Function at 0x419850
Capabilities:
Check if file exists
Delete file
Get disk information
Get disk size
Get file attributes
Get file size
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d2eb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xad0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4574c0]
mov dword [ebp - 0x9f0], eax
mov eax, dword [0x4574c8]
push 0x30
mov dword [ebp - 0x9fc], eax
lea eax, [ebp - 0xa30]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x9d0]
push 0x444
push 0
push eax
call fcn.0042a4e0
mov ax, word [0x4574e0]
add esp, 0xc
mov word [ebp - 0x1c], ax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0xa44], 0x400000
xor edi, edi
mov word [ebp - 0x16], ax
push 0x100
push eax
mov dword [ebp - 0x9e8], eax
lea eax, [ebp - 0x588]
push eax
mov dword [ebp - 0x9e4], edi
mov dword [ebp - 0x9f8], edi
mov dword [ebp - 0x9f4], edi
mov dword [ebp - 0x9e0], edi
mov dword [ebp - 0x9ec], edi
mov dword [ebp - 0xa40], edi
mov byte [ebp - 0x9da], 0
mov dword [ebp - 0x1a], 0x5c003a
movq qword [ebp - 0xad0], xmm0
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x150], xmm0
movq qword [ebp - 0x140], xmm0
movq qword [ebp - 0xa4c], xmm0
movq qword [ebp - 0xae0], xmm0
movq qword [ebp - 0xad8], xmm0
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x488]
push 0x324
push edi
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x12c], edi
xorps xmm0, xmm0
movq qword [ebp - 0x134], xmm0
push 0x30636
push edi
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x9d8], esi
test esi, esi
je 0x4199e9
mov eax, dword [ebp - 0xa44]
lea eax, [eax*2 + 0x16]
push eax
push edi
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x9ec], eax
test eax, eax
jne 0x4199fa
push esi
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x45771c], 8
xor al, al
jmp 0x41ab1d
push 0x300
push 0
push dword [0x45764c]
mov dword [ebp - 0xa10], 0x20
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa08], eax
test eax, eax
jne 0x419a5e
push dword [ebp - 0x9ec]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
push dword [0x45764c]
call esi
mov ecx, dword [ebp - 0x9d8]
push ecx
push 0
push dword [0x45764c]
call esi
mov dword [0x45771c], 8
xor al, al
jmp 0x41ab1d
lea eax, [ebp - 0xa54]
mov dword [ebp - 0xa54], str.Reg2Inf
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
sub esp, 8
lea ecx, [ebp - 0xac8]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0xac8]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0xac0]
lea eax, [ebp - 0xac8]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0xa8a]
test eax, eax
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xa00], 0
mov edx, 1
mov dword [ebp - 0xa3c], 0
push eax
cmovne ecx, edx
push 0x2000e
mov byte [ebp - 0xa8a], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x419b39
xor eax, eax
jmp 0x419b5c
lea eax, [ebp - 0xa3c]
push eax
push 2
push dword [ebp - 0xa00]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0xa00]
call esi
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0xa14], eax
mov eax, 1
mov dword [ebp - 0xa20], 0xffffffff
mov dword [ebp - 0xa1c], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0x9f0], eax
jbe 0x41a15f
mov ecx, dword [ebp - 0x9fc]
mov edi, 0xa0
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0xac4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41a1e0
mov eax, dword [ebp - 0xa10]
