Function at 0x40b420
Capabilities:
Check if file exists
Copy file
Create thread
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4538c6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x7ae4
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x7ae0], eax
push ebx
push esi
push edi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x7af8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov edi, edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], 0x104
mov byte [esp + 0x17], 0
mov dword [ebx], 0
cmp eax, 0x100
ja case.0x40b4a5.7
je 0x40c713
dec eax
cmp eax, 0x15
ja case.0x40b4a5.7
jmp dword [eax*4 + 0x40c7c4]
push str.Nhan_duoc_lenh_lay_danh_sach_tien_trinh
call fcn.00404c20
mov eax, dword [0x49671c]
add esp, 4
mov dword [edi], 1
mov dword [edi + 4], 0
mov dword [ebx], 0xc
test eax, eax
je 0x40b524
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1ce0]
call fcn.00414100
add esp, 4
test eax, eax
je 0x40b524
mov esi, dword [esp + 0x1c]
push esi
push str.MP_GET_LIST_PROCESS:Number_of_process_:__d
call fcn.00404c20
add esp, 8
test esi, esi
je 0x40b51f
add esi, esi
add esi, esi
push esi
lea edx, [esp + 0x1ce0]
push edx
lea eax, [edi + 8]
push eax
call fcn.00441730
add esp, 0xc
mov dword [edi + 4], esi
mov ecx, dword [edi + 4]
add dword [ebx], ecx
push str.End_MP_GET_LIST_PROCESS
call fcn.00404c20
jmp 0x40c79c
push str.Start_MP_QUERY_PROCESS_PATH_message
call fcn.00404c20
mov dword [edi], 5
mov edx, dword [esi + 0xc]
add esp, 4
push edx
push str.process_id_:__d
call fcn.00404c20
mov eax, dword [esi + 0xc]
add esp, 8
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40b5f6
push str.hProcess_ok
call fcn.00404c20
mov edx, dword [esp + 0x24]
add esp, 4
push 0x104
lea ecx, [esp + 0x18b8]
push ecx
push 0
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40b5d2
mov eax, dword [esp + 0x20]
mov dword [ebx], 0xc
mov dword [edi + 4], 0x208
add dword [ebx], 0x208
add edi, 8
mov ecx, 0x82
lea esi, [esp + 0x18b4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40b4a5.7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileNameExW_return_FALSE__error_code_:__d
call fcn.00404c20
mov eax, dword [esp + 0x28]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40b4a5.7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_return_FALSE__error_code_:__d
call fcn.00404c20
add esp, 8
jmp case.0x40b4a5.7
push str.Start_MP_PROCESS_INJECTED_SAFERUN_ENGINE_message
call fcn.00404c20
mov dword [edi], 9
mov ecx, dword [esi + 0xc]
add esp, 4
push ecx
call fcn.0040c930
mov dword [ebx], 0xc
add esp, 4
mov dword [edi + 4], 4
add dword [ebx], 4
push str.End_MP_PROCESS_INJECTED_SAFERUN_ENGINE_message
mov dword [edi + 8], eax
call fcn.00404c20
jmp 0x40c79c
push str.Start_MP_INJECT_SAFERUN_ENGINE_message
call fcn.00404c20
mov dword [edi], 0x10
mov edx, dword [esi + 0xc]
add esp, 4
push edx
push str.Process_ID_:__d
call fcn.00404c20
add esp, 8
lea eax, [esp + 0x2c]
push eax
push 1
push 0
push str.SOFTWAREBkavSaferun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b6c9
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x20e0]
push edx
push eax
push eax
