Function at 0x4037d0
Capabilities:
Check if file exists
Create directory
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x472497
mov eax, dword fs:[0]
push eax
mov eax, 0x302c
call fcn.00447e10
mov eax, dword [0x491050]
xor eax, esp
mov dword [esp + 0x3028], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491050]
xor eax, esp
push eax
lea eax, [esp + 0x3040]
mov dword fs:[0], eax
push 0x103
xor esi, esi
lea eax, [esp + 0x739]
mov ebx, ecx
push esi
push eax
mov dword [esp + 0x60], ebx
mov byte [esp + 0x740], 0
call fcn.00444930
add esp, 0xc
push 0x3ff
lea ecx, [esp + 0x129]
push esi
push ecx
mov byte [esp + 0x130], 0
call fcn.00444930
add esp, 0xc
push 0x103
lea edx, [esp + 0x631]
push esi
push edx
mov byte [esp + 0x638], 0
call fcn.00444930
add esp, 0xc
push 0x3ff
lea eax, [esp + 0xc41]
push esi
push eax
mov byte [esp + 0xc48], 0
call fcn.00444930
add esp, 0xc
push 0x103
lea ecx, [esp + 0x529]
push esi
push ecx
mov byte [esp + 0x530], 0
call fcn.00444930
add esp, 0xc
xor eax, eax
push 0x31
lea edx, [esp + 0x8d]
push esi
push edx
mov byte [esp + 0x88], 0
mov dword [esp + 0x89], eax
mov dword [esp + 0x8d], eax
mov byte [esp + 0x91], al
mov byte [esp + 0x94], al
call fcn.00444930
add esp, 0xc
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
mov byte [esp + 0x2b], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 0
call fcn.0040ed10
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x403948
push str.__atl_condVal
push esi
push 0xe2
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x40393e
int3
push 0x80004005
call fcn.0040d9e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x3048], esi
call fcn.0040ed10
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x403999
push str.__atl_condVal
push esi
push 0xe2
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x40398f
int3
push 0x80004005
call fcn.0040d9e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x3048], 1
call fcn.0040ed10
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4039eb
push str.__atl_condVal
push esi
push 0xe2
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x4039e1
int3
push 0x80004005
call fcn.0040d9e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x2c], ebp
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.00411540
push 0x63
lea ecx, [esp + 0xc1]
push 0
mov byte [esp + 0x3050], 3
push ecx
mov byte [esp + 0xc8], 0
call fcn.00444930
add esp, 0xc
lea edx, [esp + 0x74]
push edx
mov byte [esp + 0x1f], 0
mov byte [esp + 0x1d], 0
mov dword [esp + 0x50], 0
mov byte [0x4956dc], 0
mov byte [0x4956de], 0
call fcn.0046c3b0
lea eax, [esp + 0x74]
push eax
mov esi, str._Y__m__d
lea edi, [esp + 0x54]
call fcn.0040cff0
mov byte [esp + 0x3048], 4
mov ecx, dword [eax]
mov esi, dword [esp + 0x24]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x403aba
cmp dword [esi + 0xc], 0
jl 0x403aac
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x403aac
push eax
call fcn.0040d130
add esp, 4
mov ecx, esi
mov edi, eax
call fcn.0040d540
add edi, 0x10
mov dword [esp + 0x24], edi
jmp 0x403aba
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.0040d7e0
mov byte [esp + 0x3048], 3
mov esi, dword [esp + 0x50]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x403af0
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x403af0
int3
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x403b06
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.Prtfrwal
push ebx
call edi
test eax, eax
je 0x403b25
mov byte [esp + 0x1b], 1
mov dword [esp + 0x44], 0
push str.HuerWeb.Log
push ebx
call edi
test eax, eax
je 0x403b36
mov byte [esp + 0x32], 1
push str.HeurvirusWeek
push ebx
call edi
test eax, eax
je 0x403b47
mov byte [esp + 0x33], 1
push str.APPSUSP.log
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403c2e
push 0x4954b0
push 0x487b5c
mov edx, 0x4955b8
call fcn.0040cda0
add esp, 8
