Function at 0x41e240
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get file attributes
Get file size
Hash data using sha256
Hash data with md5
Move file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x194], 0
push esi
push edi
mov dword [ebp - 0x1c4], ebx
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 0x1c]
mov dword [ebp - 0x168], esi
add esi, 0x1c
mov eax, dword [edx + 0x90]
mov dword [ebp - 0x164], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x49c]
lea eax, [ebp - 0x164]
push eax
push dword [edx + 0x9c]
lea eax, [edx + 0x10]
push eax
push esi
call fcn.004a73f0
test eax, eax
jne 0x41e31b
mov ecx, dword [ebx + 0xc]
push esi
push dword [ebp - 0x164]
push dword [ecx + 0x9c]
call fcn.004ac340
test eax, eax
je 0x41e3d4
mov ecx, dword [ebx + 8]
push ecx
push 0
cmp eax, 2
jne 0x41e30e
push 0
push esi
call fcn.004a7df0
push 6
push 0x5fb325b5
push ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045be00
mov eax, dword [ebp - 0x168]
push ecx
add eax, 0x1c
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042d060
jmp 0x41e3a6
mov eax, dword [ebx + 0xc]
add eax, 0x10
push eax
push esi
call fcn.004a7df0
push 2
push 0x5fb325b5
push ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045be00
mov eax, dword [ebx]
mov eax, dword [eax + 0x4d8]
mov esi, dword [eax + 0xbc]
mov eax, dword [ebp - 0x168]
add eax, 0x1c
je 0x41e3a6
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x168]
add eax, 0x1c
push eax
call fcn.0042ceb0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x41e3a6
mov eax, dword [ebx]
mov dword [ebp - 0x60], 1
mov eax, dword [eax + 0x4d8]
mov esi, dword [eax + 0xbc]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.00429810
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x168]
xor edi, edi
add ecx, 0x1c
push 1
push ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045bf70
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov dword [ebp - 0x1ac], 0
mov eax, dword [eax + 0x4d8]
mov eax, dword [eax + 0xbc]
mov dword [ebp - 0x180], eax
test esi, esi
je 0x41e4ef
lea edi, [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x180]
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.0042ceb0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x41e4ef
mov eax, dword [ebp - 0x3c]
test al, 4
je 0x41e4d7
lea eax, [ebp - 0x1e8]
push eax
mov eax, dword [ebx + 0xc]
push dword [ebp - 0x164]
push dword [eax + 0x9c]
call fcn.004aeea0
test eax, eax
jne 0x41e4a0
mov ecx, dword [ebx]
movsd xmm1, qword [ebp - 0x1e8]
movsd xmm0, qword [ecx + 0x358]
comisd xmm0, xmm1
ja 0x41e4a0
mov dword [ebp - 0x1ac], 1
cmp dword [ecx + 0x270], eax
je 0x41e483
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jp 0x41e4d4
and dword [ebp - 0x3c], 0x60
mov eax, dword [ecx + 0x4d8]
mov dword [ebp - 0x60], 2
mov dword [ebp - 0x20], 0
jmp 0x41e384
mov esi, dword [ebp - 0x168]
push ecx
lea eax, [esi + 0x1c]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042d060
push ecx
mov ecx, dword [ebx + 8]
lea eax, [esi + 0x1c]
push 1
push 0
push eax
call fcn.004a7df0
jmp 0x41e3a6
mov eax, dword [ebp - 0x3c]
test eax, 0x800
mov edi, 0
mov eax, 1
cmovne edi, eax
mov dword [ebp - 0x194], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x9c]
cmp dword [ecx], 0
jne 0x41e2d6
mov eax, dword [ecx + 4]
add ecx, 8
mov edx, dword [ecx + eax*2]
lea eax, [ecx + eax*2]
add eax, 4
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x170], eax
mov edi, dword [eax]
mov ecx, edi
mov esi, dword [eax + 4]
add ecx, 0x6000000
mov eax, esi
mov dword [ebp - 0x198], esi
adc eax, 0
cmp dword [ebx + 0x34], eax
ja 0x41e54b
jb 0x41e540
cmp dword [ebx + 0x30], ecx
jae 0x41e54b
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], esi
jmp 0x41faaa