mov eax, dword [esp + 0x3c]
push str.InstallDirectory
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov bl, 1
test eax, eax
jne 0x40b6ba
mov bl, byte [esp + 0x17]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b6e3
push str.C:Program_FilesBkavProSafeRun
lea edx, [esp + 0x20e0]
push 0x104
push edx
call fcn.0043efc3
add esp, 0xc
lea eax, [esp + 0x20dc]
push eax
push str.szDirectorySafeRun_:__s
call fcn.00404c20
mov ecx, dword [esi + 0xc]
add esp, 8
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b7c6
push 0x103
lea edx, [esp + 0x20e0]
push edx
lea eax, [esp + 0x16b4]
push 0x104
push eax
call fcn.0043e9ba
add esp, 0x10
test eax, eax
jne case.0x40b4a5.7
push 0x103
push 0x4576d8
lea ecx, [esp + 0x16b4]
push 0x104
push ecx
call fcn.0043e4d6
add esp, 0x10
test eax, eax
jne case.0x40b4a5.7
push 0x103
push str.BkavSafeRunEngine.dll
lea edx, [esp + 0x16b4]
push 0x104
push edx
call fcn.0043e4d6
add esp, 0x10
test eax, eax
jne case.0x40b4a5.7
lea eax, [esp + 0x16ac]
push eax
push str.szEngineDll_:__s
call fcn.00404c20
add esp, 8
lea edx, [esp + 0x16ac]
mov ecx, esi
call fcn.0040a240
test eax, eax
je 0x40b7bf
push str.bInject_Bkav_SafeRun_Engine_Dll_Successful
call fcn.00404c20
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.End_MP_INJECT_SAFERUN_ENGINE_message
call fcn.00404c20
jmp 0x40c79c
push str.Start_MP_QUERY_PROCESS_ID_message
call fcn.00404c20
mov eax, dword [0x49671c]
add esp, 4
mov dword [edi], 6
mov dword [ebx], 0xc
mov dword [esp + 0x18], 0
test eax, eax
je 0x40b962
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1ce0]
call fcn.00414100
add esp, 4
test eax, eax
je 0x40b962
mov edx, dword [esp + 0x1c]
push edx
push str.GetListProcessOfTree_return_TRUE__Number_of_process_:__d
call fcn.00404c20
push 0x208
add esi, 8
push esi
lea eax, [esp + 0x18c4]
push 0x208
push eax
call fcn.0043e615
lea ecx, [esp + 0x18cc]
push ecx
push str.pszProcPath_:__s
call fcn.00404c20
add esp, 0x20
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
jle 0x40b962
mov edx, dword [esp + 0x20]
mov eax, dword [esp + edx*4 + 0x1cdc]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b94f
push 0x104
lea eax, [esp + 0x16b0]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40b934
lea ecx, [esp + 0x16ac]
push ecx
push str.szProcessPath_:__s
call fcn.00404c20
lea eax, [esp + 0x16b4]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b8d0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jbe 0x40b8ed
mov eax, 0x104
jmp 0x40b906
lea eax, [esp + 0x16ac]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b8f7
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18b8]
push edx
lea eax, [esp + 0x16b4]
push eax
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x40b948
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + ecx*4 + 0x1cdc]
mov dword [esp + 0x18], eax
jmp 0x40b948
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Co_loi_query_path_process:__d
call fcn.00404c20
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
inc eax
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
jl 0x40b871
mov edx, dword [esp + 0x18]
mov dword [edi + 4], 4