push 0x4955b8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403b8b
push eax
push 0x4955b8
call esi
mov ecx, dword [esp + 0x24]
push ecx
push 0x4954b0
push str._s_s.ini
mov edx, 0x4955b8
call fcn.0040cda0
add esp, 0xc
call fcn.00404ac0
push 0x4878c0
lea edx, [esp + 0x3c]
push 0x496158
push edx
call fcn.0043ec90
add esp, 0xc
test eax, eax
je 0x403c29
push 0x496158
push str._s_file_opening_failed_in_append_mode
lea eax, [esp + 0x12c]
push 0x400
push eax
call fcn.0043e0b0
lea ecx, [esp + 0x134]
push ecx
call fcn.00402250
add esp, 0x14
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.004115d0
lea ecx, [esp + 0x2c]
call fcn.0040d1e0
lea ecx, [esp + 0x1c]
call fcn.0040d1e0
lea ecx, [esp + 0x24]
call fcn.0040d1e0
mov eax, 4
jmp 0x404a8a
mov byte [esp + 0x2b], 1
cmp byte [0x495915], 1
jne 0x403c93
push 0x497450
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403c4e
push eax
push 0x497450
call esi
push 0x48810c
push 0x104
push 0x497450
call fcn.0043e110
mov edx, dword [esp + 0x30]
add esp, 0xc
push edx
push 0x104
push 0x497450
call fcn.0043e110
add esp, 0xc
push str..ini
push 0x104
push 0x497450
call fcn.0043e110
add esp, 0xc
push str.WORNSIG.LOG
push ebx
call edi
test eax, eax
je 0x403d13
mov eax, dword [0x4956e0]
push str.SendLogForDpRep
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4956bc], eax
test eax, eax
jne 0x403cfc
push str.GetProcAddress_failed_for_functionSendLogForDpRep___in_HuerWLog.dll
call fcn.00402250
add esp, 4
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.004115d0
lea ecx, [esp + 0x2c]
call fcn.0040d1e0
lea ecx, [esp + 0x1c]
call fcn.0040d1e0
lea ecx, [esp + 0x24]
call fcn.0040d1e0
mov eax, 2
jmp 0x404a8a
push 0x3d5
call fcn.0043a200
add esp, 4
mov dword [0x495194], eax
mov byte [esp + 0x23], 1
push str.c:zvDPRpt.log
lea ecx, [esp + 0x738]
push 0x104
push ecx
call fcn.0043dc50
add esp, 0xc
push str.c:zvDPRemain.log
lea edx, [esp + 0x630]
push 0x104
push edx
call fcn.0043dc50
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x734]
push eax
call esi
lea ecx, [esp + 0x62c]
push ecx
call esi
push 0x488190
lea edx, [esp + 0x38]
push ebx
push edx
call fcn.0043ec90
add esp, 0xc
test eax, eax
je 0x403ea1
push ebx
push str._s_file_opening_failed_in_read_mode
lea eax, [esp + 0x12c]
push 0x400
push eax
call fcn.0043e0b0
lea ecx, [esp + 0x134]
push ecx
call fcn.00402250
add esp, 0x14
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.004115d0
lea esi, [ebp - 0x10]
lea edi, [esi + 0xc]
mov byte [esp + 0x3048], 1
cmp dword [edi], 0
jne 0x403de6
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x403de6
int3
or edx, 0xffffffff
lock xadd dword [edi], edx
dec edx
test edx, edx
jg 0x403dfc
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x3048], 0
mov esi, dword [esp + 0x1c]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x403e32
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x403e32
int3
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x403e48
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x3048], 0xffffffff
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x403e81
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x403e81
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x403e97
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, 1
jmp 0x404a8a
push 0x4881b8
lea ecx, [esp + 0x738]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.0043ec90
add esp, 0xc
test eax, eax
je 0x403efd
lea eax, [esp + 0x734]
push eax
push str._s_file_opening_failed_in_write_mode
lea ecx, [esp + 0x12c]
push 0x400
push ecx
call fcn.0043e0b0
lea edx, [esp + 0x134]
push edx
call fcn.00402250
mov eax, dword [esp + 0x48]
add esp, 0x14
push eax
call fcn.0043efd0
jmp 0x403cc3
push 0x4881b8
lea ecx, [esp + 0x630]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.0043ec90
add esp, 0xc
test eax, eax
je 0x403f9a
lea eax, [esp + 0x62c]
push eax
push str._s_file_opening_failed_in_write_mode