mov ecx, dword [ebp - 0x170]
add ecx, 0xc
mov dword [ebx + 0x38], 0
mov dword [ebp - 0x180], ecx
add ecx, 0x10
cmp dword [ebp - 0x1ac], 1
mov dword [ebx + 0x3c], 0
mov dword [ebp - 0x170], ecx
jne 0x41e5a9
cmp edx, 1
je 0x41e5a9
mov eax, dword [ebx]
add ecx, 0x20
mov esi, 0x24
mov eax, dword [eax + 0x4ec]
mov edx, dword [eax + 0x24]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41e5f0
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41e592
mov esi, dword [ebp - 0x198]
mov eax, dword [ebx]
mov dword [ebp - 0x164], 0x40000
mov ecx, dword [eax + 0x49c]
lea eax, [ebp - 0x164]
push eax
push dword [ebx + 0x28]
mov eax, dword [ebx + 0xc]
add eax, 0x10
push eax
push dword [ebp - 0x170]
call fcn.004a73f0
test eax, eax
je 0x41e624
mov ecx, dword [ebp - 0x168]
test byte [ecx + 8], 1
je 0x41fafc
jmp 0x41e3a6
mov esi, dword [ebp - 0x168]
push ecx
mov ecx, dword [ebx]
lea eax, [esi + 0x1c]
push eax
mov ecx, dword [ecx + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042d060
push ecx
mov ecx, dword [ebx + 8]
lea eax, [esi + 0x1c]
push 1
push 0
push eax
call fcn.004a7df0
jmp 0x41e3a6
push dword [ebp - 0x170]
mov ecx, dword [ebx + 0xc]
push dword [ebp - 0x164]
push dword [ebx + 0x28]
call fcn.004ace30
test eax, eax
je 0x41e65c
mov eax, dword [ebx + 0xc]
push ecx
mov ecx, dword [ebx + 8]
add eax, 0x10
push 0
push eax
push dword [ebp - 0x170]
call fcn.004a7df0
jmp 0x41fafc
mov edx, dword [ebx + 0x28]
cmp dword [edx], 5
je 0x41e680
mov eax, dword [ebx + 0xc]
push ecx
mov ecx, dword [ebx + 8]
add eax, 0x10
push 0
push eax
mov eax, dword [ebp - 0x168]
add eax, 0x1c
push eax
jmp 0x41e316
mov eax, dword [edx + 8]
xor ecx, ecx
mov dword [ebp - 0x1b0], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1b8], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1d4], eax
add eax, edi
mov edi, dword [ebp - 0x1b0]
adc ecx, esi
cmp eax, edi
jne 0x41e664
mov esi, dword [ebp - 0x1b8]
cmp ecx, esi
jne 0x41e664
mov eax, dword [edx + 0x14]
add edx, 0x18
push 0
push eax
push esi
push edi
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x188], edx
call fcn.004f3670
or eax, edx
je 0x41e6dc
mov esi, 1
jmp 0x41e6de
xor esi, esi
push 0
push dword [ebp - 0x19c]
push dword [ebp - 0x1b8]
push edi
call fcn.004f35c0
mov ecx, dword [ebx + 0xc]
add eax, esi
mov dword [ebp - 0x1a0], eax
push 0x20
mov eax, dword [ecx + 0xa0]
mov dword [eax], 0
add eax, 4
mov dword [ebp - 0x1b4], eax
call fcn.004d3886
mov ecx, eax
mov dword [ebp - 0x190], eax
call fcn.004069a0
mov ecx, dword [ebx]
mov dword [ebp - 0x178], eax
mov esi, dword [ecx + 0x470]
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x168]
mov ecx, esi
push 0
push 1
push dword [ebp - 0x178]
add edx, 0x1c
push edx
call fcn.0041cc40
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x208
call fcn.004d9a7e
mov ecx, dword [ebx]
add esp, 4
cmp dword [ebp - 0x1ac], 0
mov esi, eax
mov dword [ebp - 0x174], esi
jne 0x41e7a3
push dword [ecx + 0x448]
push 0x104
push esi
call fcn.004d9c76
mov eax, dword [ebx]
mov ecx, 0x103
add esp, 0xc
sub ecx, dword [eax + 0x454]
jmp 0x41e7c4
push dword [ecx + 0x444]
push 0x104
push esi
call fcn.004d9c76
mov eax, dword [ebx]
mov ecx, 0x103
add esp, 0xc
sub ecx, dword [eax + 0x450]
mov dword [ebp - 0x164], ecx
lea edx, [ebp - 0x164]
push 0x504dd4
mov ecx, esi
call fcn.00453460
add esp, 4
lea edx, [ebp - 0x164]
mov ecx, esi
push dword [ebp - 0x1a8]
call fcn.00453460
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call edi
mov dword [ebp - 0x17c], eax
cmp eax, 0xffffffff
jne 0x41e963
mov ecx, esi
call fcn.004958d0
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
push esi
call edi
mov dword [ebp - 0x17c], eax
cmp eax, 0xffffffff
jne 0x41e963
