Function at 0x40dbb0
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x30], 0
push edi
mov dword [ebp - 8], ebx
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e776
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e780
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e78a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e794
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [ebp - 0x54]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
call fcn.00408110
push ecx
mov ecx, esp
push str.AppData
call fcn.00403710
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x58]
call fcn.00410780
mov eax, dword [ebp + 8]
cmp byte [eax + 0x27], 0
je 0x40e4b2
push str.winguarddll
push dword [eax]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dd01
mov eax, dword [ebp + 8]
push str.winguard
push dword [eax]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dd01
mov eax, dword [ebp + 8]
push str.winguard_x64dll
push dword [eax]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dcb8
mov eax, dword [ebp + 8]
push str.winguard_x64
push dword [eax]
call fcn.0046b1da
add esp, 8
test eax, eax
jne 0x40dd5a
push dword [ebx + 0x594]
lea eax, [ebp - 0xc]
push str._supgradewinguard_x64.exe
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
lea eax, [ebp - 0x18]
push str._swinguard_x64.exe
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
lea eax, [ebp - 0x10]
push str._supgradewinguard_x64.dll
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
push str._swinguard_x64.dll
jmp 0x40dd48
push dword [ebx + 0x594]
lea eax, [ebp - 0xc]
push str._supgradewinguard.exe
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
lea eax, [ebp - 0x18]
push str._swinguard.exe
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
lea eax, [ebp - 0x10]
push str._supgradewinguard.dll
push eax
call fcn.0041ad10
push dword [ebx + 0x594]
push str._swinguard.dll
lea eax, [ebp - 0x14]
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x14]
add esp, 0x30
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.0041e3c0
cmp byte [ebx + 0x5d5], 0
je 0x40df37
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e79e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
mov dword [ebp - 0x24], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 1], al
mov ebx, esp
push dword [ebp - 0x24]
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
push dword [ebp - 0xc]
mov bl, al
lea eax, [ebp - 0x24]
push eax
call fcn.0041d210
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x10
push ecx
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40ddff
cmp byte [ebp - 1], 0
je 0x40ddff
mov byte [ebp - 1], 1
test bl, bl
jne 0x40de03
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0x24]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40de20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
cmp byte [ebp - 1], 0
je 0x40dfcd
test eax, eax
jg 0x40de44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.TWEAKCUBE3_WINGUARD_EVENT_NAME
xor esi, esi
push esi
push 0x1f0003
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x40e16c
nop
cmp esi, 0x32
jge 0x40e16c
call fcn.00402250
test eax, eax
je 0x40e776
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a2f0
mov esi, dword [ebp - 0x1c]
test al, al
je 0x40e0f4
call fcn.00402250
test eax, eax
je 0x40e776
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x3c], ebx
call fcn.00402250
test eax, eax
je 0x40e776
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [esi - 0x10]
add ebx, 0xfffffff0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
cmp ecx, ebx
je 0x40e00e
cmp dword [ebx + 0xc], 0
jl 0x40dffc
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x40dffc
push ecx
call fcn.00403380
add esp, 4
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40df29
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
jmp 0x40e00e
cmp byte [ebx + 0x5d4], 0
je 0x40de44
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e7a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
mov dword [ebp - 0x24], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 1], al
mov ebx, esp
push dword [ebp - 0x24]
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
push dword [ebp - 0x10]
mov bl, al
lea eax, [ebp - 0x24]
push eax
call fcn.0041d210
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40ddff
cmp byte [ebp - 1], 0
jmp 0x40ddf5
test eax, eax
jg 0x40dfd9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e6d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40e6d1
push dword [esi - 0xc]
lea ecx, [ebp - 0x3c]
push esi
call fcn.00402620
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp + 8]
lea ebx, [eax - 0x10]
mov edx, dword [edx + 0x1c]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x40e067
cmp dword [ebx + 0xc], 0
jl 0x40e055
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x40e055
push ecx
call fcn.00403380
add esp, 4
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e050
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
jmp 0x40e064
push dword [edx - 0xc]
lea ecx, [ebp - 0x38]
push edx
call fcn.00402620
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
sub esp, 0xc
mov ebx, esp
mov al, byte [ecx + 0x26]
mov byte [ebp - 1], al
mov byte [ebp - 0x34], al
mov al, byte [ecx + 0x28]
mov byte [ebp - 2], al
mov byte [ebp - 0x33], al
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x2c], eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x28], eax
call fcn.00403380
mov ecx, dword [ebp - 8]
add eax, 0x10
mov dword [ebx + 4], eax
add esp, 8
mov al, byte [ebp - 1]
mov byte [ebx + 8], al
mov al, byte [ebp - 2]
mov byte [ebx + 9], al
call fcn.0042c2e0
mov edx, dword [ebp - 0x28]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e0db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e0f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40e0f7
or ebx, 0xffffffff
push str.TWEAKCUBE3_WINGUARD_EVENT_NAME
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40e120
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x24]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e142
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.TWEAKCUBE3_WINGUARD_EVENT_NAME
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x40e16c
mov esi, dword [ebp - 0x24]
jmp 0x40de70
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d4], 0
je 0x40e331
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e7b2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [esi - 0x10]
mov ebx, esp
push eax
mov dword [ebp - 0x28], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
lea eax, [esi - 0x10]
mov ebx, esp
push eax
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
mov bl, al
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0041d210
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40e205
cmp byte [ebp - 2], 0
je 0x40e205
mov byte [ebp - 1], 1
test bl, bl
jne 0x40e209
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0x2c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e226
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 1], 0
je 0x40e2c2
xor edi, edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e24b
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x64
jl 0x40e232
mov esi, dword [ebp - 0x14]
push 0
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, dword [ebp - 0x18]
test eax, eax
jne 0x40e2b7
cmp dword [ebp - 0x24], 0x14
jge 0x40e2b3
push esi
call fcn.00431f10
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40e28d
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x24]
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40e268
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e2f0
test eax, eax
je 0x40e2f0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e2f0
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [esi], eax
mov esi, esp
push dword [ebp - 0x28]
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0040add0
add esp, 8
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e30a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d5], 0
mov dword [ebp - 0x24], 0
je 0x40e48f
call fcn.00402250
mov ecx, eax
test ecx, ecx
jne 0x40e336
jmp 0x40e7bc
or ebx, 0xffffffff
jmp 0x40e30d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [esi - 0x10]
mov ebx, esp
push eax
mov dword [ebp - 0x28], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
lea eax, [esi - 0x10]
mov ebx, esp
push eax
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
mov bl, al
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0041d210
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x10
push ecx
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40e3b3
cmp byte [ebp - 2], 0
je 0x40e3b3
mov byte [ebp - 1], 1
test bl, bl
jne 0x40e3b7
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0x2c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e3d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 1], 0
mov esi, dword [ebp - 0x1c]
je 0x40e44a
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40e43f
nop dword [eax]
cmp dword [ebp - 0x24], 0x14
jge 0x40e43b
push edi
call fcn.00431f10
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40e415
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x24]
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40e3f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e478
test eax, eax
je 0x40e478
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e478
push ecx
lea eax, [esi - 0x10]
mov ebx, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
mov ebx, esp
push dword [ebp - 0x28]
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0040add0
add esp, 8
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e48f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e4a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
cmp byte [eax + 0x26], 0
je 0x40e6ce
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push dword [edi + 8]
push dword [ebx + 0x594]
push str._supgrade_s.exe
push eax
call fcn.0041ad10
push dword [edi]
lea eax, [ebp - 0x18]
push dword [ebx + 0x594]
push str._s_s.exe
push eax
call fcn.0041ad10
add esp, 0x20
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x40e7c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
cmp byte [edi + 0x27], 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ebx, esp
je 0x40e5e7
lea eax, [edi - 0x10]
push eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
lea ecx, [edi - 0x10]
mov ebx, esp
push ecx
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
mov bl, al
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0041d210
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x10
push ecx
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40e582
cmp byte [ebp - 2], 0
je 0x40e582
mov byte [ebp + 0xb], 1
test bl, bl
jne 0x40e586
mov byte [ebp + 0xb], 0
mov edx, dword [ebp - 0x2c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e5a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0xb], 0
je 0x40e5c8
push 5
push 0
push str._fromrmup
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x1c]
jmp 0x40dfdc
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
lea eax, [edi - 0x10]
mov ebx, esp
push eax
jmp 0x40e6ae
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x24], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
mov ebx, esp
push dword [ebp - 0x24]
call fcn.00403380
mov ecx, dword [ebp - 8]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00424470
push dword [ebp - 0xc]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041d210
push eax
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40e64d
cmp byte [ebp - 2], 0
mov byte [ebp + 0xb], 1
jne 0x40e651
mov byte [ebp + 0xb], 0
mov edx, dword [ebp - 0x2c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e66e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0xb], 0
je 0x40e695
push 5
push 0
push str._fromrmup
push dword [ebp - 0xc]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x1c]
jmp 0x40dfdc
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [ebx], eax
mov ebx, esp
push dword [ebp - 0x24]
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0040add0
mov edx, dword [ebp - 0x1c]
add esp, 8
or ebx, 0xffffffff
jmp 0x40dfdc
or ebx, 0xffffffff
mov edx, dword [ebp - 0x30]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e6eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x44]
call fcn.00402130
mov edx, dword [ebp - 0x44]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e70d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e724
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e73e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40e755
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40e76d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
int3