Function at 0x40d3d0
Capabilities:
Copy file
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x120
mov esi, esp
mov dword [esi + 0x5c], 0x4bbc7b98
jmp 0x40d400
mov dword [esi + 0x5c], 0x6f0882b9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x5c]
cmp eax, 0x7fcdece3
jg 0x40d550
cmp eax, 0x7ad53c91
jg 0x40d560
cmp eax, 0x6f0882b8
jg 0x40d570
cmp eax, 0x840d93ca
jg 0x40d595
cmp eax, 0x82cc3118
jne 0x40d400
mov eax, dword [esi + 0xbc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xc0]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xbc]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00404510
add esp, 8
mov eax, dword [esi + 0x100]
mov eax, dword [eax]
mov ecx, dword [esi + 0xb8]
mov edx, dword [esi + 0xc0]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xbc]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xbc]
mov edx, dword [esi + 0x100]
mov edi, 0x104
sub edi, dword [edx]
mov edx, dword [esi + 0xc0]
mov ebx, dword [esi + 0x100]
mov ebx, dword [ebx]
lea edx, [edx + ebx*2]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], edx
call fcn.004031a0
add esp, 0x10
mov eax, dword [0x465a30]
mov ecx, dword [esi + 0xc0]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], 0
call eax
mov ecx, dword [esi + 0x6c]
mov dword [ecx], eax
mov dword [esi + 0x5c], 0x3ce160df
jmp 0x40d400
cmp eax, 0x7fcdece4
jne 0x40d400
jmp 0x40d3ed
cmp eax, 0x7ad53c92
jne 0x40d400
jmp 0x40f182
cmp eax, 0x6f0882b9
jne 0x40d400
mov ecx, dword [esi + 0x68]
mov eax, 0x840d93cb
cmp dword [ecx], 0
jne 0x40d58d
mov eax, 0x1cc9a116
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x90bb0813
jg 0x40d5c4
cmp eax, 0x840d93cb
jne 0x40d400
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x5c], 0x1cc9a116
jmp 0x40d400
cmp eax, 0x94aa696e
jg 0x40d5f2
cmp eax, 0x90bb0814
jne 0x40d400
mov al, byte [esi + 0x11a]
test al, al
mov eax, 0x3b98c6aa
jne 0x40d5ea
mov eax, 0x69dd2fc3
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x69dd2fc2
jg 0x40d7c6
cmp eax, 0x6955e847
jg 0x40d81f
cmp eax, 0x648a3bd8
jg 0x40d904
cmp eax, 0x5f3df4d0
jg 0x40d91b
cmp eax, 0x519a7ef5
jg 0x40e589
cmp eax, 0x4ed2c9dd
jg 0x40eaa0
cmp eax, 0x4bbc7b97
jg 0x40eab0
cmp eax, 0x4b4a0113
jg 0x40eac7
cmp eax, 0x4a6d535a
jg 0x40eb6c
cmp eax, 0x3ce160de
jg 0x40eb7c
cmp eax, 0x3b98c6a9
jg 0x40eba1
cmp eax, 0x325ea0d9
jg 0x40ebb1
cmp eax, 0x2f2ee7c1
jg 0x40ebc8
cmp eax, 0x2d7e1c52
jg 0x40ec05
cmp eax, 0x257b86d4
jg 0x40ec1c
cmp eax, 0x1ee4bee6
jg 0x40ec33
cmp eax, 0x1cc9a115
jg 0x40ec5b
cmp eax, 0x18b943db
jg 0x40ec80
cmp eax, 0x173f49f2
jg 0x40eca0
cmp eax, 0x13f01d07
jg 0x40ecf3
cmp eax, 0x123af38b
jg 0x40ed96
cmp eax, 0xdfee6f9
jg 0x40eda6
cmp eax, 0x9024f09
jg 0x40edce
cmp eax, 0x89252c3
jg 0x40ee22
cmp eax, 0x54460c9
jg 0x40ee4a
cmp eax, 0x14fb8d6
jg 0x40ee6a
cmp eax, 0xf6d3f59c
jg 0x40eefe
cmp eax, 0xeabc3306
jg 0x40ef26
cmp eax, 0xe5b087fc
jg 0x40ef6f
cmp eax, 0xde2e11d8
jg 0x40f108
cmp eax, 0xd7a3749a
jg 0x40f14d
cmp eax, 0xc3823c1f
jg 0x40f177
cmp eax, 0xb6a25a0c
jg 0x40f1b4
cmp eax, 0xb457d1d2
jg 0x40f1f1
cmp eax, 0xb047ff79
jg 0x40f22c
cmp eax, 0xaadae34b
jg 0x40f84a
cmp eax, 0xa8e1b793
jg 0x40f9ac
cmp eax, 0xa75479e4
jg 0x40f9d7
cmp eax, 0x94aa696f
je 0x40fb66
cmp eax, 0x94cf1058
jne 0x40fb72
mov al, byte [esi + 0x11b]
test al, al
mov eax, 0x7ad53c92
jne 0x40d7be
mov eax, 0x9024f0a
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x69dd2fc3
jne 0x40d400
mov eax, dword [esi + 0xd4]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00403070
add esp, 8
mov ecx, dword [esi + 0xf4]
mov dword [ecx], eax
mov eax, dword [esi + 0x10c]
sub esp, 4
mov dword [esp], eax
call fcn.0040c4e0
add esp, 4
test eax, eax
mov eax, 0x13f01d08
jne 0x40d817
mov eax, 0xdfee6fa
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x6955e848
jne 0x40d400
mov eax, dword [esi + 0xdc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xdc]
sub esp, 0x10
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._q__u
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xc0]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xc0]
mov edx, dword [esi + 0xdc]
add edx, 0xc
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0xfe
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0xdc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x1c], 0
mov eax, dword [0x465a38]
mov ecx, dword [esi + 0x70]
sub esp, 4
mov dword [esp], ecx
call eax
cmp eax, 1
mov eax, 0x257b86d5
jne 0x40d8fc
mov eax, 0x975636d3
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x648a3bd9
jne 0x40d400
mov dword [esi + 0x5c], 0x82cc3118
jmp 0x40d400
cmp eax, 0x5f3df4d1
jne 0x40d400