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 2
mov esi, dword [ebp - 0x194]
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp - 0x174]
test eax, eax
je 0x41e875
push eax
call fcn.004d9a63
add esp, 4
mov ecx, dword [ebp - 0x178]
test ecx, ecx
je 0x41e885
mov eax, dword [ecx]
push 1
call dword [eax]
test edi, edi
jne 0x41fa8a
mov eax, dword [ebx]
push 1
push dword [ebp - 0x170]
mov ecx, dword [eax + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042ab40
mov edi, dword [ebp - 0x168]
push 1
lea eax, [edi + 0x1c]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042ab40
add edi, 0x1c
cmp dword [ebp - 0x1ac], 0
je 0x41f992
mov eax, dword [ebx]
mov eax, dword [eax + 0x4d8]
mov esi, dword [eax + 0xbc]
test edi, edi
je 0x41f86b
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x168]
add eax, 0x1c
push eax
call fcn.0042ceb0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x41f86b
mov eax, dword [ebx]
and dword [ebp - 0x3c], 0xfffffffb
cmp dword [ebp - 0x60], 3
mov dword [ebp - 0x28], 1
mov eax, dword [eax + 0x4d8]
mov edi, dword [eax + 0xbc]
jge 0x41f86b
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
call fcn.00429810
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
jmp 0x41f871
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x168]
add eax, 0x108
push eax
lea eax, [edi + 0x1c]
push eax
call fcn.004ae8f0
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x180]
mov ecx, dword [ebx]
push 0x10
push dword [ebx + 0x24]
mov ecx, dword [ecx + 0x484]
call fcn.004b48f0
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x41e9d4
mov dword [eax + 0x1f0], 0
mov dword [eax + 0x1f4], 0
mov dword [eax + 0x1f8], 0
mov dword [eax + 0x1fc], 0
push dword [ebp - 0x19c]
call fcn.004d9a7e
add esp, 4
mov esi, eax
mov dword [ebp - 0x1bc], esi
push dword [ebp - 0x19c]
call fcn.004d9a7e
mov dword [ebp - 0x1a4], eax
add esp, 4
cmp dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x184], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x140], 0x67452301
mov dword [ebp - 0x13c], 0xefcdab89
mov dword [ebp - 0x138], 0x98badcfe
mov dword [ebp - 0x134], 0x10325476
jbe 0x41f059
lea eax, [edi + 0x1c]
mov dword [ebp - 0x190], eax
nop word [eax + eax]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xd0]
test eax, eax
je 0x41f049
cmp eax, 2
je 0x41f049
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x19c]
test edx, edx
jl 0x41eaba
jg 0x41eab6
cmp eax, ecx
jbe 0x41eaba
mov edi, ecx
jmp 0x41eabc
mov edi, eax
mov dword [ebp - 0x164], ecx
sub eax, edi
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebx]
sbb edx, 0
push ecx
push esi
push dword [ebp - 0x188]
mov ecx, dword [eax + 0x49c]
push dword [ebp - 0x170]
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x1b8], edx
call fcn.004a73f0
push ecx
mov ecx, dword [ebx]
mov esi, eax
push 2
push dword [ebp - 0x188]
push dword [ebp - 0x170]
mov ecx, dword [ecx + 0x49c]
call fcn.004a7910
test esi, esi
je 0x41eb20
xor esi, esi
jmp 0x41eb47
mov esi, dword [ebp - 0x164]
cmp esi, edi
jbe 0x41eb49
push ecx
mov ecx, dword [ebx]
xor esi, esi
push esi
push dword [ebp - 0x188]
push dword [ebp - 0x170]
mov ecx, dword [ecx + 0x49c]
call fcn.004a7df0
cmp esi, edi
jae 0x41eb82
mov edi, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x18c], 1
add dword [edi], esi
adc dword [edi + 4], 0
mov dword [edi + ecx*4 + 8], esi
mov edi, dword [ebp - 0x168]
test byte [edi + 8], 1
jne 0x41f00d
mov esi, ecx
jmp 0x41efec
mov eax, dword [ebp - 0x184]
inc eax
cmp eax, dword [ebp - 0x1a0]
jae 0x41ed2a
cmp dword [ebp - 0x170], 0
mov eax, dword [ebx]
mov esi, dword [eax + 0x49c]
je 0x41ed2a
mov eax, dword [esi + 8]
cmp dword [eax + 0x20], 0
jne 0x41ed2a
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp edi, 2