lea ecx, [esp + 0x12c]
push 0x400
push ecx
call fcn.0043e0b0
lea edx, [esp + 0x134]
push edx
call fcn.00402250
mov eax, dword [esp + 0x50]
add esp, 0x14
push eax
call fcn.0043efd0
mov ecx, dword [esp + 0x38]
add esp, 4
push ecx
call fcn.0043efd0
add esp, 4
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.004115d0
lea ecx, [esp + 0x2c]
call fcn.0040d1e0
lea ecx, [esp + 0x1c]
call fcn.0040d1e0
lea ecx, [esp + 0x24]
call fcn.0040d1e0
mov eax, 3
jmp 0x404a8a
push 0x3ff
lea edx, [esp + 0x841]
push 0
push edx
mov byte [esp + 0x848], 0
call fcn.00444930
mov eax, dword [esp + 0x40]
add esp, 0xc
push eax
lea ecx, [esp + 0x128]
push 0x400
push ecx
call fcn.0043f8c0
add esp, 0xc
test eax, eax
je 0x4048e2
jmp 0x403fe0
push 7
lea edx, [esp + 0x128]
push str._Start_
push edx
mov byte [esp + 0x26], 0
call fcn.0043fe90
add esp, 0xc
test eax, eax
je 0x4048bc
cmp byte [esp + 0x33], 1
jne 0x404028
lea eax, [esp + 0x124]
push str._data_
push eax
call fcn.0044fd00
add esp, 8
test eax, eax
je 0x4048bc
lea eax, [esp + 0x124]
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404034
sub eax, esi
je 0x40406f
nop
mov al, byte [esp + edx + 0x124]
cmp al, 0xd
je 0x40404f
cmp al, 0xa
jne 0x404057
mov byte [esp + edx + 0x124], 0
lea eax, [esp + 0x124]
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404062
sub eax, esi
cmp edx, eax
jb 0x404040
cmp byte [0x495916], 1
jne 0x4040f6
lea ecx, [esp + 0x124]
push ecx
lea esi, [esp + 0x840]
call fcn.0040b130
mov eax, esi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404094
sub eax, edx
push eax
lea edx, [esp + 0x840]
push edx
lea ecx, [esp + 0x34]
call fcn.0040d7e0
lea ebx, [esp + 0x2c]
call fcn.0040db20
push eax
lea ecx, [esp + 0x20]
call fcn.0040bed0
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x8c]
push 0x32
push ecx
call fcn.0043dc50
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.0040d4b0
lea esi, [esp + 0x88]
call fcn.0040b080
cmp al, 1
je 0x4048bc
cmp byte [0x495915], 1
jne 0x404186
lea edx, [esp + 0x83c]
push edx
lea ecx, [esp + 0x128]
call fcn.0040ac90
lea eax, [esp + 0x840]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404124
sub eax, edx
push eax
lea eax, [esp + 0x840]
push eax
lea ecx, [esp + 0x34]
call fcn.0040d7e0
lea ebx, [esp + 0x2c]
call fcn.0040db20
push eax
lea ecx, [esp + 0x20]
call fcn.0040bed0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x8c]
push 0x32
push edx
call fcn.0043dc50
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.0040d4b0
lea esi, [esp + 0x88]
call fcn.0040abe0
cmp al, 1
je 0x4048bc
mov eax, dword [esp + 0x48]
inc eax
cmp eax, 0x2710
mov dword [esp + 0x48], eax
jle 0x4041b7
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x128]
push ecx
mov byte [0x4956dc], 1
call fcn.0043ed30
add esp, 8
jmp 0x4048bc
cmp byte [esp + 0x2b], 1
jne 0x4044a2
push str.APPDATA_L.220415
lea edx, [esp + 0x128]
push edx
call edi
test eax, eax
jne 0x4048bc
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x128]
push ecx
call fcn.0040a3b0
add esp, 8
cmp al, 1
jne 0x404202
mov byte [esp + 0x1a], al
mov byte [0x4956de], al
mov byte [esp + 0x19], al
push str.SUSP_VSDE
lea edx, [esp + 0x128]
push edx
call edi
test eax, eax
je 0x40423d
push str.SUSP_VSDE
lea eax, [esp + 0xc0]
push 0x64
push eax
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x1a], 1
mov byte [0x4956de], 1
mov byte [esp + 0x19], 1
push str.BLKC_VSDEL
lea ecx, [esp + 0x128]
push ecx
call edi
test eax, eax
je 0x404278
push str.BLKC_VSDEL
lea edx, [esp + 0xc0]
push 0x64
push edx
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x1a], 1
mov byte [0x4956de], 1
mov byte [esp + 0x19], 1
push str.SUSP_VSALL
lea eax, [esp + 0x128]
push eax
call edi
test eax, eax
je 0x4042b3
push str.SUSP_VSALL
lea ecx, [esp + 0xc0]
push 0x64
push ecx
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x1a], 1
mov byte [0x4956de], 1
mov byte [esp + 0x19], 1
push str.WMMP3.