mov eax, dword [0x465a24]
mov ecx, dword [0x465864]
mov edx, dword [0x46588c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x74]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x465874]
mov edx, dword [0x46588c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x78]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x465878]
mov edx, dword [0x46588c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x7c]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x465864]
mov edx, dword [0x465888]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x80]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x465858]
mov edx, dword [0x465898]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x84]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x465864]
mov edx, dword [0x46589c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x88]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x4658a8]
mov edx, dword [0x4658a0]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x8c]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x4658a4]
mov edx, dword [0x4658a0]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x90]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a24]
mov ecx, dword [0x4658a4]
mov edx, dword [0x46588c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
mov ebx, dword [esi + 0x94]
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
call eax
mov eax, dword [0x465a20]
mov ecx, dword [esi + 0x6c]
mov ecx, dword [ecx]
sub esp, 4
mov dword [esp], ecx
call eax
mov edi, dword [esi + 0xe4]
call fcn.00412e5f
and eax, 0xf
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00413814
add esp, 0xc
mov eax, dword [esi + 0xe4]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xf4]
mov dword [ecx], eax
mov eax, dword [esi + 0xf4]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [esi + 0xf4]
mov dword [edx], ecx
mov ecx, dword [esi + 0xe4]
mov word [ecx + eax*2], 0x2e
mov eax, dword [esi + 0xe4]
mov ecx, dword [esi + 0xf4]
mov ecx, dword [ecx]
lea edi, [eax + ecx*2]
call fcn.00412e5f
and eax, 1
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00413814
add esp, 0xc
mov eax, dword [esi + 0xe4]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xf4]
mov dword [ecx], eax
mov eax, dword [esi + 0xf4]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [esi + 0xf4]
mov dword [edx], ecx
mov ecx, dword [esi + 0xe4]
mov word [ecx + eax*2], 0x2e
mov eax, dword [esi + 0xe4]
mov ecx, dword [esi + 0xf4]
mov ecx, dword [ecx]
lea edi, [eax + ecx*2]
call fcn.00412e5f
and eax, 5
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00413814
add esp, 0xc
mov eax, dword [esi + 0xe4]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xf4]
mov dword [ecx], eax
mov eax, dword [esi + 0xf4]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [esi + 0xf4]
mov dword [edx], ecx
mov ecx, dword [esi + 0xe4]
mov word [ecx + eax*2], 0x2e
mov eax, dword [esi + 0xe4]
mov ecx, dword [esi + 0xf4]
mov ecx, dword [ecx]
lea edi, [eax + ecx*2]
call fcn.00412e5f
and eax, 0xc
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 0xa
call fcn.00413814
add esp, 0xc
mov eax, dword [esi + 0xe4]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xf4]
mov dword [ecx], eax
mov eax, dword [0x41d134]
movzx eax, byte [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [0x41d134]
movzx eax, byte [eax + ecx + 1]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [0x41d134]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx + 2]
mov edx, dword [0x41d134]
inc edx
mov edi, dword [esi + 0xec]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.00402600
add esp, 0x14
mov eax, dword [0x465a1c]
mov ecx, dword [0x465880]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov ecx, dword [esi + 0x98]
mov dword [ecx], eax
mov eax, dword [0x465a14]
mov ecx, dword [0x4658b0]
mov edx, dword [0x465860]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0xc], 0
call eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xe4]
mov edx, dword [0x46587c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xbc]
mov edx, dword [0x465864]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a0c]
mov ecx, dword [0x46585c]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 1
call eax
mov eax, dword [0x465a08]
mov ecx, dword [esi + 0xec]
mov edx, dword [0x4658ac]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0xc], 0x10
call eax
mov eax, dword [0x465a1c]
mov ecx, dword [0x465884]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov ecx, dword [esi + 0x9c]