cmp dword [ebp - 0xa0c], eax
jne 0x419c12
add eax, eax
mov dword [ebp - 0xa10], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [ebp - 0xa18]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov dword [ebp - 0xa08], ecx
test ecx, ecx
je 0x41a15d
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xa18], ecx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov dword [ebp - 0xa08], eax
cmp word [esi], 0x2f
jne 0x419cb3
movzx eax, word [esi + 2]
cmp eax, 0x52
je 0x419c2a
cmp eax, 0x72
jne 0x419c51
movzx ecx, word [esi + 4]
cmp ecx, 0x54
je 0x419c38
cmp ecx, 0x74
jne 0x419c51
movzx ecx, word [esi + 6]
cmp ecx, 0x49
je 0x419c46
cmp ecx, 0x69
jne 0x419c51
cmp word [esi + 8], 0
je 0x41a144
cmp eax, 0x52
je 0x419c5b
cmp eax, 0x72
jne 0x419c7b
movzx ecx, word [esi + 4]
cmp ecx, 0x54
je 0x419c69
cmp ecx, 0x74
jne 0x419c7b
cmp word [esi + 6], 0x41
jne 0x419c7b
cmp word [esi + 8], 0
je 0x41a144
cmp eax, 0x41
je 0x419c89
cmp eax, 0x61
jne 0x419d42
movzx ecx, word [esi + 4]
cmp ecx, 0x52
je 0x419c9b
cmp ecx, 0x72
jne 0x419d42
cmp word [esi + 6], 0
jne 0x419d42
cmp dword [0x4574d4], 0
je 0x41ab3b
push ecx
lea eax, [ebp - 0xa40]
mov ecx, esi
push eax
lea edx, [ebp - 0x9d8]
call fcn.00404830
add esp, 8
test al, al
je 0x41a144
mov ecx, dword [ebp - 0xa08]
mov ax, word [0x457638]
mov edi, dword [ebp - 0x9d8]
push 0
push 0x2000080
push 3
mov word [ecx + 4], ax
mov ecx, dword [ebp - 0xa40]
mov eax, dword [ebp - 0xa08]
sub ecx, edi
push 0
push 7
push 0x120089
sar ecx, 1
push edi
mov word [eax + 6], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x419ee1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41a144
cmp dword [0x4574d4], 0
je 0x41ab41
jmp 0x41a144
cmp eax, 0x41
je 0x419d50
cmp eax, 0x61
jne 0x419cb3
cmp word [esi + 4], 0x3d
jne 0x419cb3
lea ecx, [esi + 6]
mov byte [ebp - 0x9d9], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0xa38], xmm0
test ecx, ecx
je 0x419ecc
movzx eax, word [ecx]
test ax, ax
je 0x419ecc
cmp ax, 9
je 0x419e27
cmp ax, 0x20
je 0x419e27
cmp ax, 0xd
je 0x419e27
cmp ax, 0xa
je 0x419e27
cmp ax, di
je 0x419e27
cmp ax, 0xc
je 0x419e27
cmp ax, 0xb
je 0x419e27
mov edx, 0x85
cmp ax, dx
je 0x419e27
mov edx, 0x2028
cmp ax, dx
je 0x419e27
mov edx, 0x2029
cmp ax, dx
je 0x419e27
mov edx, 0x202f
cmp ax, dx
je 0x419e27
mov edx, 0x1680
cmp ax, dx
je 0x419e27
mov edx, 0x180e
cmp ax, dx
je 0x419e27
mov edx, 0x1fff
cmp ax, dx
jbe 0x419e09
mov edx, 0x200c
cmp ax, dx
jb 0x419e27
mov edx, 0x3000
cmp ax, dx
je 0x419e27
mov edx, 0xfeff
cmp ax, dx
je 0x419e27
mov edx, 0x205f
cmp ax, dx
jne 0x419e33
movzx eax, word [ecx + 2]
add ecx, 2
jmp 0x419d84
mov dword [ebp - 0x9d4], ecx
cmp ax, 0x2b
je 0x419e4f
movzx edx, ax
cmp ax, 0x2d
jne 0x419e5c
mov byte [ebp - 0x9d9], 1
movzx edx, word [ecx + 2]
add ecx, 2
mov dword [ebp - 0x9d4], ecx
mov esi, dword [ebp - 0xa38]
cmp dx, 0x30
jb 0x419eb3
mov edi, dword [ebp - 0xa34]
movzx edx, dx
cmp dx, 0x39
ja 0x419eb3
mov eax, esi
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc edi, ecx
shld edi, esi, 1
add esi, esi
add esi, eax
mov eax, dword [ebp - 0x9d4]
adc edi, edx
sub esi, 0x30
sbb edi, 0
add eax, 2
mov dword [ebp - 0x9d4], eax
movzx eax, word [eax]
mov edx, eax
cmp eax, 0x30
jae 0x419e71
mov eax, esi
neg eax
cmp byte [ebp - 0x9d9], 0
cmove eax, esi
or dword [ebp - 0x9f8], eax
jmp 0x41a144
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x9f8], eax