ja 0x41ed1a
mov ecx, dword [ebp - 0x188]
inc edi
mov eax, dword [esi + 0x30]
add ecx, 0x20
push 0
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 0x198]
push ecx
push dword [ebp - 0x170]
mov ecx, esi
push eax
je 0x41ec39
call fcn.004a6960
test eax, eax
jne 0x41ebc3
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x41ed1a
push 0
lea ecx, [ebp - 0x1cc]
push ecx
lea ecx, [ebp - 0x198]
push ecx
mov ecx, dword [ebp - 0x188]
add ecx, 0x20
push ecx
push eax
mov ecx, esi
call fcn.004a6960
test eax, eax
jne 0x41ebc3
mov eax, dword [ebp - 0x1cc]
jmp 0x41ec48
call fcn.004a6960
test eax, eax
jne 0x41ebc3
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x41ed1a
mov eax, dword [eax + 0x14]
and al, 3
cmp al, 2
je 0x41ed1a
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4c
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.004d6ed0
mov eax, dword [ebp - 0x188]
add esp, 0xc
mov dword [ebp - 0x240], 2
mov dword [ebp - 0x23c], 0
add eax, 0x20
je 0x41ece4
mov edi, dword [ebp - 0x170]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x238], 2
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x234], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [ebp - 0x224], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x214], xmm0
movups xmm0, xmmword [eax + 0x10]
lea eax, [ebp - 0x240]
push eax
movups xmmword [ebp - 0x204], xmm0
call fcn.004aab70
jmp 0x41ed24
mov eax, dword [ebp - 0x170]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x238], 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x234], xmm0
movups xmm0, xmmword [eax + 0x10]
lea eax, [ebp - 0x240]
push eax
movups xmmword [ebp - 0x224], xmm0
call fcn.004aab70
jmp 0x41ed24
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x41edbd
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xc4], 0
push ecx
push edi
push eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xe8], 0x6a09e667
mov dword [ebp - 0xe4], 0xbb67ae85
mov dword [ebp - 0xe0], 0x3c6ef372
mov dword [ebp - 0xdc], 0xa54ff53a
mov dword [ebp - 0xd8], 0x510e527f
mov dword [ebp - 0xd4], 0x9b05688c
mov dword [ebp - 0xd0], 0x1f83d9ab
mov dword [ebp - 0xcc], 0x5be0cd19
mov dword [ebp - 0x78], 0
call fcn.004b2370
lea eax, [ebp - 0xe8]
push eax
call fcn.004b2880
mov esi, dword [ebp - 0x188]
xor ecx, ecx
mov edx, esi
nop word [eax + eax]
mov eax, dword [ebp + ecx*4 - 0xe8]
cmp eax, dword [edx]
jne 0x41efab
inc ecx
add edx, 4
cmp ecx, 8
jb 0x41edd0
mov edi, dword [ebp - 0x1b4]
xor ecx, ecx
mov edx, dword [ebp - 0x16c]
mov eax, edx
add eax, dword [edi]
mov dword [edi], eax
adc ecx, dword [edi + 4]
cmp dword [ebp - 0x18c], 0
mov dword [edi + 4], ecx
jne 0x41ef3b
mov eax, dword [ebp - 0x184]
mov dword [edi + eax*4 + 8], edx
mov eax, dword [ebx]
mov esi, dword [ebx + 0x24]
mov ecx, dword [eax + 0x484]
test esi, esi
je 0x41ee9b
mov edi, dword [ebp - 0x1bc]
test edi, edi
je 0x41ee9b
cmp dword [ebp - 0x1a4], 0
je 0x41ee9b
mov eax, dword [esi + 0x200]
cmp eax, 0xa
je 0x41ee50
cmp eax, 0xc
je 0x41ee50
cmp eax, 0xe
jne 0x41ee9b
test dl, 0xf
jne 0x41ee9b
shr edx, 4
sub eax, 0xa
je 0x41ee87
sub eax, 2
je 0x41ee77
sub eax, 2
jne 0x41ee95
push edx
push dword [ebp - 0x1a4]
push edi
push esi
call fcn.004b8ca0
jmp 0x41ee95
push edx
push dword [ebp - 0x1a4]
push edi
push esi
call fcn.004b9cb0
jmp 0x41ee95
push edx
push dword [ebp - 0x1a4]
push edi
push esi
call fcn.004baa70
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x1a0]
dec eax
cmp dword [ebp - 0x184], eax
jne 0x41eeb6
sub edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x16c], edx
mov ecx, dword [ebx]
lea eax, [ebp - 0x140]
mov edi, dword [ebp - 0x1a4]
push eax
push edx
mov ecx, dword [ecx + 0x480]
push edi
call fcn.004b2200
mov esi, dword [ebp - 0x16c]