mov dword [ecx], eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x88]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x88]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a18]
mov ecx, dword [esi + 0x9c]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x78]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x78]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x7c]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x7c]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x74]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x94]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
call fcn.00412e5f
mov ecx, eax
mov edx, 0xcccccccd
mul edx
shr edx, 2
lea eax, [edx + edx*4]
sub ecx, eax
mov eax, dword [ecx*4 + 0x41d138]
mov ecx, dword [esi + 0xac]
mov dword [ecx], eax
mov eax, dword [esi + 0xac]
mov eax, dword [eax]
movzx eax, word [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [esi + 0xac]
mov ecx, dword [ecx]
movzx eax, word [ecx + eax*2 + 2]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [esi + 0xac]
mov ecx, dword [ecx]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx*2 + 4]
mov edx, dword [esi + 0xac]
mov edx, dword [edx]
add edx, 2
mov edi, dword [esi + 0xf8]
mov edi, dword [edi]
mov ebx, dword [esi + 0xb0]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00402a50
add esp, 0x14
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [esi + 0xb0]
mov edx, dword [esi + 0xcc]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xf8]
mov ecx, 0x104
sub ecx, dword [eax]
mov eax, dword [esi + 0xcc]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea eax, [eax + edx*2]
sub esp, 0x10
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [esi + 0xb0]
mov edx, dword [esi + 0xd0]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xf8]
mov ecx, 0x104
sub ecx, dword [eax]
mov eax, dword [esi + 0xd0]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea eax, [eax + edx*2]
sub esp, 0x10
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str.32.exe
call fcn.004031a0
add esp, 0x10
mov eax, dword [0x41d14c]
movzx eax, byte [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [0x41d14c]
movzx eax, byte [eax + ecx + 1]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [0x41d14c]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx + 2]
mov edx, dword [0x41d14c]
inc edx
mov edi, dword [esi + 0xf0]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.00402600
add esp, 0x14
mov eax, dword [0x465a1c]
mov ecx, dword [0x46588c]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov ecx, dword [esi + 0xa0]
mov dword [ecx], eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xcc]
mov edx, dword [0x465864]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xd0]
mov edx, dword [0x46586c]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a10]
mov ecx, dword [0x465868]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], str.Microsoft
call eax
mov eax, dword [0x465a08]
mov ecx, dword [esi + 0xf0]
mov edx, dword [0x4658a4]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0xc], 0x10
call eax
mov eax, dword [0x465a1c]
mov ecx, dword [0x465890]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov ecx, dword [esi + 0xa4]
mov dword [ecx], eax
mov eax, dword [0x465a10]
mov ecx, dword [0x465864]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0x47b2f8
call eax
mov eax, dword [0x465a18]
mov ecx, dword [esi + 0xa4]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x41d150]
movzx eax, word [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [0x41d150]
movzx eax, word [ecx + eax*2 + 2]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [0x41d150]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx*2 + 4]
mov edx, dword [0x41d150]
add edx, 2
mov edi, dword [esi + 0xf8]
mov edi, dword [edi]
mov ebx, dword [esi + 0xe8]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00402a50
add esp, 0x14
mov eax, dword [0x465a1c]
mov ecx, dword [0x465894]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov ecx, dword [esi + 0xa8]
mov dword [ecx], eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xe8]
mov edx, dword [0x465864]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a10]
mov ecx, dword [esi + 0xc8]
mov edx, dword [0x465870]
mov edi, dword [esi + 0x6c]
mov edi, dword [edi]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
mov eax, dword [0x465a18]
mov ecx, dword [esi + 0xa8]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a18]
mov ecx, dword [esi + 0xa0]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x94]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x74]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x90]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x90]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a04]