jmp 0x41a144
mov eax, dword [ebp - 0xa08]
push 0x23
mov dword [ebp - 0xa4c], 0
push 8
and dword [eax], 0x7fffffff
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [0x4576d0]
test eax, eax
jns 0x419f6b
push 4
push 0x28
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [0x4576d0]
test eax, eax
js 0x41a13d
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xa4c], eax
mov ax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x419f7b
cmp eax, 2
je 0x419f7b
mov eax, dword [ebp - 0xa08]
or dword [eax], 0x80000000
jmp 0x419f7b
test dword [ebp - 0xa4c], 0x400
jne 0x41a13d
cmp dword [ebp - 0x9e8], 0
jne 0x419fe3
mov eax, dword [ebp - 0xa08]
cmp dword [eax], 0
movzx eax, word [0x4574e0]
jl 0x419f9a
movzx eax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0xad8]
push eax
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xa20]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x419fdb
mov eax, dword [ebp - 0xa20]
or eax, dword [ebp - 0xa1c]
je 0x419fdb
mov dword [ebp - 0x9e8], 1
jmp 0x419fe3
xor eax, eax
mov dword [ebp - 0x9e8], eax
test byte [ebp - 0xa4c], 0x10
je 0x41a04d
push ecx
push 0xd
push 0x44c938
push edi
lea edx, [ebp - 0xa30]
lea ecx, [ebp - 0xac8]
call fcn.00404c20
add esp, 0x10
test al, al
jne 0x41a13d
cmp dword [0x45771c], 0
je 0x41a13d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0xac4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41aab5
cmp dword [0x45771c], 5
je 0x41a19f
jmp 0x41a144
mov eax, dword [ebp - 0xa08]
cmp dword [eax], 0
jl 0x41a089
cmp dword [0x4574d4], 0
jne 0x41a089
movzx eax, word [eax + 6]
mov edx, edi
mov ecx, dword [ebp - 0xa14]
push 0x120156
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x41a198
mov eax, dword [ebp - 0xa08]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0xa08]
mov ecx, dword [ebp - 0xa78]
mov eax, dword [ebp - 0xa74]
add ecx, dword [edx + 8]
mov dword [ebp - 0xa78], ecx
adc eax, dword [edx + 0xc]
mov dword [ebp - 0xa74], eax
cmp eax, dword [ebp - 0xa1c]
ja 0x41a1ca
jb 0x41a0d2
cmp ecx, dword [ebp - 0xa20]
ja 0x41a1ca
movzx eax, word [edx + 4]
lea eax, [eax*2 + 2]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xa08]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0xa08]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41a1bb
movzx eax, word [eax + 4]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0xa68], 1
adc dword [ebp - 0xa64], 0
inc dword [ebp - 0xa2c]
add dword [ebp - 0xa08], 0x18
inc dword [ebp - 0xa0c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa50]
inc eax
mov dword [ebp - 0xa50], eax
cmp eax, dword [ebp - 0x9f0]
jb 0x419b97
xor edi, edi
cmp dword [ebp - 0xa68], 0
je 0x41aab5
mov ecx, dword [ebp - 0xa74]
mov eax, dword [ebp - 0xa78]
test ecx, ecx
jne 0x41a221
cmp eax, 0x63
ja 0x41a221
mov dword [ebp - 0xa60], 1
jmp 0x41a232
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4574d4], 0
je 0x41ab41
mov dword [0x45771c], 5
jmp 0x41a389
mov dword [0x45771c], 8
jmp 0x41a389
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45771c], 1
jmp 0x41a389
push 0x65
push dword [ebp - 0xac0]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0xac4]
push 0
push 0
push 0x44413c
mov byte [ebp - 0xa8a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0xac4]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x41aab5
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0xa60], eax