lea eax, [ebp - 0x1dc]
push 0
push eax
push esi
push edi
push dword [ebp - 0x17c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x1dc], esi
jne 0x41f035
mov eax, dword [ebx + 4]
mov esi, dword [eax + 0xf4]
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov dword [esi + 0x58], eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0x58]
mov ecx, dword [ebp - 0x16c]
push edi
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x184]
jmp 0x41ef45
mov esi, dword [ebp - 0x184]
mov dword [edi + esi*4 + 8], edx
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
push 0
push dword [ebp - 0x190]
addsd xmm0, qword [eax*8 + 0x513d40]
mov eax, dword [ebp - 0x1a0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x513d40]
mov eax, dword [ebx + 4]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
mulss xmm1, dword [0x513ca0]
movss dword [eax + 0x14c], xmm1
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045bf70
jmp 0x41efec
push ecx
mov ecx, dword [ebx]
push 0
push esi
push dword [ebp - 0x170]
mov ecx, dword [ecx + 0x49c]
call fcn.004a7df0
mov eax, dword [ebp - 0x1b4]
mov esi, dword [ebp - 0x184]
mov dword [ebp - 0x18c], 1
mov dword [eax + esi*4 + 8], 0
mov eax, dword [ebp - 0x168]
test byte [eax + 8], 1
jne 0x41f00d
add dword [ebp - 0x188], 0x20
inc esi
mov dword [ebp - 0x184], esi
cmp esi, dword [ebp - 0x1a0]
jae 0x41f059
mov esi, dword [ebp - 0x1bc]
jmp 0x41ea80
mov ecx, dword [ebx]
mov edi, 5
mov esi, dword [ebp - 0x174]
push esi
push 0x2481de72
mov ecx, dword [ecx + 0x478]
push 0x2e90b136
call fcn.0045bf20
jmp 0x41f184
mov edi, 4
mov dword [ebp - 0x18c], 1
jmp 0x41f17e
mov edi, 1
mov dword [ebp - 0x18c], edi
jmp 0x41f17e
mov ecx, dword [ebx]
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ecx + 0x480]
call fcn.004b2580
mov eax, dword [ebx + 4]
mov dword [eax + 0x14c], 0x42c80000
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebx + 0xc]
lea eax, [eax*4 + 0xc]
push eax
push dword [ecx + 0xa0]
lea eax, [ecx + 0x30]
mov ecx, dword [ebx]
push eax
push dword [ebp - 0x170]
mov ecx, dword [ecx + 0x49c]
call fcn.004a72a0
cmp dword [ebp - 0x18c], 0
jne 0x41f16c
mov edx, dword [ebp - 0x180]
xor ecx, ecx
nop dword [eax]
mov eax, dword [ebp + ecx*4 - 0x140]
cmp eax, dword [edx + ecx*4]
jne 0x41f0d9
inc ecx
cmp ecx, 4
jb 0x41f0c0
xor edi, edi
jmp 0x41f171
push dword [ebp - 0x1a8]
mov ecx, dword [ebx]
push 0xb2164636
push 0xbcd3f497
mov dword [ebp - 0x18c], 1
mov ecx, dword [ecx + 0x478]
call fcn.0045be90
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0xbc]
mov eax, dword [ebp - 0x168]
add eax, 0x1c
je 0x41f138
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x168]
mov ecx, edi
push 0
add eax, 0x1c
push eax
call fcn.0042a970
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x168]
push ecx
mov ecx, dword [ebx]
add eax, 0x1c
push 1
push 0
push eax
mov ecx, dword [ecx + 0x49c]
call fcn.004a7df0
push ecx
mov ecx, dword [ebx]
push 1
push 0
push dword [ebp - 0x170]
mov ecx, dword [ecx + 0x49c]
call fcn.004a7df0
mov edi, 2
mov edx, dword [ebp - 0x168]
mov ecx, ebx
call fcn.0041e030
mov esi, dword [ebp - 0x174]
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x41f197
push eax
call fcn.004d9a63
add esp, 4
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x41f1aa
push eax
call fcn.004d9a63
add esp, 4
mov eax, dword [ebp - 0x17c]
cmp eax, 0xffffffff
je 0x41e856
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18c], 0
je 0x41f1e7
cmp edi, 4
je 0x41e856
cmp edi, 5
je 0x41e856
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41e856
cmp dword [ebp - 0x1ac], 0
je 0x41f426
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 0
push accept
push esi
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f23b
push 0
push 0x80
push 3
push 0
push 7
push accept
push dword [ebp - 0x174]
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x41f2ed
lea eax, [ebp - 0x1d8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x180], eax
cmp eax, 0x200000
jbe 0x41f26e
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov esi, 1
jmp 0x41f2f2
push eax
call fcn.004d9a7e
add esp, 4
mov edi, eax
lea eax, [ebp - 0x190]
push 0
push eax
push dword [ebp - 0x180]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x190], eax
jne 0x41f2e4
lea ecx, [ebp - 0x1d0]
push ecx
mov ecx, dword [ebx]
push eax
push edi
call fcn.0049a5a0
test eax, eax
je 0x41f2ca
push edi
call fcn.004d9a63
add esp, 4
mov esi, 1
jmp 0x41f2f2
movsd xmm0, qword [ebp - 0x1d0]
ucomisd xmm0, qword [ebp - 0x1e8]
lahf
test ah, 0x44
jnp 0x41f394
push edi
call fcn.004d9a63
add esp, 4
mov esi, 2
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x168]
add eax, 0x1c
push eax
call fcn.004ae8f0
xor eax, eax
mov dword [ebp - 0x60], 2
cmp esi, 2
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
setne al
mov dword [ebp - 0x34], 0
add eax, 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
mov dword [ebp - 0x2c], 0
mov eax, dword [eax + 0x4d8]
mov esi, dword [eax + 0xbc]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.00429810
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x168]
push ecx
mov ecx, dword [ebx + 8]
add eax, 0x1c
push 1
push 0
push eax
call fcn.004a7df0
mov edi, 3
jmp 0x41e856
push edi
call fcn.004d9a63
add esp, 4
push 0x208
call fcn.004d9a7e
add esp, 4
mov esi, eax
mov dword [ebp - 0x16c], esi
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.004d644c
add esp, 8
test eax, eax
jne 0x41f3e2
push esi
call fcn.004d9a63
add esp, 4
mov edi, 3
jmp 0x41e862
xor ecx, ecx
mov word [eax + 2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f3f0
sub ecx, edx
mov eax, 0x103
sar ecx, 1
lea edx, [ebp - 0x164]
sub eax, ecx
mov ecx, esi
push str.perfect_dark.update.exe
mov dword [ebp - 0x164], eax
call fcn.00453460
add esp, 4
jmp 0x41f5f9
push 0x208
call fcn.004d9a7e
mov esi, eax
add esp, 4
mov eax, dword [ebx]
mov dword [ebp - 0x16c], esi
push dword [eax + 0x448]
push 0x104
push esi
call fcn.004d9c76
mov eax, dword [ebx]
lea edx, [ebp - 0x164]
mov edi, dword [ebp - 0x1a8]
add esp, 0xc
mov ecx, 0x103
sub ecx, dword [eax + 0x454]
mov dword [ebp - 0x164], ecx
mov ecx, esi
push edi
call fcn.00453460
add esp, 4
push 0x2e
push edi
call fcn.004d644c
add esp, 8
mov dword [ebp - 0x17c], eax
mov edi, 2
push esi
test eax, eax
jne 0x41f52b
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f5f9
nop dword [eax]
mov eax, dword [ebx]
push dword [eax + 0x448]
push 0x104
push esi
call fcn.004d9c76
mov eax, dword [ebx]
lea edx, [ebp - 0x164]
add esp, 0xc
mov ecx, 0x103
sub ecx, dword [eax + 0x454]
push dword [ebp - 0x1a8]
mov dword [ebp - 0x164], ecx
mov ecx, esi
call fcn.00453460
add esp, 4
lea eax, [ebp - 0x14]
push edi
push 0x504de0
push 0xffffffffffffffff
push 8
push eax
call fcn.00415570
add esp, 0x14
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x164]
mov ecx, esi
inc edi
push eax
call fcn.00453460
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41f4b0
jmp 0x41f5f9
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f5eb
mov eax, dword [ebp - 0x17c]
lea ecx, [eax + 2]
mov dword [ebp - 0x190], ecx
nop dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebx]
push dword [eax + 0x448]
push 0x104
push esi
call fcn.004d9c76
mov eax, dword [ebx]
lea edx, [ebp - 0x164]
add esp, 0xc
mov ecx, 0x103
sub ecx, dword [eax + 0x454]
push dword [ebp - 0x1a8]
mov dword [ebp - 0x164], ecx
mov ecx, esi
call fcn.00453460
add esp, 4
lea eax, [ebp - 0x14]
push edi
push str.._d.
