Function at 0x415578
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Get file version info
Hide graphical window
Link many functions at runtime
Log keystrokes
Log keystrokes via application hook
Move file
Resume thread
Set environment variable
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc50
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 0x3ac], edx
mov dword [ebp - 0x3b0], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416ec7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407118
mov eax, dword [ebp - 4]
fstp qword [eax + 0x234]
wait
push 0x416ed8
mov eax, dword [0x41e820]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
push eax
push 1
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
fld qword [eax + 0x1cc]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x234]
fnstsw ax
sahf
jae 0x41562f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x416e94
mov eax, dword [ebp - 4]
call fcn.00415468
test al, al
je 0x416e94
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x208], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1f4], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1f0], edx
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c8]
lea eax, [ebp - 0x3a8]
mov edx, 0x416eec
call fcn.004036f0
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
mov dword [ebp - 0x40], eax
xor edx, edx
push ebp
push 0x416e8a
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.004063f0
mov eax, dword [ebp - 0x3a8]
call fcn.004064f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x244]
sub eax, 1
jb 0x415723
je 0x415753
dec eax
je 0x41575f
jmp 0x415769
mov eax, dword [ebp - 4]
mov byte [eax + 0x240], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416efc
call fcn.00412e04
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x241]
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x242], al
jmp 0x415769
mov eax, dword [ebp - 4]
mov byte [eax + 0x242], 0
jmp 0x415769
mov eax, dword [ebp - 4]
mov byte [eax + 0x242], 1
lea eax, [ebp - 0x171]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x3ac]
lea edx, [ebp - 0x171]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3a8]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x26c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
mov ecx, 0x416f10
call fcn.0040dc30
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
add eax, 0x1d4
call fcn.0040347c
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.00413ba8
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
add eax, 0x1d4
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x280
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d4]
call fcn.0040347c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x280]
mov eax, dword [ebp - 4]
add eax, 0x1d4
mov ecx, 0x416f30
call fcn.004036f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24c], edx
push 0x416f38
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x415866
push 0x15b3
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, 0xffffff7f
je 0x415866
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
jge 0x4159e5
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
mov esi, ebx
mov dword [eax + 0x24c], esi
lea edx, [ebp - 0x3a8]
mov eax, esi
call fcn.00405fd4
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
add eax, 0x250
mov edx, 0x416f54
call fcn.004036f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x250]
lea eax, [ebp - 0x3a8]
mov edx, 0x416f64
call fcn.004036f0
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x415a03
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
dec ebx
cmp ebx, 0x80000036
jne 0x415879
jmp 0x415a03
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x415937
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d4]
lea eax, [ebp - 0x3a8]
mov edx, 0x416f84
call fcn.004036f0
mov ecx, dword [ebp - 0x3a8]
mov dl, 1
mov eax, dword [0x405334]
call fcn.00408ec0
call fcn.00402f40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.00415294
test al, al
je 0x4159a2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1d4]
lea eax, [ebp - 8]
mov ecx, 0x416fa0
call fcn.004036f0
lea eax, [ebp - 0x3a4]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x3a0], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x39c], eax
mov word [ebp - 0x394], 0x414
lea eax, [ebp - 0x3a4]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4159e5
mov eax, dword [ebp - 4]
inc dword [eax + 0x24c]
mov eax, dword [ebp - 4]
push dword [eax + 0x280]
push 0x416f30
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00405fd4
push dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
add eax, 0x1d4
mov edx, 3
call fcn.00403764
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.00403868
push eax
call sub.kernel32.dll_CreateDirectoryA_1
test eax, eax
je 0x4158fb
mov eax, dword [ebp - 4]
add eax, 0x250
mov edx, 0x416f54
call fcn.0040347c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
je 0x415a48
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00405fd4
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
