029d0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c0], ecx
push 0
mov edx, dword [ebp - 0x2c0]
push edx
lea ecx, [ebp - 0x24]
call fcn.004526d5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4390c3
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
sub eax, 0x10
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x2c4]
call fcn.004029d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00452641
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0x2c8], ecx
mov ecx, dword [ebp - 0x2c8]
call fcn.004029d0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
sub edx, 0x10
mov dword [ebp - 0x2cc], edx
mov ecx, dword [ebp - 0x2cc]
call fcn.004029d0
jmp 0x43c7e0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x2c], 0
je 0x43c7a5
lea ecx, [ebp - 0x24]
call fcn.0045221f
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x24]
call fcn.004525c2
test eax, eax
je 0x4390f2
jmp 0x4390cf
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00412990
mov byte [ebp - 4], 6
push 1
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [eax]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 1
jne 0x43915b
push 0
mov ecx, dword [ebp - 0x2d4]
call fcn.0040fd40
movzx eax, ax
mov ecx, 0x5c
movzx edx, cx
cmp eax, edx
jne 0x43915b
mov dword [ebp - 0x9c0], 0
jmp 0x439165
mov dword [ebp - 0x9c0], 1
mov al, byte [ebp - 0x9c0]
mov byte [ebp - 0x121], al
mov ecx, dword [ebp - 0x128]
sub ecx, 0x10
mov dword [ebp - 0x2d8], ecx
mov ecx, dword [ebp - 0x2d8]
call fcn.004029d0
movzx edx, byte [ebp - 0x121]
test edx, edx
je 0x4391ee
push 0x5c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00444e30
add esp, 0xc
mov dword [ebp - 0x9c4], eax
mov edx, dword [ebp - 0x9c4]
mov dword [ebp - 0x2dc], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x34]
call fcn.00412a10
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x12c]
sub ecx, 0x10
mov dword [ebp - 0x2e0], ecx
mov ecx, dword [ebp - 0x2e0]
call fcn.004029d0
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x24]
call fcn.004529c1
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x2e4], eax
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx]
mov dword [ebp - 0x2e8], edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x2e8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00411880
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x130]
sub edx, 0x10
mov dword [ebp - 0x2f0], edx
mov ecx, dword [ebp - 0x2f0]
call fcn.004029d0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
call fcn.00412990
mov byte [ebp - 4], 9
push 1
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040f040
mov dword [ebp - 0x2f8], eax
mov edx, dword [ebp - 0x2f8]
mov eax, dword [edx]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 1
jne 0x4392cf
push 0
mov ecx, dword [ebp - 0x2f8]
call fcn.0040fd40
movzx edx, ax
mov eax, 0x5c
movzx ecx, ax
cmp edx, ecx
jne 0x4392cf
mov dword [ebp - 0x9cc], 0
jmp 0x4392d9
mov dword [ebp - 0x9cc], 1
mov dl, byte [ebp - 0x9cc]
mov byte [ebp - 0x131], dl
mov eax, dword [ebp - 0x138]
sub eax, 0x10
mov dword [ebp - 0x2fc], eax
mov ecx, dword [ebp - 0x2fc]
call fcn.004029d0
movzx ecx, byte [ebp - 0x131]
test ecx, ecx
je 0x439362
push 0x5c
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.00444e30
add esp, 0xc
mov dword [ebp - 0x9d0], eax
mov ecx, dword [ebp - 0x9d0]
mov dword [ebp - 0x300], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x300]
push edx
lea ecx, [ebp - 0x30]
call fcn.00412a10
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x13c]
sub eax, 0x10
mov dword [ebp - 0x304], eax
mov ecx, dword [ebp - 0x304]
call fcn.004029d0
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004529c1
mov dword [ebp - 0x9d4], eax
mov edx, dword [ebp - 0x9d4]
mov dword [ebp - 0x310], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x310]
mov ecx, dword [eax]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x308], edx
mov eax, dword [ebp - 0x310]
mov ecx, dword [eax]
mov dword [ebp - 0x30c], ecx
mov edx, dword [ebp - 0x308]
push edx
mov eax, dword [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00411880
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x140]
sub ecx, 0x10
mov dword [ebp - 0x314], ecx
mov ecx, dword [ebp - 0x314]
call fcn.004029d0
push 0x10
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
mov eax, dword [edx + 0x38]
call eax
test eax, eax
je 0x439457
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
mov dword [ebp - 0x318], ecx
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x318]
call fcn.00412990
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x9d8], eax
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x148], esp
mov dword [ebp - 0x31c], ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x31c]
call fcn.00412990
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x9dc], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x9bc]
call fcn.00438fb0
jmp 0x43c788
call fcn.0044fb81
push eax
lea ecx, [ebp - 0x3c]
call fcn.00412940
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004529c1
mov dword [ebp - 0x9e0], eax
mov edx, dword [ebp - 0x9e0]
mov dword [ebp - 0x320], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x320]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00412a10
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x14c]
sub ecx, 0x10
mov dword [ebp - 0x324], ecx
mov ecx, dword [ebp - 0x324]
call fcn.004029d0
mov edx, str.UpdatePatch.exe
neg edx
sbb edx, edx
neg edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x328], edx
jne 0x4394de
push 0x80004005
call fcn.00405b70
xor eax, eax
jne 0x4394bb
xor ecx, ecx
jne 0x4394e2
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x32c], edx
push str.UpdatePatch.exe
mov eax, dword [ebp - 0x32c]
push eax
call fcn.00494296
add esp, 8
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jne 0x439568
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x334], ecx
mov ecx, dword [ebp - 0x334]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x338], edx
mov ecx, dword [ebp - 0x338]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 0x33c]
call fcn.004029d0
jmp 0x4390cf
mov ecx, dword [ebp - 0x9bc]
cmp dword [ecx + 0xdc], 0
je 0x43c682
mov ecx, dword [ebp - 0x9bc]
call fcn.0043cbb0
test eax, eax
je 0x43afda
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x344], edx
push 0x2e
mov eax, dword [ebp - 0x344]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jne 0x4395c3
mov dword [ebp - 0x9e4], 0xffffffff
jmp 0x4395d4
mov ecx, dword [ebp - 0x340]
sub ecx, dword [ebp - 0x3c]
sar ecx, 1
mov dword [ebp - 0x9e4], ecx
push 4
mov edx, dword [ebp - 0x9e4]
sub edx, 4
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004250f0
mov byte [ebp - 4], 0xf
push str.WINXP
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
jne 0x439635
push str.WINSVR2003
mov eax, dword [ebp - 0x9bc]
add eax, 0xd0
push eax
call fcn.00444f00
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x439b26
mov edx, str.XP64
neg edx
sbb edx, edx
neg edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x368], edx
jne 0x439658
push 0x80004005
call fcn.00405b70
xor eax, eax
jne 0x439635
xor ecx, ecx
jne 0x43965c
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x36c], edx
push str.XP64
mov eax, dword [ebp - 0x36c]
push eax
call fcn.00494296
add esp, 8
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
je 0x4396fd
