Function at 0x40ce20
Capabilities:
Copy file
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x448728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xaf0
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x10], ebx
mov eax, dword [0x45f750]
push edi
xor esi, esi
cmp eax, esi
mov edi, ecx
mov dword [esp + 0x24], edi
je 0x40d08c
push esi
call fcn.0042520e
push str.expire
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push str.SOFTWARE_newcodingchrrep
push eax
mov dword [esp + 0x50], edx
call fcn.004038d0
mov ecx, dword [esp + 0x30]
push 0x44b7d1
push ecx
mov dword [esp + 0xb1c], esi
call fcn.00423f3b
add esp, 0x18
test eax, eax
jne 0x40cf4b
lea edx, [esp + 0x3c]
push edx
call fcn.004248d1
add esp, 4
cmp eax, esi
je 0x40cebc
mov eax, dword [eax + 0xc]
mov dword [esp + 0x18], eax
jmp 0x40cec0
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004248d1
add esp, 4
cmp eax, esi
je 0x40ced5
mov esi, dword [eax + 0x10]
inc esi
lea edx, [esp + 0x3c]
push edx
call fcn.004248d1
add esp, 4
test eax, eax
je 0x40cef0
mov eax, dword [eax + 0x14]
add eax, 0x76c
jmp 0x40cef2
xor eax, eax
mov ecx, dword [esp + 0x18]
push ecx
push esi
push eax
lea edx, [esp + 0x404]
push str._d__d__d
push edx
call fcn.00425430
lea eax, [esp + 0x40c]
push eax
push str.expire
push str.SOFTWARE_newcodingchrrep
call fcn.004011b0
lea eax, [esp + 0x418]
add esp, 0x20
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cf30
sub eax, edx
push eax
lea ecx, [esp + 0x3fc]
push ecx
lea ecx, [esp + 0x28]
call fcn.00402ba0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
push ecx
push str._4d__2d__2d
push edx
call fcn.004258f9
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
add esp, 0x14
push 0xffffffffffffffff
push 0
push 0
push 0
push eax
push ecx
push edx
lea ecx, [esp + 0x60]
call fcn.00404900
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
add edx, 0x83d600
mov eax, esi
adc eax, 0
cmp eax, ecx
jl 0x40d181
mov eax, dword [esp + 0x3c]
jg 0x40cfb9
cmp edx, eax
jb 0x40d181
add eax, 0x83d600
adc ecx, 0
cmp ecx, esi
jl 0x40d181
jg 0x40cfd5
cmp eax, dword [esp + 0x44]
jb 0x40d181
lea eax, [esp + 0x30]
push str.1012
push eax
call fcn.00409cc0
mov esi, eax
lea ecx, [esp + 0x20]
push str.1022
push ecx
mov byte [esp + 0xb14], 3
call fcn.00409cc0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push 0
push esi
push eax
mov ecx, edi
mov byte [esp + 0xb10], 4
call fcn.00437109
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d03d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d063
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0xb04], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d08c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 1
mov ecx, edi
call fcn.00437167
mov eax, dword [edi + 0x114]
mov dword [0x45f748], eax
mov ecx, dword [edi + 0x110]
cmp dword [0x45f750], 2
mov dword [0x45d0f0], ecx
mov edx, dword [edi + 0x1c8]
mov dword [0x45f74c], edx
jne 0x40d218
cmp dword [edi + 0x114], 1
jne 0x40d218
lea eax, [esp + 0x18]
push str.1012
push eax
call fcn.00409cc0
mov esi, eax
lea ecx, [esp + 0x24]
push str.1018
mov ebx, 5
push ecx
mov dword [esp + 0xb14], ebx
call fcn.00409cc0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push 0
push esi
push eax
mov ecx, edi
mov byte [esp + 0xb10], 6
call fcn.00437109
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0xb04], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d13d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0xb04], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e14f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xafc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x30]