lea edx, [esp + 0x128]
push edx
call edi
test eax, eax
je 0x4042ee
push str.WMMP3.
lea eax, [esp + 0xc0]
push 0x64
push eax
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x1a], 1
mov byte [0x4956de], 1
mov byte [esp + 0x19], 1
push 0x488234
lea ecx, [esp + 0x128]
push ecx
call edi
test eax, eax
je 0x404329
push 0x488234
lea edx, [esp + 0xc0]
push 0x64
push edx
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x1a], 1
mov byte [0x4956de], 1
mov byte [esp + 0x19], 1
lea eax, [esp + 0xbc]
push eax
call fcn.00408400
add esp, 4
cmp al, 1
jne 0x404347
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0xc3c]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.00404c90
lea eax, [esp + 0xc44]
push eax
lea ecx, [esp + 0x130]
push 0x400
push ecx
call fcn.0043dc50
mov eax, dword [esp + 0x60]
inc eax
add esp, 0x14
cmp eax, 0x19
mov dword [esp + 0x4c], eax
jle 0x4043bf
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x128]
push eax
call fcn.0043ed30
mov ecx, dword [esp + 0x40]
push ecx
push 0x4878d4
call fcn.0043ed30
add esp, 0x10
mov byte [esp + 0x19], 0
mov dword [0x4956d8], 1
jmp 0x4048bc
lea edx, [esp + 0x124]
call fcn.0040b3e0
mov ecx, edx
call fcn.004052a0
cmp al, 1
jne 0x4043e0
mov byte [esp + 0x19], 0
jmp 0x4048bc
cmp byte [esp + 0x19], 1
jne 0x404403
lea edx, [esp + 0xbc]
push edx
push 0x64
push 0x497558
call fcn.0043dc50
add esp, 0xc
mov byte [esp + 0x19], 0
lea eax, [esp + 0x124]
push 0x488238
push eax
call fcn.00440020
add esp, 8
test eax, eax
je 0x404471
inc eax
push eax
lea ecx, [esp + 0x30]
call fcn.0040d890
lea ebx, [esp + 0x2c]
call fcn.0040db20
push eax
lea ecx, [esp + 0x20]
call fcn.0040bed0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x8c]
push 0x32
push edx
call fcn.0043dc50
add esp, 0xc
lea esi, [esp + 0x88]
call fcn.00407790
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.0040d4b0
cmp bl, 1
je 0x4048bc
cmp byte [esp + 0x1a], 1
jne 0x4044a2
push str._____________________________________________________________________________________________
call fcn.004083b0
add esp, 4
push 0x496d18
call fcn.004083b0
lea eax, [esp + 0x128]
add esp, 4
push eax
call fcn.004083b0
add esp, 4
cmp byte [esp + 0x23], 1
jne 0x404822
mov esi, dword [0x495194]
push 0x32
push 0
push esi
call fcn.00444930
add esp, 0xc
push 0x32
lea ecx, [esi + 0x32]
push 0
push ecx
call fcn.00444930
add esp, 0xc
push 0x104
lea edx, [esi + 0x168]
push 0
push edx
call fcn.00444930
add esp, 0xc
push 0x104
lea eax, [esi + 0x26c]
push 0
push eax
call fcn.00444930
add esp, 0xc
push 0x104
lea ecx, [esi + 0x64]
push 0
push ecx
call fcn.00444930
add esp, 0xc
push 0x32
lea edx, [esi + 0x370]
push 0
push edx
call fcn.00444930
add esp, 0xc
push 0x32
push 0
add esi, 0x3a2
push esi
call fcn.00444930
add esp, 0xc
push 0x486f97
lea eax, [esp + 0xc40]
push 0x400
push eax