push 0xffffffffffffffff
push 8
push eax
call fcn.00415570
add esp, 0x14
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x164]
mov ecx, esi
inc edi
push eax
call fcn.00453460
add esp, 4
lea edx, [ebp - 0x164]
mov ecx, esi
push dword [ebp - 0x190]
call fcn.00453460
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x17c]
jne 0x41f550
mov eax, dword [ebp - 0x17c]
mov ecx, 0x2e
mov word [eax], cx
push esi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x178]
nop dword [eax]
mov eax, dword [edx + 0x14]
xor edi, edi
mov ecx, dword [edx + 0x10]
sub eax, ecx
mov dword [ebp - 0x180], edi
cmp eax, 8
jb 0x41f834
mov esi, dword [ebp - 0x178]
lea eax, [ecx + 4]
mov ecx, dword [edx + 4]
mov dword [edx + 0x10], eax
mov edx, dword [ecx + eax]
add eax, 4
mov dword [esi + 0x10], eax
mov esi, dword [ebp - 0x16c]
test edx, edx
je 0x41f65f
lea edi, [ecx + eax]
mov ecx, dword [ebp - 0x178]
add eax, edx
mov dword [ebp - 0x180], edi
mov dword [ecx + 0x10], eax
mov eax, dword [ebx]
push dword [eax + 0x448]
push 0x104
push dword [ebp - 0x174]
call fcn.004d9c76
mov eax, dword [ebx]
mov edx, 0x103
add esp, 0xc
sub edx, dword [eax + 0x454]
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x164], edx
je 0x41f7c3
mov ecx, dword [ebp - 0x174]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f6a2
mov eax, dword [ebp - 0x174]
sub ecx, esi
sar ecx, 1
lea eax, [eax + ecx*2]
mov ecx, edi
mov dword [ebp - 0x198], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f6c5
sub ecx, esi
mov edi, edx
sar ecx, 1
cmp ecx, edx
cmovbe edi, ecx
lea esi, [edi + edi]
push esi
push dword [ebp - 0x180]
push dword [ebp - 0x198]
call fcn.004d6950
mov eax, dword [ebp - 0x198]
xor ecx, ecx
mov edx, dword [ebp - 0x17c]
add esp, 0xc
sub edx, edi
mov dword [ebp - 0x17c], edx
mov word [eax + esi], cx
mov dword [ebp - 0x164], edx
je 0x41f7bd
mov ebx, dword [ebp - 0x174]
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f724
sub ecx, esi
sar ecx, 1
lea edi, [ebx + ecx*2]
mov ebx, 1
cmp edx, ebx
cmovb ebx, edx
lea esi, [ebx + ebx]
push esi
push 0x504dd0
push edi
call fcn.004d6950
xor eax, eax
add esp, 0xc
mov word [edi + esi], ax
mov esi, dword [ebp - 0x17c]
sub esi, ebx
mov dword [ebp - 0x164], esi
je 0x41f7b7
mov ebx, dword [ebp - 0x174]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f773
sub ecx, edx
sar ecx, 1
lea edi, [ebx + ecx*2]
mov ebx, dword [ebp - 0x1a8]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f790
sub ecx, edx
sar ecx, 1
cmp ecx, esi
cmovbe esi, ecx
add esi, esi
push esi
push ebx
push edi
call fcn.004d6950
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
mov ebx, dword [ebp - 0x1c4]
mov esi, dword [ebp - 0x16c]
mov edi, dword [ebp - 0x174]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41f809
mov ecx, edi
call fcn.004958d0
cmp dword [ebp - 0x194], 0
je 0x41f7fa
mov ecx, dword [ebp - 0x178]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0x10]
jne 0x41f7fa
push edi
push esi
jmp 0x41f600
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x41f606
cmp dword [ebp - 0x194], 0
mov edx, dword [ebp - 0x178]
je 0x41f610
mov eax, dword [edx + 0x14]
sub eax, dword [edx + 0x10]
jne 0x41f610
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41f606
mov eax, dword [ebx]
push 0x5c
push esi
mov edi, dword [eax + 0x478]
call fcn.004d644c
add esp, 8
test eax, eax
je 0x41f850
add eax, 2
jmp 0x41f852
mov eax, esi
push eax
push 0xb0bab51
