Function at 0x415fa0
Capabilities:
Access peb ldr_data
Check if file exists
Delete file
Get file attributes
Get ntdll base address
Get process heap force flags
Move file

Disassembly:
push 0xffffffffffffffff
push 0x41b45c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xf4]
sub eax, 0x10
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.004012c0
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], ebx
call sub.MFC70U.DLL_Ordinal_977
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
push 0x41e710
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.00404410
mov ecx, dword [edi + 0x180]
mov eax, 1
cmp ecx, eax
mov byte [esp + 0x30], 2
jne 0x416024
cmp dword [esi - 0xc], ebx
je 0x416024
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x17c]
push ecx
lea esi, [edi + 0x17c]
sub eax, 0x10
mov dword [esp + 0x28], esp
mov ebp, esp
push eax
call fcn.004012c0
add eax, 0x10
mov dword [ebp], eax
add esp, 4
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call fcn.00414c30
push eax
mov ecx, esi
mov byte [esp + 0x34], 3
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416085
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 0x178]
mov ebp, 1
cmp eax, ebp
jne 0x4160a9
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x4160a9
push esi
lea ecx, [esp + 0x14]
call fcn.00401510
mov dword [esp + 0x20], ebp
push 0x41e710
push str.LastSavePath
push 0x41d0b0
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call sub.MFC70U.DLL_Ordinal_2909
mov edx, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov byte [esp + 0x34], 4
call ebx
cmp eax, 0xffffffff
je 0x4160e9
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.00401510
mov eax, dword [edi + 0x170]
mov esi, 1
cmp eax, esi
jne 0x4162f9
mov eax, dword [edi + 0x174]
lea ebp, [edi + 0x174]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4162f9
push ebp
lea ecx, [esp + 0x18]
call fcn.00401510
cmp dword [esp + 0x20], esi
jne 0x4162f9
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push ebp
push edx
call fcn.00403d00
add esp, 0xc
lea esi, [edi + 0x104]
push eax
mov ecx, esi
mov byte [esp + 0x34], 5
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416171
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x10]
lea ecx, [edi + 0x108]
push eax
call fcn.00401510
lea ecx, [edi + 0x10c]
push ebp
call fcn.00401510
mov eax, dword [esi]
push eax
call ebx
cmp eax, 0xffffffff
je 0x41626f
mov eax, dword [edi + 0x18c]
cmp eax, 2
je 0x4161cc
cmp eax, 3
je 0x4161cc
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41626f
push str._cannot_be_replaced.__It_may_be_read_only_or_have_been_opened._nPlease_choose_a_new_file_name.
push esi
lea ecx, [esp + 0x2c]
push ecx
jmp 0x416b5f
push str.3021
lea edx, [edi + 0x100]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00403db0
add esp, 0xc
add edi, 0x19c
push eax
mov ecx, edi
mov byte [esp + 0x34], 6
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41621b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x416cda
push 0x41e710
mov ecx, edi
call fcn.00401af0
push str._cannot_be_replaced.__It_may_have_been_opened._nPlease_choose_a_new_file_name.
push esi
lea ecx, [esp + 0x2c]
push ecx
jmp 0x416b5f
mov ecx, dword [ecx + 0x20]
push 0x30
push str.Save_As
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x24]
jmp 0x416c25
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416292
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x30], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4162b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4162d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x416d98
mov eax, dword [edi + 0x198]
test eax, eax
jne 0x4163fc
push 4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push str..pdf
push eax
call dword [sym.imp.MSVCR70.dll__wcsicmp]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x24]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41634b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x416398
push str..pdf
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416398
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 8
je 0x4163e5
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
push ecx
push str.Adobe_PDF_File__.pdf_.pdfPNG__.png_.pngJPEG__.jpg__.jpeg_.jpg__.jpegBMP__.bmp_.bmpTIFF__.tif__.tiff_.tif__.tiffGIF__.gif_.gif
push 0x801004
push edx
push 0
push 0
mov ecx, eax
call fcn.00401d50
mov ecx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [ecx + 0x30], str.Save_PDF_File_As
jmp 0x4168f5
xor eax, eax
mov esi, eax
mov eax, 0x74
mov ecx, dword [eax]
mov dword [ecx + 0x30], str.Save_PDF_File_As
jmp 0x4168f5
mov eax, dword [edi + 0x25c]
mov esi, dword [sym.imp.MSVCR70.dll__wcsicmp]
push 0x41d8f0
push eax
call esi
add esp, 8
test eax, eax
jne 0x41650f
push 4
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push str..png
push eax
call esi
add esp, 8
test eax, eax
mov eax, dword [esp + 0x24]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41645b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x4164a8
push str..png
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 9
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4164a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 0xa
je 0x4164f8
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
push ecx
push str.PNG__.png_.pngAdobe_PDF_File__.pdf_.pdfPNG__.png_.pngJPEG__.jpg__.jpeg_.jpg__.jpegBMP__.bmp_.bmpTIFF__.tif__.tiff_.tif__.tiffGIF__.gif_.gif
push 0x801004
push edx
push 0x422d64
push 0
mov ecx, eax
call fcn.00401d50
mov ecx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [ecx + 0x30], str.Save_PNG_Image_File_As
jmp 0x4168f5
xor eax, eax
mov esi, eax
mov eax, 0x74
mov ecx, dword [eax]
mov dword [ecx + 0x30], str.Save_PNG_Image_File_As
jmp 0x4168f5
mov eax, dword [edi + 0x25c]
push 0x41d8ac
push eax
call esi
add esp, 8
test eax, eax
jne 0x416645
push 4
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push str..jpg
push eax
mov byte [esp + 0x38], 0xb
call esi
add esp, 8
test eax, eax
je 0x416581
push 5
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push str..jpeg
push eax
call esi
add esp, 8
test eax, eax
lea ecx, [esp + 0x24]
setne bl
call fcn.00401430
test bl, bl
je 0x416581
mov bl, 1
jmp 0x416583
xor bl, bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4165a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x4165de
push str..jpg
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 0xc
call fcn.00401510
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 4
call fcn.00401430
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 0xd
je 0x41662e
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
push edx
push str.JPEG__.jpg__.jpeg_.jpg__.jpegAdobe_PDF_File__.pdf_.pdfPNG__.png_.pngJPEG__.jpg__.jpeg_.jpg__.jpegBMP__.bmp_.bmpTIFF__.tif__.tiff_.tif__.tiffGIF__.gif_.gif
push 0x801004
push ecx
push 0x4232a8
push 0
mov ecx, eax
call fcn.00401d50
mov edx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [edx + 0x30], str.Save_JPG_Image_File_As
jmp 0x4168f5
xor eax, eax
mov esi, eax
mov eax, 0x74
mov edx, dword [eax]
mov dword [edx + 0x30], str.Save_JPG_Image_File_As
jmp 0x4168f5
mov eax, dword [edi + 0x25c]
push 0x41d868
push eax
call esi
add esp, 8
test eax, eax
jne 0x416728
push 4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push str..bmp
push eax
call esi
add esp, 8
test eax, eax
lea ecx, [esp + 0x24]
setne bl
call fcn.00401430
test bl, bl
je 0x4166c1
push str..bmp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 0xe
call fcn.00401510
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 4
call fcn.00401430
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 0xf
je 0x416711
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
push ecx
push str.BMP__.bmp_.bmpAdobe_PDF_File__.pdf_.pdfPNG__.png_.pngJPEG__.jpg__.jpeg_.jpg__.jpegBMP__.bmp_.bmpTIFF__.tif__.tiff_.tif__.tiffGIF__.gif_.gif
push 0x801004
push edx
push 0x4232a0
push 0
mov ecx, eax
call fcn.00401d50
mov ecx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [ecx + 0x30], str.Save_BMP_Image_File_As
jmp 0x4168f5
xor eax, eax
mov esi, eax
mov eax, 0x74
mov ecx, dword [eax]
mov dword [ecx + 0x30], str.Save_BMP_Image_File_As
jmp 0x4168f5
mov eax, dword [edi + 0x25c]
push 0x41d824
push eax
call esi
add esp, 8
test eax, eax
lea ecx, [esp + 0x10]
push 4
jne 0x416849
lea edx, [esp + 0x24]
push edx
call fcn.00401de0
mov eax, dword [eax]
push str..tif
push eax
mov byte [esp + 0x38], 0x10
call esi
add esp, 8
test eax, eax
je 0x41679a
push 5
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
call fcn.00401de0
mov eax, dword [eax]
push 0x41d78c
push eax
call esi
add esp, 8
test eax, eax
lea ecx, [esp + 0x24]
setne bl
call fcn.00401430
test bl, bl
je 0x41679a
mov bl, 1
jmp 0x41679c
xor bl, bl
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.00401430
test bl, bl
je 0x4167e2
push str..tif
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 0x11
call fcn.00401510
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 4
call fcn.00401430
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 0x12
je 0x416832
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
push ecx
push str.TIFF__.tif__.tiff_.tif__.tiffAdobe_PDF_File__.pdf_.pdfPNG__.png_.pngJPEG__.jpg__.jpeg_.jpg__.jpegBMP__.bmp_.bmpTIFF__.tif__.tiff_.tif__.tiffGIF__.gif_.gif
push 0x801004
push edx
push 0x423298
push 0
mov ecx, eax
call fcn.00401d50
mov ecx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [ecx + 0x30], str.Save_TIF_Image_File_As
jmp 0x4168f5
xor eax, eax
mov esi, eax
mov eax, 0x74
mov ecx, dword [eax]
mov dword [ecx + 0x30], str.Save_TIF_Image_File_As
jmp 0x4168f5
lea edx, [esp + 0x28]
push edx
call fcn.00401de0
mov eax, dword [eax]
push str..gif
push eax
call esi
add esp, 8
test eax, eax
lea ecx, [esp + 0x24]
setne bl
call fcn.00401430
test bl, bl
je 0x4168a6
push str..gif
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403db0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 0x13
call fcn.00401510
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 4
call fcn.00401430
push 0x314
call sub.MFC70U.DLL_Ordinal_703
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 0x14
je 0x4168e4
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
push edx
push 0x427038
push 0x801004
push ecx
push 0x423290
push 0
mov ecx, eax
call fcn.00401d50
jmp 0x4168e6
xor eax, eax
mov edx, dword [eax + 0x74]
mov esi, eax
add eax, 0x74
mov dword [edx + 0x30], str.Save_GIF_Image_File_As
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
test edx, edx
mov byte [esp + 0x30], 4
je 0x41690a
mov eax, dword [eax]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edi + 0x198]
mov dword [esi + 0x30c], ecx
lea ebp, [esi + 0x310]
lea ebx, [edi + 0x25c]
push ebx
mov ecx, ebp
call fcn.00401510
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x148]
cmp eax, 1
je 0x4169d3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416960
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x30], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416983
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4169a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4169cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
jmp 0x416da7
mov eax, dword [esi + 0x30c]
push ebp
mov ecx, ebx
mov dword [edi + 0x198], eax
call fcn.00401510
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call sub.MFC70U.DLL_Ordinal_2887
lea ebp, [edi + 0x104]
push eax
mov ecx, ebp
mov byte [esp + 0x34], 0x15
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416a29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call sub.MFC70U.DLL_Ordinal_2551
lea ecx, [edi + 0x108]
push eax
mov byte [esp + 0x34], 0x16
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or ebx, 0xffffffff
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416a6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call sub.MFC70U.DLL_Ordinal_2549
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 0x17
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416aa8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp]
push 0x5c
push eax
call dword [sym.imp.MSVCR70.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x416abf
mov eax, ebx
jmp 0x416ac4
sub eax, dword [ebp]
sar eax, 1
inc eax
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call fcn.00401e40
lea ecx, [edi + 0x10c]
push eax
mov byte [esp + 0x34], 0x18
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416b05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 0x198]
test eax, eax
jne 0x416d1d
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
je 0x416d03
mov eax, dword [edi + 0x18c]
cmp eax, 2
je 0x416c58
cmp eax, 3
je 0x416c58
cmp eax, 1
jne 0x416b7a
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416cda
push str._cannot_be_replaced.__It_may_have_been_opened._nPlease_choose_a_new_file_name.
push ebp
lea eax, [esp + 0x2c]
push eax
call fcn.00403db0
mov ecx, dword [esp + 0x44]
mov eax, dword [eax]
add esp, 0xc
test ecx, ecx
jne 0x416254
jmp 0x416257
push str._already_exists._nDo_you_want_to_replace_it_
lea ecx, [esp + 0x28]
push ebp
push ecx
call fcn.00403db0
mov esi, dword [esp + 0x44]
mov eax, dword [eax]
add esp, 0xc
test esi, esi
jne 0x416b9b
xor ecx, ecx
jmp 0x416b9e
mov ecx, dword [esi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x34
push str.Save_As
push eax
push ecx
call ebx
lea ecx, [esp + 0x24]
mov edi, eax
call fcn.00401430
cmp edi, 6
jne 0x416c2a
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x416be8
push str._is_Read_Only__nPlease_choose_a_new_file_name.
lea edx, [esp + 0x3c]
push ebp
push edx
call fcn.00403db0
mov eax, dword [eax]
add esp, 0xc
test esi, esi
jne 0x416c13
jmp 0x416c16
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416cda
push str._cannot_be_replaced.__It_may_have_been_opened._nPlease_choose_a_new_file_name.
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.00403db0
mov eax, dword [eax]
add esp, 0xc
test esi, esi
je 0x416c16
mov esi, dword [esi + 0x20]
push 0x30
push str.Save_As
push eax
push esi
call ebx
lea ecx, [esp + 0x38]
call fcn.00401430
lea ecx, [esp + 0x18]
call fcn.00401430
lea ecx, [esp + 0x14]
call fcn.00401430
lea ecx, [esp + 0x1c]
call fcn.00401430
lea ecx, [esp + 0x10]
call fcn.00401430
mov eax, 2
jmp 0x416da7
push str.3021
lea ecx, [edi + 0x100]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00403db0
add esp, 0xc
lea esi, [edi + 0x19c]
push eax
mov ecx, esi
mov byte [esp + 0x34], 0x19
call fcn.00401510
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x416ca4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
mov ecx, dword [ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x416cda
push 0x41e710
mov ecx, esi
call fcn.00401af0
push str._cannot_be_replaced.__It_may_have_been_opened._nPlease_choose_a_new_file_name.
push ebp
lea ecx, [esp + 0x2c]
push ecx
jmp 0x416b5f
lea ecx, [esp + 0x18]
call fcn.00401430
lea ecx, [esp + 0x14]
call fcn.00401430
lea ecx, [esp + 0x1c]
call fcn.00401430
lea ecx, [esp + 0x10]
call fcn.00401430
jmp 0x416da2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x416d35
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416d3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x30], 1
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416d61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416d83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x416da2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4