Function at 0x40af80
Capabilities:
Create directory
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x642]
push ecx
mov word [ebp - 0x644], ax
call fcn.00414930
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x43a]
push eax
mov word [ebp - 0x43c], dx
call fcn.00414930
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x232]
push edx
mov word [ebp - 0x234], cx
call fcn.00414930
xor eax, eax
add esp, 0x24
push 0x104
lea ecx, [ebp - 0x644]
push ecx
push str._TEMP_
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x644]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b030
mov edx, dword [str.SMR]
mov ecx, dword [0x4226cc]
mov dword [eax], edx
mov dx, word [0x4226d0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [ebp - 0x644]
push 0
push eax
call fcn.0040e7ad
add esp, 8
cmp eax, 0xffffffff
jne 0x40b07d
push 0
lea ecx, [ebp - 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x654]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x648]
movzx ecx, word [ebp - 0x64a]
movzx edx, word [ebp - 0x64c]
push eax
movzx eax, word [ebp - 0x64e]
push ecx
movzx ecx, word [ebp - 0x652]
push edx
push eax
push ecx
lea edx, [ebp - 0x28]
push str._02u_02u_02u_02u_02u
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [ebp - 0x43c]
add esp, 0x1c
mov eax, esi
sub ebx, esi
mov edi, edi
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b0d0
lea eax, [ebp - 0x43c]
add eax, 0xfffffffe
jmp 0x40b0f0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b0f0
mov ecx, dword [str.hodll.dll]
mov edx, dword [0x4226d8]
mov dword [eax], ecx
mov ecx, dword [0x4226dc]
mov dword [eax + 4], edx
mov edx, dword [0x4226e0]
mov dword [eax + 8], ecx
mov ecx, dword [0x4226e4]
mov dword [eax + 0xc], edx
mov dx, word [0x4226e8]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
xor eax, eax
jmp 0x40b140
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b140
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b161
mov ecx, dword [str.hodll.]
mov edx, dword [0x4226f0]
mov dword [eax], ecx
mov ecx, dword [0x4226f4]
mov dword [eax + 4], edx
mov edx, dword [0x4226f8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b195
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b1b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b1b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b215
lea eax, [ebp - 0x43c]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b230
mov ecx, dword [str.Hook1.dll]
mov edx, dword [0x422700]
mov dword [eax], ecx
mov ecx, dword [0x422704]
mov dword [eax + 4], edx
mov edx, dword [0x422708]
mov dword [eax + 8], ecx
mov ecx, dword [0x42270c]
mov dword [eax + 0xc], edx
mov dx, word [0x422710]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
xor eax, eax
jmp 0x40b280
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b280
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b2a1
mov ecx, dword [str.Hook1.]
mov edx, dword [0x422718]
mov dword [eax], ecx
mov ecx, dword [0x42271c]
mov dword [eax + 4], edx
mov edx, dword [0x422720]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b2d5
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b2f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b2f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b355
lea eax, [ebp - 0x43c]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b370
mov ecx, dword [str.Hook2.dll]
mov edx, dword [0x422728]
mov dword [eax], ecx
mov ecx, dword [0x42272c]
mov dword [eax + 4], edx
mov edx, dword [0x422730]
mov dword [eax + 8], ecx
mov ecx, dword [0x422734]
mov dword [eax + 0xc], edx
mov dx, word [0x422738]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
xor eax, eax
jmp 0x40b3c0
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b3c0
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b3e1
mov ecx, dword [str.Hook2.]
mov edx, dword [0x422740]
mov dword [eax], ecx
mov ecx, dword [0x422744]
mov dword [eax + 4], edx
mov edx, dword [0x422748]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b415
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b430
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b430
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b495
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b4b0
mov ecx, 8
mov esi, str.wmLookProc.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b4d0
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b4f1
mov ecx, 6
mov esi, str.wmLookProc.
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b510
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b526
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40b590
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b590
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40b5b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b5b0
mov ecx, 8
mov esi, str.wmTakeHttp.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b5d0
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b5f1
mov ecx, 6
mov esi, str.wmTakeHttp.
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b610
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b626
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40b690
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b690
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40b6b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b6b0
mov ecx, 7
mov esi, str.wmTakeIM.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b6d0
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b6f1
mov ecx, dword [str.wmTakeIM.]
mov edx, dword [0x4227e4]
mov dword [eax], ecx
mov ecx, dword [0x4227e8]
mov dword [eax + 4], edx
mov edx, dword [0x4227ec]
mov dword [eax + 8], ecx
mov ecx, dword [0x4227f0]
mov dword [eax + 0xc], edx
mov dx, word [0x4227f4]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
lea eax, [ebp - 0x28]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b740
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b756
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40b7c0
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b7c0
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40b7e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b7e0
mov ecx, 9
mov esi, str.wmLookProc64.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b800
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b821
mov ecx, 7
mov esi, str.wmLookProc64.
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b840
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b856
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40b8c0
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b8c0
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40b8e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b8e0
mov ecx, 7
mov esi, str.WaterMark.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b900
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b921
mov ecx, dword [str.WaterMark.]
mov edx, dword [0x422860]
mov dword [eax], ecx
mov ecx, dword [0x422864]
mov dword [eax + 4], edx
mov edx, dword [0x422868]
mov dword [eax + 8], ecx
mov ecx, dword [0x42286c]
mov dword [eax + 0xc], edx
mov edx, dword [0x422870]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b967
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b980
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40b9b3
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40b9d0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b9d0
mov ecx, 6
mov esi, str.wmcHook.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40b9f0
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40ba11
mov edx, dword [str.wmcHook.]
mov ecx, dword [0x422894]
mov dword [eax], edx
mov edx, dword [0x422898]
mov dword [eax + 4], ecx
mov ecx, dword [0x42289c]
mov dword [eax + 8], edx
mov edx, dword [0x4228a0]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ba50
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40ba66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40bad0
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40bad0
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40baf0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40baf0
mov ecx, 7
mov esi, str.wmcHook64.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40bb10
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40bb31
mov ecx, dword [str.wmcHook64.]
mov edx, dword [0x4228c8]
mov dword [eax], ecx
mov ecx, dword [0x4228cc]
mov dword [eax + 4], edx
mov edx, dword [0x4228d0]
mov dword [eax + 8], ecx
mov ecx, dword [0x4228d4]
mov dword [eax + 0xc], edx
mov edx, dword [0x4228d8]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bb77
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40bb90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40bbf5
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40bc10
mov ecx, 7
mov esi, str.wmcMemmgr.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40bc30
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40bc51
mov ecx, dword [str.wmcMemmgr.]
mov edx, dword [0x422900]
mov dword [eax], ecx
mov ecx, dword [0x422904]
mov dword [eax + 4], edx
mov edx, dword [0x422908]
mov dword [eax + 8], ecx
mov ecx, dword [0x42290c]
mov dword [eax + 0xc], edx
mov edx, dword [0x422910]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [ebp - 0x28]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bc97
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40bcb0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40bd15
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40bd30
mov ecx, 8
mov esi, str.wmcMemmgr64.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40bd50
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40bd71
mov ecx, 7
mov esi, str.wmcMemmgr64.
lea eax, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bd90
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40bda6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40be10
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40be10
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40be30
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40be30
mov ecx, 8
mov esi, str.wmcInvenLib.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40be50
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40be71
mov ecx, 7
mov esi, str.wmcInvenLib.
lea eax, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be90
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40bea6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40bf10
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40bf10
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40bf30
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40bf30
mov ecx, 0xc
mov esi, str.wmcWatermark_DLL64.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40bf50
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40bf71
mov ecx, 0xa
mov esi, str.wmcWatermark_DLL64.
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bf90
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40bfa6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40c010
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40c010
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40c030
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c030
mov ecx, 0xb
mov esi, str.wmcWatermark_DLL.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40c050
lea edi, [ebp - 0x234]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c071
mov ecx, 9
mov esi, str.wmcWatermark_DLL.
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c090
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40c0a6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40c110
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40c110
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40c130
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c130
mov ecx, 7
mov esi, str.wmcHook7.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40c150
lea eax, [ebp - 0x234]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40c171
mov ecx, dword [str.wmcHook7.]
mov edx, dword [0x422a64]
mov dword [eax], ecx
mov ecx, dword [0x422a68]
mov dword [eax + 4], edx
mov edx, dword [0x422a6c]
mov dword [eax + 8], ecx
mov ecx, dword [0x422a70]
mov dword [eax + 0xc], edx
mov dx, word [0x422a74]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
lea eax, [ebp - 0x28]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c1c0
lea edi, [ebp - 0x234]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40c1d6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x234]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x40c240
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x40c240
lea edi, [ebp - 0x43c]
add edi, 0xfffffffe
jmp 0x40c260
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c260
mov ecx, 8
mov esi, str.wmcHook764.dll
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x644]
mov word [ebp + eax - 0x234], cx
add eax, 2
test cx, cx
jne 0x40c280