push str.1012
push eax
call fcn.00409cc0
mov esi, eax
lea ecx, [esp + 0x20]
push str.1021
push ecx
mov byte [esp + 0xb14], 1
call fcn.00409cc0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push 0
push esi
push eax
mov ecx, edi
mov byte [esp + 0xb10], 2
call fcn.00437109
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d1e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d20f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
jmp 0x40d141
xor esi, esi
push esi
push esi
mov dword [0x45f73c], esi
mov eax, dword [edi + 0x8c]
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40d3a5
lea esp, [esp]
push esi
lea ecx, [edi + 0x70]
call fcn.00433a4d
test eax, eax
je 0x40d37a
push 0
push esi
lea ecx, [esp + 0x30]
push ecx
lea ecx, [edi + 0x70]
call fcn.0043378c
mov eax, dword [eax]
push 0x44b7d1
or ebx, 1
push eax
mov dword [esp + 0xb0c], 7
mov dword [esp + 0x1c], ebx
call fcn.00423f3b
add esp, 8
test eax, eax
je 0x40d2dd
push 1
push esi
lea eax, [edi + 0x70]
push eax
lea edx, [esp + 0x38]
push edx
call fcn.00408920
mov dword [esp + 0x2c], eax
push 0
push esi
lea eax, [edi + 0x70]
push eax
lea eax, [esp + 0x34]
or ebx, 2
push eax
mov dword [esp + 0xb24], 8
mov dword [esp + 0x34], ebx
call fcn.00408920
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx]
mov eax, dword [eax]
push ecx
push eax
or ebx, 4
call fcn.00423f3b
add esp, 0x28
test eax, eax
mov byte [esp + 0x13], 1
jne 0x40d2e2
mov byte [esp + 0x13], 0
test bl, 4
je 0x40d30c
mov eax, dword [esp + 0x18]
and ebx, 0xfffffffb
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d30c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, 2
mov dword [esp + 0xb04], 7
je 0x40d341
mov eax, dword [esp + 0x2c]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d341
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, 1
mov dword [esp + 0xb04], 0xffffffff
je 0x40d372
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
and ebx, 0xfffffffe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d372
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, byte [esp + 0x13]
test al, al
jne 0x40d39b
mov eax, dword [edi + 0x8c]
push 0
push 0
push 0x1004
push eax
inc esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, eax
jl 0x40d240
jmp 0x40d3a5
mov dword [0x45f73c], 1
mov ecx, dword [0x45f744]
mov eax, 1
cmp ecx, eax
jne 0x40d3c0
mov dword [0x45f73c], 0
jmp 0x40d3c8
cmp dword [0x45f73c], eax
je 0x40d3d1
mov eax, dword [0x45f740]
test eax, eax
jle 0x40d431
lea ecx, [esp + 0x18]
push str.1024
push ecx
call fcn.00409cc0
mov esi, eax
lea edx, [esp + 0x24]
push str.1023
or ebx, 8
push edx
mov dword [esp + 0xb14], 9
mov dword [esp + 0x24], ebx
call fcn.00409cc0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push 4
push esi
or ebx, 0x10
push eax
mov ecx, edi
mov dword [esp + 0xb10], 0xa
mov dword [esp + 0x20], ebx
call fcn.00437109
cmp eax, 7
mov byte [esp + 0x13], 1
je 0x40d436
mov byte [esp + 0x13], 0
test bl, 0x10
mov dword [esp + 0xb04], 9
je 0x40d46b
mov eax, dword [esp + 0x1c]
and ebx, 0xffffffef
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d46b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, 8
mov dword [esp + 0xb04], 0xffffffff
je 0x40d499
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d499
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, byte [esp + 0x13]
test al, al
jne 0x40e14f
mov eax, dword [edi + 0xdc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
push esi
push esi
push 0x1004
push eax
call ebx
test eax, eax
