Function at 0x403680
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5d4
mov eax, dword [esp + 0x5d8]
mov ecx, dword [0x424220]
mov edx, dword [0x424224]
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x1bc], eax
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x1bc], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x1cc], 0x9e3779b9
mov dword [esp + 0x1c8], ecx
mov dword [esp + 0x1d0], edx
call fcn.00403670
mov eax, dword [0x424228]
add dword [esp + 0xc], 0x23f
mov edi, dword [0x42422c]
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1c4], 0x20
lea ecx, [ecx]
mov dword [esp + 0x10], 2
add dword [esp + 0x10], 3
mov eax, dword [0x2b4ac14]
mov edx, esi
shl edx, 4
add edx, dword [esp + 0x1d4]
cmp eax, 0xfa9
jne 0x403731
mov dword [0x2b4266c], 0xedeb2e40
jmp 0x403742
cmp eax, 0x3eb
jne 0x403742
mov dword [0x2b3f188], 0
mov ecx, dword [esp + 0xc]
add ecx, esi
mov eax, dword [esp + 0x1bc]
shr eax, 5
mov dword [esp + 8], eax
add dword [esp + 8], edi
mov dword [0x2b42668], 0xf4ea3dee
mov dword [esp + 0xbc], 0x7788a509
mov dword [esp + 0x1c], 0x902c9fb
mov dword [esp + 0xb4], 0x315ab5ec
mov dword [esp + 0x28], 0x7240ca60
mov dword [esp + 0xac], 0x3d1b136f
mov dword [esp + 0x8c], 0x4376c03
mov dword [esp + 0x100], 0x13ea46bd
mov dword [esp + 0x80], 0x6df629b0
mov dword [esp + 0x90], 0x1be77211
mov dword [esp + 0x15c], 0x629b1ec7
mov dword [esp + 0x11c], 0x163fb90b
mov dword [esp + 0x84], 0x1c68a861
mov dword [esp + 0xc0], 0x50d27f1e
mov dword [esp + 0x154], 0x7dd8f61d
mov dword [esp + 0x14c], 0x2d14e2c8
mov dword [esp + 0xa4], 0x40cf0fe4
mov dword [esp + 0x19c], 0x385e10e4
mov dword [esp + 0x20], 0x7bd4c4f3
mov dword [esp + 0x190], 0x5442dd6a
mov dword [esp + 0x60], 0x19c379c8
mov dword [esp + 0x78], 0x16a7dad5
mov dword [esp + 0x5c], 0x4672147a
mov dword [esp + 0x1ac], 0xa2572c6
mov dword [esp + 0x144], 0x62f03021
mov dword [esp + 0x58], 0xbac5b61
mov dword [esp + 0x54], 0x559d21d
mov dword [esp + 0x118], 0x2fb84866
mov dword [esp + 0x50], 0x13364b8b
mov dword [esp + 0x98], 0x468fa63
mov dword [esp + 0x128], 0x441a3f77
mov dword [esp + 0x114], 0x5a8b45ea
mov dword [esp + 0x194], 0x78f2b3ab
mov dword [esp + 0xe8], 0x496e1a67
mov dword [esp + 0x18c], 0x1821c5d8
mov dword [esp + 0x178], 0x308336c1
mov dword [esp + 0x13c], 0x54fc3266
mov dword [esp + 0x9c], 0x4e22cd1a
mov dword [esp + 0x7c], 0x7b850bfb
mov dword [esp + 0x4c], 0x5023cf4f
mov dword [esp + 0x1b0], 0x38995f52
mov dword [esp + 0x138], 0x50452912
mov dword [esp + 0x70], 0x280aa435
mov dword [esp + 0x44], 0x7c4ccfc5
mov dword [esp + 0x160], 0x6c69e876