mov ecx, dword [esi + 0x84]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a00]
mov ecx, dword [esi + 0x84]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a18]
mov ecx, dword [esi + 0x98]
mov ecx, dword [ecx]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [0x465a28]
mov ecx, dword [esi + 0x6c]
mov ecx, dword [ecx]
sub esp, 4
mov dword [esp], ecx
call eax
mov eax, dword [esi + 0xe0]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x20a
call fcn.004049f0
add esp, 8
mov eax, dword [0x465a68]
mov ecx, dword [esi + 0xe0]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov ecx, dword [esi + 0x64]
mov dword [ecx], eax
mov ecx, dword [esi + 0x64]
mov eax, 0x2d7e1c53
cmp dword [ecx], 0
je 0x40e581
mov eax, 0xeabc3307
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x519a7ef6
jne 0x40d400
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov dword [esi + 0x2c], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x24], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x20], esp
mov eax, 0x3c
call fcn.00412580
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov edx, esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 8], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xc], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x10], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x14], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x18], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x1c], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x28], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x30], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x34], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x38], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x3c], esp
mov eax, 0x20c
call fcn.00412580
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0x40], esp
mov eax, 0xc8
call fcn.00412580
mov dword [esi + 0x4c], esp
mov eax, 0x28
call fcn.00412580
mov edi, esp
mov eax, 0x10
call fcn.00412580
mov ebx, esp
mov eax, 0x10
call fcn.00412580
mov dword [esi + 0x50], esp
mov eax, 0xc
call fcn.00412580
mov dword [esi + 0x54], esp
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov eax, 4
call fcn.00412580
mov dword [esi + 0x48], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x44], esp
mov eax, 4
call fcn.00412580
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [edx], 0
sub esp, 0xc
mov eax, dword [esi + 8]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x10]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x18]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x28]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x30]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x34]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x38]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x3c]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x40]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x4c]
mov dword [esp], eax
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 0
mov dword [ebx], 0
mov eax, dword [esi + 0x50]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [esi + 0x54]
mov word [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [esi + 0x48]
mov dword [eax], 0
mov eax, dword [esi + 0x44]
mov dword [eax], 0xffffffff
call fcn.0040d070
mov dword [esi + 0x5c], 0xb047ff7a
jmp 0x40d400
cmp eax, 0x4ed2c9de
jne 0x40d400
jmp 0x40f182
cmp eax, 0x4bbc7b98
jne 0x40d400
mov dword [esi + 0x5c], 0xb047ff7a
jmp 0x40d400
cmp eax, 0x4b4a0114
jne 0x40d400
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xd4]
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esi + 0xb8]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00403cc0
add esp, 8
mov eax, dword [esi + 0xb8]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0x100]
mov dword [ecx], eax
sub esp, 4
mov dword [esp], 0
call fcn.0040fbf0
add esp, 4
mov edi, eax
call fcn.00402200
imul eax, edi
sub esp, 4
mov dword [esp], eax
call fcn.00412e82
add esp, 4
mov dword [esi + 0x5c], 0xaadae34c
jmp 0x40d400
cmp eax, 0x4a6d535b
jne 0x40d400
jmp 0x40f182
cmp eax, 0x3ce160df
jne 0x40d400
mov ecx, dword [esi + 0x6c]
mov eax, 0x82cc3118
cmp dword [ecx], 0
je 0x40eb99
mov eax, 0x5f3df4d1
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x3b98c6aa
jne 0x40d400
jmp 0x40ee55
cmp eax, 0x325ea0da
jne 0x40d400
mov dword [esi + 0x5c], 0x6f0882b9
jmp 0x40d400
cmp eax, 0x2f2ee7c2
jne 0x40d400
mov eax, dword [esi + 0xc8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0xd8]
