Function at 0x415324
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Get file version info
Hide graphical window
Link many functions at runtime
Log keystrokes
Log keystrokes via application hook
Move file
Resume thread
Set environment variable
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x38c], edx
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x394], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416b5c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004070c0
mov eax, dword [ebp - 4]
fstp qword [eax + 0x208]
wait
push 0x416b6c
mov eax, dword [0x41d820]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
push eax
push 1
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x208]
fnstsw ax
sahf
jae 0x4153db
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x416b29
mov eax, dword [ebp - 4]
call fcn.00415200
test al, al
je 0x416b29
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1dc], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x19c]
lea eax, [ebp - 0x38c]
mov edx, 0x416b80
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
mov dword [ebp - 0x40], eax
xor edx, edx
push ebp
push 0x416b1f
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x390]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x390]
lea edx, [ebp - 0x38c]
call fcn.00406398
mov eax, dword [ebp - 0x38c]
call fcn.0040649c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
sub eax, 1
jb 0x4154cf
je 0x4154ff
dec eax
je 0x41550b
jmp 0x415515
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416b90
call fcn.00412c78
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x215]
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x216], al
jmp 0x415515
mov eax, dword [ebp - 4]
mov byte [eax + 0x216], 0
jmp 0x415515
mov eax, dword [ebp - 4]
mov byte [eax + 0x216], 1
lea eax, [ebp - 0x155]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x390]
lea edx, [ebp - 0x155]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x390]
push eax
lea eax, [ebp - 0x38c]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x240]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
mov ecx, 0x416ba4
call fcn.0040daa4
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.0040347c
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00413a14
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x254
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040347c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov ecx, 0x416bc4
call fcn.004036f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x220], edx
push 0x416bcc
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x415612
push 0x15b3
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, 0xffffff7f
je 0x415612
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
jge 0x415791
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
mov esi, ebx
mov dword [eax + 0x220], esi
lea edx, [ebp - 0x38c]
mov eax, esi
call fcn.00405f7c
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x224
mov edx, 0x416be8
call fcn.004036f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
mov edx, 0x416bf8
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4157af
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
dec ebx
cmp ebx, 0x80000036
jne 0x415625
jmp 0x4157af
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x4156e3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1a8]
lea eax, [ebp - 0x38c]
mov edx, 0x416c18
call fcn.004036f0
mov ecx, dword [ebp - 0x38c]
mov dl, 1
mov eax, dword [0x4052dc]
call fcn.00408e68
call fcn.00402f40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.0041502c
test al, al
je 0x41574e
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x416c34
call fcn.004036f0
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x415791
mov eax, dword [ebp - 4]
inc dword [eax + 0x220]
mov eax, dword [ebp - 4]
push dword [eax + 0x254]
push 0x416bc4
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.00405f7c
push dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 3
call fcn.00403764
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00403868
push eax
call sub.kernel32.dll_CreateDirectoryA_1
test eax, eax
je 0x4156a7
mov eax, dword [ebp - 4]
add eax, 0x224
mov edx, 0x416be8
call fcn.0040347c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
je 0x4157f4
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.00405f7c
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x224
call fcn.004036ac
cmp dword [ebp - 0x44], 0
je 0x415808
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x44], eax
call fcn.0040263c
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 0x416c40
call fcn.004036ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
add eax, 0x30
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x244
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x254
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416b90
call fcn.00412c78
mov eax, dword [ebp - 4]
cmp dword [eax + 0x254], 0
jne 0x4158cf
call fcn.00402fe0
jmp 0x416b29
call fcn.004070c0
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1a0]
fnstsw ax
sahf
jbe 0x41590e
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.00414058
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov edx, 0x416bf8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x2c58