call fcn.0043dc50
add esp, 0xc
push 0x486f97
lea ecx, [esp + 0x528]
push 0x104
push ecx
call fcn.0043dc50
lea edx, [esp + 0xc48]
add esp, 0xc
push edx
lea ecx, [esp + 0x528]
lea edx, [esp + 0x128]
call fcn.00406470
add esp, 4
test eax, eax
je 0x4048bc
lea eax, [esp + 0x524]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x40470d
push 0
lea ecx, [esp + 0x528]
push ecx
lea ecx, [esp + 0x60]
call fcn.004116f0
test eax, eax
je 0x4045d7
lea ecx, [esp + 0x58]
call fcn.00411d20
lea ecx, [esp + 0x58]
call fcn.00410bc0
test eax, eax
jne 0x4048bc
lea ecx, [esp + 0x58]
call fcn.00411640
mov edx, dword [0x495194]
push 0x4882a0
push 0x32
push edx
call fcn.0043dc50
mov eax, dword [0x495194]
add esp, 0xc
push 0x4882a0
add eax, 0x26c
push 0x104
push eax
call fcn.0043dc50
add esp, 0xc
push 0x4882a0
lea ecx, [esp + 0x80]
push 0xa
push ecx
call fcn.0043dc50
mov edx, dword [0x495194]
add esp, 0xc
push 0x4882a0
add edx, 0x370
push 0x32
push edx
call fcn.0043dc50
mov eax, dword [0x495194]
add esp, 0xc
push 0x4882a0
add eax, 0x3a2
push 0x32
push eax
call fcn.0043dc50
mov ecx, dword [0x495194]
add esp, 0xc
push 0x4882a0
add ecx, 0x64
push 0x104
push ecx
call fcn.0043dc50
add esp, 0xc
push 0x4882a0
lea edx, [esp + 0x1040]
push 0x2000
push edx
call fcn.0043dc50
mov eax, dword [0x495194]
add esp, 0xc
push eax
lea ecx, [esp + 0x528]
push ecx
call dword [0x4956bc]
add esp, 8
lea esi, [esp + 0x524]
call fcn.004069e0
cmp eax, 1
jne 0x4046cf
push 0x4882a4
push 0xa
lea edx, [esp + 0x84]
push edx
jmp 0x4046de
push 0x4882a8
push 0xa
lea eax, [esp + 0x84]
push eax
call fcn.0043dc50
mov eax, dword [0x4954ac]
add esp, 0xc
test eax, eax
je 0x4047c3
lea ecx, [esp + 0x103c]
push ecx
lea edx, [esp + 0x528]
push edx
call eax
add esp, 8
jmp 0x4047c3
mov eax, dword [0x495194]
push 0x4882a0
push 0x32
push eax
call fcn.0043dc50
mov ecx, dword [0x495194]
add esp, 0xc
push 0x4882a0
add ecx, 0x26c
push 0x104
push ecx
call fcn.0043dc50
add esp, 0xc
push 0x4882a0
lea edx, [esp + 0x80]
push 0xa
push edx
call fcn.0043dc50
mov eax, dword [0x495194]
add esp, 0xc
push 0x4882a0
add eax, 0x370
push 0x32
push eax
call fcn.0043dc50
mov ecx, dword [0x495194]
add esp, 0xc
push 0x4882a0
add ecx, 0x3a2
push 0x32
push ecx
call fcn.0043dc50
add esp, 0xc
push 0x486f97
lea edx, [esp + 0x1040]
push 0x2000
push edx
call fcn.0043dc50
mov eax, dword [0x495194]
add esp, 0xc
push 0x4882a0
add eax, 0x64
push 0x104
push eax
call fcn.0043dc50
add esp, 0xc
mov ecx, dword [0x495194]
push 0x32
push ecx
call fcn.00440520
mov eax, dword [0x495194]
lea ecx, [eax + 0x3a2]
lea edx, [esp + 0x1044]
push edx
push ecx
lea edx, [eax + 0x370]
push edx
lea ecx, [esp + 0x90]
push ecx
lea edx, [eax + 0x26c]
push edx
push eax
add eax, 0x64
push eax
lea eax, [esp + 0xc60]
push eax
push str._s__s__s__s__s__s__s__s____n
lea ecx, [esp + 0x150]
push 0x400
