Function at 0x411a80
Capabilities:
Create thread
Move file

Disassembly:
sub esp, 0x184
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, ecx
push edi
push 0
push 0
mov eax, dword [ebp + 0xc]
push 0x1032
push eax
call esi
cmp eax, 1
mov dword [esp + 0x1c], eax
jl 0x411f9f
mov eax, dword [ebp + 0xc4]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x411b20
mov ecx, dword [ebp + 0xcc]
mov dword [ebp + 0xd0], 1
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7f02
push 0
call ebx
push eax
call edi
mov edx, dword [ebp + 0xc4]
push 0x2710
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x411b0a
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [ebp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 0xbc]
xor eax, eax
cmp ecx, eax
mov dword [ebp + 0xc4], eax
mov dword [ebp + 0xd4], eax
je 0x411b7d
mov ecx, dword [ebp + 0xb4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp + 0xbc]
push 0xbb8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x411b66
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [ebp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0xbc], 0
mov ecx, dword [ebp + 0xc]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call esi
cmp eax, 0xffffffff
jne 0x411b9f
mov edx, dword [ebp + 0xc]
push 2
push eax
push 0x100c
push edx
call esi
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0x1004
push eax
call esi
push 0x7f02
push 0
mov dword [esp + 0x28], 0
call ebx
push eax
call edi
lea eax, [ebp + 0x20c]
mov ebx, 1
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x24]
or edi, 0xffffffff
call fcn.00424d70
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], 0
test eax, eax
jle 0x411d51
mov dword [esp + 0x14], eax
jmp 0x411c02
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp + 0xc]
push 2
push edi
push 0x100c
push ecx
call esi
lea edx, [esp + 0x64]
mov dword [esp + 0x18], eax
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0xc]
push edx
push 0
push 0x1005
push eax
mov dword [esp + 0x74], 4
mov dword [esp + 0x7c], 0
call esi
test eax, eax
je 0x411d42
mov edi, dword [esp + 0x84]
test edi, edi
je 0x411d42
mov eax, dword [edi + 8]
cmp eax, 3
je 0x411d42
cmp eax, 2
je 0x411d42
cmp eax, ebx
jne 0x411c6e
mov dword [esp + 0x20], ebx
mov ecx, dword [edi + 0x68]
lea eax, [ebp + 0x20c]
push ecx
lea edx, [esp + 0x90]
push eax
push edx
call fcn.0044a2d0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
add esp, 0xc
lea ecx, [eax + 1]
cmp edx, ecx
jne 0x411cfd
mov edx, dword [esp + 0x38]
add eax, edx
lea eax, [eax*4 + 4]
push eax
call fcn.004be967
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
mov ebx, eax
lea ecx, [ecx*4 + 4]
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x2c]
push eax
call fcn.004be975
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x8c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 8
add eax, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], eax
mov ebx, 1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x8c]
mov dword [edx + eax*4], edi
mov eax, dword [esp + 0x2c]
inc eax
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x10]
lea eax, [edx + eax + 1]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 8]
cmp eax, ebx
jne 0x411d42
mov eax, dword [0x4eb340]
test eax, eax
je 0x411d42
mov dword [esp + 0x198], ebx
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x411bfe
mov eax, dword [ebp + 0x994]
test eax, eax
je 0x411d6c
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
call fcn.00408c90
jmp 0x411f96
mov edx, dword [esp + 0x10]
push edx
call fcn.004be967
mov ecx, dword [esp + 0x30]
mov esi, eax
add esp, 4
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x14], esi
test ecx, ecx
mov dword [esp + 0x10], eax
jle 0x411e13
jmp 0x411d99
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x411daa
test eax, eax
jl 0x411daa
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + eax*4]
jmp 0x411dac
xor eax, eax
mov edx, dword [eax + 0x68]
lea eax, [ebp + 0x20c]
push edx
push eax
lea eax, [esp + 0x94]
push eax
call fcn.0044a2d0
add esp, 0xc
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x14]
mov ecx, eax
lea esi, [esp + 0x8c]
lea edi, [ebx + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + eax], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
inc ebx
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x411d95
mov esi, dword [esp + 0x14]
mov byte [ebx + esi], 0
mov ecx, dword [ebp + 8]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [ebp + 0x208]
xor ebx, ebx
mov edi, dword [edx + 0x30]
cmp edi, ebx
je 0x411e51
mov ecx, edi
call fcn.0045aeb0
test eax, eax
je 0x411e51
mov ecx, dword [ebp + 0x208]
call fcn.00460e50
push 1
mov ecx, edi
call fcn.0045a850
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], 3
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xa
mov dword [esp + 0x4c], esi
jge 0x411e81
or byte [esp + 0x54], 4
cmp dword [esp + 0x19c], ebx
je 0x411e8f
or byte [esp + 0x54], 0x40
cmp dword [esp + 0x198], ebx
jne 0x411e9d
or byte [esp + 0x54], 0x10
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push esi
call fcn.004be975
add esp, 4
lea edx, [esp + 0x24]
mov ecx, ebp
push 1
push edx
call fcn.0041ff00
mov ecx, ebp
call fcn.00417060
cmp dword [esp + 0x20], ebx
je 0x411ef9
cmp dword [0x4eb434], ebx
je 0x411ef9
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0xb
push eax
call esi
push 1
push ebx
mov ecx, ebp
call fcn.0041ce90
mov ecx, dword [ebp + 0x10]
push ebx
push 1
push 0xb
push ecx
call esi
cmp dword [0x4eb21c], ebx
je 0x411f0a
push 1
mov ecx, ebp
call fcn.00412600
mov ecx, ebp
call fcn.004204e0
mov dword [ebp + 0x428], ebx
mov eax, dword [0x4eb46c]
cmp eax, ebx
je 0x411f96
cmp dword [ebp + 0xbc], ebx
je 0x411f6f
mov edx, dword [ebp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp + 0xbc]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x411f56
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
mov ecx, dword [ebp + 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov dword [ebp + 0xbc], ebx
cmp eax, ebx
jne 0x411f96
mov edx, dword [ebp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
push 0x411fb0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0xbc], eax
lea ecx, [esp + 0x24]
call fcn.00424ec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x184
ret 8