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x415972
call fcn.00402fe0
jmp 0x416b29
push 0x548
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1dc], ebx
test ebx, ebx
jne 0x4159a2
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x254
call fcn.004036f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415a79
lea eax, [ebp - 0xc]
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00406174
test al, al
je 0x415a09
lea eax, [ebp - 0xc]
mov edx, 0x416c4c
call fcn.004034c0
push 0
lea edx, [ebp - 0x38c]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416c68
push dword [ebp - 0xc]
push 0x416c80
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x394]
call fcn.00408484
push dword [ebp - 0x394]
lea eax, [ebp - 0x390]
mov edx, 4
call fcn.00403764
mov eax, dword [ebp - 0x390]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00402fe0
jmp 0x416b29
push 0x416c90
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x415a97
call fcn.00402fe0
jmp 0x416b29
push 0x416c98
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x415ab5
call fcn.00402fe0
jmp 0x416b29
push 0x416ca0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x415ad3
call fcn.00402fe0
jmp 0x416b29
push 0x416ca8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x415af4
call fcn.00402fe0
jmp 0x416b29
push 0x416cb0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415b10
call fcn.00402fe0
jmp 0x416b29
push 0x416cb8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415b2c
call fcn.00402fe0
jmp 0x416b29
push 0x416cc0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415b48
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
xor ecx, ecx
mov edx, 0x548
call fcn.004028a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov dword [eax + 0x58], 1
mov eax, dword [ebp - 4]
call fcn.004198c0
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x415b96
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x476], 1
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xba]
mov byte [eax + 0x4a], dl
mov edx, dword [ebp - 4]
cmp byte [edx + 0x9a], 0
je 0x415be6
mov byte [eax + 0x49], 1
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x415be6
call fcn.00402fe0
jmp 0x416b29
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x415c07
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x32]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x3f], al
mov edx, dword [ebp - 4]
cmp byte [edx + 0x12a], 0
jne 0x415c4f
mov edx, dword [ebp - 4]
cmp byte [edx + 0x13a], 0
jne 0x415c4f
mov edx, dword [ebp - 4]
cmp byte [edx + 0xca], 0
je 0x415c4b
mov edx, dword [ebp - 4]
cmp byte [edx + 0xda], 0
jne 0x415c4f
xor edx, edx
jmp 0x415c51
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x15a]
mov byte [eax + 0x52], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x17a]
mov byte [eax + 0x62], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x16a]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x22]
xor dl, 1
mov byte [eax + 0x3e], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x14a]
mov byte [eax + 0x54], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
cmp byte [eax + 0x3f], 0
jne 0x415cb4
cmp byte [eax + 0x3e], 0
jne 0x415cb4
cmp byte [eax + 0x54], 0
je 0x415cd5
push 0
mov eax, dword [ebp - 0x10]
push eax
push edi
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x415cd5
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1dc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov dword [ebx + 0x540], eax
mov eax, dword [ebp - 4]
lea esi, [eax + 0x268]
lea edi, [ebx + 0x478]
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x260]
mov byte [ebx + 0x61], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x45], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x10a]
mov byte [ebx + 0x50], al
xor eax, eax
mov byte [ebx + 0x3c], al
cmp byte [ebx + 0x3c], 0
je 0x415da0
push 0xfffffffffffffff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowRect
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x4c], eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
mov edx, 0x416cd0
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1bc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1bc], 0
jne 0x415df9
call fcn.00402fe0
jmp 0x416b29
push 0x416ce8
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c0], 0
jne 0x415e22
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0
jne 0x415e38
call fcn.00402fe0
jmp 0x416b29
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x244]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
call fcn.004036f0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
je 0x415e7d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.004036f0
lea eax, [ebp - 0x155]
mov edx, dword [ebp - 8]
call fcn.0040653c
lea eax, [ebp - 0x19c]
xor ecx, ecx
mov edx, 0x44
call fcn.004028a0
mov word [ebp - 0x16c], 1
mov dword [ebp - 0x18c], 0x1388
mov dword [ebp - 0x188], 0xffffec78
mov dword [ebp - 0x170], 0x85
lea edx, [ebp - 0x38c]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416d00
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x38c]
call fcn.00405f7c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416d18
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405f7c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416d2c
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405f7c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
lea edx, [ebp - 0x394]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x394]
lea edx, [ebp - 0x390]
call fcn.004063f4
mov eax, dword [ebp - 0x390]
call fcn.00403868
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
je 0x415f96
lea eax, [ebp - 0x48]
call fcn.00406474
jmp 0x415fa7
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.004034c0
lea eax, [ebp - 0x38c]
push eax
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0x48]
call fcn.004038a8
mov eax, dword [ebp - 0x38c]
mov edx, 0x416c40
call fcn.004037b4
jne 0x415fee
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
lea eax, [ebp - 0x48]
mov ecx, 1
call fcn.004038e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
add eax, 0x74
mov edx, dword [ebp - 0x48]
mov ecx, 0xff
call fcn.00403680
push dword [ebp - 0x48]
push 0x416c40
mov eax, dword [ebp - 4]
push dword [eax + 0x248]
lea eax, [ebp - 0x38c]
mov edx, 3
call fcn.00403764
mov eax, dword [ebp - 0x38c]
push eax
lea eax, [ebp - 0x390]
lea edx, [ebp - 0x155]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x390]
pop edx
call fcn.00413d64
test al, al
je 0x416087
push dword [ebp - 0x48]
push 0x416c40
mov eax, dword [ebp - 4]
push dword [eax + 0x248]
lea eax, [ebp - 0x38c]
mov edx, 3
call fcn.00403764
mov edx, dword [ebp - 0x38c]
lea eax, [ebp - 0x155]
call fcn.0040653c
lea eax, [ebp - 0x155]
push eax
push 0x416d40
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00403868
push eax
push 0x416d5c
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0x416d74
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x477], 0
mov eax, dword [ebp - 4]
add eax, 0x1c8
push eax
lea eax, [ebp - 0x155]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1d4], ebx
test ebx, ebx
je 0x416194
mov eax, ebx
call fcn.0040253c
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x41618d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
lea eax, [ebp - 0x155]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x416177
mov eax, dword [ebp - 4]
add eax, 0x1c8
push eax
lea eax, [ebp - 0x50]
push eax
push 0x416d90
mov eax, dword [ebp - 0x4c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x416177
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 0x60000
setge al
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x477], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416194
mov eax, dword [ebp - 0x4c]
call fcn.00402554
ret
mov eax, dword [ebp - 4]
add eax, 0x1c4
push eax
lea eax, [ebp - 0x19c]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x155]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41666e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x41621f
call fcn.00414c3c
mov dword [ebp - 0x38], eax
mov dl, 1
or eax, 0xffffffff
call fcn.00414cbc
mov dword [ebp - 0x3c], eax
xor eax, eax
call fcn.00414c74
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1d4], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x41625c
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x208]
fnstsw ax
sahf
jb 0x41625c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x41627c
push 0x2b67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.004070c0
fstp qword [ebp - 0x34]
wait
jmp 0x4162b2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x4162d3
push 0x16
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
push eax
push 0x4149fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_EnumThreadWindows
call fcn.004070c0
fsub qword [ebp - 0x34]
fld xword [0x416d94]
fcompp
fnstsw ax
sahf
jbe 0x4162d3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
je 0x416287
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
jne 0x4162eb
mov eax, dword [ebp - 4]
mov byte [eax + 0x1e0], 1
jmp 0x41632f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x25c], 0
je 0x416327
mov eax, dword [ebp - 4]
call fcn.00419144
mov eax, dword [ebp - 4]
call fcn.004143c8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x41666e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x41637e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x416360
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x37
call sub.kernel32.dll_Sleep
call fcn.00413b18
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8a], 0
je 0x4163d3
push 0x44
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4163f6
push 0x54
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov dword [eax + 0x64], 1
jmp 0x416644
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
cmp byte [eax + 0x63], 0
je 0x416450
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x416450
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x416450
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x416660
cmp byte [0x41f6a8], 0
je 0x4164a6
push 0x14
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_InvalidateRect
mov byte [0x41f6a8], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x416506
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
je 0x4164d6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x13a], 0
jne 0x4164d6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12a], 0
je 0x416506
mov al, byte [0x41f6aa]
or al, byte [0x41f6a9]
je 0x416506
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0
push 0x416da0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413b18
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x8a]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1e1]
test al, al
je 0x416533
cmp dword [ebp - 0x20], 0
test al, al
je 0x41661c
cmp word [0x41f692], 0
jne 0x4165fa
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11a], 0
jne 0x416599
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x4165b3
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x4165b3
mov al, byte [0x41f6aa]
or al, byte [0x41f6a9]
je 0x4165b3
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4165cb
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413b18
push 0
push 0
push 0x406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x4165ff
call fcn.00413b18
mov eax, dword [ebp - 4]
mov byte [eax + 0x1e2], 1
mov eax, dword [ebp - 4]
mov dword [0x41f694], eax
mov dword [0x41f690], 0x416dc0
cmp byte [0x41d7a0], 0
je 0x41663c
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_PostMessageA
jmp 0x416644
mov eax, dword [ebp - 4]
call fcn.004152d4
push 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x416417
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416b29
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19c]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
push eax
push 0xffff
call sub.user32.dll_PostMessageA
mov ax, word [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp dword [ebp - 0x44], 0
je 0x4166d2
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
je 0x416751
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e5f0
cmp al, 2
jne 0x416716
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e3c4
call fcn.00413b18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e288
call fcn.00413b18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406268
mov eax, dword [ebp - 8]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406268
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4167cb
inc ebx
xor esi, esi
call fcn.00413b18
lea ecx, [ebp - 0x390]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x390]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406268
inc esi
dec ebx
jne 0x416789
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x4167e6
mov dl, 1
mov eax, dword [ebp - 0x3c]
call fcn.00414cbc
mov eax, dword [ebp - 0x38]
call fcn.00414c74
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c8], 0
je 0x416801
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x41681c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [0x41f690], eax
mov dword [0x41f694], eax
cmp dword [ebp - 0x14], 0
je 0x41684b
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x18], 0
je 0x41685a
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x1c], 0
je 0x416886
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x416874
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x41687b
push 0
call sub.user32.dll_MessageBeep
call fcn.00413b18
cmp dword [ebp - 0x1c], 0
jne 0x416860
cmp dword [ebp - 0x20], 0
je 0x416895
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_UnhookWindowsHookEx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4168b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x24], 0
je 0x4168bf
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x10], 0
je 0x4168ce
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1dc], 0
je 0x41691a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x30], edx
xor edx, edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x38], edx
mov byte [eax + 0x3c], 0
mov byte [eax + 0x3d], 0
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x28], 0
je 0x416929
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
call fcn.00413b18
mov eax, dword [ebp - 4]
call fcn.00413de8
call fcn.00413b18
mov eax, dword [ebp - 4]
call fcn.00413f50
call fcn.00413b18
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406268
test al, al
jne 0x4169c3
cmp dword [ebp - 0x28], 3
jne 0x4169ab
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x4169b5
push 0x22b
call sub.kernel32.dll_Sleep
call fcn.00413b18
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jne 0x416961
mov eax, dword [ebp - 4]
push dword [eax + 0x1a8]
push 0x416db8
push 0x416c34
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403764
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004036a4
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.00403978
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00402778
call fcn.0040263c
test eax, eax
je 0x416b1e
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x416c34
call fcn.004036f0
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
test ebx, ebx
je 0x416ac4
push 0x6f
call sub.kernel32.dll_Sleep
test ebx, ebx
je 0x416adb
call sub.kernel32.dll_GetTickCount
sub eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x457
jle 0x416aab
test ebx, ebx
je 0x416b1e
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x454
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416b63
lea eax, [ebp - 0x394]
mov edx, 3
call fcn.0040344c
lea eax, [ebp - 0x48]
call fcn.00403428
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040344c
ret