mov dword [esp + 0x18], 0x49e5d357
mov dword [esp + 0xf8], 0x3c9bd97c
mov dword [esp + 0xf4], 0x2dd6789e
mov dword [esp + 0x14], 0x6f163400
mov dword [esp + 0xa8], 0x33be269c
mov dword [esp + 0xb8], 0x45263b08
mov dword [esp + 0x188], 0x6223f19e
mov dword [esp + 0xec], 0xa171a7f
mov dword [esp + 0xe0], 0x2e0d3341
mov dword [esp + 0xf0], 0x39066b7d
mov dword [esp + 0x74], 0x94a6f9
mov dword [esp + 0x148], 0x76de4eb0
mov dword [esp + 0x134], 0x23d83334
mov dword [esp + 0x140], 0x25423390
mov dword [esp + 0x88], 0x27680b29
mov dword [esp + 0x180], 0x2dcaf872
mov dword [esp + 0x3c], 0x6a464c2d
mov dword [esp + 0x1b8], 0x9fe290b
mov dword [esp + 0x6c], 0x67d15ea0
mov dword [esp + 0x48], 0x669aa0d
mov dword [esp + 0xe4], 0x4bf02b85
mov dword [esp + 0xd8], 0x71c5b395
mov dword [esp + 0x158], 0x4ed1486a
mov dword [esp + 0xd0], 0x66f663e5
mov dword [esp + 0xa0], 0xc31d9a
mov dword [esp + 0x184], 0x51ad6a8
mov dword [esp + 0x198], 0x48953c90
mov dword [esp + 0x110], 0x38a3c478
mov dword [esp + 0x130], 0x5cbfb148
mov dword [esp + 0xdc], 0x65237f08
mov dword [esp + 0x40], 0x58381ab9
mov dword [esp + 0x1b4], 0x4b0ba1fc
mov dword [esp + 0x64], 0x4d511afb
mov dword [esp + 0x34], 0x4a6b753b
mov dword [esp + 0xd4], 0x274b5455
mov dword [esp + 0x2c], 0x149d0521
mov dword [esp + 0x10c], 0x169610cb
mov dword [esp + 0x1a0], 0x33d59fc2
mov dword [esp + 0x1a4], 0x4c9f7be4
mov dword [esp + 0x68], 0x674acc83
mov dword [esp + 0x38], 0x537efb5d
mov dword [esp + 0x108], 0x41a7fbfb
mov dword [esp + 0xcc], 0x24eaa885
mov dword [esp + 0x168], 0x6048eb32
mov dword [esp + 0x12c], 0x4aaa2fca
mov dword [esp + 0x17c], 0x456b4027
mov dword [esp + 0xc8], 0x495e5667
mov dword [esp + 0xb0], 0x7b2a3b9a
mov dword [esp + 0x120], 0x569d5736
mov dword [esp + 0x1a8], 0x3db9dce2
mov dword [esp + 0x94], 0x4d5fd03f
mov dword [esp + 0x104], 0x61ff5dc7
mov dword [esp + 0x30], 0x4242e64f
mov dword [esp + 0x124], 0x275d3a0f
mov dword [esp + 0x24], 0x68d4bf3b
mov dword [esp + 0xc4], 0x623bed7b
mov dword [esp + 0x150], 0x1ea5b173
mov dword [esp + 0x174], 0x4d0f71e1
mov dword [esp + 0x16c], 0x179efd7c
mov dword [esp + 0x170], 0x37dcfa5a
mov dword [esp + 0x164], 0x31172eac
mov dword [esp + 0xfc], 0x7bfc6636
add dword [esp + 0xbc], 0x12e1764e
add dword [esp + 0xbc], 0x471c9ff4
sub dword [esp + 0xbc], 0xd5f5d33
add dword [esp + 0x1c], 0x5f4a6414
sub dword [esp + 0x1c], 0x5d36bbd2
sub dword [esp + 0xbc], 0x30d87b3b
add dword [esp + 0xb4], 0x610b7d4f
sub dword [esp + 0xb4], 0x108cb6b3
sub dword [esp + 0xb4], 0x3f7a5f72
add dword [esp + 0xb4], 0x36068cd6
add dword [esp + 0x28], 0xa45e1cc
add dword [esp + 0xbc], 0x5faf0e49