add eax, 0x250
call fcn.004036ac
cmp dword [ebp - 0x44], 0
je 0x415a5c
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x44], eax
call fcn.0040263c
mov eax, dword [ebp - 4]
add eax, 0x1d4
mov edx, 0x416fac
call fcn.004036ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x240], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
add eax, 0x30
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d4]
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x270
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x278
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x280
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e0]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416efc
call fcn.00412e04
mov eax, dword [ebp - 4]
cmp dword [eax + 0x280], 0
jne 0x415b23
call fcn.00402fe0
jmp 0x416e94
call fcn.00407118
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1cc]
fnstsw ax
sahf
jbe 0x415b62
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.004141ec
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov edx, 0x416f64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x250]
lea eax, [ebp - 0x3a8]
call fcn.004036f0
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0x2c5c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x415bc6
call fcn.00402fe0
jmp 0x416e94
push 0x54c
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x208], ebx
test ebx, ebx
jne 0x415bf6
call fcn.00402fe0
jmp 0x416e94
mov eax, ebx
xor ecx, ecx
mov edx, 0x54c
call fcn.004028a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov dword [eax + 0x58], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x280]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1d4]
mov eax, dword [ebp - 4]
add eax, 0x280
call fcn.004036f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
call fcn.00403868
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415ceb
lea eax, [ebp - 0xc]
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
call fcn.004061cc
test al, al
je 0x415c7b
lea eax, [ebp - 0xc]
mov edx, 0x416fb8
call fcn.004034c0
push 0
lea edx, [ebp - 0x3a8]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0x416fd4
push dword [ebp - 0xc]
push 0x416fec
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x3b0]
call fcn.004084dc
push dword [ebp - 0x3b0]
lea eax, [ebp - 0x3ac]
mov edx, 4
call fcn.00403764
mov eax, dword [ebp - 0x3ac]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00402fe0
jmp 0x416e94
push 0x416ffc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x415d0c
call fcn.00402fe0
jmp 0x416e94
push 0x417004
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x415d2a
call fcn.00402fe0
jmp 0x416e94
push 0x41700c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x415d48
call fcn.00402fe0
jmp 0x416e94
push 0x417014
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x415d66
call fcn.00402fe0
jmp 0x416e94
push 0x41701c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415d82
call fcn.00402fe0
jmp 0x416e94
push 0x417024
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415d9e
call fcn.00402fe0
jmp 0x416e94
push 0x41702c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415dba
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
call fcn.0041a7c8
push 0
mov eax, dword [ebp - 0x10]
push eax
push edi
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x415de3
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x476], 1
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xba]
mov byte [eax + 0x4a], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x9a]
mov byte [eax + 0x49], dl
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x415e2c
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x474], 1
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x415e5d
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x32]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov byte [edx + 0x3f], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
xor edx, edx
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
cmp byte [edx + 0x12a], 0
jne 0x415eb3
mov edx, dword [ebp - 4]
cmp byte [edx + 0x13a], 0
jne 0x415eb3
mov edx, dword [ebp - 4]
cmp byte [edx + 0xca], 0
je 0x415eaf
mov edx, dword [ebp - 4]
cmp byte [edx + 0xda], 0
jne 0x415eb3
xor edx, edx
jmp 0x415eb5
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x15a]
mov byte [eax + 0x52], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x17a]
mov byte [eax + 0x62], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x16a]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x22]
xor dl, 1
mov byte [eax + 0x3e], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x14a]
mov byte [eax + 0x54], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
cmp byte [eax + 0x3f], 0
jne 0x415f18
cmp byte [eax + 0x3e], 0
jne 0x415f18
cmp byte [eax + 0x54], 0
je 0x415f3c
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x415f3c
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x208]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
mov dword [ebx + 0x540], eax