push 0x2e90b136
mov ecx, edi
call fcn.0045be90
xor edi, edi
jmp 0x41e862
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx]
add eax, 0x330
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x168]
add ecx, 0x368
movsd xmm0, qword [ebp - 0x1e8]
mov eax, dword [edx + 0x1c]
mov dword [ecx], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x28]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x34]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x38]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebx]
movsd qword [eax + 0x350], xmm0
mov ecx, dword [ebx]
ucomisd xmm0, qword [ecx + 0x3b0]
lahf
test ah, 0x44
jp 0x41f90a
movups xmm0, xmmword [ecx + 0x3b8]
movups xmmword [ecx + 0x388], xmm0
movups xmm0, xmmword [ecx + 0x3c8]
movups xmmword [ecx + 0x398], xmm0
movq xmm0, qword [ecx + 0x3d8]
movq qword [ecx + 0x3a8], xmm0
mov eax, dword [ebx]
add eax, 0x330
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
mov eax, dword [ebx]
mov esi, dword [ebp - 0x16c]
push 0xa
push dword [eax + 0x444]
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call fcn.004d9a63
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ecx + 0x4f0]
cmp dword [eax + 0xc], 0
jne 0x41f96d
push 0x3e8
call edi
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x4f0]
cmp dword [eax + 0xc], 0
je 0x41f958
mov ecx, dword [ecx + 0x478]
push 2
push 0x884420a1
call fcn.00407030
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret
push esi
call fcn.004d9a63
add esp, 4
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.004ae980
mov eax, dword [ebx + 0xc]
push 0xc
mov eax, dword [eax + 0x9c]
mov dword [eax], 3
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx]
push dword [eax + 0x9c]
mov ecx, dword [ecx + 0x49c]
add eax, 0x10
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004a72a0
mov eax, dword [ebx]
lea edx, [ebp - 0x164]
push edx
mov dword [ebp - 0x164], 0x568
mov ecx, dword [eax + 0x49c]
mov eax, dword [ebx + 0xc]
push dword [eax + 0x9c]
add eax, 0x10
push eax
push edi
call fcn.004a73f0
test eax, eax
jne 0x41e3a6
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebx + 0xc]
push ecx
push dword [eax + 0x9c]
call fcn.004abd50
mov eax, dword [ebx]
mov edi, dword [ebp - 0x190]
add edi, 4
push edi
mov esi, dword [eax + 0x4c8]
mov ecx, esi
call fcn.0047ac20
test eax, eax
je 0x41fa58
push edi
mov ecx, esi
call fcn.0047acd0
mov eax, dword [ebx + 0xc]
push dword [ebp - 0x164]
mov ecx, dword [ebx]
push dword [eax + 0x9c]
mov eax, dword [ebp - 0x168]
mov ecx, dword [ecx + 0x49c]
add eax, 0x1c
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004a72a0
jmp 0x41e3a6
cmp edi, 1
je 0x41e3c1
cmp edi, 2
je 0x41e31b
cmp edi, 3
je 0x41e3a6
cmp edi, 4
jne 0x41fae5
mov eax, dword [ebx]
push 0x3c755387
push 0xbcd3f497
mov eax, dword [eax + 0x4f0]
or dword [eax + 0x20], 0x20
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045bdc0
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret
cmp edi, 5
je 0x41e3a6
cmp edi, 6
je 0x41e2d6
cmp edi, 7
jne 0x41fb31
push 7
push 0x5fb325b5
push ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045be00
mov eax, dword [ebx]
push 0
push dword [ebp - 0x170]
mov ecx, dword [eax + 0x4d8]
mov ecx, dword [ecx + 0xbc]
call fcn.0042b720
jmp 0x41e3a6
push edi
push 0x5fb325b5
push ecx
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x478]
call fcn.0045be00
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret