Function at 0x415464
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Get file version info
Hide graphical window
Link many functions at runtime
Log keystrokes
Log keystrokes via application hook
Move file
Resume thread
Set environment variable
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x38c], edx
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x394], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416cbe
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004070e0
mov eax, dword [ebp - 4]
fstp qword [eax + 0x208]
wait
push 0x416ccc
mov eax, dword [0x41d820]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
push eax
push 1
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x208]
fnstsw ax
sahf
jae 0x41551b
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x416c8b
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
call fcn.00403868
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.00415340
test al, al
je 0x416c8b
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1dc], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c4], edx
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x19c]
lea eax, [ebp - 0x38c]
mov edx, 0x416d2c
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
mov dword [ebp - 0x40], eax
xor edx, edx
push ebp
push 0x416c81
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x390]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x390]
lea edx, [ebp - 0x38c]
call fcn.004063b8
mov eax, dword [ebp - 0x38c]
call fcn.004064bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
sub eax, 1
jb 0x415631
je 0x415661
dec eax
je 0x41566d
jmp 0x415677
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416d3c
call fcn.00412c98
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x215]
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x216], al
jmp 0x415677
mov eax, dword [ebp - 4]
mov byte [eax + 0x216], 0
jmp 0x415677
mov eax, dword [ebp - 4]
mov byte [eax + 0x216], 1
lea eax, [ebp - 0x155]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x390]
lea edx, [ebp - 0x155]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x390]
push eax
lea eax, [ebp - 0x38c]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x240]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
mov ecx, 0x416d50
call fcn.0040dac4
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.0040347c
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00413a34
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x254
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040347c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov ecx, 0x416d70
call fcn.004036f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x220], edx
push 0x416d78
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x415774
push 0x15b3
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, 0xffffff7f
je 0x415774
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
jge 0x4158f3
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
mov esi, ebx
mov dword [eax + 0x220], esi
lea edx, [ebp - 0x38c]
mov eax, esi
call fcn.00405f9c
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x224
mov edx, 0x416d94
call fcn.004036f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
mov edx, 0x416da4
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x415911
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
dec ebx
cmp ebx, 0x80000036
jne 0x415787
jmp 0x415911
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x415845
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1a8]
lea eax, [ebp - 0x38c]
mov edx, 0x416dc4
call fcn.004036f0
mov ecx, dword [ebp - 0x38c]
mov dl, 1
mov eax, dword [0x4052fc]
call fcn.00408e88
call fcn.00402f40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.0041516c
test al, al
je 0x4158b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x416de0
call fcn.004036f0
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4158f3
mov eax, dword [ebp - 4]
inc dword [eax + 0x220]
mov eax, dword [ebp - 4]
push dword [eax + 0x254]
push 0x416d70
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.00405f9c
push dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 3
call fcn.00403764
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00403868
push eax
call sub.kernel32.dll_CreateDirectoryA_1
test eax, eax
je 0x415809
mov eax, dword [ebp - 4]
add eax, 0x224
mov edx, 0x416d94
call fcn.0040347c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
je 0x415956
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.00405f9c
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 4]
add eax, 0x224
call fcn.004036ac
cmp dword [ebp - 0x44], 0
je 0x41596a
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x44], eax
call fcn.0040263c
mov eax, dword [ebp - 4]
add eax, 0x1a8
mov edx, 0x416dec
call fcn.004036ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
add eax, 0x30
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.0040347c
mov eax, dword [ebp - 4]
add eax, 0x244
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.00403428
mov eax, dword [ebp - 4]
add eax, 0x254
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x416d3c
call fcn.00412c98
mov eax, dword [ebp - 4]
cmp dword [eax + 0x254], 0
jne 0x415a31
call fcn.00402fe0
jmp 0x416c8b
call fcn.004070e0
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x1a0]
fnstsw ax
sahf
jbe 0x415a70
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ac]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 4]
call fcn.00414078
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov edx, 0x416da4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x2c58
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x415ad4
call fcn.00402fe0
jmp 0x416c8b
push 0x548
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1dc], ebx
test ebx, ebx
jne 0x415b04
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x254
call fcn.004036f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415bdb
lea eax, [ebp - 0xc]
call fcn.00403428
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00406194
test al, al
je 0x415b6b
lea eax, [ebp - 0xc]
mov edx, 0x416df8
call fcn.004034c0
push 0
lea edx, [ebp - 0x38c]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416e14
push dword [ebp - 0xc]
push 0x416e2c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x394]
call fcn.004084a4
push dword [ebp - 0x394]
lea eax, [ebp - 0x390]
mov edx, 4
call fcn.00403764
mov eax, dword [ebp - 0x390]
call fcn.00403868
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00402fe0
jmp 0x416c8b
push 0x416e3c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x415bf9
call fcn.00402fe0
jmp 0x416c8b
push 0x416e44
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x415c17
call fcn.00402fe0
jmp 0x416c8b
push 0x416e4c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x415c35
call fcn.00402fe0
jmp 0x416c8b
push 0x416e54
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x415c56
call fcn.00402fe0
jmp 0x416c8b
push 0x416e5c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415c72
call fcn.00402fe0
jmp 0x416c8b
push 0x416e64
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415c8e
call fcn.00402fe0
jmp 0x416c8b
push 0x416e6c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
jne 0x415caa
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
xor ecx, ecx
mov edx, 0x548
call fcn.004028a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov dword [eax + 0x58], 1
mov eax, dword [ebp - 4]
call fcn.00419b68
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x415cf8
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x476], 1
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xba]
mov byte [eax + 0x4a], dl
mov edx, dword [ebp - 4]
cmp byte [edx + 0x9a], 0
je 0x415d48
mov byte [eax + 0x49], 1
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x415d48
call fcn.00402fe0
jmp 0x416c8b
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x415d69
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x32]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x3f], al
mov edx, dword [ebp - 4]
cmp byte [edx + 0x12a], 0
jne 0x415db1
mov edx, dword [ebp - 4]
cmp byte [edx + 0x13a], 0
jne 0x415db1
mov edx, dword [ebp - 4]
cmp byte [edx + 0xca], 0
je 0x415dad
mov edx, dword [ebp - 4]
cmp byte [edx + 0xda], 0
jne 0x415db1
xor edx, edx
jmp 0x415db3
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x15a]
mov byte [eax + 0x52], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x17a]
mov byte [eax + 0x62], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x16a]
mov byte [eax + 0x51], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x22]
xor dl, 1
mov byte [eax + 0x3e], dl
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x14a]
mov byte [eax + 0x54], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
cmp byte [eax + 0x3f], 0
jne 0x415e16
cmp byte [eax + 0x3e], 0
jne 0x415e16
cmp byte [eax + 0x54], 0
je 0x415e37
push 0
mov eax, dword [ebp - 0x10]
push eax
push edi
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x415e37
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1dc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov dword [ebx + 0x540], eax
mov eax, dword [ebp - 4]
lea esi, [eax + 0x268]
lea edi, [ebx + 0x478]
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x260]
mov byte [ebx + 0x61], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x45], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x10a]
mov byte [ebx + 0x50], al
xor eax, eax
mov byte [ebx + 0x3c], al
cmp byte [ebx + 0x3c], 0
je 0x415f02
push 0xfffffffffffffff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowLongA
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowRect
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x4c], eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x224]
lea eax, [ebp - 0x38c]
mov edx, 0x416e7c
call fcn.004036f0
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1bc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1bc], 0
jne 0x415f5b
call fcn.00402fe0
jmp 0x416c8b
push 0x416e94
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c0], 0
jne 0x415f84
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0
jne 0x415f9a
call fcn.00402fe0
jmp 0x416c8b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x244]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
call fcn.004036f0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
je 0x415fdf
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
mov eax, dword [ebp - 4]
add eax, 0x24c
call fcn.004036f0
lea eax, [ebp - 0x155]
mov edx, dword [ebp - 8]
call fcn.0040655c
lea eax, [ebp - 0x19c]
xor ecx, ecx
mov edx, 0x44
call fcn.004028a0
mov word [ebp - 0x16c], 1
mov dword [ebp - 0x18c], 0x1388
mov dword [ebp - 0x188], 0xffffec78
mov dword [ebp - 0x170], 0x85
lea edx, [ebp - 0x38c]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416eac
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x38c]
call fcn.00405f9c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416ec4
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405f9c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
push 0x416ed8
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00405f9c
mov eax, dword [ebp - 0x38c]
call fcn.00403868
push eax
lea edx, [ebp - 0x394]
xor eax, eax
call fcn.00402720
mov eax, dword [ebp - 0x394]
lea edx, [ebp - 0x390]
call fcn.00406414
mov eax, dword [ebp - 0x390]
call fcn.00403868
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
je 0x4160f8
lea eax, [ebp - 0x48]
call fcn.00406494
jmp 0x416109
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.004034c0
lea eax, [ebp - 0x38c]
push eax
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0x48]
call fcn.004038a8
mov eax, dword [ebp - 0x38c]
mov edx, 0x416dec
call fcn.004037b4
jne 0x416150
mov eax, dword [ebp - 0x48]
call fcn.004036a4
mov edx, eax
lea eax, [ebp - 0x48]
mov ecx, 1
call fcn.004038e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
add eax, 0x74
mov edx, dword [ebp - 0x48]
mov ecx, 0xff
call fcn.00403680
push dword [ebp - 0x48]
push 0x416dec
mov eax, dword [ebp - 4]
push dword [eax + 0x248]
lea eax, [ebp - 0x38c]
mov edx, 3
call fcn.00403764
mov eax, dword [ebp - 0x38c]
push eax
lea eax, [ebp - 0x390]
lea edx, [ebp - 0x155]
mov ecx, 0x105
call fcn.00403654
mov eax, dword [ebp - 0x390]
pop edx
call fcn.00413d84
test al, al
je 0x4161e9
push dword [ebp - 0x48]
push 0x416dec
mov eax, dword [ebp - 4]
push dword [eax + 0x248]
lea eax, [ebp - 0x38c]
mov edx, 3
call fcn.00403764
mov edx, dword [ebp - 0x38c]
lea eax, [ebp - 0x155]
call fcn.0040655c
lea eax, [ebp - 0x155]
push eax
push 0x416eec
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00403868
push eax
push 0x416f08
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0x416f20
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov byte [eax + 0x477], 0
mov eax, dword [ebp - 4]
add eax, 0x1c8
push eax
lea eax, [ebp - 0x155]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1d4], ebx
test ebx, ebx
je 0x4162f6
mov eax, ebx
call fcn.0040253c
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x4162ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
lea eax, [ebp - 0x155]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4162d9
mov eax, dword [ebp - 4]
add eax, 0x1c8
push eax
lea eax, [ebp - 0x50]
push eax
push 0x416f3c
mov eax, dword [ebp - 0x4c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4162d9
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 0x60000
setge al
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x477], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4162f6
mov eax, dword [ebp - 0x4c]
call fcn.00402554
ret
mov eax, dword [ebp - 4]
add eax, 0x1c4
push eax
lea eax, [ebp - 0x19c]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00403868
push eax
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x155]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4167d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x416381
call fcn.00414d7c
mov dword [ebp - 0x38], eax
mov dl, 1
or eax, 0xffffffff
call fcn.00414dfc
mov dword [ebp - 0x3c], eax
xor eax, eax
call fcn.00414db4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1d4], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x4163be
mov eax, dword [ebp - 4]
fld qword [eax + 0x1a0]
mov eax, dword [ebp - 4]
fcomp qword [eax + 0x208]
fnstsw ax
sahf
jb 0x4163be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x4163de
push 0x2b67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.004070e0
fstp qword [ebp - 0x34]
wait
jmp 0x416414
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x416435
push 0x16
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
push eax
push 0x414b3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.user32.dll_EnumThreadWindows
call fcn.004070e0
fsub qword [ebp - 0x34]
fld xword [0x416f40]
fcompp
fnstsw ax
sahf
jbe 0x416435
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
je 0x4163e9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
jne 0x41644d
mov eax, dword [ebp - 4]
mov byte [eax + 0x1e0], 1
jmp 0x416491
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x25c], 0
je 0x416489
mov eax, dword [ebp - 4]
call fcn.00419334
mov eax, dword [ebp - 4]
call fcn.004143e8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x4167d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4164e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4164c2
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x37
call sub.kernel32.dll_Sleep
call fcn.00413b38
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8a], 0
je 0x416535
push 0x44
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x416558
push 0x54
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
mov dword [eax + 0x64], 1
jmp 0x4167a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
cmp byte [eax + 0x63], 0
je 0x4165b2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x4165b2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4165b2
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x198], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e0], 0
jne 0x4167c2
cmp byte [0x41f6a8], 0
je 0x416608
push 0x14
mov eax, dword [0x41f6a4]
push eax
mov eax, dword [0x41f6a0]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_InvalidateRect
mov byte [0x41f6a8], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x416668
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
je 0x416638
mov eax, dword [ebp - 4]
cmp byte [eax + 0x13a], 0
jne 0x416638
mov eax, dword [ebp - 4]
cmp byte [eax + 0x12a], 0
je 0x416668
mov al, byte [0x41f6ac]
or al, byte [0x41f6ab]
je 0x416668
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0
push 0x416f4c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413b38
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x8a]
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1dc]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1e1]
test al, al
je 0x416695
cmp dword [ebp - 0x20], 0
test al, al
je 0x41677e
cmp word [0x41f692], 0
jne 0x41675c
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x11a], 0
jne 0x4166fb
mov eax, dword [ebp - 4]
cmp byte [eax + 0xca], 0
je 0x416715
mov eax, dword [ebp - 4]
cmp byte [eax + 0xda], 0
jne 0x416715
mov al, byte [0x41f6ac]
or al, byte [0x41f6ab]
je 0x416715
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x41672d
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowPos
call fcn.00413b38
push 0
push 0
push 0x406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x416761
call fcn.00413b38
mov eax, dword [ebp - 4]
mov byte [eax + 0x1e2], 1
mov eax, dword [ebp - 4]
mov dword [0x41f694], eax
mov dword [0x41f690], 0x416f6c
cmp byte [0x41d7a0], 0
je 0x41679e
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4167a6
mov eax, dword [ebp - 4]
call fcn.00415414
push 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x416579
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416c8b
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1c0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19c]
call fcn.00403868
push eax
call sub.kernel32.dll_GlobalAddAtomA
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
push eax
push 0xffff
call sub.user32.dll_PostMessageA
mov ax, word [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
cmp dword [ebp - 0x44], 0
je 0x416834
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
push eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24c], 0
je 0x4168b3
mov eax, dword [ebp - 4]
mov byte [eax + 0x56], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e610
cmp al, 2
jne 0x416878
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e3e4
call fcn.00413b38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0040e2a8
call fcn.00413b38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406288
mov eax, dword [ebp - 8]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406288
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x41692d
inc ebx
xor esi, esi
call fcn.00413b38
lea ecx, [ebp - 0x390]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x390]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406288
inc esi
dec ebx
jne 0x4168eb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x42], 0
je 0x416948
mov dl, 1
mov eax, dword [ebp - 0x3c]
call fcn.00414dfc
mov eax, dword [ebp - 0x38]
call fcn.00414db4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c8], 0
je 0x416963
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c4], 0
je 0x41697e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [0x41f690], eax
mov dword [0x41f694], eax
cmp dword [ebp - 0x14], 0
je 0x4169ad
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x18], 0
je 0x4169bc
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x1c], 0
je 0x4169e8
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4169d6
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4169dd
push 0
call sub.user32.dll_MessageBeep
call fcn.00413b38
cmp dword [ebp - 0x1c], 0
jne 0x4169c2
cmp dword [ebp - 0x20], 0
je 0x4169f7
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_UnhookWindowsHookEx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x198], 0
je 0x416a12
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x198]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x24], 0
je 0x416a21
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0x10], 0
je 0x416a30
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1dc], 0
je 0x416a7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x30], edx
xor edx, edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x38], edx
mov byte [eax + 0x3c], 0
mov byte [eax + 0x3d], 0
push 0x6f
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1dc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x28], 0
je 0x416a8b
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_PostMessageA
call fcn.00413b38
mov eax, dword [ebp - 4]
call fcn.00413e08
call fcn.00413b38
mov eax, dword [ebp - 4]
call fcn.00413f70
call fcn.00413b38
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
mov edx, eax
lea eax, [ebp - 0x38c]
call fcn.004035dc
mov eax, dword [ebp - 0x38c]
call fcn.00406288
test al, al
jne 0x416b25
cmp dword [ebp - 0x28], 3
jne 0x416b0d
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call fcn.00403868
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x416b17
push 0x22b
call sub.kernel32.dll_Sleep
call fcn.00413b38
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jne 0x416ac3
mov eax, dword [ebp - 4]
push dword [eax + 0x1a8]
push 0x416f64
push 0x416de0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403764
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004036a4
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
add eax, 0x1a8
call fcn.00403978
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.00402778
call fcn.0040263c
test eax, eax
je 0x416c80
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 8]
mov ecx, 0x416de0
call fcn.004036f0
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x414
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
test ebx, ebx
je 0x416c26
push 0x6f
call sub.kernel32.dll_Sleep
test ebx, ebx
je 0x416c3d
call sub.kernel32.dll_GetTickCount
sub eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x457
jle 0x416c0d
test ebx, ebx
je 0x416c80
lea eax, [ebp - 0x388]
xor ecx, ecx
mov edx, 0x1e
call fcn.004028a0
mov dword [ebp - 0x384], 3
mov eax, dword [ebp - 8]
call fcn.00403868
mov dword [ebp - 0x380], eax
mov word [ebp - 0x378], 0x454
lea eax, [ebp - 0x388]
push eax
call sub.shell32.dll_SHFileOperationA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416cc5
lea eax, [ebp - 0x394]
mov edx, 3
call fcn.0040344c
lea eax, [ebp - 0x48]
call fcn.00403428
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040344c
ret