push ecx
call fcn.0043e0b0
add esp, 0x34
cmp byte [0x4956df], 1
jne 0x40483f
lea ecx, [esp + 0x124]
call fcn.00407840
cmp al, 1
je 0x4048bc
cmp byte [esp + 0x32], 1
jne 0x404859
push str.WSO.CROWTI3.300415.MCL
lea edx, [esp + 0x128]
push edx
call edi
test eax, eax
jne 0x4048bc
cmp byte [esp + 0x1b], 1
jne 0x404874
lea ecx, [esp + 0x124]
call fcn.0040a620
cmp al, 1
je 0x4048bc
inc dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x128]
push ecx
call fcn.0043ed30
add esp, 8
cmp byte [esp + 0x1b], 1
jne 0x4048a2
mov edx, dword [esp + 0x3c]
push edx
push 0x4882e0
call fcn.0043ed30
add esp, 8
push 0x486f97
lea eax, [esp + 0x128]
push 0x400
push eax
call fcn.0043dc50
add esp, 0xc
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x128]
push 0x400
push edx
call fcn.0043f8c0
add esp, 0xc
test eax, eax
jne 0x403fe0
mov ebp, dword [esp + 0x2c]
cmp dword [0x4956d8], 0
je 0x4048f8
push str.APPSUSP.log_has_got_more_than_25_Lines_so_skipping_more_than_25_lines_in_this_instance
call fcn.00402250
add esp, 4
mov eax, dword [esp + 0x34]
push eax
call fcn.0043efd0
mov ecx, dword [esp + 0x40]
add esp, 4
push ecx
call fcn.0043efd0
mov edx, dword [esp + 0x44]
add esp, 4
push edx
call fcn.0043efd0
mov eax, dword [esp + 0x3c]
add esp, 4
test eax, eax
je 0x404938
push eax
call fcn.0043efd0
add esp, 4
mov dword [esp + 0x38], 0
mov esi, dword [esp + 0x54]
push str.WORNSIG.LOG
push esi
call edi
test eax, eax
je 0x40495a
mov eax, dword [0x495194]
test eax, eax
je 0x40495a
push eax
call fcn.00439ce0
add esp, 4
cmp byte [0x4956dc], 1
jne 0x404974
push 3
push esi
lea eax, [esp + 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp byte [esp + 0x23], 1
jne 0x404980
call fcn.00406c10
cmp byte [esp + 0x1b], 1
jne 0x404995
cmp dword [esp + 0x44], 0
jne 0x404995
mov byte [0x494f80], 0
lea ecx, [esp + 0x58]
mov byte [esp + 0x3048], 2
call fcn.004115d0
lea esi, [ebp - 0x10]
lea edi, [esi + 0xc]
mov byte [esp + 0x3048], 1
cmp dword [edi], 0
jne 0x4049d7
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x4049d7
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4049ed
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x3048], 0
mov esi, dword [esp + 0x1c]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x404a23
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x404a23
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x404a39
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x3048], 0xffffffff
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x404a72
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x404a72
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x404a88
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
xor eax, eax
mov ecx, dword [esp + 0x3040]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3028]
xor ecx, esp
call fcn.00439cd0
add esp, 0x3038
ret