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x40]
sub ecx, 0x10
mov dword [ebp - 0x374], ecx
mov ecx, dword [ebp - 0x374]
call fcn.004029d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3c]
sub edx, 0x10
mov dword [ebp - 0x378], edx
mov ecx, dword [ebp - 0x378]
call fcn.004029d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
sub eax, 0x10
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x37c]
call fcn.004029d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
sub ecx, 0x10
mov dword [ebp - 0x380], ecx
mov ecx, dword [ebp - 0x380]
call fcn.004029d0
jmp 0x4390cf
mov edx, dword [ebp - 0x9bc]
mov dword [edx + 0xd4], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x388], eax
push 0x2e
mov ecx, dword [ebp - 0x388]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jne 0x439742
mov dword [ebp - 0x9e8], 0xffffffff
jmp 0x439753
mov edx, dword [ebp - 0x384]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0x9e8], edx
mov eax, dword [ebp - 0x9e8]
sub eax, 4
push eax
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x34]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x394], ecx
push 0x2e
mov edx, dword [ebp - 0x394]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
jne 0x4397ae
mov dword [ebp - 0x9ec], 0xffffffff
jmp 0x4397bf
mov eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0x9ec], eax
mov ecx, dword [ebp - 0x38c]
sub ecx, dword [ebp - 0x9ec]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x12
push 0x80
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x150]
call fcn.00412370
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x39c], eax
mov ecx, dword [ebp - 0x39c]
mov edx, dword [ecx]
mov dword [ebp - 0x3a0], edx
mov eax, dword [ebp - 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x154]
sub ecx, 0x10
mov dword [ebp - 0x3a4], ecx
mov ecx, dword [ebp - 0x3a4]
call fcn.004029d0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x150]
sub edx, 0x10
mov dword [ebp - 0x3a8], edx
mov ecx, dword [ebp - 0x3a8]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x158]
call fcn.00412370
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x15c]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov ecx, dword [eax]
mov dword [ebp - 0x3b4], ecx
mov edx, dword [ebp - 0x3b4]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x15c]
sub ecx, 0x10
mov dword [ebp - 0x3b8], ecx
mov ecx, dword [ebp - 0x3b8]
call fcn.004029d0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x158]
sub edx, 0x10
mov dword [ebp - 0x3bc], edx
mov ecx, dword [ebp - 0x3bc]
call fcn.004029d0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x3c0], eax
push 0
mov ecx, dword [ebp - 0x3c0]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x164]
call fcn.00412370
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x168]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [eax]
mov dword [ebp - 0x3cc], ecx
mov edx, dword [ebp - 0x3cc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x15d], al
mov eax, dword [ebp - 0x168]
sub eax, 0x10
mov dword [ebp - 0x3d0], eax
mov ecx, dword [ebp - 0x3d0]
call fcn.004029d0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x164]
sub ecx, 0x10
mov dword [ebp - 0x3d4], ecx
mov ecx, dword [ebp - 0x3d4]
call fcn.004029d0
movzx edx, byte [ebp - 0x15d]
test edx, edx
je 0x439a5f
push 0x4d33a8
lea ecx, [ebp - 0x16c]
call fcn.00412370
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x170]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [eax]
mov dword [ebp - 0x3e0], ecx
push 4
push 0
mov edx, dword [ebp - 0x3e0]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x170]
sub eax, 0x10
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.004029d0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x16c]
sub ecx, 0x10
mov dword [ebp - 0x3e8], ecx
mov ecx, dword [ebp - 0x3e8]
call fcn.004029d0
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x44]
sub edx, 0x10
mov dword [ebp - 0x3ec], edx
mov ecx, dword [ebp - 0x3ec]
call fcn.004029d0
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x4c]
sub eax, 0x10
mov dword [ebp - 0x3f0], eax
mov ecx, dword [ebp - 0x3f0]
call fcn.004029d0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x48]
sub ecx, 0x10
mov dword [ebp - 0x3f4], ecx
mov ecx, dword [ebp - 0x3f4]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x40]
sub edx, 0x10
mov dword [ebp - 0x3f8], edx
mov ecx, dword [ebp - 0x3f8]
call fcn.004029d0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3c]
sub eax, 0x10
mov dword [ebp - 0x3fc], eax
mov ecx, dword [ebp - 0x3fc]
call fcn.004029d0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
sub ecx, 0x10
mov dword [ebp - 0x400], ecx
mov ecx, dword [ebp - 0x400]
call fcn.004029d0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
sub edx, 0x10
mov dword [ebp - 0x404], edx
mov ecx, dword [ebp - 0x404]
call fcn.004029d0
jmp 0x4390cf
push str.WIN2000
mov eax, dword [ebp - 0x9bc]
add eax, 0xd0
push eax
call fcn.00444f00
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x439b6b
push str.WINNT4
mov edx, dword [ebp - 0x9bc]
add edx, 0xd0
push edx
call fcn.00444f00
add esp, 8
movzx eax, al
test eax, eax
je 0x43a05c
mov ecx, str.2k64
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x428], ecx
jne 0x439b8e
push 0x80004005
call fcn.00405b70
xor edx, edx
jne 0x439b6b
xor eax, eax
jne 0x439b92
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x42c], ecx
push str.2k64
mov edx, dword [ebp - 0x42c]
push edx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x439c33
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40]
sub eax, 0x10
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
call fcn.004029d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x438], ecx
mov ecx, dword [ebp - 0x438]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x43c], edx
mov ecx, dword [ebp - 0x43c]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
call fcn.004029d0
jmp 0x4390cf
mov ecx, dword [ebp - 0x9bc]
mov dword [ecx + 0xd4], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x448], edx
push 0x2e
mov eax, dword [ebp - 0x448]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
jne 0x439c78
mov dword [ebp - 0x9f0], 0xffffffff
jmp 0x439c89
mov ecx, dword [ebp - 0x444]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0x9f0], ecx
mov edx, dword [ebp - 0x9f0]
sub edx, 4
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x454], eax
push 0x2e
mov ecx, dword [ebp - 0x454]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x439ce4
mov dword [ebp - 0x9f4], 0xffffffff
jmp 0x439cf5
mov edx, dword [ebp - 0x450]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0x9f4], edx
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x9f4]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x19
push 0x80
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x174]
call fcn.00412370
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x178]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
mov dword [ebp - 0x460], ecx
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x178]
sub eax, 0x10
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
call fcn.004029d0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x174]
sub ecx, 0x10
mov dword [ebp - 0x468], ecx
mov ecx, dword [ebp - 0x468]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x17c]
call fcn.00412370
