Function at 0x412500
Capabilities:
Copy file
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4666e8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x146c
call fcn.0044f600
mov eax, dword [0x482ad0]
xor eax, esp
mov dword [esp + 0x1468], eax
push ebx
push esi
push edi
mov eax, dword [0x482ad0]
xor eax, esp
push eax
lea eax, [esp + 0x1480]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
push eax
mov edi, ecx
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ebx, dword [0x4864ac]
cmp ebx, 1
jle 0x4128ed
mov edi, dword [0x4864b4]
mov esi, dword [edi + 4]
mov ecx, 0x4727d0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4125a7
test dx, dx
je 0x4125a3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4125a7
add eax, 4
add ecx, 4
test dx, dx
jne 0x412581
xor eax, eax
jmp 0x4125ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41278c
cmp ebx, 5
jne 0x412c5d
mov eax, dword [edi + 8]
lea edx, [esp + 0x474]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4125d0
lea ecx, [esp + 0x474]
push 0x4727d8
push ecx
xor esi, esi
call fcn.0044b276
lea edx, [esp + 0x47c]
add esp, 8
cmp eax, edx
jne 0x412613
lea eax, [esp + 0x478]
push eax
call fcn.0044b255
add esp, 4
mov esi, eax
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41264a
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push esi
call edi
test eax, eax
jne 0x41264a
push 2
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7530
push esi
call edi
mov ecx, dword [0x4864b4]
mov edx, dword [ecx + 0xc]
push edx
lea ecx, [esp + 0x24]
call fcn.00409150
mov dword [esp + 0x1488], 0
mov eax, dword [0x4864b4]
mov ecx, dword [eax + 0x10]
push ecx
lea ecx, [esp + 0x20]
call fcn.00409150
mov byte [esp + 0x1488], 1
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e]
push edx
mov esi, eax
mov word [esp + 0x70], cx
call fcn.0044cd10
add esp, 0xc
push 0x104
lea eax, [esp + 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0041bb26
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4126e3
push 0x80004005
call fcn.00403120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x1488], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x68]
push edx
push eax
lea eax, [esp + 0x1c]
push str.__r__p_d___s____s_
push eax
call fcn.004031f0
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
add esp, 0x14
push ecx
call fcn.00413db0
lea eax, [edi - 0x10]
mov byte [esp + 0x1488], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412750
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1488], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412778
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1488], 0xffffffff
mov eax, dword [esp + 0x20]
jmp 0x4128cd
mov ecx, 0x472808
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4127b9
test dx, dx
je 0x4127b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4127b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x412793
xor eax, eax
jmp 0x4127be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x412c5d
cmp ebx, 5
jne 0x412c5d
mov eax, dword [edi + 8]
lea edx, [esp + 0xc74]
sub edx, eax
jmp 0x4127e0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4127e0
lea ecx, [esp + 0xc74]
push 0x4727d8
push ecx
xor esi, esi
call fcn.0044b276
lea edx, [esp + 0xc7c]
add esp, 8
cmp eax, edx
jne 0x412823
lea eax, [esp + 0xc78]
push eax
call fcn.0044b255
add esp, 4
mov esi, eax
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41285a
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push esi
call edi
test eax, eax
jne 0x41285a
push 2
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7530
push esi
call edi
mov ecx, dword [0x4864b4]
mov edx, dword [ecx + 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00409150
mov dword [esp + 0x1488], 3
mov eax, dword [0x4864b4]
mov ecx, dword [eax + 0x10]
push ecx
lea ecx, [esp + 0x14]
call fcn.00409150
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1488], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412c5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
jmp 0x412c58
mov ecx, edi
call fcn.004330a4
xor esi, esi
push esi
call fcn.00433b69
test eax, eax
jne 0x41290f
push 0xffffffffffffffff
push esi
push 0x68
call fcn.0041b749
jmp 0x412c5d
call fcn.00433dc0
test eax, eax
jne 0x412927
push 0xffffffffffffffff
push esi
push 0x64
call fcn.0041b749
jmp 0x412c5d
push esi
call fcn.0042b51c
add esp, 4
push str.uuzu.com
mov ecx, edi
call fcn.00433e54
push esi
lea ecx, [esp + 0x30]
push ecx
lea edx, [edi + 0xe4]
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call sub.gdiplus.dll_GdiplusStartup
push edi
call fcn.004134e0
mov eax, dword [edi + 0xbc]
mov esi, dword [eax]
mov eax, dword [edi + 0xa4]
mov ebx, dword [0x4871bc]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x412990
cmp eax, dword [0x4871a4]
je 0x412995
call fcn.0044aa49
cmp esi, ebx
je 0x4129aa
lea esi, [esp + 0x14]
call fcn.00401900
mov eax, dword [eax]
push eax
call fcn.00413070
push 0x90
call fcn.00419661
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x1488], 4
test eax, eax
je 0x4129e7
push 0x472be8
push 0x471470
push 0x472af8
push 0x81
mov ecx, eax
call fcn.004340ff
jmp 0x4129e9
xor eax, eax
or ebx, 0xffffffff
mov dword [esp + 0x1488], ebx
test eax, eax
je 0x412c5d
push eax
mov ecx, edi
call fcn.0043449a
push 0x200
call fcn.00419661
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x1488], 5
test eax, eax
je 0x412a2d
push eax
call fcn.0040e4d0
mov esi, eax
jmp 0x412a2f
xor esi, esi
mov dword [esp + 0x1488], ebx
test esi, esi
je 0x412c5d
mov eax, dword [esi]
mov edx, dword [eax + 0x140]
push 0
push 0
push 0xcf8000
push 0x80
mov ecx, esi
call edx
test eax, eax
je 0x412c52
push str.game
mov eax, edi
call fcn.00413360
test eax, eax
je 0x412a8f
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 4]
mov edx, dword [eax + 8]
sub edx, dword [eax]
push 0x86
push ecx
push edx
push 0
push 0
push 0
mov ecx, esi
call fcn.0041ca89
lea ecx, [esp + 0x3c]
mov dword [edi + 0x20], esi
call fcn.004336fa
lea eax, [esp + 0x3c]
mov ebx, 6
push eax
mov ecx, edi
mov dword [esp + 0x148c], ebx
call fcn.00432cd5
call fcn.0041c57b
mov eax, dword [eax + 0xc]
push 0x104
lea ecx, [esp + 0x270]
push ecx
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x8c
call fcn.00419661
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x1488], 7
test eax, eax
je 0x412af6
push eax
call fcn.00401010
jmp 0x412af8
xor eax, eax
mov byte [esp + 0x1488], bl
mov dword [edi + 0x11c], eax
mov edx, dword [eax]
push esi
mov ecx, eax
mov eax, dword [edx + 0x13c]
push 0x82
call eax
mov ecx, dword [edi + 0x11c]
push 0
push 0xb0000
push 0
call fcn.0041c6cb
lea ecx, [esp + 0x26c]
push ecx
mov ecx, dword [edi + 0x11c]
call fcn.0041c723
push 0xc8
call fcn.00419661
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x1488], 8
test eax, eax
je 0x412b63
push eax
call fcn.0040cf80
jmp 0x412b65
xor eax, eax
mov byte [esp + 0x1488], bl
mov ecx, dword [edi + 0x11c]
mov dword [edi + 0x120], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x13c]
push ecx
push 0x83
mov ecx, eax
call edx
push 0xc0
call fcn.00419661
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x1488], 9
test eax, eax
je 0x412baf
push eax
call fcn.004149c0
jmp 0x412bb1
xor eax, eax
mov byte [esp + 0x1488], bl
mov ecx, dword [edi + 0x120]
mov dword [edi + 0x124], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x13c]
push ecx
push 0xfc
mov ecx, eax
call edx
mov ecx, dword [edi + 0x11c]
push 5
call fcn.0041c7ee
mov ecx, dword [edi + 0x120]
push 5
call fcn.0041c7ee
mov ecx, dword [edi + 0x124]
push 5
call fcn.0041c7ee
mov ecx, dword [edi + 0x11c]
push 0
call fcn.0041f7e5
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.0043431c
test eax, eax
jne 0x412c30
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1488], 0xffffffff
call fcn.0043373e
jmp 0x412c5d
mov ebx, edi
call fcn.00413930
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1488], 0xffffffff
call fcn.0043373e
mov eax, 1
jmp 0x412c5f
mov edx, dword [esi]
push 1
mov ecx, esi
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1468]
xor ecx, esp
call fcn.0044a4f0
mov esp, ebp
pop ebp
ret