add dword [ebx], 4
mov dword [edi + 8], edx
jmp case.0x40b4a5.7
push str.Start_MP_ADD_PROCESS_message
call fcn.00404c20
add esi, 8
xor ecx, ecx
add esp, 4
cmp dword [esi + 0x210], ecx
je case.0x40b4a5.7
mov eax, dword [0x49671c]
cmp eax, ecx
jne 0x40b9cc
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], ecx
mov dword [esp + 0x250], ecx
mov byte [esp + 0x254], 1
call fcn.00412fe0
add esp, 4
mov dword [0x49671c], eax
push 4
push esi
push eax
call fcn.00413050
mov ecx, dword [esi + 0x210]
mov edx, dword [esi + 4]
add esp, 0xc
push ecx
lea edi, [esi + 8]
push edi
mov ebx, eax
mov eax, dword [esi]
push edx
push eax
push str.ParentProcessId_:__d__ChildrenProcessId_:__d__pszFilePath_:__s__checksum_:__16x
mov dword [esp + 0x2c], ebx
call fcn.00404c20
mov eax, edi
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ba02
sub eax, edx
sar eax, 1
je case.0x40b4a5.7
test ebx, ebx
jne 0x40ba28
mov eax, dword [0x49671c]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ba8d
push 8
call fcn.0043ef53
mov ebx, eax
mov eax, dword [esi + 4]
add esp, 4
push eax
push str.waitParam.dwProcessID_:__d
mov dword [ebx], eax
call fcn.00404c20
add esp, 8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 4], eax
movzx ecx, byte [esi + 0x214]
mov edx, dword [esi + 0x210]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, edi
mov edi, dword [esp + 0x24]
call fcn.004131f0
add esp, 0xc
push 0
push 0
push ebx
push 0x40c820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x496730]
test eax, eax
je case.0x40b4a5.7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x496730]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp case.0x40b4a5.7
push str.Start_MP_SAFERUN_SAVE_AS_message
call fcn.00404c20
add esp, 4
mov dword [esp + 0x28], vtable.UltiFunction.0
mov dword [esp + 0x7b00], 0
mov ecx, dword [esi + 0xc]
lea edi, [esi + 0xc]
push ecx
push str.coupleProcess__ParentProcessId_:__d
call fcn.00404c20
mov edx, dword [0x49671c]
push 4
push edi
push edx
call fcn.00413050
add esp, 0x14
test eax, eax
jne 0x40bb08
push str.pSubTree_is_NULL
call fcn.00404c20
jmp 0x40c79c
mov ebx, dword [eax]
movzx edi, byte [ebx + 0x216]
push edi
push str.nSaveAsFile_:__d
call fcn.00404c20
add esp, 8
cmp edi, 8
ja 0x40bb4e
imul edi, edi, 0x208
push 0x103
add esi, 0x10
push esi
lea eax, [edi + ebx + 0x21c]
push 0x104
push eax
call fcn.0043e9ba
add esp, 0x10
inc byte [ebx + 0x216]
push str.End_MP_SAFERUN_SAVE_AS_message
call fcn.00404c20
jmp 0x40c79c
cmp dword [0x496738], 0
jne case.0x40b4a5.7
push 0x208
add esi, 8
push esi
lea ecx, [esp + 0x18bc]
push 0x208
push ecx
call fcn.0043e615
lea edx, [esp + 0x18c4]
push edx
push str.pszProcPath_:__s
call fcn.00404c20
mov esi, dword [0x49671c]
add esp, 0x18
test esi, esi
je case.0x40b4a5.7
push str.Start_IsFilePathExistEx
call fcn.00404c20
lea eax, [esp + 0x18b8]
add esp, 4
push eax
mov eax, esi
call fcn.00414190
mov dword [edi], 0x12
mov dword [ebx], 0xc
add esp, 4
mov dword [edi + 4], 4
add dword [ebx], 4
mov dword [edi + 8], eax
jmp case.0x40b4a5.7
push str.Start_MP_SAFERUN_WRITE_TEMP_PATH_VALUE
call fcn.00404c20
add esp, 4
push 0x208