push 0x65
push dword [ebp - 0xac0]
mov dword [ebp - 0xa88], 1
mov dword [ebp - 0xa84], 0
mov byte [ebp - 0xa89], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0xac4]
push 0
push 0
push 0x44413c
mov byte [ebp - 0xa8a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0xac4]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0xa8f], 0
je 0x41a2c6
mov eax, dword [ebp - 0xabc]
mov byte [ebp - 0xa8f], 0
test eax, eax
je 0x41a2c6
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0xabc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x45754c]
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0xa38], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
movups xmm0, xmmword [str.Reg2Inf:]
mov dword [ebp - 0xa34], eax
mov ax, word [0x44c964]
mov word [0x457730], ax
lea eax, [ebp - 0xa38]
push eax
push 0xfb
push 0x457732
push 0x400
push 0
push dword [0x4563bc]
movups xmmword [0x457720], xmm0
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0xac4]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac4]
push 0
mov byte [ebp - 0xa89], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
cmp byte [ebx + 8], 0
mov dword [ebp - 0xac8], eax
je 0x41a46e
lea ecx, [ebp - 0x9d0]
call fcn.00415f90
test al, al
jne 0x41a3d3
cmp byte [ebp - 0xa8a], 0
je 0x41a39d
lea ecx, [ebp - 0xac8]
call fcn.004036e0
sub esp, 8
lea ecx, [ebp - 0xac8]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0xac8]
push 0x5dc
call fcn.00403330
jmp 0x41aab5
mov esi, dword [ebp - 0x9d8]
lea edi, [ebp - 0x9d0]
push 0x324
push 0
mov dword [ebp - 0x9e4], edi
lea eax, [esi + 0x10212]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x488]
push eax
call fcn.0042a4e0
mov ecx, dword [str.______]
mov eax, 0x3039
mov word [ebp - 0x468], ax
add esp, 0xc
mov eax, dword [0x444f34]
mov dword [ebp - 0x362], eax
mov dword [ebp - 0x262], eax
lea eax, [esi + 0x20424]
mov dword [ebp - 0x584], eax
mov eax, 0x8109
mov dword [ebp - 0x488], VariantClear
mov dword [ebp - 0x484], 0x7fff8000
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x366], ecx
mov dword [ebp - 0x266], ecx
mov word [ebp - 0x586], ax
jmp 0x41a474
mov esi, dword [ebp - 0x9d8]
mov ecx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0xa08], eax
test ecx, ecx
je 0x41aa98
mov eax, dword [ebp - 0xac4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41aa98
mov eax, dword [ebp - 0xa08]
push 0
push 1
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0xac4]
push eax
push 2
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
mov edx, dword [ebp - 0xa08]
lea ecx, [ebp - 0xac8]
push edi
push dword [ebp - 0x9f8]
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0x9ec]
push eax
push esi
call fcn.00417bd0
add esp, 0x14
mov byte [ebp - 0x9da], al
cmp byte [ebx + 8], 0
je 0x41aa7c
test al, al
je 0x41aa7c
movzx ecx, word [edi + 0x43c]
lea ecx, [ecx*2 + 2]
push ecx
mov ecx, dword [ebp - 0x9e0]
push esi
push ecx
call fcn.0043c9e0
movzx eax, word [edi + 0x43e]
lea ecx, [edi + 0x34]
mov edx, dword [ebp - 0x9e0]
add esp, 0xc
movups xmm0, xmmword [str.Entries_]
mov dword [ebp - 0x9fc], ecx
movups xmmword [edx + eax*2], xmm0
mov eax, dword [edi + 0x434]
add edx, 0x10
add eax, eax
push eax
movzx eax, word [edi + 0x43e]
push ecx
lea eax, [edx + eax*2]
push eax
call fcn.0043c9e0
movzx eax, word [edi + 0x43e]
add esp, 0xc
add eax, dword [edi + 0x434]
mov edx, dword [ebp - 0x9e0]
movq xmm0, qword [str..ini]
push 0
push 0xa000080
push 2
push 0
lea ecx, [edx + eax*2]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x44c984]
push 1
push 0x40000000
push edx
mov word [ecx + 0x18], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41aa76
push 0
lea eax, [ebp - 0x9f4]
push eax
push 2
push 0x44e5a7
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x9f0], 0
cmp dword [eax + 0x1c], 0
mov esi, dword [eax + 4]
jbe 0x41a691
nop dword [eax + eax]
push 0
lea eax, [ebp - 0x9f4]
push eax
mov eax, dword [esi]
and eax, 0x3fffffff
add eax, eax
push eax
push dword [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi]
shr eax, 0x1e
cmp eax, 1
jne 0x41a648
mov ecx, dword [ebp - 0x9e4]
lea eax, [ebp - 0x9f4]
push 0
push eax
mov eax, dword [ecx + 0x438]
add eax, eax
push eax
lea eax, [ecx + 0x234]
push eax
jmp 0x41a66b
cmp eax, 2
jne 0x41a672
push 0
lea eax, [ebp - 0x9f4]
push eax
mov eax, dword [ebp - 0x9e4]
mov eax, dword [eax + 0x434]
add eax, eax
push eax
push dword [ebp - 0x9fc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x9f0]
add esi, 8
mov ecx, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9f0], eax
cmp eax, dword [ecx + 0x1c]
jb 0x41a600
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xa08]
cmp dword [ecx], 0
jge 0x41a6c3
mov si, word [0x4576b4]
movzx eax, si
add eax, eax
push eax
push dword [0x4574d0]
push dword [ebp - 0x584]
call fcn.0043c9e0
jmp 0x41a6e7
movzx eax, word [ecx + 4]
lea eax, [eax*2 + 2]
push eax
push dword [ecx + 0x10]
push dword [ebp - 0x584]
call fcn.0043c9e0
mov eax, dword [ebp - 0xa08]
mov si, word [eax + 6]
mov edi, dword [ebp - 0x9e4]
add esp, 0xc
movzx eax, si
mov dword [ebp - 0x9d4], eax
mov word [ebp - 0x57a], si
mov eax, dword [edi + 0x438]
mov si, word [ebp - 0x9d4]
add eax, eax
push eax
lea eax, [edi + 0x234]
movzx ecx, si
push eax
mov eax, dword [ebp - 0x584]
lea eax, [eax + ecx*2]
push eax
call fcn.0043c9e0
add si, word [edi + 0x438]
mov edx, 0x5f
mov eax, dword [ebp - 0x584]
add esp, 0xc
movzx ecx, si
mov word [ebp - 0x9d4], si
inc dword [ebp - 0x9d4]
mov si, word [ebp - 0x9d4]
mov word [eax + ecx*2], dx
mov eax, dword [edi + 0x434]
add eax, eax
movzx ecx, si
push eax
lea eax, [edi + 0x34]
push eax
mov eax, dword [ebp - 0x584]
lea eax, [eax + ecx*2]
push eax
call fcn.0043c9e0
add si, word [edi + 0x434]
add esp, 0xc
mov eax, dword [ebp - 0x584]
movups xmm0, xmmword [str._Registry_TWEAKS_True_AddOn.cab]
movzx ecx, si
mov word [ebp - 0x9d4], si
push 0
push 1
movups xmmword [eax + ecx*2], xmm0
movups xmm0, xmmword [0x44c998]
movups xmmword [eax + ecx*2 + 0x10], xmm0
movups xmm0, xmmword [0x44c9a8]
movups xmmword [eax + ecx*2 + 0x20], xmm0
movups xmm0, xmmword [0x44c9b8]
movups xmmword [eax + ecx*2 + 0x30], xmm0
mov ecx, dword [ebp - 0x57a]
mov eax, dword [ebp - 0x9d4]
add ecx, 0x20
add eax, ecx
movzx ecx, word [ebp - 0x57a]
mov word [ebp - 0x588], ax
mov eax, dword [ebp - 0x584]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0xac4]
push eax
push 2
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
mov dword [ebp - 0xac8], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x588]
mov dword [0x45771c], 0
push eax
lea eax, [ebp - 0x488]
movq qword [ebp - 0x134], xmm0
push eax
push 0x407ad0
push 0x407890
push 0x407850
push 0x407820
push 0x4077e0
mov dword [ebp - 0x12c], 0
movq qword [ebp - 0x498], xmm0
mov dword [ebp - 0x490], 0
push 0x4077a0
push 0x407700
push 0x4076e0
push 0x4076c0
lea eax, [ebp - 0x134]
push fcn.004078d0
push eax
call dword [sym.imp.Cabinet.dll_FCICreate]
add esp, 0x34
mov dword [ebp - 0x9d4], eax
test eax, eax
je 0x41aa23
test byte [ebp - 0x9f8], 2
jne 0x41a8d8
push dword [ebp - 0x584]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a8d8
push dword [ebp - 0x586]
mov edx, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x584]
call fcn.00404280
mov dword [ebp - 0x584], eax
add esp, 4
mov ax, word [0x457638]
mov word [ebp - 0x588], ax
movzx eax, word [edi + 0x43e]
lea ecx, [ebp - 0x128]
movzx esi, word [edi + 0x43c]
push 0
push 0
push 0x100
push ecx
mov ecx, dword [ebp - 0x9d8]
sub esi, eax
push 0xffffffffffffffff
inc esi
lea eax, [ecx + eax*2]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x1503
push 0x4078e0
push 0x419830
xor ecx, ecx
cmp esi, eax
mov esi, dword [ebp - 0x9d4]
mov eax, 0x80
push fcn.004078d0
cmovne ecx, eax
lea eax, [ebp - 0x128]
push 0
push eax
push dword [ebp - 0x9d8]
mov word [ebp - 0x576], cx
push esi
call dword [sym.imp.Cabinet.dll_FCIAddFile]
add esp, 0x20
test eax, eax
jne 0x41a96b
mov dword [ebp - 0x12c], 1
jmp 0x41aa29
mov ecx, dword [ebp - 0x9e0]
lea eax, [ebp - 0x128]
push 0
push 0
push 0x100
push eax
movzx eax, word [edi + 0x43e]
push 0xffffffffffffffff
lea eax, [ecx + eax*2]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x1503
push 0x4078e0
push 0x419830
push fcn.004078d0
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x9e0]
push esi
call dword [sym.imp.Cabinet.dll_FCIAddFile]
add esp, 0x20
test eax, eax
jne 0x41a9d8
mov dword [ebp - 0x12c], 1
jmp 0x41aa29
push 0x419830
push fcn.004078d0
push 0
push esi
call dword [sym.imp.Cabinet.dll_FCIFlushCabinet]
add esp, 0x10
mov esi, eax
push dword [ebp - 0x9d8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x9e0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x41aa23
push dword [ebp - 0x9d4]
call dword [sym.imp.Cabinet.dll_FCIDestroy]
mov esi, dword [ebp - 0x9d8]
add esp, 4
jmp 0x41aa7c
mov esi, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x130]
test eax, eax
mov ecx, dword [ebp - 0x494]
cmovne ecx, eax
push esi
mov dword [0x45771c], ecx
call dword [sym.imp.Cabinet.dll_FCIDestroy]
add esp, 4
lea ecx, [ebp - 0xac8]
cmp dword [ebp - 0x9e8], 1
sete al
movzx eax, al
push eax
push dword [0x45771c]
push 0x3e8
call fcn.00403330
mov esi, dword [ebp - 0x9d8]
jmp 0x41aa7c
mov edi, dword [ebp - 0x9e4]
mov eax, dword [ebp - 0x9e8]
add dword [ebp - 0xa08], 0x18
dec eax
mov dword [ebp - 0x9e8], eax
test eax, eax
jne 0x41a494
lea ecx, [ebp - 0xac8]
mov byte [ebp - 0xa80], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x9d8]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x9ec]
push 0
push dword [0x45764c]
call esi
sub esp, 8
lea ecx, [ebp - 0xa30]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0xac8]
call fcn.00403270
mov eax, dword [ebp - 0x9d0]
test eax, eax
je 0x41ab0c
push eax
push 0
push dword [0x45764c]
call esi
lea ecx, [ebp - 0xac8]
call fcn.00402f30
mov al, byte [ebp - 0x9da]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edi, dword [ebp - 0x9d8]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x9ec]
push 0
push dword [0x45764c]
call esi
sub esp, 0xc
lea edx, [ebp - 0xa30]
lea ecx, [ebp - 0xac8]
call fcn.00403910
int3