sub esp, 4
mov dword [esp], eax
call fcn.0040c400
add esp, 4
mov dword [esi + 0x5c], 0x7fcdece4
jmp 0x40d400
cmp eax, 0x2d7e1c53
jne 0x40d400
mov dword [esi + 0x5c], 0x2f2ee7c2
jmp 0x40d400
cmp eax, 0x257b86d5
jne 0x40d400
mov dword [esi + 0x5c], 0x6f0882b9
jmp 0x40d400
cmp eax, 0x1ee4bee7
jne 0x40d400
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x5c], 0xb457d1d3
jmp 0x40d400
cmp eax, 0x1cc9a116
jne 0x40d400
mov ecx, dword [esi + 0x64]
mov eax, 0x1ee4bee7
cmp dword [ecx], 0
jne 0x40ec78
mov eax, 0xb457d1d3
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x18b943dc
jne 0x40d400
mov eax, dword [esi + 0x60]
mov dword [eax], 0
mov dword [esi + 0x5c], 0x123af38c
jmp 0x40d400
cmp eax, 0x173f49f3
jne 0x40d400
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 0x38]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
call edi
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call edi
test eax, eax
mov eax, 0x325ea0da
jne 0x40eceb
mov eax, 0x6955e848
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x13f01d08
jne 0x40d400
mov eax, dword [esi + 0xf4]
mov eax, dword [eax]
mov ecx, dword [esi + 0xd4]
mov edx, dword [esi + 0xc4]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x104
call fcn.00403530
add esp, 0x10
mov ecx, dword [esi + 0x108]
mov dword [ecx], eax
mov eax, dword [esi + 0x108]
mov eax, dword [eax]
mov ecx, dword [esi + 0xc4]
mov word [ecx + eax*2 - 8], 0
mov eax, dword [esi + 0xc4]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esi + 0x68]
mov dword [ecx], eax
mov ecx, dword [esi + 0x68]
mov eax, 0xd7a3749b
cmp dword [ecx], 0
jne 0x40ed8e
mov eax, 0x18b943dc
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x123af38c
jne 0x40d400
jmp 0x40fbd7
cmp eax, 0xdfee6fa
jne 0x40d400
mov ecx, dword [esi + 0x10c]
mov eax, 0x54460ca
cmp dword [ecx], 6
jb 0x40edc6
mov eax, 0x4b4a0114
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x9024f0a
jne 0x40d400
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0xdc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x1c], 0
mov eax, dword [0x465a38]
mov ecx, dword [esi + 0x70]
sub esp, 4
mov dword [esp], ecx
call eax
cmp eax, 1
mov eax, 0xc3823c20
jne 0x40ee1a
mov eax, 0x14fb8d7
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0x89252c4
jne 0x40d400
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x5c], 0xf6d3f59d
jmp 0x40d400
cmp eax, 0x54460ca
jne 0x40d400
mov eax, dword [esi + 0x60]
mov dword [eax], 0xffffffff
mov dword [esi + 0x5c], 0x123af38c
jmp 0x40d400
cmp eax, 0x14fb8d7
jne 0x40d400
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 0x38]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x465a34]
mov eax, dword [esi + 0xcc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0x1c], 1
mov eax, dword [0x465a38]
mov ecx, dword [esi + 0x70]
sub esp, 4
mov dword [esp], ecx
call eax
cmp eax, 1
mov eax, 0x4a6d535b
jne 0x40eef6
mov eax, 0x173f49f3
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0xf6d3f59d
jne 0x40d400
mov eax, dword [esi + 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x5c], 0x18b943dc
jmp 0x40d400
cmp eax, 0xeabc3307
jne 0x40d400
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x104]
mov dword [ecx], eax
mov ecx, dword [esi + 0x104]
mov eax, 0xa8e1b794
cmp dword [ecx], 0
jne 0x40ef67
mov eax, 0x94aa696f
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0xe5b087fd
jne 0x40d400
mov eax, dword [esi + 0x70]
mov dword [eax], 0x3c
mov eax, dword [esi + 0x70]
mov dword [eax + 4], 0x40
mov eax, dword [esi + 0x70]
mov dword [eax + 8], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0xc], 0x47b2fc
mov eax, dword [esi + 0x70]
mov dword [eax + 0x18], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0
mov eax, dword [esi + 0xdc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xdc]
sub esp, 0x10
mov dword [esp], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x47b306
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xc0]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xc0]
mov edx, dword [esi + 0xdc]
add edx, 6
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x101
call fcn.004031a0
add esp, 0x10
mov eax, dword [0x41d154]
movzx eax, word [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [0x41d154]
movzx eax, word [ecx + eax*2 + 2]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [0x41d154]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx*2 + 4]
mov edx, dword [0x41d154]
add edx, 2
mov edi, dword [esi + 0xf8]
mov edi, dword [edi]
mov ebx, dword [esi + 0xb4]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00402a50
add esp, 0x14
mov eax, dword [esi + 0xc4]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esi + 0x68]
mov dword [ecx], eax
mov eax, dword [esi + 0x68]
cmp dword [eax], 0
sete byte [esi + 0x11b]
mov dword [esi + 0x5c], 0x94cf1058
jmp 0x40d400
cmp eax, 0xde2e11d9
jne 0x40d400
mov eax, dword [esi + 0xc8]
mov ecx, dword [esi + 0xd8]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, 0xaadae34c
je 0x40f145
mov eax, 0x648a3bd9
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0xd7a3749b
jne 0x40d400
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 0x89252c4
je 0x40f16f
mov eax, 0xf6d3f59d
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0xc3823c20
jne 0x40d400
mov eax, dword [esi + 0xc8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0xd8]
sub esp, 4
mov dword [esp], eax
call fcn.0040c400
add esp, 4
mov dword [esi + 0x5c], 0x6f0882b9
jmp 0x40d400
cmp eax, 0xb6a25a0d
jne 0x40d400
mov eax, dword [esi + 0xc8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0xd8]
sub esp, 4
mov dword [esp], eax
call fcn.0040c400
add esp, 4
mov dword [esi + 0x5c], 0x2f2ee7c2
jmp 0x40d400
cmp eax, 0xb457d1d3
jne 0x40d400
mov eax, dword [esi + 0xc0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040d3b0
mov eax, dword [esi + 0x110]
mov eax, dword [eax]
mov ecx, dword [esi + 0x60]
mov dword [ecx], eax
mov dword [esi + 0x5c], 0x123af38c
jmp 0x40d400
cmp eax, 0xb047ff7a
jne 0x40d400
mov eax, 4
call fcn.00412580
mov dword [esi + 0x60], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x64], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x68], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x6c], esp
mov eax, 0x3c
call fcn.00412580
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x70], eax
mov eax, 4
call fcn.00412580
mov dword [esi + 0x74], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x78], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x7c], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x80], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x84], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x88], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x8c], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x90], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x94], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x98], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x9c], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xa0], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xa4], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xa8], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xac], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xb0], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xb4], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xb8], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xbc], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xc0], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xc4], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xc8], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xcc], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xd0], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xd4], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xd8], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xdc], esp
mov eax, 0x20c
call fcn.00412580
mov dword [esi + 0xe0], esp
mov eax, 0xc8
call fcn.00412580
mov dword [esi + 0xe4], esp
mov eax, 0x28
call fcn.00412580
mov dword [esi + 0xe8], esp
mov eax, 0x10
call fcn.00412580
mov dword [esi + 0xec], esp
mov eax, 0x10
call fcn.00412580
mov dword [esi + 0xf0], esp
mov eax, 0xc
call fcn.00412580
mov edi, esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xf4], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xf8], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0xfc], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x100], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x104], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x108], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x10c], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x110], esp
mov eax, 4
call fcn.00412580
mov dword [esi + 0x114], esp
mov eax, dword [esi + 0x64]
mov dword [eax], 0
mov eax, dword [esi + 0x68]
mov dword [eax], 0
mov eax, dword [esi + 0x6c]
mov dword [eax], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [esi + 0xac]
mov dword [eax], 0
mov eax, dword [esi + 0xb0]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xb4]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xb8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xbc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xc0]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xc4]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xc8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xcc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xd0]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xd4]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xd8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xe0]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xe4]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0
call fcn.00412cf0
add esp, 0xc
mov eax, dword [esi + 0xe8]
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [esi + 0xec]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [esi + 0xf0]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov word [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov eax, dword [esi + 0x10c]
mov dword [eax], 0
mov eax, dword [esi + 0x110]
mov dword [eax], 0xffffffff
call fcn.0040d070
test eax, eax
sets byte [esi + 0x11a]
mov dword [esi + 0x5c], 0x90bb0814
jmp 0x40d400
cmp eax, 0xaadae34c
jne 0x40d400
mov eax, dword [esi + 0xc4]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xc8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xc4]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x104
call fcn.00404510
add esp, 8
mov eax, dword [esi + 0xc4]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0x114]
mov dword [ecx], eax
mov eax, dword [esi + 0x100]
mov eax, dword [eax]
mov ecx, dword [esi + 0xb8]
mov edx, dword [esi + 0xc8]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0x114]
mov eax, dword [eax]
mov ecx, dword [esi + 0xc4]
mov edx, dword [esi + 0x100]
mov edi, 0x104
sub edi, dword [edx]
mov edx, dword [esi + 0xc8]
mov ebx, dword [esi + 0x100]
mov ebx, dword [ebx]
lea edx, [edx + ebx*2]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], edx
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0x100]
mov ecx, 0x104
sub ecx, dword [eax]
mov eax, dword [esi + 0x114]
sub ecx, dword [eax]
mov eax, dword [esi + 0xc8]
mov edx, dword [esi + 0x100]
mov edx, dword [edx]
lea eax, [eax + edx*2]
mov edx, dword [esi + 0x114]
mov edx, dword [edx]
lea eax, [eax + edx*2]
sub esp, 0x10
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.004031a0
add esp, 0x10
mov dword [esi + 0x5c], 0xde2e11d9
jmp 0x40d400
cmp eax, 0xa8e1b794
jne 0x40d400
mov ecx, dword [esi + 0x104]
mov eax, 0x4ed2c9de
cmp dword [ecx], 0x80
jne 0x40f9cf
mov eax, 0x94aa696f
mov dword [esi + 0x5c], eax
jmp 0x40d400
cmp eax, 0xa75479e5
jne 0x40d400
mov eax, dword [esi + 0x70]
mov dword [eax], 0x3c
mov eax, dword [esi + 0x70]
mov dword [eax + 4], 0x40
mov eax, dword [esi + 0x70]
mov dword [eax + 8], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0xc], 0x47b2fc
mov eax, dword [esi + 0x70]
mov dword [eax + 0x18], 0
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0
mov eax, dword [esi + 0xdc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00402fc0
add esp, 0xc
mov eax, dword [esi + 0xdc]
sub esp, 0x10
mov dword [esp], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x47b306
mov dword [esp + 4], 0x104
call fcn.004031a0
add esp, 0x10
mov eax, dword [esi + 0xc0]
sub esp, 4
mov dword [esp], eax
call fcn.00403790
add esp, 4
mov ecx, dword [esi + 0xc0]
mov edx, dword [esi + 0xdc]
add edx, 6
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x101
call fcn.004031a0
add esp, 0x10
mov eax, dword [0x41d154]
movzx eax, word [eax]
mov ecx, dword [esi + 0xf8]
mov dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax]
mov ecx, dword [0x41d154]
movzx eax, word [ecx + eax*2 + 2]
mov ecx, dword [esi + 0xfc]
mov dword [ecx], eax
mov eax, dword [esi + 0xfc]
mov eax, dword [eax]
mov ecx, dword [0x41d154]
mov edx, dword [esi + 0xf8]
mov edx, dword [edx]
lea ecx, [ecx + edx*2 + 4]
mov edx, dword [0x41d154]
add edx, 2
mov edi, dword [esi + 0xf8]
mov edi, dword [edi]
mov ebx, dword [esi + 0xb4]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00402a50
add esp, 0x14
mov eax, dword [esi + 0xc4]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esi + 0x68]
mov dword [ecx], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x5c], 0xe5b087fd
jmp 0x40d400
mov dword [esi + 0x5c], 0xe5b087fd
jmp 0x40d400
cmp eax, 0x975636d3
jne 0x40d400
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 0x38]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x465a34]
mov eax, dword [esi + 0x110]
mov dword [eax], 1
mov dword [esi + 0x5c], 0x6f0882b9
jmp 0x40d400
mov eax, dword [esi + 0x60]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret