Function at 0x10004129
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
xor ebx, ebx
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], 1
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x100050bc
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004163
sub eax, edx
mov esi, eax
mov dword [ebp - 0x18], esi
je 0x100050bc
call fcn.10012679
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x100050bc
call fcn.10012679
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x100050a8
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100041b6
push 0x82
push 0x1a
mov edx, 0x10028008
call fcn.100117e3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x18]
xor ebx, ebx
push 0
push ecx
push 4
inc ebx
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, ebx
call fcn.10013793
add esp, 0x24
mov esi, 0x98
test eax, eax
jne 0x100043e5
call fcn.100125b4
mov edx, eax
mov dword [ebp - 0x20], edx
test edx, edx
je 0x10004382
xor al, al
push 0x20
pop ecx
lea edi, [ebp - 0x48]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, esi
mov dword [ebp - 0x44], edx
call fcn.1001dad0
mov edi, esp
test edi, edi
je 0x1000422a
push esi
push 0x97
mov eax, edi
mov edx, 0x10029ef0
call fcn.100117e3
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x1000424b
push 0x8d
push 0x2f
mov eax, esi
mov edx, 0x10029fbc
call fcn.100117e3
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000426a
push 0x87
push 0x24
mov edx, 0x10029f98
call fcn.100117e3
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
xor edi, edi
lea eax, [ebp - 0x48]
push eax
call fcn.1000f972
test eax, eax
jne 0x100042d8
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x100042c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
cmp dword [ebp - 8], esi
je 0x100042a5
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x100042c5
push 0x99
push 0x13
mov edx, 0x100285b8
call fcn.100117e3
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xf
jl 0x10004278
jmp 0x100042df
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x20]
call fcn.100054fc
call fcn.1000209d
push eax
push dword [ebp - 0x20]
call fcn.1001256a
test eax, eax
jne 0x10004339
cmp dword [ebp - 0xc], eax
je 0x10004339
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x10004319
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x26
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004339
push 0x83
push 0x12
mov edx, 0x100285cc
call fcn.100117e3
call fcn.100052df
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004344
sub eax, edx
je 0x10004365
mov eax, dword [ebp - 0x20]
mov edx, 0x1002b754
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10004359
jmp 0x10004373
mov edi, 0x1002b754
xor al, al
mov ecx, 0x104
rep stosb byte es:[edi], al
call fcn.1000545b
mov esi, dword [ebp - 0x20]
call fcn.1001272d
jmp 0x100043af
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
push 0x27
pop esi
mov dword [ebp - 0x10], eax
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x100043af
push 0x90
push 0x13
mov edx, 0x10028600
call fcn.100117e3
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100043ce
push 0x88
push 6
mov edx, 0x10027f8c
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
mov esi, 0x98
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004404
push 0x86
push 0x1a
mov edx, 0x10028050
call fcn.100117e3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push ecx
push 4
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, ebx
call fcn.10013793
add esp, 0x24
test eax, eax
jne 0x10004644
call fcn.100125b4
mov edx, eax
mov dword [ebp - 0x20], edx
test edx, edx
je 0x10004613
xor al, al
push 0x20
pop ecx
lea edi, [ebp - 0x48]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, esi
mov dword [ebp - 0x44], edx
call fcn.1001dad0
mov edi, esp
test edi, edi
je 0x10004470
push esi
push 0x97
mov eax, edi
mov edx, 0x10029ef0
call fcn.100117e3
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x10004491
push 0x8d
push 0x2f
mov eax, esi
mov edx, 0x10029fbc
call fcn.100117e3
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100044b0
push 0x87
push 0x24
mov edx, 0x10029f98
call fcn.100117e3
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x48]
push eax
call fcn.1000f972
test eax, eax
je 0x10004576
mov esi, dword [ebp - 0x20]
push esi
call fcn.100054fc
call fcn.10005808
mov edi, eax
test edi, edi
jne 0x1000452b
cmp dword [ebp - 0xc], eax
je 0x100045b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], edi
je 0x10004507
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x26
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x100045b7
push 0x81
push 0x12
mov edx, 0x100285a4
jmp 0x100045b2
push esi
call fcn.1001218b
test eax, eax
jne 0x100045d1
cmp dword [ebp - 0xc], eax
je 0x100045b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x10004559
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x28
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x100045b7
push 0x8b
push 0x14
mov edx, 0x10028614
jmp 0x100045b2
cmp dword [ebp - 0xc], 0
je 0x100045b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x10004597
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x100045b7
push 0x99
push 0x13
mov edx, 0x100285b8
call fcn.100117e3
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x100044c0
jmp 0x10004613
mov eax, dword [0x1002a04c]
cmp eax, 0xffffffff
je 0x100045e8
push eax
call fcn.10010350
or dword [0x1002a04c], 0xffffffff
call fcn.100122a2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10004607
mov edi, esi
call fcn.100122a2
call fcn.1000199a
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ebx
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004632
push 0x8e
push 6
mov edx, 0x100297a8
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004663
push 0x99
push 0x18
mov edx, 0x10028038
call fcn.100117e3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push ecx
push 4
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, ebx
call fcn.10013793
add esp, 0x24
test eax, eax
jne 0x10004834
call fcn.100125b4
mov ebx, eax
test ebx, ebx
je 0x100047bf
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100046b9
push 0x93
push 4
mov edx, 0x10029390
call fcn.100117e3
push 0x104
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
xor al, al
and dword [ebp - 0x1c], 0
push 0x20
lea edi, [ebp - 0x48]
pop ecx
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x48]
push eax
call fcn.1000f972
test eax, eax
je 0x10004745
push ebx
call fcn.10010386
test eax, eax
je 0x10004745
push ebx
call fcn.100054fc
push ebx
call fcn.1001218b
test eax, eax
jne 0x100047b2
cmp dword [ebp - 0xc], eax
je 0x10004786
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x10004728
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x28
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004786
push 0x8b
push 0x14
mov edx, 0x10028614
jmp 0x10004781
cmp dword [ebp - 0xc], 0
je 0x10004786
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x10004766
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004786
push 0x99
push 0x13
mov edx, 0x100285b8
call fcn.100117e3
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10004798
mov edi, ebx
call fcn.100122a2
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jl 0x100046dd
jmp 0x10004800
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
jmp 0x10004800
cmp dword [ebp - 0xc], 0
je 0x10004800
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x100047e0
mov esi, dword [ebp - 8]
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004800
push 0x90
push 0x13
mov edx, 0x10028600
call fcn.100117e3
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000481f
push 0x8b
push 4
mov edx, 0x10027f9c
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
xor ebx, ebx
inc ebx
push 0x18
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004853
push 0x88
push 0x14
mov edx, 0x10028024
call fcn.100117e3
lea ecx, [ebp - 0x14]
push ecx
push 4
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, ebx
call fcn.10013793
add esp, 0x18
test eax, eax
jne 0x100048ba
call fcn.100052df
mov dword [0x1002b738], ebx
call fcn.1000545b
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000489e
push 0x8f
push 7
mov edx, 0x10027f94
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
call fcn.10002291
call sym.payload.x86.dll_Ordinal_1
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100048d9
push 0x8c
push 0x24
mov edx, 0x10027fcc
call fcn.100117e3
lea ecx, [ebp - 0x24]
push ecx
push 4
push ebx
lea ecx, [ebp - 0x154]
push ecx
push 0x104
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, ebx
call fcn.10013793
add esp, 0x30
test eax, eax
jne 0x10004b33
call fcn.100052df
cmp dword [0x1002b744], 0
jne 0x10004b33
mov esi, dword [ebp - 0x14]
call fcn.100058d4
cmp dword [ebp - 0x24], 0
je 0x1000493d
call fcn.100052df
mov eax, dword [0x1002bc68]
cmp eax, dword [ebp - 0x24]
jl 0x10004964
call fcn.1000572a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004945
sub eax, edx
je 0x10004964
call fcn.1000572a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10004a93
call fcn.100125b4
mov ebx, eax
test ebx, ebx
je 0x10004a54
xor al, al
push 0x20
pop ecx
lea edi, [ebp - 0x48]
rep stosb byte es:[edi], al
lea eax, [ebp - 0x154]
mov dword [ebp - 0x48], eax
mov eax, 0x98
mov dword [ebp - 0x44], ebx
call fcn.1001dad0
mov esi, esp
test esi, esi
je 0x100049af
push 0x98
push 0x97
mov eax, esi
mov edx, 0x10029ef0
call fcn.100117e3
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x100049d0
push 0x8d
push 0x2f
mov eax, edi
mov edx, 0x10029fbc
call fcn.100117e3
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100049ef
push 0x87
push 0x24
mov edx, 0x10029f98
call fcn.100117e3
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], edi
call fcn.1000f972
test eax, eax
je 0x10004a1a
mov esi, ebx
call fcn.100056dc
mov esi, dword [ebp - 0x24]
call fcn.10005898
jmp 0x10004a93
cmp dword [ebp - 0xc], 0
je 0x10004a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004a39
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004a93
push 0x99
mov edx, 0x100285b8
jmp 0x10004a8c
cmp dword [ebp - 0xc], 0
je 0x10004a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004a73
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004a93
push 0x90
mov edx, 0x10028600
push 0x13
call fcn.100117e3
call fcn.1000572a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10004ae3
cmp dword [ebp - 0xc], eax
je 0x10004b02
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004ac1
call fcn.1001272d
push 0x2b
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004b02
push 0x8f
push 0x17
mov edx, 0x1002858c
call fcn.100117e3
jmp 0x10004b02
call fcn.100052df
mov dword [0x1002b744], 1
call fcn.1000545b
call fcn.100050c9
cmp dword [ebp - 0xc], 0
jne 0x10004b33
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004b21
push 0x88
push 9
mov edx, 0x10027f74
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
xor ebx, ebx
cmp eax, ebx
je 0x10004b54
push 0x82
push 0x18
mov edx, 0x10027ff0
call fcn.100117e3
lea ecx, [ebp - 0x14]
push ecx
push 4
pop edi
push edi
xor esi, esi
inc esi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.10013793
add esp, 0x18
test eax, eax
jne 0x10004bb6
call fcn.100052df
mov dword [0x1002b744], ebx
call fcn.1000545b
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10004ba4
push 0x8d
push 0xa
mov edx, 0x10027f80
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10004bd5
push 0x94
push 0x19
mov edx, 0x1002806c
call fcn.100117e3
lea ecx, [ebp - 0x14]
push ecx
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.10013793
add esp, 0x18
test eax, eax
jne 0x10004c2d
push esi
push ebx
push 0x10006345
call fcn.1001007b
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10004c1b
push 0x90
push 0xc
mov edx, 0x10027fb8
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10004c4c
push 0x81
push 0x24
mov edx, 0x10028088
call fcn.100117e3
lea ecx, [ebp - 0x24]
push ecx
push edi
push esi
lea ecx, [ebp - 0x154]
push ecx
push 0x104
push ebx
lea ecx, [ebp - 0x14]
push ecx
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.10013793
add esp, 0x30
test eax, eax
jne 0x10004ea1
call fcn.100052df
cmp dword [0x1002b748], ebx
jne 0x10004ea1
mov esi, dword [ebp - 0x14]
call fcn.100058f2
cmp dword [ebp - 0x24], ebx
je 0x10004cab
call fcn.100052df
mov eax, dword [0x1002bc6c]
cmp eax, dword [ebp - 0x24]
jl 0x10004cd2
call fcn.10005799
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004cb3
sub eax, edx
je 0x10004cd2
call fcn.10005799
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10004e01
call fcn.100125b4
mov ebx, eax
test ebx, ebx
je 0x10004dc2
xor al, al
push 0x20
pop ecx
lea edi, [ebp - 0x48]
rep stosb byte es:[edi], al
lea eax, [ebp - 0x154]
mov dword [ebp - 0x48], eax
mov eax, 0x98
mov dword [ebp - 0x44], ebx
call fcn.1001dad0
mov esi, esp
test esi, esi
je 0x10004d1d
push 0x98
push 0x97
mov eax, esi
mov edx, 0x10029ef0
call fcn.100117e3
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x10004d3e
push 0x8d
push 0x2f
mov eax, edi
mov edx, 0x10029fbc
call fcn.100117e3
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004d5d
push 0x87
push 0x24
mov edx, 0x10029f98
call fcn.100117e3
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], edi
call fcn.1000f972
test eax, eax
je 0x10004d88
mov esi, ebx
call fcn.1000574b
mov esi, dword [ebp - 0x24]
call fcn.100058b6
jmp 0x10004e01
cmp dword [ebp - 0xc], 0
je 0x10004e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004da7
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004e01
push 0x99
mov edx, 0x100285b8
jmp 0x10004dfa
cmp dword [ebp - 0xc], 0
je 0x10004e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004de1
call fcn.1001272d
push 0x27
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004e01
push 0x90
mov edx, 0x10028600
push 0x13
call fcn.100117e3
call fcn.10005799
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10004e51
cmp dword [ebp - 0xc], eax
je 0x10004e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10004e2f
call fcn.1001272d
push 0x2b
pop esi
call fcn.10012679
mov dword [ebp - 8], eax
test eax, eax
je 0x10004e70
push 0x8f
push 0x17
mov edx, 0x1002858c
call fcn.100117e3
jmp 0x10004e70
call fcn.100052df
mov dword [0x1002b748], 1
call fcn.1000545b
call fcn.100050c9
cmp dword [ebp - 0xc], 0
jne 0x10004ea1
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004e8f
push 0x86
push 9
mov edx, 0x10027fa0
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004ec0
push 0x97
push 0x18
mov edx, 0x100280ac
call fcn.100117e3
lea ecx, [ebp - 0x14]
push ecx
push 4
xor esi, esi
inc esi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.10013793
add esp, 0x18
test eax, eax
jne 0x10004f21
call fcn.100052df
and dword [0x1002b748], 0
call fcn.1000545b
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004f0f
push 0x88
push 0xb
mov edx, 0x10027fac
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004f40
push 0x8a
push 0x1b
mov edx, 0x100280c4
call fcn.100117e3
lea ecx, [ebp - 0x154]
push ecx
push 0x104
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.10013793
add esp, 0x24
test eax, eax
jne 0x1000509c
call fcn.100125b4
mov ebx, eax
test ebx, ebx
je 0x1000506b
xor al, al
push 0x20
pop ecx
lea edi, [ebp - 0x48]
rep stosb byte es:[edi], al
lea eax, [ebp - 0x154]
mov dword [ebp - 0x48], eax
mov esi, 0x98
mov eax, esi
mov dword [ebp - 0x44], ebx
call fcn.1001dad0
mov edi, esp
test edi, edi
je 0x10004fb7
push esi
push 0x97
mov eax, edi
mov edx, 0x10029ef0
call fcn.100117e3
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x10004fd8
push 0x8d
push 0x2f
mov eax, esi
mov edx, 0x10029fbc
call fcn.100117e3
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10004ff7
push 0x87
push 0x24
mov edx, 0x10029f98
call fcn.100117e3
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], esi
call fcn.1000f972
test eax, eax
je 0x1000506b
push ebx
call fcn.100054fc
xor edi, edi
push edi
lea eax, [ebp + 8]
push eax
push ebx
mov dword [ebp + 8], edi
call fcn.10012106
mov esi, eax
cmp esi, edi
je 0x10005064
cmp dword [ebp + 8], edi
je 0x10005064
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x10005051
push 0x8d
push 0x2f
mov edx, 0x10029fbc
call fcn.100117e3
push dword [ebp + 8]
push esi
push eax
call fcn.1001499e
push dword [ebp + 8]
push esi
call fcn.10014805
mov edi, ebx
call fcn.100122a2
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000508a
push 0x82
push 7
mov edx, 0x10027fc4
call fcn.100117e3
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
call fcn.100040ef
mov esi, dword [ebp - 8]
test esi, esi
je 0x100050a8
call fcn.1001272d
mov esi, dword [ebp - 0x28]
call fcn.1001272d
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x100050bc
call fcn.1001272d
lea esp, [ebp - 0x164]
pop edi
pop esi
pop ebx
leave
ret 4