jle 0x40d4eb
push str.0_54
push 2
push esi
lea ecx, [edi + 0xc0]
call fcn.00433420
mov ecx, dword [edi + 0xdc]
push 0
push 0
push 0x1004
push ecx
inc esi
call ebx
cmp esi, eax
jl 0x40d4c1
mov edx, dword [edi + 0x8c]
xor esi, esi
push esi
push esi
push 0x1004
push edx
call ebx
test eax, eax
jle 0x40d528
push str.0_54
push 2
push esi
lea ecx, [edi + 0x70]
call fcn.00433420
mov eax, dword [edi + 0x8c]
push 0
push 0
push 0x1004
push eax
inc esi
call ebx
cmp esi, eax
jl 0x40d501
push 0
lea ecx, [esp + 0x324]
call fcn.004102f0
push edi
lea ecx, [esp + 0x324]
mov dword [esp + 0xb08], 0xb
call fcn.004103c0
lea ecx, [esp + 0x64]
call fcn.00433e74
lea ecx, [esp + 0x50]
mov byte [esp + 0xb04], 0xc
call fcn.00433e74
mov ecx, dword [edi + 0x8c]
xor esi, esi
push esi
push esi
push 0x1004
push ecx
mov byte [esp + 0xb14], 0xd
call ebx
test eax, eax
jle 0x40d64d
lea ebx, [ebx]
push 0
push esi
lea eax, [edi + 0x70]
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00408920
add esp, 0x10
push eax
mov eax, dword [esp + 0x70]
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0xb0c], 0xe
call fcn.00434028
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d5e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 1
push esi
lea eax, [edi + 0x70]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00408920
add esp, 0x10
mov ecx, dword [esp + 0x58]
push eax
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb0c], 0xf
call fcn.00434028
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d632
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 0x8c]
push 0
push 0
push 0x1004
push eax
inc esi
call ebx
cmp esi, eax
jl 0x40d590
xor esi, esi
push esi
push esi
mov dword [0x45f738], esi
mov ecx, dword [edi + 0xdc]
push 0x1004
push ecx
mov dword [esp + 0x3c], esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40e107
mov eax, dword [0x45f96c]
cmp esi, eax
jl 0x40d699
mov edi, edi
push 0x44b7d1
push eax
mov ecx, 0x45f964
call fcn.0043405f
mov eax, dword [0x45f96c]
cmp esi, eax
jge 0x40d680
test esi, esi
jl 0x40e16b
cmp esi, eax
jge 0x40e16b
mov edx, dword [0x45f968]
push 0
lea ecx, [edx + esi*4]
push 0x44b7d1
call fcn.00402ba0
lea ebx, [esi + 1]
lea ecx, [esp + 0x320]
mov dword [esp + 0x3c], ebx
mov dword [0x45f738], ebx
call fcn.004102b0
test eax, eax
jne 0x40e107
lea ecx, [edi + 0xc0]
push esi
call fcn.00433a4d
test eax, eax
je 0x40e0dd
lea eax, [esp + 0x34]
push str.1025
push eax
call fcn.00409cc0
push 0xa
lea ecx, [esp + 0x84]
push ecx
push ebx
mov byte [esp + 0xb18], 0x10
call fcn.00427824
lea eax, [esp + 0x8c]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d727
sub eax, ecx
push eax
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x3c]
call fcn.00408070
push 1
push 0x44c8e0
lea ecx, [esp + 0x3c]
call fcn.00408070
mov ecx, dword [edi + 0xdc]
push 0xa
lea eax, [esp + 0x7c]
push eax
push 0
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call fcn.00427824
lea eax, [esp + 0x84]
add esp, 0xc
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d780
sub eax, ecx
push eax
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x3c]
call fcn.00408070
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x324]
call fcn.00410210
push 3
push 3
lea ebx, [edi + 0xc0]
push esi
mov ecx, ebx
call fcn.004333f5
mov ecx, dword [edi + 0xdc]
push 1
push esi
push 0x1013
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push esi
lea edx, [esp + 0x1c]
push edx
mov ecx, ebx
call fcn.0043378c
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x4fc]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x800]
push edx
lea eax, [esp + 0x404]
push eax
push ecx
mov byte [esp + 0xb18], 0x11
call fcn.0042592d
mov eax, dword [edi + 0x174]
add esp, 0x14
cmp eax, 1
jne 0x40d87f
cmp dword [0x45f73c], 1
je 0x40d835
mov eax, dword [0x45f740]
test eax, eax
jle 0x40d8fc
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x8f8]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40d844
lea edi, [esp + 0x8f8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d856
mov edx, dword [str..bak]
mov al, byte [0x44c8dc]
push 0
lea ecx, [esp + 0x8fc]
push ecx
mov dword [edi], edx
push ebx
mov byte [edi + 4], al
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x45f740]
test eax, eax
jle 0x40d8fc
lea edx, [esp + 0xa0]
push str..doc
push edx
call fcn.00430160
add esp, 8
test eax, eax
je 0x40e091
lea eax, [esp + 0xa0]
push str..rtf
push eax
call fcn.00430160
add esp, 8
test eax, eax
je 0x40e091
lea ecx, [esp + 0xa0]
push str..xls
push ecx
call fcn.00430160
add esp, 8
test eax, eax
je 0x40e091
lea edx, [esp + 0xa0]
push str..ppt
push edx
call fcn.00430160
add esp, 8
test eax, eax
je 0x40e091
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x7f
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x120]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40d924
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
jne 0x40d9cd
lea eax, [esp + 0x120]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x120]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d963
mov ecx, dword [0x44c8cc]
mov edx, dword [str.rep.tmp]
mov eax, dword [0x44c8d4]
mov dword [edi], ecx
lea ecx, [esp + 0x120]
mov dword [edi + 4], edx
push 0x44c8c8
push ecx
mov dword [edi + 8], eax
call fcn.004239da
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40db77
lea edx, [esp + 0x4f8]
push edi
push edx
call fcn.0042436f
lea eax, [esp + 0xa8]
push edi
push eax
call fcn.0042436f
push edi
call fcn.004235f9
add esp, 0x14
jmp 0x40db77
lea ecx, [esp + 0xa0]
push str..doc
push ecx
call fcn.00430160
add esp, 8
test eax, eax
je 0x40db0f
lea edx, [esp + 0xa0]
push str..rtf
push edx
call fcn.00430160
add esp, 8
test eax, eax
je 0x40db0f
lea eax, [esp + 0xa0]
push str..xls
push eax
call fcn.00430160
add esp, 8
test eax, eax
jne 0x40da8d
lea ecx, [esp + 0x120]
push ecx
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x120]
dec edi
jmp 0x40da40
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40da40
mov edx, dword [0x44c8cc]
mov eax, dword [str.rep.tmp]
mov ecx, dword [0x44c8d4]
mov dword [edi], edx
mov edx, dword [esp + 0x14]
mov dword [edi + 4], eax
push edx
mov dword [edi + 8], ecx
call fcn.004024f0
add esp, 4
cmp eax, ebx
mov dword [esp + 0x30], eax
je 0x40db77
lea ecx, [esp + 0x120]
push ecx
push eax
call fcn.00403160
jmp 0x40db74
lea edx, [esp + 0xa0]
push str..ppt
push edx
call fcn.00430160
add esp, 8
test eax, eax
jne 0x40db77
lea eax, [esp + 0x120]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x120]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40dac5
mov ecx, dword [0x44c8cc]
mov edx, dword [str.rep.tmp]
mov eax, dword [0x44c8d4]
mov dword [edi], ecx
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], edx
push ecx
mov dword [edi + 8], eax
call fcn.004025e0
add esp, 4
cmp eax, ebx
mov dword [esp + 0x28], eax
je 0x40db77
lea edx, [esp + 0x120]
push edx
push eax
call fcn.004026e0
jmp 0x40db74
lea eax, [esp + 0x120]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x120]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40db30
mov ecx, dword [0x44c8cc]
mov edx, dword [str.rep.tmp]
mov eax, dword [0x44c8d4]
mov dword [edi], ecx
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], edx
push ecx
mov dword [edi + 8], eax
call fcn.00402250
add esp, 4
cmp eax, ebx
mov dword [esp + 0x38], eax
je 0x40db77
lea edx, [esp + 0x120]
push edx
push eax
call fcn.00402340
add esp, 8
cmp dword [0x45f740], ebx
jne 0x40def1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x8c]
xor ebx, ebx
push ebx
push ebx
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40def1
jmp 0x40dbb0
lea ecx, [esp + 0x320]
call fcn.004102b0
test eax, eax
jne 0x40def1
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push eax
mov eax, dword [edx + 0xdc]
push 0x1004
push eax
call edi
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x8c]
push 0
push 0
push 0x1004
push edx
mov dword [esp + 0x2c], eax
call edi
push 0
mov edi, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x8c]
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
imul edi, dword [esp + 0x1c]
imul eax, esi
add eax, ebx
imul eax, eax, 0x64
cdq
idiv edi
lea ecx, [esp + 0x320]
push eax
call fcn.004107e0
mov ecx, dword [esp + 0x24]
add ecx, 0x70
push ebx
call fcn.00433a4d
test eax, eax
je 0x40deca
mov eax, dword [0x45f748]
test eax, eax
mov eax, dword [0x45f96c]
jne 0x40dcb0
cmp esi, eax
jge 0x40e16b
test ebx, ebx
mov edx, dword [0x45f968]
lea esi, [edx + esi*4]
jl 0x40e16b
cmp ebx, dword [esp + 0x58]
jge 0x40e16b
mov eax, dword [esp + 0x54]
mov ecx, dword [eax + ebx*4]
cmp ebx, dword [esp + 0x6c]
jge 0x40e16b
mov edx, dword [esp + 0x68]
mov eax, dword [edx + ebx*4]
mov edx, dword [esp + 0x28]
push esi
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x44]
push edx
push ecx
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0040a4a0
jmp 0x40dd0a
cmp esi, eax
jge 0x40e16b
test ebx, ebx
mov ecx, dword [0x45f968]
lea esi, [ecx + esi*4]
jl 0x40e16b
cmp ebx, dword [esp + 0x58]
jge 0x40e16b
cmp ebx, dword [esp + 0x6c]
mov edx, dword [esp + 0x54]
mov ecx, dword [edx + ebx*4]
jge 0x40e16b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
mov eax, dword [eax + ebx*4]
push esi
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x44]
push edx
push ecx
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0040c390
add esp, 0x1c
test eax, eax
mov dword [esp + 0x18], eax
jle 0x40deca
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
push 2
push edi
lea ecx, [esp + 0x28]
push ecx
add esi, 0xc0
mov ecx, esi
call fcn.0043378c
mov eax, dword [esp + 0x20]
push 0xa
lea edx, [esp + 0x90]
push edx
push eax
mov byte [esp + 0xb10], 0x12
call fcn.00425c41
add eax, dword [esp + 0x24]
add esp, 4
push eax
call fcn.00427824
add esp, 0xc
lea ecx, [esp + 0x8c]
push ecx
push 2
push edi
mov ecx, esi
call fcn.00433420
mov ecx, dword [esp + 0x24]
push 2
push ebx
lea edx, [esp + 0x4c]
push edx
add ecx, 0x70
call fcn.0043378c
mov eax, dword [eax]
mov edi, dword [esp + 0x20]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
cmp esi, edi
mov byte [esp + 0xb04], 0x13
mov dword [esp + 0x4c], edi
je 0x40de43
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40de35
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40de35
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ddd7
cmp eax, dword [esi]
jne 0x40ddd7
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40de15
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x40e166
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x4c]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40de2c
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x20], esi
jmp 0x40de43
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00402ba0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40de69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
push 0xa
lea eax, [esp + 0x90]
push eax
push ecx
call fcn.00425c41
add eax, dword [esp + 0x24]
add esp, 4
push eax
call fcn.00427824
mov ecx, dword [esp + 0x30]
add esp, 0xc
lea edx, [esp + 0x8c]
push edx
push 2
push ebx
add ecx, 0x70
call fcn.00433420
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40deca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x8c]
push 0
push 0
push 0x1004
push ecx
inc ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebx, eax
mov esi, dword [esp + 0x2c]
jl 0x40dbb0
mov eax, dword [0x45f740]
dec eax
cmp eax, 3
ja case.default.0x40defc
jmp dword [eax*4 + 0x40e170]
mov edx, dword [esp + 0x14]
push edx
call fcn.00401470
jmp 0x40df31
mov eax, dword [esp + 0x14]
push eax
call fcn.00401770
jmp 0x40df31
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004015f0
jmp 0x40df31
mov edx, dword [esp + 0x14]
push edx
call fcn.00401850
add esp, 4
cmp dword [ebp + 8], 1
jne 0x40dffa
xor eax, eax
mov byte [esp + 0x5f8], 0
mov ecx, 0x7f
lea edi, [esp + 0x5f9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x120]
push 0x44c8c4
push eax
call fcn.004239da
mov edi, eax
add esp, 8
test edi, edi
je 0x40df90
push edi
lea ecx, [esp + 0x4fc]
push pe_nt_image_headers32
push ecx
call fcn.00425b33
push edi
call fcn.004235f9
add esp, 0x10
push 0x44b7d1
lea edx, [esp + 0x4fc]
push edx
lea eax, [esp + 0x800]
push eax
lea ecx, [esp + 0x404]
push ecx
lea edx, [esp + 0x608]
push edx
call fcn.00425aa3
mov eax, dword [0x45f73c]
add esp, 0x14
cmp eax, 1
jne 0x40dffa
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x5f8]
push eax
push ecx
call fcn.00425a75
add esp, 8
test eax, eax
jne 0x40dffa
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x5f8]
push edx
push 1
push esi
add ecx, 0xc0
call fcn.00433420
mov esi, dword [esp + 0x38]
test esi, esi
je 0x40e012
mov ecx, esi
call fcn.004187c0
push esi
call fcn.00401ed0
add esp, 4
mov esi, dword [esp + 0x30]
test esi, esi
je 0x40e02a
mov ecx, esi
call fcn.004179f0
push esi
call fcn.00401f50
add esp, 4
mov esi, dword [esp + 0x28]
test esi, esi
je 0x40e042
mov ecx, esi
call fcn.004185d0
push esi
call fcn.00401f80
add esp, 4
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x120]
lea ecx, [ecx]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40e078
test cl, cl
je 0x40e074
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40e078
add eax, 2
add esi, 2
test cl, cl
jne 0x40e050
xor eax, eax
jmp 0x40e07d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40e091
lea eax, [esp + 0x120]
push eax
call fcn.0043296b
add esp, 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e0b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0xb04], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e0dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0xdc]
mov esi, dword [esp + 0x3c]
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x3c], esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, eax
jl 0x40d675
call fcn.00401d80
call fcn.00401e50
call fcn.00401e90
lea ecx, [esp + 0x50]
mov byte [esp + 0xb04], 0xc
call fcn.00433ec6
lea ecx, [esp + 0x64]
mov byte [esp + 0xb04], 0xb
call fcn.00433ec6
lea ecx, [esp + 0x320]
mov dword [esp + 0xb04], 0xffffffff
call fcn.00410460
mov ecx, dword [esp + 0xafc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00401a30
call fcn.00432a1d
add ebx, edi
inc eax
add byte [edi], cl
fild word [eax]
sbb ebx, edi
inc eax
add byte [edi], ah
fild word [eax]
push 0
call fcn.0040ce20
ret