add dword [esp + 0x100], 0x620343a8
sub dword [esp + 0x1c], 0x79071f6d
add dword [esp + 0x28], 0x51e559bf
add dword [esp + 0x28], 0x59c7988
add dword [esp + 0xac], 0x41c18f25
add dword [esp + 0x80], 0x47276a06
add dword [esp + 0x80], 0x4e418edb
sub dword [esp + 0x1c], 0x39ee38e5
add dword [esp + 0x100], 0x5673106a
add dword [esp + 0xb4], 0x5921c674
add dword [esp + 0x8c], 0x55bc5c1
sub dword [esp + 0x11c], 0x318aa0f5
sub dword [esp + 0x1c], 0x2f704c96
sub dword [esp + 0xac], 0x6b87d2e6
sub dword [esp + 0x154], 0x67f2b0ce
add dword [esp + 0x8c], 0x473a03c
sub dword [esp + 0xac], 0x6ba5389f
add dword [esp + 0x84], 0x2da97dd7
add dword [esp + 0x90], 0x5e3897e5
sub dword [esp + 0x90], 0x5f598e23
add dword [esp + 0x8c], 0x43a16283
sub dword [esp + 0x80], 0x3ccbf57f
sub dword [esp + 0x100], 0xdb9d782
sub dword [esp + 0x11c], 0x65f6aae5
add dword [esp + 0xbc], 0x73bd57f2
sub dword [esp + 0x19c], 0x58e8e603
sub dword [esp + 0x8c], 0x13ac75dc
add dword [esp + 0x90], 0x41cbedf5
sub dword [esp + 0x154], 0x52a086f2
sub dword [esp + 0x154], 0x6cf08ba2
sub dword [esp + 0x14c], 0x65fb570c
sub dword [esp + 0xbc], 0x287168d2
add dword [esp + 0x154], 0x1c2c6d77
add dword [esp + 0x28], 0xcb8f171
add dword [esp + 0x19c], 0x29f1e7e
sub dword [esp + 0x20], 0x3aef30e
sub dword [esp + 0x20], 0x112b6761
add dword [esp + 0x78], 0xb8fb373
add dword [esp + 0x14c], 0x7253c075
sub dword [esp + 0x11c], 0x73e22733
add dword [esp + 0x144], 0x2b71871d
add dword [esp + 0xc0], 0x23def55a
sub dword [esp + 0x1ac], 0x5accd6fc
add dword [esp + 0x14c], 0x3f6ccd48
add dword [esp + 0xb4], 0x63025581
sub dword [esp + 0x5c], 0x27bbf237
add dword [esp + 0x28], 0x2eb209ec
sub dword [esp + 0x15c], 0x39e3e426
add dword [esp + 0x19c], 0x760f32b7
sub dword [esp + 0xac], 0x6e9dd92c
add dword [esp + 0x90], 0x521980f2
sub dword [esp + 0x100], 0x2224c207
sub dword [esp + 0x14c], 0x4a25d084
add dword [esp + 0x50], 0x223b70
sub dword [esp + 0x60], 0x25f8fd1
add dword [esp + 0x154], 0x5df125f
sub dword [esp + 0x19c], 0x7fb5ed59
sub dword [esp + 0x118], 0x601f247
add dword [esp + 0x58], 0x3502d0f5
sub dword [esp + 0x58], 0x2270420a
add dword [esp + 0x11c], 0x3b9a3d58
sub dword [esp + 0x98], 0x2c2812ad
sub dword [esp + 0x190], 0x3fd315a2
sub dword [esp + 0xc0], 0x344d2d1d
sub dword [esp + 0xac], 0x68c777fc
sub dword [esp + 0x15c], 0x21ac88ff
sub dword [esp + 0x11c], 0x7050f491
sub dword [esp + 0xa4], 0x2d5500cd
add dword [esp + 0xac], 0x26863cd4
add dword [esp + 0x50], 0x1ac042dd
add dword [esp + 0x98], 0x3bc7dfa4
add dword [esp + 0x84], 0xa673704
sub dword [esp + 0x5c], 0x2e39959c
add dword [esp + 0x194], 0x7de8c3
sub dword [esp + 0x14c], 0x3dcebdda
add dword [esp + 0x144], 0x17e830d9
sub dword [esp + 0xa4], 0x67e8b0b3
sub dword [esp + 0xac], 0x2c7e2bba
sub dword [esp + 0x80], 0x5da9237a
sub dword [esp + 0xb4], 0x4efddc66
add dword [esp + 0x15c], 0xc4fb14b
add dword [esp + 0x100], 0x3b7e2dfb
add dword [esp + 0xa4], 0x5c1928a0
sub dword [esp + 0xe8], 0x39243213
add dword [esp + 0x18c], 0x54b532cd
sub dword [esp + 0x84], 0x624cc42e
sub dword [esp + 0x60], 0x550fb697
sub dword [esp + 0xbc], 0x60c32727
sub dword [esp + 0x14c], 0x64bbdce3
add dword [esp + 0x60], 0x666d0b06
sub dword [esp + 0x5c], 0x711d4c6c
add dword [esp + 0x58], 0x3ba40441
add dword [esp + 0xa4], 0x732fd7ea
add dword [esp + 0x128], 0x55706721
sub dword [esp + 0x9c], 0x242e6e37
sub dword [esp + 0x19c], 0x77a2697f
add dword [esp + 0x7c], 0x627918a
add dword [esp + 0x144], 0x6df5ee27
add dword [esp + 0x70], 0x5bbd7a6c
add dword [esp + 0x14c], 0x62eacb0d
add dword [esp + 0x19c], 0x123ff54e
sub dword [esp + 0x18c], 0xe68be95
add dword [esp + 0x14c], 0x688e27aa
sub dword [esp + 0x54], 0xd746f48
add dword [esp + 0xa8], 0x1c5e8ef3
add dword [esp + 0x100], 0x41c4873d
add dword [esp + 0x128], 0x38534bed
sub dword [esp + 0x1ac], 0xa26ea0b
add dword [esp + 0x1ac], 0x591cf4ed
sub dword [esp + 0xac], 0x29e268d7
add dword [esp + 0x188], 0x1b92f003
add dword [esp + 0x4c], 0x25ad8123
sub dword [esp + 0x58], 0x50cf0a64
sub dword [esp + 0x18c], 0x51e5f983
add dword [esp + 0x78], 0x61afaa88
add dword [esp + 0x134], 0x7c40b4bb
add dword [esp + 0x128], 0x127c05fb
add dword [esp + 0x7c], 0x281767e3
add dword [esp + 0x190], 0x58ea6aa0
add dword [esp + 0x78], 0x7b10d84e
sub dword [esp + 0x148], 0x73f6b50a
add dword [esp + 0x128], 0x7ea8607f
sub dword [esp + 0x90], 0x602833f8
sub dword [esp + 0x60], 0x302b51cb
add dword [esp + 0xc0], 0x44cf409b
sub dword [esp + 0x178], 0x3ab51983
sub dword [esp + 0x3c], 0x5d51a327
sub dword [esp + 0x88], 0x163361d3
sub dword [esp + 0xbc], 0x4aa53f64
add dword [esp + 0x148], 0x228c0c54
sub dword [esp + 0x90], 0x13a8bde8
sub dword [esp + 0xf8], 0x21d99133
add dword [esp + 0x144], 0x37c5840
add dword [esp + 0x114], 0x7de28851
sub dword [esp + 0x138], 0x6878054e
add dword [esp + 0xc0], 0x3e0a48ef
add dword [esp + 0x7c], 0x2fbdf35
sub dword [esp + 0xa0], 0x7a67bd5a
sub dword [esp + 0x98], 0x7482a53e
add dword [esp + 0xf8], 0x7fb18914
add dword [esp + 0x19c], 0x3d36f356
add dword [esp + 0x158], 0x478bfa09
sub dword [esp + 0x15c], 0x33657635
sub dword [esp + 0x148], 0x15fd99d
add dword [esp + 0x98], 0x3b563d85
add dword [esp + 0x184], 0x29b62604
sub dword [esp + 0x44], 0x54cef374
add dword [esp + 0x140], 0x3de73097
sub dword [esp + 0x178], 0x1930500f
add dword [esp + 0x9c], 0x1c0c9451
sub dword [esp + 0x88], 0x68325c1c
add dword [esp + 0x154], 0x306144f3
add dword [esp + 0x44], 0xb0dc931
add dword [esp + 0x184], 0x73baa1a7
sub dword [esp + 0xd0], 0xf454f77
add dword [esp + 0x18], 0x1cff4836
add dword [esp + 0x130], 0x562aaadf
sub dword [esp + 0x1b0], 0x7dfea5f4
add dword [esp + 0x74], 0x199904da
add dword [esp + 0x4c], 0x9c38317
add dword [esp + 0x160], 0x12e0cfbc
sub dword [esp + 0x144], 0x235fe44b
sub dword [esp + 0x4c], 0x76557b7
sub dword [esp + 0x130], 0x15e58b25
add dword [esp + 0xc0], 0x59299660
add dword [esp + 0xe8], 0x38cf38fc
add dword [esp + 0x58], 0x5e7ada61
sub dword [esp + 0xa8], 0x4b9a0a1d
sub dword [esp + 0xbc], 0xb3ec367
add dword [esp + 0xe4], 0x577d5432
add dword [esp + 0x40], 0x62cf0474
add dword [esp + 0x100], 0x48485870
add dword [esp + 0xe8], 0x6562a705
sub dword [esp + 0x8c], 0x1946a3d5
add dword [esp + 0x14], 0x2fab1d88
sub dword [esp + 0x14c], 0xfe4ce4f
sub dword [esp + 0xe8], 0x6b568d5c
sub dword [esp + 0x14c], 0x32a2a64b
add dword [esp + 0x18c], 0x28296823
add dword [esp + 0x28], 0x25130022
sub dword [esp + 0x13c], 0x7255ec4c
sub dword [esp + 0x78], 0x63731cd6
sub dword [esp + 0x64], 0x207d3d2f
add dword [esp + 0xc0], 0x2f550e8b
add dword [esp + 0x1b8], 0x28c21394
add dword [esp + 0x54], 0x7b6516e1
sub dword [esp + 0x1b4], 0x7c632fd9
add dword [esp + 0x194], 0x8ebbb68
sub dword [esp + 0x1ac], 0x1c293012
add dword [esp + 0x154], 0x4ea9512b
sub dword [esp + 0x184], 0x3ed2046f
sub dword [esp + 0xe0], 0x66fd8431
add dword [esp + 0x188], 0x72da3699
add dword [esp + 0x140], 0x14269f33
add dword [esp + 0xe4], 0x3077fc41
add dword [esp + 0x138], 0x6f27bdb6
sub dword [esp + 0xf0], 0x7ff369de
sub dword [esp + 0x188], 0x5dfc9a53
sub dword [esp + 0x74], 0x6e8222b0
add dword [esp + 0x144], 0x6140d4ae
add dword [esp + 0xb4], 0x5d3b1473
add dword [esp + 0xc0], 0xb8cba38
sub dword [esp + 0x70], 0x16eb7fec
sub dword [esp + 0xcc], 0x708b18fe
add dword [esp + 0x194], 0x66d9755a
sub dword [esp + 0x184], 0x4d97d827
sub dword [esp + 0x4c], 0x6d6c1dca
sub dword [esp + 0x100], 0x48da99a1
add dword [esp + 0x180], 0x1cd6bc59
add dword [esp + 0xa8], 0x39712d62
sub dword [esp + 0x48], 0x3987008a
sub dword [esp + 0x2c], 0x51521655
sub dword [esp + 0xd8], 0x8658470
sub dword [esp + 0x108], 0x3beec8f7
sub dword [esp + 0xf4], 0x4647fecd
sub dword [esp + 0x70], 0x3f06dd3f
add dword [esp + 0x10c], 0x28351b3d
sub dword [esp + 0x14], 0x4ce1543d
add dword [esp + 0xd0], 0xdc8bf2b
sub dword [esp + 0x50], 0x270874a1
add dword [esp + 0xb8], 0x5f1a9fbb
add dword [esp + 0x154], 0x205066e3
add dword [esp + 0x1a8], 0x15cd5132
sub dword [esp + 0x14], 0x31e2dacb
add dword [esp + 0x17c], 0x6c6643c2
sub dword [esp + 0x7c], 0x2313f2be
add dword [esp + 0x48], 0x4b581095
add dword [esp + 0x2c], 0x7be6f593
sub dword [esp + 0x14], 0x75ad1f1d
sub dword [esp + 0xa8], 0x2fd56e15
add dword [esp + 0x6c], 0x7784b037
add dword [esp + 0x198], 0x1df3ff18
sub dword [esp + 0xc8], 0x1d5ee7e3
sub dword [esp + 0xd8], 0x40e62814
add dword [esp + 0x14], 0x10ff119c
add dword [esp + 0x9c], 0x163cab31
add dword [esp + 0x1c], 0x346cb5ad
sub dword [esp + 0x78], 0x37b8b8cd
sub dword [esp + 0x8c], 0x382bd66b
add dword [esp + 0x10c], 0x40805198
sub dword [esp + 0x74], 0x69714dff
add dword [esp + 0x14], 0x1ab86fbb
sub dword [esp + 0x64], 0x3a213f85
sub dword [esp + 0x140], 0x6ff9ae6b
add dword [esp + 0x178], 0x6cb2d81f
add dword [esp + 0x120], 0x4d0449cf
sub dword [esp + 0xec], 0x3bec460b
add dword [esp + 0x8c], 0x107a1ab4
sub dword [esp + 0x20], 0x17be79a
add dword [esp + 0x40], 0x527a67c4
sub dword [esp + 0x94], 0x43b82801
add dword [esp + 0x15c], 0x7174babd
add dword [esp + 0x1a4], 0x331e610f
add dword [esp + 0x50], 0x3c7b285e
add dword [esp + 0xac], 0x821d252
add dword [esp + 0x114], 0xa1c9934
add dword [esp + 0x110], 0x486f72c
add dword [esp + 0x98], 0x64323f9d
add dword [esp + 0x4c], 0x2cec7731
sub dword [esp + 0x14c], 0x6ae7ebbc
add dword [esp + 0x50], 0x3a9bafc9
sub dword [esp + 0x104], 0x662966e0
sub dword [esp + 0x118], 0x29f5b604
add dword [esp + 0x64], 0x63eb79ab
sub dword [esp + 0xc4], 0x38908ca4
sub dword [esp + 0xf4], 0x1486facd
sub dword [esp + 0x6c], 0x7cd6885d
sub dword [esp + 0x184], 0x21c0c196
add dword [esp + 0x9c], 0x44f9e5cc
add dword [esp + 0x78], 0x75d6db5a
add dword [esp + 0x16c], 0x3ae3e910
sub dword [esp + 0x30], 0x2f4ca858
sub dword [esp + 0x150], 0x55760dcf
add dword [esp + 0x24], 0x4e812b30
add dword [esp + 0x30], 0x750a435d
add dword [esp + 0xd4], 0x62424d1e
add dword [esp + 0x174], 0x400114c6
add dword [esp + 0x80], 0x4c8f079a
add dword [esp + 0x18c], 0x5868484c
add dword [esp + 0x138], 0x59f45b09
add dword [esp + 0x64], 0x59fa3454
add dword [esp + 0x10c], 0xf0a9628
add dword [esp + 0x44], 0x4f9f9799
sub dword [esp + 0x1ac], 0x771b117a
sub dword [esp + 0xf8], 0x1e836d6f
add dword [esp + 0xe8], 0x52c60caa
add dword [esp + 0x140], 0x40933101
add dword [esp + 0x12c], 0x2bb3b6bc
add dword [esp + 0x1a4], 0x1abe78a9
add dword [esp + 0xf8], 0x571032f8
add dword [esp + 0xd4], 0x706b9b42
add dword [esp + 0x50], 0x508d1fd2
add dword [esp + 0x88], 0x113fa124
add dword [esp + 0xc8], 0x6257553
add dword [esp + 0x90], 0x3008ca71
sub dword [esp + 0x110], 0x33204145
sub dword [esp + 0x134], 0x56fb6785
sub dword [esp + 0xa4], 0x53a8035
sub dword [esp + 0x8c], 0x7fd0884
add dword [esp + 0x68], 0x25456aa6
sub dword [esp + 0x190], 0x5c2ff7e2
sub dword [esp + 0x5c], 0x20eda0a2
sub dword [esp + 0x110], 0x725bd13f
add dword [esp + 0x1b0], 0x1730d9c8
sub dword [esp + 0x78], 0x23913c5c
sub dword [esp + 0x180], 0x2716fffd
add dword [esp + 0xa8], 0x36dc582b
add dword [esp + 0xc4], 0xfc057ba
add dword [esp + 0x38], 0x1d715b85
add dword [esp + 0x94], 0x11cce6e9
sub dword [esp + 0x154], 0x21a26e3b
add dword [esp + 0x1a4], 0x3588475a
add dword [esp + 0x168], 0x78eba691
sub dword [esp + 0xd4], 0x3bc305d8
add dword [esp + 0x124], 0x1eed8df6
sub dword [esp + 0x1a0], 0x50399f6b
sub dword [esp + 0x170], 0xb2b711b
add dword [esp + 0xf8], 0x2ede781e
sub dword [esp + 0x158], 0x7ef59227
add dword [esp + 0x34], 0x5c581f79
add dword [esp + 0xec], 0x655faf4b
sub dword [esp + 0x168], 0x5a69272d
add dword [esp + 0x20], 0x12e783cc
sub dword [esp + 0xfc], 0xdcf5fcd
sub dword [esp + 0x64], 0x5b81e92
sub dword [esp + 0x130], 0x2d68caba
add dword [esp + 0x40], 0x3fb80edd
add dword [esp + 0x9c], 0x7fa389b5
sub dword [esp + 0xb0], 0x4b51148a
add dword [esp + 0x148], 0x263016d6
sub dword [esp + 0xdc], 0x4a09a1a6
add dword [esp + 0x164], 0x626190c3
add dword [esp + 0x60], 0x533ac4f4
add dword [esp + 0x8c], 0x52978b05
add dword [esp + 0xec], 0x155a7e7
mov eax, dword [esp + 8]
xor eax, ecx
xor eax, edx
cmp dword [0x2b4ac14], 0x516
mov dword [esp + 8], eax
jne 0x4049bf
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
lea edx, [esp + 0x1e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x1c0]
mov ecx, dword [esp + 0xc]
sub edx, eax
add ecx, edx
mov dword [esp + 0x1bc], ecx
mov ecx, dword [esp + 0x10]
mov eax, edx
shr eax, cl
mov dword [esp + 0x1c0], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1d0]
add dword [esp + 8], eax
mov eax, edx
shl eax, 4
add eax, dword [esp + 0x1c8]
xor eax, dword [esp + 0x1bc]
cmp dword [0x2b4ac14], 0x121
mov dword [esp + 0x1bc], eax
jne 0x404a2e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov eax, dword [esp + 0x1bc]
mov ecx, dword [esp + 8]
xor ecx, eax
sub esi, ecx
mov dword [0x44fce0], 0
mov dword [esp + 0x1bc], esi
mov eax, dword [esp + 0x1cc]
sub dword [esp + 0xc], eax
dec dword [esp + 0x1c4]
jne 0x403700
mov eax, dword [esp + 0x5e0]
mov edx, dword [esp + 0x1c0]
pop edi
mov dword [eax], esi
mov dword [eax + 4], edx
pop esi
add esp, 0x5d4
ret 4