add esi, 8
push esi
lea ecx, [esp + 0x16b4]
push 0x208
push ecx
call fcn.0043e615
push 0x103
push 0x47afa8
lea edx, [esp + 0x16c4]
push 0x104
push edx
call fcn.0043e4d6
lea eax, [esp + 0x16cc]
push eax
push str.pszProcPath_:__s
call fcn.00404c20
add esp, 0x28
lea ecx, [esp + 0x16ac]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x18]
push edx
push 0xf003f
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [eax + eax + 2]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40bc74
xor esi, esi
jmp 0x40bc98
mov ecx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x16b0]
push eax
push 1
push 0
push str.szTempDirectory
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40bcae
push str.bSetValue_is_TRUE
jmp 0x40bcb3
push str.bSetValue_is_FALSE
call fcn.00404c20
mov dword [edi], 0x13
mov dword [ebx], 0xc
add esp, 4
mov dword [edi + 4], 4
add dword [ebx], 4
push str.End_MP_SAFERUN_WRITE_TEMP_PATH_VALUE
mov dword [edi + 8], esi
call fcn.00404c20
jmp 0x40c79c
push str.Start_MP_SAFERUN_WRITE_SAFERUN_BACKUP
call fcn.00404c20
add esp, 4
push 0x21c
add esi, 8
push esi
lea eax, [esp + 0x18bc]
push 0x21c
push eax
call fcn.0043e615
lea ecx, [esp + 0x18c4]
push ecx
push str.pszProcPath_:__s
call fcn.00404c20
add esp, 0x18
lea edx, [esp + 0x18b4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40bd56
xor esi, esi
jmp 0x40bd7a
mov edx, dword [esp + 0x18]
push esi
lea ecx, [esp + 0x18b8]
push ecx
push 1
push 0
push str.szSafeRunBackup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40bd90
push str.bSetValue_is_TRUE
jmp 0x40bd95
push str.bSetValue_is_FALSE
call fcn.00404c20
mov dword [edi], 0x14
mov dword [ebx], 0xc
add esp, 4
mov dword [edi + 4], 4
add dword [ebx], 4
push str.End_MP_SAFERUN_WRITE_SAFERUN_BACKUP
mov dword [edi + 8], esi
call fcn.00404c20
jmp 0x40c79c
push str.Nhan_duoc_lenh_kill_tien_trinh
call fcn.00404c20
mov ecx, dword [0x49671c]
add esp, 4
push 4
add esi, 8
push esi
push ecx
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x2c], 0
call fcn.00413050
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40c5f6
push 0x40c900
push esi
call fcn.00413130
mov edi, dword [esi]
push esi
mov dword [esp + 0x24], edi
call fcn.004140c0
add esp, 0xc
push eax
push str.nNumberAlive_:__d
call fcn.00404c20
push esi
call fcn.004140c0
add esp, 0xc
test eax, eax
jne 0x40c5f6
push 0x103
lea ebx, [edi + 8]
push ebx
lea edx, [esp + 0x1adc]
push 0x104
push edx
call fcn.0043e9ba
call fcn.00413170
push str.After_GetOutSubTree
call fcn.00404c20
mov eax, ebx
add esp, 0x14
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be70
sub eax, edx
sar eax, 1
je 0x40c5f6
mov dword [esp + 0x38], vtable.UltiFunction.0
mov dword [esp + 0x7b00], 1
mov al, byte [edi + 0x214]
mov byte [esp + 0x17], al
movzx eax, byte [edi + 0x216]
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x40bf00
mov esi, dword [esp + 0x18]
lea ebx, [esp + 0x3c]
add esi, 0x21c
mov edi, eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bec6
sub eax, edx
sar eax, 1
je 0x40beeb
push 0x103
push esi
push 0x104
push ebx
call fcn.0043e9ba
add esp, 0x10
add esi, 0x208
add ebx, 0x208
sub edi, 1
jne 0x40bec1
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push ecx
push 1
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c5eb
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x16b0]
push eax
push 0
push 0
push str.szTempDirectory
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x30]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40c5eb
xor eax, eax
mov word [esp + 0x18b2], ax
lea eax, [esp + 0x16ac]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bf70
sub eax, edx
sar eax, 1
je 0x40c5eb
push str.SafeRun
lea ecx, [esp + 0x16b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40c5eb
lea edx, [esp + 0x16ac]
push 0x5c
push edx
call fcn.00440099
add esp, 8
test eax, eax
je 0x40bfc9
add eax, 2
push 0x5c
push eax
inc ebx
call fcn.00440099
add esp, 8
test eax, eax
jne 0x40bfb6
mov al, byte [esp + 0x17]
cmp al, 1
je 0x40c11f
cmp al, 2
je 0x40c11f
movzx eax, byte [edi + 0x216]
push eax
push str.btType__ADD_PROCESS_TYPE_FROM_SHARE__processEntry__btReserve_2__:__d
call fcn.00404c20
lea ebx, [edi + 0x21c]
push ebx
lea esi, [esp + 0x24]
call fcn.00403210
mov edx, dword [edi + 0x210]
add esp, 0xc
xor ecx, ecx
cmp edx, dword [esp + 0x18]
push 0x104
setne cl
lea eax, [esp + 0x1ce0]
push eax
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x40c5eb
push 0x4576d8
push 0
lea ecx, [esp + 0x1ce4]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
lea edx, [esp + 0x1cdc]
sub eax, edx
sar eax, 1
inc eax
push eax
mov eax, edx
push eax
lea ecx, [esp + 0x3af4]
push 0x400
push ecx
call fcn.0043e9ba
push 0x3ff
push str.SafeRunBkavSafeRunManager.exe
lea edx, [esp + 0x3b04]
push 0x400
push edx
call fcn.0043e4d6
add esp, 0x20
test esi, esi
jne 0x40c097
cmp byte [edi + 0x216], 1
jbe 0x40c5eb
push str.bOrigrinalFileChanged
call fcn.00404c20
add esp, 4
push 0x3ff
push str.__sbqShare
lea eax, [esp + 0x3af4]
push 0x400
push eax
call fcn.0043e4d6
push ebx
push str.__s_
lea ecx, [esp + 0x6b04]
push 0x400
push ecx
call fcn.0043ed50
push 0x3ff
lea edx, [esp + 0x6b10]
push edx
lea eax, [esp + 0x3b14]
push 0x400
push eax
call fcn.0043e4d6
lea ecx, [esp + 0x3b1c]
push ecx
push str.szSRMgrPath_:_s
call fcn.00404c20
push 1
lea ebx, [esp + 0x3b28]
call fcn.00413390
add esp, 0x3c
jmp 0x40c5eb
cmp ebx, 2
jle 0x40c5eb
lea edx, [esp + 0x22e4]
push edx
lea ebx, [esp + 0x16b0]
lea esi, [esp + 0x1ad8]
call fcn.0043adf0
test eax, eax
je 0x40c5eb
lea eax, [esp + 0x22e4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c161
xor esi, esi
jmp 0x40c1c2
lea ecx, [esp + 0x22e4]
push ecx
lea esi, [esp + 0x1c]
call fcn.00403210
mov eax, dword [esp + 0x1c]
add esp, 4
xor edx, edx
cmp eax, dword [edi + 0x210]
push str..xls
setne dl
lea ecx, [esp + 0x1ad8]
push ecx
mov esi, edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40c1be
lea edx, [esp + 0x22e4]
push edx
lea eax, [esp + 0x1ad8]
push eax
call fcn.00401220
add esp, 8
test eax, eax
jne 0x40c15d
lea esi, [eax + 1]
jmp 0x40c1cd
test esi, esi
jne 0x40c1cd
cmp dword [esp + 0x1c], 0
jle 0x40c5eb
push 0x104
lea ecx, [esp + 0x18b8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x40c5eb
push 0x4576d8
push 0
lea edx, [esp + 0x18bc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
lea ecx, [esp + 0x18b4]
sub eax, ecx
sar eax, 1
inc eax
push eax
mov edx, ecx
push edx
lea eax, [esp + 0x2aec]
push 0x400
push eax
call fcn.0043e9ba
push 0x3ff
push str.SafeRunBkavSafeRunManager.exe
lea ecx, [esp + 0x2afc]
push 0x400
push ecx
call fcn.0043e4d6
mov al, byte [esp + 0x37]
add esp, 0x20
cmp al, 1
jne 0x40c35b
push 0x3ff
push str.__sbq
lea edx, [esp + 0x2aec]
push 0x400
push edx
call fcn.0043e4d6
push 1
lea ebx, [esp + 0x2af8]
call fcn.00413390
add esp, 0x14
test eax, eax
je 0x40c342
test esi, esi
je 0x40c29d
push 0
lea eax, [esp + 0x1ad8]
push eax
lea ecx, [esp + 0x22ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x1c], 0
jle 0x40c5eb
push str.nSaveAsFile___0
call fcn.00404c20
xor edi, edi
add esp, 4
cmp dword [esp + 0x1c], edi
jle 0x40c5eb
lea esi, [esp + 0x3c]
test esi, esi
je 0x40c330
lea edx, [esp + 0x62ec]
push edx
lea ebx, [esp + 0x16b0]
call fcn.0043adf0
test eax, eax
je 0x40c330
lea eax, [esp + 0x62ec]
push eax
push esi
push edi
push str.pszSaveAsPathArry__d__:__s__szDest_:__s
call fcn.00404c20
add esp, 0x10
push 0
push esi
lea ecx, [esp + 0x62f4]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40c31c
push str.Copied_file_successful
call fcn.00404c20
add esp, 4
jmp 0x40c330
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Copied_file_failed__Last_error_:__d
call fcn.00404c20
add esp, 8
inc edi
add esi, 0x208
cmp edi, dword [esp + 0x1c]
jl 0x40c2c5
jmp 0x40c5eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.bSave_is_FAILED__last_error_:__d
call fcn.00404c20
add esp, 8
jmp 0x40c5eb
cmp al, 2
jne 0x40c5eb
push str.ADD_PROCESS_TYPE_FROM_MAIL_BROWSER
call fcn.00404c20
add esp, 4
push 0x3ff
push str.__autosave
lea edx, [esp + 0x2aec]
push 0x400
push edx
call fcn.0043e4d6
add esp, 0x10
test esi, esi
je 0x40c4d1
lea eax, [esp + 0x1ad4]
push eax
push str.__s_
lea ecx, [esp + 0x72f4]
push 0x400
push ecx
call fcn.0043ed50
add esp, 0x10
push 0
lea edx, [esp + 0x1ad8]
push edx
lea eax, [esp + 0x22ec]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40c4bd
push 0x3ff
lea ecx, [esp + 0x2ae8]
push ecx
lea edx, [esp + 0x42f4]
push 0x400
push edx
call fcn.0043e9ba
push 0x3ff
lea eax, [esp + 0x7300]
push eax
lea ecx, [esp + 0x4304]
push 0x400
push ecx
call fcn.0043e4d6
push 0
lea ebx, [esp + 0x4310]
call fcn.00413390
add esp, 0x24
push 0x3f6
lea edx, [esp + 0x1ad8]
push edx
lea eax, [esp + 0x5af4]
push 0x400
push eax
call fcn.0043e9ba
push 0x3f6
push str.:Zone.Identifier
lea ecx, [esp + 0x5b04]
push 0x400
push ecx
call fcn.0043e4d6
lea edx, [esp + 0x5b0c]
push edx
push str.szAdsFile_:__s
call fcn.00404c20
add esp, 0x28
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
lea eax, [esp + 0x5b04]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c4d1
push 0
lea ecx, [esp + 0x28]
push ecx
push 0x18
push str._ZoneTransfer__r_nZoneId3
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c4d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Copied_file_failed__Last_error_:__d
call fcn.00404c20
add esp, 8
cmp dword [esp + 0x1c], 0
jle 0x40c5eb
push str.nSaveAsFile___0
call fcn.00404c20
xor edi, edi
add esp, 4
cmp dword [esp + 0x1c], edi
jle 0x40c5eb
lea esi, [esp + 0x3c]
lea esp, [esp]
test esi, esi
je 0x40c5da
lea edx, [esp + 0x52ec]
push edx
lea ebx, [esp + 0x16b0]
call fcn.0043adf0
test eax, eax
je 0x40c5da
lea eax, [esp + 0x52ec]
push eax
push esi
push edi
push str.pszSaveAsPathArry__d__:__s__szDest_:__s
call fcn.00404c20
add esp, 0x10
push 0
push esi
lea ecx, [esp + 0x52f4]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40c5c6
push str.Copied_file_successful
call fcn.00404c20
add esp, 4
push esi
push str.__s_
lea edx, [esp + 0x32ec]
push 0x400
push edx
call fcn.0043ed50
push 0x3ff
lea eax, [esp + 0x2af8]
push eax
lea ecx, [esp + 0x4b04]
push 0x400
push ecx
call fcn.0043e9ba
push 0x3ff
lea edx, [esp + 0x3308]
push edx
lea eax, [esp + 0x4b14]
push 0x400
push eax
call fcn.0043e4d6
push 0
lea ebx, [esp + 0x4b20]
call fcn.00413390
add esp, 0x34
jmp 0x40c5da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Copied_file_failed__Last_error_:__d
call fcn.00404c20
add esp, 8
inc edi
add esi, 0x208
cmp edi, dword [esp + 0x1c]
jl 0x40c500
mov dword [esp + 0x7b00], 0xffffffff
mov eax, dword [0x496730]
test eax, eax
je 0x40c613
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x496730]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.004110d0
jmp case.0x40b4a5.7
cmp dword [0x496718], 0
jne case.0x40b4a5.7
mov eax, dword [0x496734]
mov dword [0x496718], 1
test eax, eax
je case.0x40b4a5.7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x40b4a5.7
push 0x800
add esi, 8
push esi
lea edx, [esp + 0x22ec]
push 0x800
push edx
call fcn.0043e615
lea eax, [esp + 0x22f4]
push eax
push str.pszFilePath_:__s
call fcn.00404c20
lea eax, [esp + 0x22fc]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c687
sub eax, edx
sar eax, 1
je case.0x40b4a5.7
push 0x47b510
lea ecx, [esp + 0x22e8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je case.0x40b4a5.7
push 1
lea ecx, [esp + 0x22e8]
jmp 0x40c797
push str.MP_EXIT_DOC_WITH_SAFERUN
call fcn.00404c20
mov edx, dword [0x49671c]
add esp, 4
push 4
add esi, 8
push esi
push edx
call fcn.00413050
add esp, 0xc
test eax, eax
je case.0x40b4a5.7
mov eax, dword [eax]
test eax, eax
je case.0x40b4a5.7
mov eax, dword [eax + 0x166c]
test eax, eax
je case.0x40b4a5.7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x40b4a5.7
mov eax, dword [esi + 4]
cmp eax, 0x800
jae case.0x40b4a5.7
push eax
lea eax, [esi + 8]
push eax
lea ecx, [esp + 0x32ec]
push 0x800
push ecx
call fcn.0043e615
mov edx, dword [esi + 4]
lea ecx, [esp + 0x32f4]
push ecx
shr edx, 1
xor eax, eax
push str.pszFilePath_:__s
mov word [esp + edx*2 + 0x32fe], ax
call fcn.00404c20
lea eax, [esp + 0x32fc]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c766
sub eax, edx
sar eax, 1
je case.0x40b4a5.7
push 0x47b510
lea edx, [esp + 0x32e8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je case.0x40b4a5.7
push 0
lea ecx, [esp + 0x32e8]
call fcn.0040ca30
add esp, 4
mov ecx, dword [esp + 0x7af8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7ae0]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret