Function at 0x4262f0
Capabilities:
Check mutex on windows
Check os version
Copy file
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x491b61
mov eax, dword fs:[0]
push eax
sub esp, 0x9dc
mov eax, dword [0x4b3c40]
xor eax, esp
mov dword [esp + 0x9d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b3c40]
xor eax, esp
push eax
lea eax, [esp + 0x9f0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], esi
call fcn.0041dad0
mov ecx, dword [esi]
mov dword [esp + 0x9f8], 0
call fcn.0041a050
push eax
lea ecx, [esp + 0x6c]
call fcn.00426060
mov eax, dword [esp + 0x7c]
mov edi, dword [eax]
mov ebp, dword [esp + 0x68]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov byte [esp + 0x9f8], 1
mov edi, edi
mov esi, dword [esp + 0x7c]
test ebp, ebp
je 0x42637e
cmp ebp, dword [esp + 0x68]
je 0x426383
call fcn.00446828
cmp edi, esi
je 0x4264e8
mov edx, dword [0x4b5e2c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4b5e2c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x9f8], 2
test ebp, ebp
jne 0x4264d1
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x4263c3
call fcn.00446828
mov eax, dword [edi + 8]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx]
push eax
call fcn.0041d130
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
push eax
call fcn.0040d710
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
cmp dword [esi - 4], 1
mov byte [esp + 0x9f8], 3
jle 0x42640d
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.0040cc90
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00445ddd
add esp, 8
test eax, eax
jl 0x4264de
cmp eax, dword [esi - 8]
jg 0x4264de
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call fcn.0040ede0
mov edx, dword [esp + 0x18]
add esp, 4
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edx
call ebx
cmp eax, 0xffffffff
je 0x426469
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov byte [esp + 0x9f8], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42648d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x9f8], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4264b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebp, ebp
jne 0x4264d9
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x4264ca
call fcn.00446828
mov edi, dword [edi]
jmp 0x426370
mov eax, dword [ebp]
jmp 0x4263b9
mov eax, dword [ebp]
jmp 0x4264c0
push 0x80070057
call fcn.0040c180
mov esi, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esi]
call fcn.0041f900
mov edx, dword [esi + 0x24]
cmp byte [edx + 0x418], bl
jne 0x4265f2
mov eax, dword [esp + 0x44]
mov edi, dword [eax]
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x44]
cmp ebp, ebx
je 0x426522
cmp ebp, dword [esp + 0x30]
je 0x426527
call fcn.00446828
cmp edi, esi
je 0x4265f2
cmp ebp, ebx
jne 0x4265b8
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426548
call fcn.00446828
lea ecx, [edi + 0x224]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f040
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], ebx
jl 0x426580
push str.360tray.exe
push ecx
call fcn.00446934
mov ecx, dword [esp + 0x1c]
add esp, 8
cmp eax, ebx
je 0x426580
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4265c2
lea eax, [ecx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42659c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, ebx
jne 0x4265bd
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x4265b1
call fcn.00446828
mov edi, dword [edi]
jmp 0x426514
mov eax, dword [ebp]
jmp 0x42653e
mov eax, dword [ebp]
jmp 0x4265a7
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x3c]
call fcn.0041c340
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4265f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
call fcn.00439350
add esp, 4
cmp eax, ebx
je 0x426608
lea ecx, [esp + 0x4c]
mov dword [eax], ecx
jmp 0x42660a
xor eax, eax
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x9f8], 4
call fcn.0041c0d0
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x9fc], 5
call fcn.00421280
mov ecx, dword [esp + 0x60]
mov ebp, dword [ecx]
mov esi, dword [esp + 0x4c]
lea esp, [esp]
mov edi, dword [esp + 0x60]
cmp esi, ebx
je 0x42665e
cmp esi, dword [esp + 0x4c]
je 0x426663
call fcn.00446828
cmp ebp, edi
je 0x4266f3
cmp esi, ebx
jne 0x4266bd
call fcn.00446828
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x426680
call fcn.00446828
cmp dword [ebp + 0xc], ebx
jle 0x4266c9
cmp esi, ebx
jne 0x4266c1
call fcn.00446828
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x42669a
call fcn.00446828
cmp esi, ebx
jne 0x4266c5
call fcn.00446828
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x4266af
call fcn.00446828
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x7d0
add eax, dword [ebp + 0xc]
jmp 0x4266cb
mov eax, dword [esi]
jmp 0x426676
mov eax, dword [esi]
jmp 0x426690
mov eax, dword [esi]
jmp 0x4266a5
xor eax, eax
mov ecx, dword [esp + 0x18]
add dword [ecx + 0x14], eax
cmp esi, ebx
jne 0x4266ef
call fcn.00446828
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x4266e7
call fcn.00446828
mov ebp, dword [ebp]
jmp 0x426650
mov eax, dword [esi]
jmp 0x4266dd
mov edi, dword [esp + 0x18]
mov ecx, dword [edi]
call fcn.0041ab40
imul eax, eax, 0x7d0
add dword [edi + 0x14], eax
lea edx, [esp + 0x30]
push edx
mov ecx, edi
call fcn.00423d80
mov esi, eax
call fcn.00421940
cmp esi, ebx
je 0x4267c6
lea ecx, [esp + 0x4c]
call fcn.0041efb0
mov eax, dword [esp + 0x60]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x50]
push ecx
mov dword [esp + 0x68], ebx
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x68]
mov byte [esp + 0x9f8], 6
call fcn.0041df80
mov edx, dword [esp + 0x7c]
push edx
call fcn.00439380
mov eax, dword [esp + 0x6c]
push eax
mov dword [esp + 0x84], ebx
call fcn.00439380
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x4c]
add esp, 8
mov dword [esp + 0x48], ebx
cmp eax, ecx
je 0x4267a5
mov esi, dword [eax]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x426790
push ecx
call fcn.00439380
mov ecx, dword [esp + 0x34]
push ecx
mov dword [esp + 0x4c], ebx
call fcn.00439380
add esp, 8
mov eax, 1
jmp 0x42728c
push ebx
lea ecx, [edi + 0x20]
push 0x4a6c2c
call fcn.0040e110
push str.360ap_setup
push 0x104
lea edx, [esp + 0xd0]
push edx
mov byte [esp + 0xd4], 0
call fcn.00422460
mov dword [esp + 0xc0], ebx
lea eax, [esp + 0xc8]
push eax
push ebx
push ebx
mov byte [esp + 0xa04], 7
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc4], esi
cmp esi, 0xb7
je 0x426840
cmp esi, 5
je 0x426840
mov ecx, dword [esp + 0xc0]
mov al, 1
jmp 0x426864
mov ecx, dword [esp + 0xc0]
cmp ecx, ebx
je 0x426862
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc4]
xor ecx, ecx
mov dword [esp + 0xc0], ecx
xor al, al
xor edx, edx
test al, al
sete dl
mov eax, edx
cmp eax, ebx
je 0x426936
cmp esi, ebx
jne 0x426892
cmp ecx, ebx
je 0x426892
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x4c]
call fcn.0041efb0
mov ecx, dword [esp + 0x60]
push ecx
call fcn.00439380
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x68], ebx
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x68]
mov byte [esp + 0x9f8], 8
call fcn.0041df80
mov eax, dword [esp + 0x7c]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x6c]
push ecx
mov dword [esp + 0x84], ebx
call fcn.00439380
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x4c]
add esp, 8
mov dword [esp + 0x48], ebx
cmp eax, ecx
je 0x426915
mov esi, dword [eax]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x426900
push ecx
call fcn.00439380
mov edx, dword [esp + 0x34]
push edx
mov dword [esp + 0x4c], ebx
call fcn.00439380
add esp, 8
mov eax, 0x14
jmp 0x42728c
push 0x410
lea eax, [esp + 0x1d0]
push ebx
push eax
call fcn.004453c0
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebp + 0x24]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x495a30
add ecx, 8
push ecx
lea edx, [esp + 0x1d4]
push edx
call edi
xor esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp word [esp + 0x1cc], bx
je 0x42698f
inc esi
cmp word [esp + esi*2 + 0x1cc], bx
jne 0x426984
push esi
lea ecx, [esp + 0x24]
call fcn.00421e50
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1cc]
movzx eax, word [edx]
mov word [ecx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x4269a4
mov dword [esp + 0x24], esi
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x9fc], 9
call fcn.00435dc0
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00446995
push 0x410
lea edx, [esp + 0x5e8]
push ebx
push edx
call fcn.004453c0
mov eax, dword [ebp + 0x24]
add esp, 0x14
push str.7z.dll
add eax, 8
push eax
lea ecx, [esp + 0x5e4]
push ecx
call edi
mov eax, dword [ebp + 0x18]
push ebx
lea edx, [esp + 0x5e0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [esp + 0x2c], ebx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x9fc], 0xa
call fcn.00434db0
test al, al
jne 0x426b16
lea ecx, [esp + 0x2c]
mov byte [esp + 0x9f8], 7
call fcn.00434c90
cmp dword [esp + 0xc4], ebx
jne 0x426a6f
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x426a6f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x4c]
call fcn.0041efb0
mov ecx, dword [esp + 0x60]
push ecx
call fcn.00439380
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x68], ebx
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x68]
mov byte [esp + 0x9f8], 0xb
call fcn.0041df80
mov eax, dword [esp + 0x7c]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x6c]
push ecx
mov dword [esp + 0x84], ebx
call fcn.00439380
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x4c]
add esp, 8
mov dword [esp + 0x48], ebx
cmp eax, ecx
je 0x426af5
lea ecx, [ecx]
mov esi, dword [eax]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x426ae0
push ecx
call fcn.00439380
mov edx, dword [esp + 0x34]
push edx
mov dword [esp + 0x4c], ebx
call fcn.00439380
add esp, 8
mov eax, 2
jmp 0x42728c
mov ecx, dword [ebp]
call fcn.00419e00
fstp dword [esp + 0x1c]
mov eax, dword [esp + 0x60]
mov eax, dword [eax]
mov esi, dword [esp + 0x4c]
mov edi, eax
mov edi, edi
mov ebp, dword [esp + 0x60]
cmp esi, ebx
je 0x426b3e
cmp esi, dword [esp + 0x4c]
je 0x426b43
call fcn.00446828
cmp edi, ebp
je 0x426d5c
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 8], 0
jne 0x426d5c
cmp esi, ebx
jne 0x426c56
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426b72
call fcn.00446828
cmp dword [edi + 0xc], ebx
je 0x426c3a
cmp esi, ebx
jne 0x426c5d
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426b94
call fcn.00446828
cmp esi, ebx
jne 0x426c64
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426bad
call fcn.00446828
mov edx, dword [edi + 0x1c]
fld dword [edi + 0x18]
push edx
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x28]
fstp dword [esp]
call fcn.004218b0
add esp, 0xc
test al, al
je 0x426c3a
cmp esi, ebx
jne 0x426c6b
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426be7
call fcn.00446828
mov eax, dword [edi + 8]
mov ebp, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.004253d0
cmp esi, ebx
jne 0x426c72
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426c10
call fcn.00446828
lea edx, [edi + 0x20]
push edx
mov ecx, ebp
call fcn.00423d80
cmp eax, ebx
jne 0x426c7e
cmp esi, ebx
jne 0x426c76
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426c34
call fcn.00446828
mov eax, dword [edi + 0xc]
add dword [ebp + 0x10], eax
cmp esi, ebx
jne 0x426c7a
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426c4f
call fcn.00446828
mov edi, dword [edi]
jmp 0x426b30
mov eax, dword [esi]
jmp 0x426b68
mov eax, dword [esi]
jmp 0x426b8a
mov eax, dword [esi]
jmp 0x426ba3
mov eax, dword [esi]
jmp 0x426bdd
mov eax, dword [esi]
jmp 0x426c06
mov eax, dword [esi]
jmp 0x426c2a
mov eax, dword [esi]
jmp 0x426c45
lea ecx, [esp + 0x2c]
mov byte [esp + 0x9f8], 7
call fcn.00434c90
cmp dword [esp + 0xc4], ebx
jne 0x426cb8
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x426cb8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x4c]
call fcn.0041efb0
mov edx, dword [esp + 0x60]
push edx
call fcn.00439380
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x68], ebx
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x68]
mov byte [esp + 0x9f8], 0xc
call fcn.0041df80
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00439380
mov edx, dword [esp + 0x6c]
push edx
mov dword [esp + 0x84], ebx
call fcn.00439380
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x4c]
add esp, 8
mov dword [esp + 0x48], ebx
cmp eax, ecx
je 0x426d3b
mov esi, dword [eax]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
cmp esi, ecx
jne 0x426d26
push ecx
call fcn.00439380
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x4c], ebx
call fcn.00439380
add esp, 8
mov eax, 3
jmp 0x42728c
lea ecx, [esp + 0x2c]
call fcn.00434c90
push 4
call fcn.00439350
add esp, 4
cmp eax, ebx
je 0x426d7e
lea ecx, [esp + 0x84]
mov dword [eax], ecx
jmp 0x426d80
xor eax, eax
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x9f8], 0xd
call fcn.0041c0f0
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ebx
mov ecx, dword [0x4b5ba8]
mov byte [esp + 0x9f8], 0xe
cmp ecx, ebx
je 0x4271ad
lea edx, [esp + 0x84]
push edx
call fcn.00426290
test eax, eax
jle 0x4271ad
mov edx, dword [esp + 0x84]
xor eax, eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x98]
test edi, edi
je 0x426e3e
cmp edi, dword [esp + 0x84]
je 0x426e43
call fcn.00446828
cmp dword [esp + 0x24], esi
je 0x4271ad
mov eax, dword [0x4b5e2c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4b5e2c
call edx
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
mov eax, dword [0x4b5e2c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4b5e2c
mov byte [esp + 0x9f8], 0xf
call edx
lea ebx, [eax + 0x10]
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x9f8], 0x10
test edi, edi
jne 0x426ee9
call fcn.00446828
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x14]
jne 0x426ea2
call fcn.00446828
mov eax, dword [esi + 8]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x426f5d
cmp dword [ebp + 0xc], 0
jl 0x426f4f
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x426f4f
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x426eed
cmp eax, dword [esi]
jne 0x426eed
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x426f28
mov eax, dword [edi]
jmp 0x426e94
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x42715c
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004449f6
add esp, 0x10
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x426f42
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
add edi, 0x10
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x20]
jmp 0x426f5d
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040e110
test edi, edi
jne 0x427004
call fcn.00446828
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x14]
jne 0x426f7a
call fcn.00446828
mov edi, dword [esi]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x98]
mov dword [esp + 0x24], edi
test ebp, ebp
je 0x426f98
cmp ebp, dword [esp + 0x84]
je 0x426f9d
call fcn.00446828
cmp edi, esi
je 0x427161
test ebp, ebp
jne 0x42700b
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x426fba
call fcn.00446828
mov eax, dword [edi + 8]
lea esi, [eax - 0x10]
lea ebp, [ebx - 0x10]
cmp esi, ebp
je 0x427081
cmp dword [ebp + 0xc], 0
lea ebx, [ebp + 0xc]
jl 0x42706f
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42706f
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x427010
cmp eax, dword [esi]
jne 0x427010
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42704b
mov eax, dword [edi]
jmp 0x426f6c
mov eax, dword [ebp]
jmp 0x426fb0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x42715c
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004449f6
add esp, 0x10
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x427062
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
lea ebx, [edi + 0x10]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
jmp 0x427081
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.0040e110
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4270e9
call fcn.00446828
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x42709a
call fcn.00446828
mov ecx, dword [edi]
mov esi, dword [esp + 0x14]
push 0
lea edx, [esp + 0xa4]
push edx
push esi
mov dword [esp + 0x30], ecx
call fcn.00437d30
push 0
lea eax, [esp + 0xc0]
push eax
push ebx
call fcn.00437d30
lea ecx, [esp + 0xc8]
push ecx
lea edx, [esp + 0xbc]
push edx
call fcn.00438c90
add esp, 0x20
test al, al
je 0x4270ed
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42710b
mov eax, dword [eax]
jmp 0x427090
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push esi
call edi
test eax, eax
jne 0x42710b
push 4
push ebx
push esi
call edi
mov eax, dword [esp + 0x18]
mov byte [eax + 9], 1
lea eax, [ebx - 0x10]
mov byte [esp + 0x9f8], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42712f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x9f8], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426e26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x426e26
call fcn.0040cc80
lea eax, [ebx - 0x10]
mov byte [esp + 0x9f8], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427185
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x9f8], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4271ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x9f8], 0x11
call fcn.0041df80
mov ecx, dword [esp + 0x98]
push ecx
call fcn.00439380
mov edx, dword [esp + 0x88]
xor esi, esi
push edx
mov dword [esp + 0xa0], esi
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x9f8], 7
call fcn.00434c90
cmp dword [esp + 0xc4], esi
jne 0x427221
mov eax, dword [esp + 0xc0]
cmp eax, esi
je 0x427221
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x4c]
call fcn.0041efb0
mov ecx, dword [esp + 0x60]
push ecx
call fcn.00439380
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x68], esi
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x68]
mov byte [esp + 0x9f8], 0x12
call fcn.0041df80
mov eax, dword [esp + 0x7c]
push eax
call fcn.00439380
mov ecx, dword [esp + 0x6c]
push ecx
mov dword [esp + 0x84], esi
call fcn.00439380
add esp, 8
lea ecx, [esp + 0x30]
call fcn.0041bee0
mov edx, dword [esp + 0x30]
push edx
call fcn.00439380
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x9f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9d8]
xor ecx, esp
call fcn.004453a3
add esp, 0x9e8
ret