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x17c]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x180]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x470], eax
mov edx, dword [ebp - 0x470]
mov eax, dword [edx]
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x180]
sub eax, 0x10
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x478]
call fcn.004029d0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x17c]
sub ecx, 0x10
mov dword [ebp - 0x47c], ecx
mov ecx, dword [ebp - 0x47c]
call fcn.004029d0
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x480], edx
push 0
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x188]
call fcn.00412370
mov byte [ebp - 4], 0x1c
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x18c]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0x488]
mov eax, dword [edx]
mov dword [ebp - 0x48c], eax
mov ecx, dword [ebp - 0x48c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x181], al
mov edx, dword [ebp - 0x18c]
sub edx, 0x10
mov dword [ebp - 0x490], edx
mov ecx, dword [ebp - 0x490]
call fcn.004029d0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x188]
sub eax, 0x10
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
call fcn.004029d0
movzx ecx, byte [ebp - 0x181]
test ecx, ecx
je 0x439f95
push 0x4d33a8
lea ecx, [ebp - 0x190]
call fcn.00412370
mov byte [ebp - 4], 0x1d
lea edx, [ebp - 0x190]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x194]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x49c], eax
mov edx, dword [ebp - 0x49c]
mov eax, dword [edx]
mov dword [ebp - 0x4a0], eax
push 4
push 0
mov ecx, dword [ebp - 0x4a0]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 0x194]
sub edx, 0x10
mov dword [ebp - 0x4a4], edx
mov ecx, dword [ebp - 0x4a4]
call fcn.004029d0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x190]
sub eax, 0x10
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
call fcn.004029d0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x50]
sub ecx, 0x10
mov dword [ebp - 0x4ac], ecx
mov ecx, dword [ebp - 0x4ac]
call fcn.004029d0
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x58]
sub edx, 0x10
mov dword [ebp - 0x4b0], edx
mov ecx, dword [ebp - 0x4b0]
call fcn.004029d0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x54]
sub eax, 0x10
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x40]
sub ecx, 0x10
mov dword [ebp - 0x4b8], ecx
mov ecx, dword [ebp - 0x4b8]
call fcn.004029d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3c]
sub edx, 0x10
mov dword [ebp - 0x4bc], edx
mov ecx, dword [ebp - 0x4bc]
call fcn.004029d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
sub eax, 0x10
mov dword [ebp - 0x4c0], eax
mov ecx, dword [ebp - 0x4c0]
call fcn.004029d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
sub ecx, 0x10
mov dword [ebp - 0x4c4], ecx
mov ecx, dword [ebp - 0x4c4]
call fcn.004029d0
jmp 0x4390cf
push str.WINVISTA
mov edx, dword [ebp - 0x9bc]
add edx, 0xd0
push edx
call fcn.00444f00
add esp, 8
movzx eax, al
test eax, eax
je 0x43a572
mov ecx, str.LH64
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x4d8], ecx
jne 0x43a0a4
push 0x80004005
call fcn.00405b70
xor edx, edx
jne 0x43a081
xor eax, eax
jne 0x43a0a8
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x4dc], ecx
push str.LH64
mov edx, dword [ebp - 0x4dc]
push edx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0
je 0x43a149
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40]
sub eax, 0x10
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
call fcn.004029d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x4e8], ecx
mov ecx, dword [ebp - 0x4e8]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x4ec], edx
mov ecx, dword [ebp - 0x4ec]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x4f0], eax
mov ecx, dword [ebp - 0x4f0]
call fcn.004029d0
jmp 0x4390cf
mov ecx, dword [ebp - 0x9bc]
mov dword [ecx + 0xd4], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x4f8], edx
push 0x2e
mov eax, dword [ebp - 0x4f8]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0
jne 0x43a18e
mov dword [ebp - 0x9f8], 0xffffffff
jmp 0x43a19f
mov ecx, dword [ebp - 0x4f4]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0x9f8], ecx
mov edx, dword [ebp - 0x9f8]
sub edx, 4
push edx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x504], eax
push 0x2e
mov ecx, dword [ebp - 0x504]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
jne 0x43a1fa
mov dword [ebp - 0x9fc], 0xffffffff
jmp 0x43a20b
mov edx, dword [ebp - 0x500]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0x9fc], edx
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x9fc]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x20
push 0x80
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x198]
call fcn.00412370
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x19c]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax]
mov dword [ebp - 0x510], ecx
mov edx, dword [ebp - 0x510]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x19c]
sub eax, 0x10
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
call fcn.004029d0
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x198]
sub ecx, 0x10
mov dword [ebp - 0x518], ecx
mov ecx, dword [ebp - 0x518]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x1a0]
call fcn.00412370
mov byte [ebp - 4], 0x22
lea edx, [ebp - 0x1a0]
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x520], eax
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
mov dword [ebp - 0x524], eax
mov ecx, dword [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x1a4]
sub eax, 0x10
mov dword [ebp - 0x528], eax
mov ecx, dword [ebp - 0x528]
call fcn.004029d0
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x1a0]
sub ecx, 0x10
mov dword [ebp - 0x52c], ecx
mov ecx, dword [ebp - 0x52c]
call fcn.004029d0
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x530], edx
push 0
mov eax, dword [ebp - 0x530]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x1ac]
call fcn.00412370
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0x1ac]
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x538], eax
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x53c], eax
mov ecx, dword [ebp - 0x53c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1a5], al
mov edx, dword [ebp - 0x1b0]
sub edx, 0x10
mov dword [ebp - 0x540], edx
mov ecx, dword [ebp - 0x540]
call fcn.004029d0
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x1ac]
sub eax, 0x10
mov dword [ebp - 0x544], eax
mov ecx, dword [ebp - 0x544]
call fcn.004029d0
movzx ecx, byte [ebp - 0x1a5]
test ecx, ecx
je 0x43a4ab
push 0x4d33a8
lea ecx, [ebp - 0x1b4]
call fcn.00412370
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x54c], eax
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx]
mov dword [ebp - 0x550], eax
push 4
push 0
mov ecx, dword [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 0x1b8]
sub edx, 0x10
mov dword [ebp - 0x554], edx
mov ecx, dword [ebp - 0x554]
call fcn.004029d0
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x1b4]
sub eax, 0x10
mov dword [ebp - 0x558], eax
mov ecx, dword [ebp - 0x558]
call fcn.004029d0
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x10
mov dword [ebp - 0x55c], ecx
mov ecx, dword [ebp - 0x55c]
call fcn.004029d0
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0x64]
sub edx, 0x10
mov dword [ebp - 0x560], edx
mov ecx, dword [ebp - 0x560]
call fcn.004029d0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x60]
sub eax, 0x10
mov dword [ebp - 0x564], eax
mov ecx, dword [ebp - 0x564]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x40]
sub ecx, 0x10
mov dword [ebp - 0x568], ecx
mov ecx, dword [ebp - 0x568]
call fcn.004029d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3c]
sub edx, 0x10
mov dword [ebp - 0x56c], edx
mov ecx, dword [ebp - 0x56c]
call fcn.004029d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
sub eax, 0x10
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
call fcn.004029d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
sub ecx, 0x10
mov dword [ebp - 0x574], ecx
mov ecx, dword [ebp - 0x574]
call fcn.004029d0
jmp 0x4390cf
push str.WINDOWS7
mov edx, dword [ebp - 0x9bc]
add edx, 0xd0
push edx
call fcn.00444f00
add esp, 8
movzx eax, al
test eax, eax
jne 0x43a5b8
push str.WINDOWS8
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
je 0x43aaa9
mov eax, str.W764
neg eax
sbb eax, eax
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x598], eax
jne 0x43a5db
push 0x80004005
call fcn.00405b70
xor ecx, ecx
jne 0x43a5b8
xor edx, edx
jne 0x43a5df
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x59c], eax
push str.W764
mov ecx, dword [ebp - 0x59c]
push ecx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0
je 0x43a680
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x40]
sub edx, 0x10
mov dword [ebp - 0x5a4], edx
mov ecx, dword [ebp - 0x5a4]
call fcn.004029d0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3c]
sub eax, 0x10
mov dword [ebp - 0x5a8], eax
mov ecx, dword [ebp - 0x5a8]
call fcn.004029d0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
sub ecx, 0x10
mov dword [ebp - 0x5ac], ecx
mov ecx, dword [ebp - 0x5ac]
call fcn.004029d0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
sub edx, 0x10
mov dword [ebp - 0x5b0], edx
mov ecx, dword [ebp - 0x5b0]
call fcn.004029d0
jmp 0x4390cf
mov eax, dword [ebp - 0x9bc]
mov dword [eax + 0xd4], 1
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x5b8], ecx
push 0x2e
mov edx, dword [ebp - 0x5b8]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
jne 0x43a6c5
mov dword [ebp - 0xa00], 0xffffffff
jmp 0x43a6d6
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0xa00], eax
mov ecx, dword [ebp - 0xa00]
sub ecx, 4
push ecx
lea edx, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x5bc], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x5c4], edx
push 0x2e
mov eax, dword [ebp - 0x5c4]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
jne 0x43a731
mov dword [ebp - 0xa04], 0xffffffff
jmp 0x43a742
mov ecx, dword [ebp - 0x5c0]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0xa04], ecx
mov edx, dword [ebp - 0x5bc]
sub edx, dword [ebp - 0xa04]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x68]
push eax
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x27
push 0x80
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x1bc]
call fcn.00412370
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x5cc], eax
mov edx, dword [ebp - 0x5cc]
mov eax, dword [edx]
mov dword [ebp - 0x5d0], eax
mov ecx, dword [ebp - 0x5d0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1c0]
sub edx, 0x10
mov dword [ebp - 0x5d4], edx
mov ecx, dword [ebp - 0x5d4]
call fcn.004029d0
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x1bc]
sub eax, 0x10
mov dword [ebp - 0x5d8], eax
mov ecx, dword [ebp - 0x5d8]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x1c4]
call fcn.00412370
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1c4]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x1c8]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x5e0], eax
mov ecx, dword [ebp - 0x5e0]
mov edx, dword [ecx]
mov dword [ebp - 0x5e4], edx
mov eax, dword [ebp - 0x5e4]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x1c8]
sub edx, 0x10
mov dword [ebp - 0x5e8], edx
mov ecx, dword [ebp - 0x5e8]
call fcn.004029d0
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x1c4]
sub eax, 0x10
mov dword [ebp - 0x5ec], eax
mov ecx, dword [ebp - 0x5ec]
call fcn.004029d0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x5f0], ecx
push 0
mov edx, dword [ebp - 0x5f0]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x1d0]
call fcn.00412370
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x1d4]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x5f8], eax
mov ecx, dword [ebp - 0x5f8]
mov edx, dword [ecx]
mov dword [ebp - 0x5fc], edx
mov eax, dword [ebp - 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1c9], al
mov ecx, dword [ebp - 0x1d4]
sub ecx, 0x10
mov dword [ebp - 0x600], ecx
mov ecx, dword [ebp - 0x600]
call fcn.004029d0
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x1d0]
sub edx, 0x10
mov dword [ebp - 0x604], edx
mov ecx, dword [ebp - 0x604]
call fcn.004029d0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x43a9e2
push 0x4d33a8
lea ecx, [ebp - 0x1d8]
call fcn.00412370
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x1d8]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x1dc]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x60c], eax
mov ecx, dword [ebp - 0x60c]
mov edx, dword [ecx]
mov dword [ebp - 0x610], edx
push 4
push 0
mov eax, dword [ebp - 0x610]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x1dc]
sub ecx, 0x10
mov dword [ebp - 0x614], ecx
mov ecx, dword [ebp - 0x614]
call fcn.004029d0
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x1d8]
sub edx, 0x10
mov dword [ebp - 0x618], edx
mov ecx, dword [ebp - 0x618]
call fcn.004029d0
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x68]
sub eax, 0x10
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp - 0x61c]
call fcn.004029d0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x70]
sub ecx, 0x10
mov dword [ebp - 0x620], ecx
mov ecx, dword [ebp - 0x620]
call fcn.004029d0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x6c]
sub edx, 0x10
mov dword [ebp - 0x624], edx
mov ecx, dword [ebp - 0x624]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40]
sub eax, 0x10
mov dword [ebp - 0x628], eax
mov ecx, dword [ebp - 0x628]
call fcn.004029d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x62c], ecx
mov ecx, dword [ebp - 0x62c]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x630], edx
mov ecx, dword [ebp - 0x630]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x634], eax
mov ecx, dword [ebp - 0x634]
call fcn.004029d0
jmp 0x4390cf
push str.WINDOWS10
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
je 0x43afba
mov eax, str.W864
neg eax
sbb eax, eax
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x648], eax
jne 0x43aaf1
push 0x80004005
call fcn.00405b70
xor ecx, ecx
jne 0x43aace
xor edx, edx
jne 0x43aaf5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x64c], eax
push str.W864
mov ecx, dword [ebp - 0x64c]
push ecx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
je 0x43ab96
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x40]
sub edx, 0x10
mov dword [ebp - 0x654], edx
mov ecx, dword [ebp - 0x654]
call fcn.004029d0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3c]
sub eax, 0x10
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x658]
call fcn.004029d0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
sub ecx, 0x10
mov dword [ebp - 0x65c], ecx
mov ecx, dword [ebp - 0x65c]
call fcn.004029d0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
sub edx, 0x10
mov dword [ebp - 0x660], edx
mov ecx, dword [ebp - 0x660]
call fcn.004029d0
jmp 0x4390cf
mov eax, dword [ebp - 0x9bc]
mov dword [eax + 0xd4], 1
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x668], ecx
push 0x2e
mov edx, dword [ebp - 0x668]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jne 0x43abdb
mov dword [ebp - 0xa08], 0xffffffff
jmp 0x43abec
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0xa08], eax
mov ecx, dword [ebp - 0xa08]
sub ecx, 4
push ecx
lea edx, [ebp - 0x78]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x66c], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x674], edx
push 0x2e
mov eax, dword [ebp - 0x674]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
jne 0x43ac47
mov dword [ebp - 0xa0c], 0xffffffff
jmp 0x43ac58
mov ecx, dword [ebp - 0x670]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0xa0c], ecx
mov edx, dword [ebp - 0x66c]
sub edx, dword [ebp - 0xa0c]
push edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x74]
push eax
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x2e
push 0x80
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x1e0]
call fcn.00412370
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x1e0]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x1e4]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x67c], eax
mov edx, dword [ebp - 0x67c]
mov eax, dword [edx]
mov dword [ebp - 0x680], eax
mov ecx, dword [ebp - 0x680]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1e4]
sub edx, 0x10
mov dword [ebp - 0x684], edx
mov ecx, dword [ebp - 0x684]
call fcn.004029d0
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x1e0]
sub eax, 0x10
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x1e8]
call fcn.00412370
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x1e8]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x1ec]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x690], eax
mov ecx, dword [ebp - 0x690]
mov edx, dword [ecx]
mov dword [ebp - 0x694], edx
mov eax, dword [ebp - 0x694]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x1ec]
sub edx, 0x10
mov dword [ebp - 0x698], edx
mov ecx, dword [ebp - 0x698]
call fcn.004029d0
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x1e8]
sub eax, 0x10
mov dword [ebp - 0x69c], eax
mov ecx, dword [ebp - 0x69c]
call fcn.004029d0
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x6a0], ecx
push 0
mov edx, dword [ebp - 0x6a0]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x1f4]
call fcn.00412370
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1f4]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x1f8]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x6a8], eax
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x6ac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1ed], al
mov ecx, dword [ebp - 0x1f8]
sub ecx, 0x10
mov dword [ebp - 0x6b0], ecx
mov ecx, dword [ebp - 0x6b0]
call fcn.004029d0
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x1f4]
sub edx, 0x10
mov dword [ebp - 0x6b4], edx
mov ecx, dword [ebp - 0x6b4]
call fcn.004029d0
movzx eax, byte [ebp - 0x1ed]
test eax, eax
je 0x43aef8
push 0x4d33a8
lea ecx, [ebp - 0x1fc]
call fcn.00412370
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x1fc]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x6bc], eax
mov ecx, dword [ebp - 0x6bc]
mov edx, dword [ecx]
mov dword [ebp - 0x6c0], edx
push 4
push 0
mov eax, dword [ebp - 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x200]
sub ecx, 0x10
mov dword [ebp - 0x6c4], ecx
mov ecx, dword [ebp - 0x6c4]
call fcn.004029d0
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x1fc]
sub edx, 0x10
mov dword [ebp - 0x6c8], edx
mov ecx, dword [ebp - 0x6c8]
call fcn.004029d0
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x74]
sub eax, 0x10
mov dword [ebp - 0x6cc], eax
mov ecx, dword [ebp - 0x6cc]
call fcn.004029d0
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x7c]
sub ecx, 0x10
mov dword [ebp - 0x6d0], ecx
mov ecx, dword [ebp - 0x6d0]
call fcn.004029d0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x78]
sub edx, 0x10
mov dword [ebp - 0x6d4], edx
mov ecx, dword [ebp - 0x6d4]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40]
sub eax, 0x10
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x6d8]
call fcn.004029d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x6dc], ecx
mov ecx, dword [ebp - 0x6dc]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x6e0], edx
mov ecx, dword [ebp - 0x6e0]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x6e4], eax
mov ecx, dword [ebp - 0x6e4]
call fcn.004029d0
jmp 0x4390cf
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x40]
sub ecx, 0x10
mov dword [ebp - 0x6e8], ecx
mov ecx, dword [ebp - 0x6e8]
call fcn.004029d0
jmp 0x43c682
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x6f0], edx
push 0x2e
mov eax, dword [ebp - 0x6f0]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0
jne 0x43b00f
mov dword [ebp - 0xa10], 0xffffffff
jmp 0x43b020
mov ecx, dword [ebp - 0x6ec]
sub ecx, dword [ebp - 0x3c]
sar ecx, 1
mov dword [ebp - 0xa10], ecx
push 2
mov edx, dword [ebp - 0xa10]
sub edx, 2
push edx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004250f0
mov byte [ebp - 4], 0x33
push str.WINXP
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
jne 0x43b081
push str.WINSVR2003
mov eax, dword [ebp - 0x9bc]
add eax, 0xd0
push eax
call fcn.00444f00
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43b59f
mov edx, 0x4da8f4
neg edx
sbb edx, edx
neg edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x714], edx
jne 0x43b0a4
push 0x80004005
call fcn.00405b70
xor eax, eax
jne 0x43b081
xor ecx, ecx
jne 0x43b0a8
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x718], edx
push 0x4da8f4
mov eax, dword [ebp - 0x718]
push eax
call fcn.00494296
add esp, 8
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
je 0x43b149
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x80]
sub ecx, 0x10
mov dword [ebp - 0x720], ecx
mov ecx, dword [ebp - 0x720]
call fcn.004029d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3c]
sub edx, 0x10
mov dword [ebp - 0x724], edx
mov ecx, dword [ebp - 0x724]
call fcn.004029d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
sub eax, 0x10
mov dword [ebp - 0x728], eax
mov ecx, dword [ebp - 0x728]
call fcn.004029d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
sub ecx, 0x10
mov dword [ebp - 0x72c], ecx
mov ecx, dword [ebp - 0x72c]
call fcn.004029d0
jmp 0x4390cf
mov edx, dword [ebp - 0x9bc]
mov dword [edx + 0xd4], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x734], eax
push 0x2e
mov ecx, dword [ebp - 0x734]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
jne 0x43b18e
mov dword [ebp - 0xa14], 0xffffffff
jmp 0x43b19f
mov edx, dword [ebp - 0x730]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0xa14], edx
mov eax, dword [ebp - 0xa14]
sub eax, 2
push eax
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x34]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x738], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x740], ecx
push 0x2e
mov edx, dword [ebp - 0x740]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0
jne 0x43b1fd
mov dword [ebp - 0xa18], 0xffffffff
jmp 0x43b20e
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0xa18], eax
mov ecx, dword [ebp - 0x738]
sub ecx, dword [ebp - 0xa18]
push ecx
lea edx, [ebp - 0x8c]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x36
push 0x80
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x204]
call fcn.00412370
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x748], eax
mov ecx, dword [ebp - 0x748]
mov edx, dword [ecx]
mov dword [ebp - 0x74c], edx
mov eax, dword [ebp - 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x208]
sub ecx, 0x10
mov dword [ebp - 0x750], ecx
mov ecx, dword [ebp - 0x750]
call fcn.004029d0
mov byte [ebp - 4], 0x36
mov edx, dword [ebp - 0x204]
sub edx, 0x10
mov dword [ebp - 0x754], edx
mov ecx, dword [ebp - 0x754]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x20c]
call fcn.00412370
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
mov ecx, dword [eax]
mov dword [ebp - 0x760], ecx
mov edx, dword [ebp - 0x760]
push edx
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x210]
sub ecx, 0x10
mov dword [ebp - 0x764], ecx
mov ecx, dword [ebp - 0x764]
call fcn.004029d0
mov byte [ebp - 4], 0x36
mov edx, dword [ebp - 0x20c]
sub edx, 0x10
mov dword [ebp - 0x768], edx
mov ecx, dword [ebp - 0x768]
call fcn.004029d0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x76c], eax
push 0
mov ecx, dword [ebp - 0x76c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x218]
call fcn.00412370
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x21c]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
mov ecx, dword [eax]
mov dword [ebp - 0x778], ecx
mov edx, dword [ebp - 0x778]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x211], al
mov eax, dword [ebp - 0x21c]
sub eax, 0x10
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
call fcn.004029d0
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x218]
sub ecx, 0x10
mov dword [ebp - 0x780], ecx
mov ecx, dword [ebp - 0x780]
call fcn.004029d0
movzx edx, byte [ebp - 0x211]
test edx, edx
je 0x43b4cf
push 0x4d33a8
lea ecx, [ebp - 0x220]
call fcn.00412370
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x788]
mov ecx, dword [eax]
mov dword [ebp - 0x78c], ecx
push 4
push 0
mov edx, dword [ebp - 0x78c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x224]
sub eax, 0x10
mov dword [ebp - 0x790], eax
mov ecx, dword [ebp - 0x790]
call fcn.004029d0
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x220]
sub ecx, 0x10
mov dword [ebp - 0x794], ecx
mov ecx, dword [ebp - 0x794]
call fcn.004029d0
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0x84]
sub edx, 0x10
mov dword [ebp - 0x798], edx
mov ecx, dword [ebp - 0x798]
call fcn.004029d0
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x8c]
sub eax, 0x10
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x79c]
call fcn.004029d0
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x88]
sub ecx, 0x10
mov dword [ebp - 0x7a0], ecx
mov ecx, dword [ebp - 0x7a0]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x80]
sub edx, 0x10
mov dword [ebp - 0x7a4], edx
mov ecx, dword [ebp - 0x7a4]
call fcn.004029d0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3c]
sub eax, 0x10
mov dword [ebp - 0x7a8], eax
mov ecx, dword [ebp - 0x7a8]
call fcn.004029d0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
sub ecx, 0x10
mov dword [ebp - 0x7ac], ecx
mov ecx, dword [ebp - 0x7ac]
call fcn.004029d0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
sub edx, 0x10
mov dword [ebp - 0x7b0], edx
mov ecx, dword [ebp - 0x7b0]
call fcn.004029d0
jmp 0x4390cf
push str.WIN2000
mov eax, dword [ebp - 0x9bc]
add eax, 0xd0
push eax
call fcn.00444f00
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x43b5e4
push str.WINNT4
mov edx, dword [ebp - 0x9bc]
add edx, 0xd0
push edx
call fcn.00444f00
add esp, 8
movzx eax, al
test eax, eax
je 0x43baf3
mov ecx, 0x4da8ec
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x7d4], ecx
jne 0x43b607
push 0x80004005
call fcn.00405b70
xor edx, edx
jne 0x43b5e4
xor eax, eax
jne 0x43b60b
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x7d8], ecx
push 0x4da8ec
mov edx, dword [ebp - 0x7d8]
push edx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0
je 0x43b6ac
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x80]
sub eax, 0x10
mov dword [ebp - 0x7e0], eax
mov ecx, dword [ebp - 0x7e0]
call fcn.004029d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10
mov dword [ebp - 0x7e4], ecx
mov ecx, dword [ebp - 0x7e4]
call fcn.004029d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x7e8], edx
mov ecx, dword [ebp - 0x7e8]
call fcn.004029d0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
sub eax, 0x10
mov dword [ebp - 0x7ec], eax
mov ecx, dword [ebp - 0x7ec]
call fcn.004029d0
jmp 0x4390cf
mov ecx, dword [ebp - 0x9bc]
mov dword [ecx + 0xd4], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x7f4], edx
push 0x2e
mov eax, dword [ebp - 0x7f4]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 0
jne 0x43b6f1
mov dword [ebp - 0xa1c], 0xffffffff
jmp 0x43b702
mov ecx, dword [ebp - 0x7f0]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0xa1c], ecx
mov edx, dword [ebp - 0xa1c]
sub edx, 2
push edx
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x7f8], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x800], eax
push 0x2e
mov ecx, dword [ebp - 0x800]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0
jne 0x43b760
mov dword [ebp - 0xa20], 0xffffffff
jmp 0x43b771
mov edx, dword [ebp - 0x7fc]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0xa20], edx
mov eax, dword [ebp - 0x7f8]
sub eax, dword [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x3c
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x3d
push 0x80
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x228]
call fcn.00412370
mov byte [ebp - 4], 0x3e
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x808]
mov ecx, dword [eax]
mov dword [ebp - 0x80c], ecx
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x22c]
sub eax, 0x10
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x810]
call fcn.004029d0
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x228]
sub ecx, 0x10
mov dword [ebp - 0x814], ecx
mov ecx, dword [ebp - 0x814]
call fcn.004029d0
push 0x4d33a8
lea ecx, [ebp - 0x230]
call fcn.00412370
mov byte [ebp - 4], 0x3f
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x81c], eax
mov edx, dword [ebp - 0x81c]
mov eax, dword [edx]
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x820]
push ecx
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x234]
sub eax, 0x10
mov dword [ebp - 0x824], eax
mov ecx, dword [ebp - 0x824]
call fcn.004029d0
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x230]
sub ecx, 0x10
mov dword [ebp - 0x828], ecx
mov ecx, dword [ebp - 0x828]
call fcn.004029d0
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x82c], edx
push 0
mov eax, dword [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x23c]
call fcn.00412370
mov byte [ebp - 4], 0x40
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x834], eax
mov edx, dword [ebp - 0x834]
mov eax, dword [edx]
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x838]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x235], al
mov edx, dword [ebp - 0x240]
sub edx, 0x10
mov dword [ebp - 0x83c], edx
mov ecx, dword [ebp - 0x83c]
call fcn.004029d0
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x23c]
sub eax, 0x10
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
call fcn.004029d0
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
je 0x43ba32
push 0x4d33a8
lea ecx, [ebp - 0x244]
call fcn.00412370
mov byte [ebp - 4], 0x41
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov eax, dword [edx]
mov dword [ebp - 0x84c], eax
push 4
push 0
mov ecx, dword [ebp - 0x84c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 0x248]
sub edx, 0x10
mov dword [ebp - 0x850], edx
mov ecx, dword [ebp - 0x850]
call fcn.004029d0
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x244]
sub eax, 0x10
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x854]
call fcn.004029d0
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x90]
sub ecx, 0x10
mov dword [ebp - 0x858], ecx
mov ecx, dword [ebp - 0x858]
call fcn.004029d0
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0x98]
sub edx, 0x10
mov dword [ebp - 0x85c], edx
mov ecx, dword [ebp - 0x85c]
call fcn.004029d0
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0x94]
sub eax, 0x10
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
call fcn.004029d0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x80]
sub ecx, 0x10
mov dword [ebp - 0x864], ecx
mov ecx, dword [ebp - 0x864]
call fcn.004029d0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3c]
sub edx, 0x10
mov dword [ebp - 0x868], edx
mov ecx, dword [ebp - 0x868]
call fcn.004029d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
sub eax, 0x10
mov dword [ebp - 0x86c], eax
mov ecx, dword [ebp - 0x86c]
call fcn.004029d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.004129d0
jmp 0x4390cf
push str.WINVISTA
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
je 0x43bf15
mov eax, 0x4da8e4
neg eax
sbb eax, eax
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x884], eax
jne 0x43bb3b
push 0x80004005
call fcn.00405b70
xor ecx, ecx
jne 0x43bb18
xor edx, edx
jne 0x43bb3f
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x888], eax
push 0x4da8e4
mov ecx, dword [ebp - 0x888]
push ecx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
je 0x43bba4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.004129d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.004129d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.004129d0
jmp 0x4390cf
mov edx, dword [ebp - 0x9bc]
mov dword [edx + 0xd4], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x8a4], eax
push 0x2e
mov ecx, dword [ebp - 0x8a4]
push ecx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0
jne 0x43bbe9
mov dword [ebp - 0xa24], 0xffffffff
jmp 0x43bbfa
mov edx, dword [ebp - 0x8a0]
sub edx, dword [ebp - 0x34]
sar edx, 1
mov dword [ebp - 0xa24], edx
mov eax, dword [ebp - 0xa24]
sub eax, 2
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x42
mov edx, dword [ebp - 0x34]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x8a8], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x8b0], ecx
push 0x2e
mov edx, dword [ebp - 0x8b0]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0
jne 0x43bc58
mov dword [ebp - 0xa28], 0xffffffff
jmp 0x43bc69
mov eax, dword [ebp - 0x8ac]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0xa28], eax
mov ecx, dword [ebp - 0x8a8]
sub ecx, dword [ebp - 0xa28]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x44
push 0x80
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x24c]
call fcn.00412370
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x250]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x8b8], eax
mov ecx, dword [ebp - 0x8b8]
mov edx, dword [ecx]
mov dword [ebp - 0x8bc], edx
mov eax, dword [ebp - 0x8bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x250]
call fcn.004129d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x24c]
call fcn.004129d0
push 0x4d33a8
lea ecx, [ebp - 0x254]
call fcn.00412370
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x258]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x8cc], eax
mov ecx, dword [ebp - 0x8cc]
mov edx, dword [ecx]
mov dword [ebp - 0x8d0], edx
mov eax, dword [ebp - 0x8d0]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x258]
call fcn.004129d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x254]
call fcn.004129d0
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x8dc], edx
push 0
mov eax, dword [ebp - 0x8dc]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x260]
call fcn.00412370
mov byte [ebp - 4], 0x47
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x8e4], eax
mov edx, dword [ebp - 0x8e4]
mov eax, dword [edx]
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x259], al
lea ecx, [ebp - 0x264]
call fcn.004129d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x260]
call fcn.004129d0
movzx edx, byte [ebp - 0x259]
test edx, edx
je 0x43beae
push 0x4d33a8
lea ecx, [ebp - 0x268]
call fcn.00412370
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x26c]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x8f8]
mov ecx, dword [eax]
mov dword [ebp - 0x8fc], ecx
push 4
push 0
mov edx, dword [ebp - 0x8fc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x26c]
call fcn.004129d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x268]
call fcn.004129d0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x9c]
call fcn.004129d0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xa4]
call fcn.004129d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xa0]
call fcn.004129d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.004129d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.004129d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.004129d0
jmp 0x4390cf
push str.WINDOWS7
mov eax, dword [ebp - 0x9bc]
add eax, 0xd0
push eax
call fcn.00444f00
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x43bf5a
push str.WINDOWS8
mov edx, dword [ebp - 0x9bc]
add edx, 0xd0
push edx
call fcn.00444f00
add esp, 8
movzx eax, al
test eax, eax
je 0x43c345
mov ecx, 0x4da8dc
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x954], ecx
jne 0x43bf7d
push 0x80004005
call fcn.00405b70
xor edx, edx
jne 0x43bf5a
xor eax, eax
jne 0x43bf81
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x958], ecx
push 0x4da8dc
mov edx, dword [ebp - 0x958]
push edx
call fcn.00494296
add esp, 8
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x95c], 0
je 0x43bfe6
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.004129d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.004129d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.004129d0
jmp 0x4390cf
mov eax, dword [ebp - 0x9bc]
mov dword [eax + 0xd4], 1
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x974], ecx
push 0x2e
mov edx, dword [ebp - 0x974]
push edx
call fcn.00494159
add esp, 8
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 0
jne 0x43c02b
mov dword [ebp - 0xa2c], 0xffffffff
jmp 0x43c03c
mov eax, dword [ebp - 0x970]
sub eax, dword [ebp - 0x34]
sar eax, 1
mov dword [ebp - 0xa2c], eax
mov ecx, dword [ebp - 0xa2c]
sub ecx, 2
push ecx
lea edx, [ebp - 0xac]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x978], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x980], edx
push 0x2e
mov eax, dword [ebp - 0x980]
push eax
call fcn.00494159
add esp, 8
mov dword [ebp - 0x97c], eax
cmp dword [ebp - 0x97c], 0
jne 0x43c09a
mov dword [ebp - 0xa30], 0xffffffff
jmp 0x43c0ab
mov ecx, dword [ebp - 0x97c]
sub ecx, dword [ebp - 0x34]
sar ecx, 1
mov dword [ebp - 0xa30], ecx
mov edx, dword [ebp - 0x978]
sub edx, dword [ebp - 0xa30]
push edx
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0xac]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x4b
push 0x80
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x270]
call fcn.00412370
mov byte [ebp - 4], 0x4c
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x274]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x988], eax
mov edx, dword [ebp - 0x988]
mov eax, dword [edx]
mov dword [ebp - 0x98c], eax
mov ecx, dword [ebp - 0x98c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x274]
call fcn.004129d0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x270]
call fcn.004129d0
push 0x4d33a8
lea ecx, [ebp - 0x278]
call fcn.00412370
mov byte [ebp - 4], 0x4d
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x27c]
push ecx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x99c], eax
mov edx, dword [ebp - 0x99c]
mov eax, dword [edx]
mov dword [ebp - 0x9a0], eax
mov ecx, dword [ebp - 0x9a0]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x27c]
call fcn.004129d0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x278]
call fcn.004129d0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x9ac], eax
push 0
mov ecx, dword [ebp - 0x9ac]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x284]
call fcn.00412370
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0x288]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa34], eax
mov ecx, dword [ebp - 0xa34]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x27d], al
lea ecx, [ebp - 0x288]
call fcn.00412420
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x284]
call fcn.00412420
movzx eax, byte [ebp - 0x27d]
test eax, eax
je 0x43c2de
push 0x4d33a8
lea ecx, [ebp - 0x28c]
call fcn.00412370
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x290]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa38], eax
push 4
push 0
mov ecx, dword [ebp - 0xa38]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x290]
call fcn.00412420
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x28c]
call fcn.00412420
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xa8]
call fcn.00412420
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xb0]
call fcn.00412420
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xac]
call fcn.00412420
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00412420
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.00412420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.00412420
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.00412420
jmp 0x4390cf
push str.WINDOWS10
mov ecx, dword [ebp - 0x9bc]
add ecx, 0xd0
push ecx
call fcn.00444f00
add esp, 8
movzx edx, al
test edx, edx
je 0x43c676
push 0x4da8d4
lea ecx, [ebp - 0x80]
call fcn.00425d20
test eax, eax
je 0x43c3b0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00412420
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.00412420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.00412420
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.00412420
jmp 0x4390cf
mov eax, dword [ebp - 0x9bc]
mov dword [eax + 0xd4], 1
push 0x2e
lea ecx, [ebp - 0x34]
call fcn.00444d60
sub eax, 2
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040f0f0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x34]
call fcn.00445140
mov esi, eax
push 0x2e
lea ecx, [ebp - 0x34]
call fcn.00444d60
sub esi, eax
push esi
lea edx, [ebp - 0xbc]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040f040
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.0040f190
add esp, 0xc
mov byte [ebp - 4], 0x52
push 0x80
lea ecx, [ebp - 0xb4]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4d33a8
lea ecx, [ebp - 0x294]
call fcn.00412370
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0x298]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa3c], eax
mov ecx, dword [ebp - 0xa3c]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x298]
call fcn.00412420
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x294]
call fcn.00412420
push 0x4d33a8
lea ecx, [ebp - 0x29c]
call fcn.00412370
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa40], eax
mov ecx, dword [ebp - 0xa40]
call fcn.004450d0
push eax
lea ecx, [ebp - 0xb4]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x2a0]
call fcn.00412420
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x29c]
call fcn.00412420
push 0
lea ecx, [ebp - 0xb4]
call fcn.004450d0
push eax
lea ecx, [ebp - 0x30]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4d33a8
lea ecx, [ebp - 0x2a8]
call fcn.00412370
mov byte [ebp - 4], 0x55
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0x2ac]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa44], eax
mov ecx, dword [ebp - 0xa44]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x2a1], al
lea ecx, [ebp - 0x2ac]
call fcn.00412420
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x2a8]
call fcn.00412420
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x43c614
push 0x4d33a8
lea ecx, [ebp - 0x2b0]
call fcn.00412370
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0x2b4]
push eax
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0xa48], eax
push 4
push 0
mov ecx, dword [ebp - 0xa48]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x2b4]
call fcn.00412420
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x2b0]
call fcn.00412420
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xb4]
call fcn.00412420
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xbc]
call fcn.00412420
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xb8]
call fcn.00412420
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00412420
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.00412420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.00412420
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.00412420
jmp 0x4390cf
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80]
call fcn.00412420
push 0x80
lea ecx, [ebp - 0x34]
call fcn.004450d0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x9bc]
call fcn.00434960
push str.AtlComService.exe
lea ecx, [ebp - 0x3c]
call fcn.00425d20
test eax, eax
jne 0x43c77c
cmp dword [ebp - 0x38], 2
jne 0x43c77c
mov dword [ebp - 0x11c], 0x44
push 0x40
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.004931a0
add esp, 0xc
mov dword [ebp - 0xd0], 0
xor ecx, ecx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], ecx
push 0x4d31a8
lea ecx, [ebp - 0xc0]
call fcn.00412290
mov byte [ebp - 4], 0x57
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0xc0]
call fcn.00444af0
push str.___Service
lea ecx, [ebp - 0xc0]
call fcn.00444b30
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.004450d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc0]
call fcn.00412420
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
call fcn.00412420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.00412420
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.00412420
jmp 0x4390cf
lea ecx, [ebp - 0x24]
call fcn.00452139
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00412420
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00452641
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00412420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00412420
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8