mov eax, dword [ebp - 4]
lea esi, [eax + 0x294]
lea edi, [ebx + 0x478]
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x28c]
mov byte [ebx + 0x61], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x45], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x10a]
mov byte [ebx + 0x50], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1a8]
mov byte [ebx + 0x548], al
xor eax, eax
mov byte [ebx + 0x3c], al
cmp byte [ebx + 0x3c], 0
je 0x416016
push 0xfffffffffffffff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowRect
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x4c], eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x250]
lea eax, [ebp - 0x3a8]
mov edx, 0x41703c
call fcn.004036f0
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1e8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1e8], 0
jne 0x41606f
call fcn.00402fe0
jmp 0x416e94
push 0x417054
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1ec], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1ec], 0
jne 0x416098
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
cmp dword [eax + 0x270], 0
jne 0x4160ae
call fcn.00402fe0
jmp 0x416e94
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x270]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1d4]
lea eax, [ebp - 8]
call fcn.004036f0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x278], 0
je 0x4160f3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x278]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1d4]
mov eax, dword [ebp - 4]
add eax, 0x278
call fcn.004036f0
lea eax, [ebp - 0x171]
mov edx, dword [ebp - 8]
call fcn.00406594
lea eax, [ebp - 0x1b8]
xor ecx, ecx
mov edx, 0x44
call fcn.004028a0
mov word [ebp - 0x188], 1
mov dword [ebp - 0x1a8], 0x1388
mov dword [ebp - 0x1a4], 0xffffec78
mov dword [ebp - 0x18c], 0x85
lea edx, [ebp - 0x3a8]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0x41706c
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x3a8]
call fcn.00405fd4
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0x417084
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405fd4
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
push 0x417098
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405fd4
mov eax, dword [ebp - 0x3a8]
call fcn.00403868
push eax
lea edx, [ebp - 0x3b0]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x3b0]
lea edx, [ebp - 0x3ac]
call fcn.0040644c
mov eax, dword [ebp - 0x3ac]
call fcn.00403868
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x242], 0
je 0x41620c
lea eax, [ebp - 0x48]
call fcn.004064cc
jmp 0x41621d
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d4]
call fcn.004034c0
lea eax, [ebp - 0x3a8]
push eax
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0x48]
call fcn.004038a8
mov eax, dword [ebp - 0x3a8]
mov edx, 0x416fac
call fcn.004037b4
jne 0x416264
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
lea eax, [ebp - 0x48]
mov ecx, 1
call fcn.004038e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
add eax, 0x74
mov edx, dword [ebp - 0x48]
mov ecx, 0xff
call fcn.00403680
push dword [ebp - 0x48]
push 0x416fac
mov eax, dword [ebp - 4]
push dword [eax + 0x274]
lea eax, [ebp - 0x3a8]
mov edx, 3
call fcn.00403764
mov eax, dword [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x3ac]
lea edx, [ebp - 0x171]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x3ac]
pop edx
call fcn.00413ef8
test al, al
je 0x4162fd
push dword [ebp - 0x48]
push 0x416fac
mov eax, dword [ebp - 4]
push dword [eax + 0x274]
lea eax, [ebp - 0x3a8]
mov edx, 3
call fcn.00403764
mov edx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x171]
call fcn.00406594
lea eax, [ebp - 0x171]
push eax
push 0x4170ac
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.00403868
push eax
push 0x4170c8
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0x4170e0
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x477], 0
mov eax, dword [ebp - 4]
add eax, 0x1f4
push eax
lea eax, [ebp - 0x171]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x200], ebx
test ebx, ebx
je 0x41640a
mov eax, ebx
call fcn.0040253c
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x416403
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f4]
push eax
lea eax, [ebp - 0x171]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4163ed
mov eax, dword [ebp - 4]
add eax, 0x1f4
push eax
lea eax, [ebp - 0x50]
push eax
push 0x4170fc
mov eax, dword [ebp - 0x4c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4163ed
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 0x60000
setge al
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov byte [edx + 0x477], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41640a
mov eax, dword [ebp - 0x4c]
call fcn.00402554
ret
mov eax, dword [ebp - 4]
add eax, 0x360
lea edx, [ebp - 0x171]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x549], 1
mov eax, dword [ebp - 4]
add eax, 0x1f0
push eax
lea eax, [ebp - 0x1b8]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x171]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4169d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x4164bd
call fcn.00414ea4
mov dword [ebp - 0x38], eax
mov dl, 1
or eax, 0xffffffff
call fcn.00414f24
mov dword [ebp - 0x3c], eax
xor eax, eax
call fcn.00414edc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x200], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 0
jne 0x4164fa
mov eax, dword [ebp - 4]
fld qword [eax + 0x1cc]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x234]
fnstsw ax
sahf
jb 0x4164fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f4]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov byte [eax + 0x476], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 0
jne 0x41652a
push 0x2b67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.00407118
fstp qword [ebp - 0x34]
wait
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 0
jne 0x416608
jmp 0x4165e3
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne bl
mov eax, dword [ebp - 4]
mov byte [eax + 0x20c], bl
test bl, bl
jne 0x416608
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
cmp dword [eax + 0x30], 0
je 0x4165cb
jmp 0x41659b
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4165b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x416583
mov eax, dword [ebp - 4]
push eax
push 0x414de0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x4165e3
mov eax, dword [ebp - 4]
push eax
push 0x414de0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
push eax
call sub.user32.dll_EnumThreadWindows
call fcn.00407118
fsub qword [ebp - 0x34]
fld xword [0x417100]
fcompp
fnstsw ax
sahf
jbe 0x416608
mov eax, dword [ebp - 4]
cmp dword [eax + 0x200], 0
je 0x416548
mov eax, dword [ebp - 4]
cmp dword [eax + 0x200], 0
jne 0x416620
mov eax, dword [ebp - 4]
mov byte [eax + 0x20c], 1
jmp 0x416673
push 0x37
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
call fcn.00414d3c
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x288], 0
je 0x41666b
mov eax, dword [ebp - 4]
call fcn.00419780
mov eax, dword [ebp - 4]
call fcn.0041455c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 0
jne 0x4169d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x4166c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4166a4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x37
call sub.kernel32.dll_Sleep
call fcn.00413cac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8a], 0
je 0x416717
push 0x44
mov eax, dword [0x4206a4]
push eax
mov eax, dword [0x4206a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x41673a
push 0x54
mov eax, dword [0x4206a4]
push eax
mov eax, dword [0x4206a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov dword [eax + 0x64], 1
jmp 0x4169af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
cmp byte [eax + 0x63], 0
je 0x416794
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x416794
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x416794
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 0
jne 0x4169cb
cmp byte [0x4206a8], 0
je 0x4167ea
push 0x14
mov eax, dword [0x4206a4]
push eax
mov eax, dword [0x4206a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_InvalidateRect
mov byte [0x4206a8], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1bc], 0
jne 0x416833
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x416856
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
je 0x416826
mov eax, dword [ebp - 4]
cmp byte [eax + 0x13a], 0
jne 0x416826
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12a], 0
je 0x416856
mov al, byte [0x4206ac]
or al, byte [0x4206ab]
je 0x416856
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0
push 0x41710c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413cac
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x8a]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x20d]
test al, al
je 0x416883
cmp dword [ebp - 0x20], 0
test al, al
je 0x416987
cmp word [0x420692], 0
jne 0x416965
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1bc], 0
jne 0x4168f5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11a], 0
jne 0x4168f5
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x41690f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x41690f
mov al, byte [0x4206ac]
or al, byte [0x4206ab]
je 0x41690f
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x416927
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413cac
push 0
push 0
push 0x406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_SetActiveWindow
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x41696a
call fcn.00413cac
mov eax, dword [ebp - 4]
mov byte [eax + 0x20e], 1
mov eax, dword [ebp - 4]
mov dword [0x420694], eax
mov dword [0x420690], 0x41712c
cmp byte [0x41e7a0], 0
je 0x4169a7
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x200]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4169af
mov eax, dword [ebp - 4]
call fcn.0041553c
push 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41675b
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416e94
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1ec], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x23c]
push eax
push 0xffff
call sub.user32.dll_PostMessageA
mov ax, word [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp dword [ebp - 0x44], 0
je 0x416a3d
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fc]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x278], 0
je 0x416abc
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e77c
cmp al, 2
jne 0x416a81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e550
call fcn.00413cac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e414
call fcn.00413cac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x278]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x3a8]
call fcn.004035dc
mov eax, dword [ebp - 0x3a8]
call fcn.004062c0
mov eax, dword [ebp - 8]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x3a8]
call fcn.004035dc
mov eax, dword [ebp - 0x3a8]
call fcn.004062c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416b36
inc ebx
xor esi, esi
call fcn.00413cac
lea ecx, [ebp - 0x3ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3ac]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x3a8]
call fcn.004035dc
mov eax, dword [ebp - 0x3a8]
call fcn.004062c0
inc esi
dec ebx
jne 0x416af4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x416b51
mov dl, 1
mov eax, dword [ebp - 0x3c]
call fcn.00414f24
mov eax, dword [ebp - 0x38]
call fcn.00414edc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f4], 0
je 0x416b6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f0], 0
je 0x416b87
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [0x420690], eax
mov dword [0x420694], eax
cmp dword [ebp - 0x14], 0
je 0x416bb6
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x18], 0
je 0x416bc5
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x1c], 0
je 0x416bf1
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x416bdf
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x416be6
push 0
call sub.user32.dll_MessageBeep
call fcn.00413cac
cmp dword [ebp - 0x1c], 0
jne 0x416bcb
cmp dword [ebp - 0x20], 0
je 0x416c00
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_UnhookWindowsHookEx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x416c1b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x24], 0
je 0x416c2a
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x10], 0
je 0x416c39
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x208], 0
je 0x416c85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x30], edx
xor edx, edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x38], edx
mov byte [eax + 0x3c], 0
mov byte [eax + 0x3d], 0
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x28], 0
je 0x416c94
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
call fcn.00413cac
mov eax, dword [ebp - 4]
call fcn.00413f7c
call fcn.00413cac
mov eax, dword [ebp - 4]
call fcn.004140e4
call fcn.00413cac
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x3a8]
call fcn.004035dc
mov eax, dword [ebp - 0x3a8]
call fcn.004062c0
test al, al
jne 0x416d2e
cmp dword [ebp - 0x28], 3
jne 0x416d16
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
call fcn.00403868
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x416d20
push 0x22b
call sub.kernel32.dll_Sleep
call fcn.00413cac
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jne 0x416ccc
mov eax, dword [ebp - 4]
push dword [eax + 0x1d4]
push 0x417124
push 0x416fa0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403764
lea eax, [ebp - 0x3a4]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x3a0], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x39c], eax
mov word [ebp - 0x394], 0x414
lea eax, [ebp - 0x3a4]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.004036a4
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
add eax, 0x1d4
call fcn.00403978
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.00402778
call fcn.0040263c
test eax, eax
je 0x416e89
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1d4]
lea eax, [ebp - 8]
mov ecx, 0x416fa0
call fcn.004036f0
lea eax, [ebp - 0x3a4]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x3a0], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x39c], eax
mov word [ebp - 0x394], 0x414
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea eax, [ebp - 0x3a4]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
test ebx, ebx
je 0x416e2f
push 0x6f
call sub.kernel32.dll_Sleep
test ebx, ebx
je 0x416e46
call sub.kernel32.dll_GetTickCount
sub eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x457
jle 0x416e16
test ebx, ebx
je 0x416e89
lea eax, [ebp - 0x3a4]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x3a0], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x39c], eax
mov word [ebp - 0x394], 0x454
lea eax, [ebp - 0x3a4]
push eax
call sub.shell32.dll_SHFileOperationA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416ece
lea eax, [ebp - 0x3b0]
mov edx, 3
call fcn.0040344c
lea eax, [ebp - 0x48]
call fcn.00403428
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040344c
ret