Function at 0x4dfdc0
Capabilities:
Check if file exists
Copy file
Create thread
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x340
mov rbp, rsp
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], rdx
mov qword [rbp + 0x98], r8
mov byte [rbp + 0xa7], r9b
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x330], 0
mov qword [rbp + 0x328], 0
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x310], 0
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x2e0], 0
mov qword [rbp + 0x2d8], 0
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2b8], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2a0], 0
nop
lea rcx, [rbp + 0x2d0]
mov rdx, qword [0x00422240]
call fcn.00413ec0
lea rcx, [rbp + 0x2c8]
mov rdx, qword [0x00422240]
call fcn.00413ec0
lea rcx, [rbp + 0x2c0]
mov rdx, qword [0x00422240]
call fcn.00413ec0
cmp qword [rbp + 0x3a8], 0
je 0x4e01a3
mov rax, qword [rbp + 0x3a8]
mov qword [rax], 0
mov rax, qword [rbp + 0xa8]
test rax, rax
jne 0x4e01bd
xor rax, rax
mov byte [rbp + 0xbf], al
jmp 0x4e1df2
cmp byte [rbp + 0x390], 0
je 0x4e02e8
cmp byte [rbp + 0x3a0], 0
jne 0x4e02e8
mov ecx, 0xfa
call fcn.004ac300
test al, al
jne 0x4e02e8
mov rax, qword [rbp + 0x98]
test rax, rax
je 0x4e0227
mov rcx, qword [rbp + 0x98]
mov rdx, 0xfffffffffffffffe
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 3
call sub.user32.dll_SetWindowPos
mov ecx, 0x40
mov edx, 0x20
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
mov rcx, rbx
mov rdx, qword [rbp + 0xa8]
call fcn.004106d0
lea rcx, [rbx + 8]
mov rdx, qword [rbp + 0xb0]
call fcn.00415fa0
movzx rax, byte [rbp + 0xa7]
mov byte [rbx + 0x10], al
lea rcx, [rbx + 0x18]
mov rdx, qword [rbp + 0x398]
call fcn.00415fa0
xor rcx, rcx
xor rdx, rdx
lea r8, [0x004dfd60]
mov r9, rbx
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x2b4]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
test rax, rax
je 0x4e02d1
mov cl, 1
mov byte [rbp + 0xbf], cl
cmp qword [rbp + 0x3a8], 0
je 0x4e02c4
mov rcx, qword [rbp + 0x3a8]
mov qword [rcx], rax
jmp 0x4e1df2
mov rcx, rax
call sub.kernel32.dll_CloseHandle
jmp 0x4e1df2
mov rcx, rbx
mov rdx, qword [0x004dfc90]
call fcn.00412f70
mov rcx, rbx
call sub.kernel32.dll_LocalFree
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x308]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x620]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x300]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x630]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x2f0]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x1b0]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x298]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x340]
cmp qword [rbp + 0x298], 0
jne 0x4e0442
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x290]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x1b0]
cmp qword [rbp + 0x290], 0
je 0x4e0442
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x2f8]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x1b0]
lea rcx, [rbp + 0x2f8]
call fcn.004c7f90
cmp eax, 1
jle 0x4e03fd
lea rcx, [rbp + 0x288]
mov rdx, qword [rbp + 0x2f8]
mov r8d, 1
mov r9b, 0x2c
mov rbx, qword [0x00bb8a78]
call qword [rbx]
lea rcx, [rbp + 0x2f8]
mov rdx, qword [rbp + 0x288]
call fcn.00410750
lea rcx, [rbp + 0x280]
mov rdx, qword [rbp + 0x2f8]
xor r8, r8
call fcn.004c8000
lea rcx, [rbp + 0x278]
mov rdx, qword [rbp + 0x280]
call fcn.00411f60
lea rcx, [rbp + 0x2f8]
lea rdx, [0x004e22e4]
mov r8, qword [rbp + 0x278]
call fcn.00412270
jmp 0x4e0460
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x2f8]
mov rax, qword [rbp + 0x398]
mov rbx, qword [rax]
call qword [rbx + 0x340]
lea rcx, [rbp + 0x338]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e2308]
call fcn.004de240
lea rcx, [rbp + 0x330]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e2334]
call fcn.004de240
lea rcx, [rbp + 0x328]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e2364]
call fcn.004de3d0
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x308]
mov r8, qword [rbp + 0x338]
mov r9, qword [rbp + 0x330]
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x28], rax
call fcn.004ad250
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x300]
mov r8, qword [rbp + 0x338]
mov r9, qword [rbp + 0x330]
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x28], rax
call fcn.004ad250
lea rcx, [rbp + 0x2d8]
call fcn.004c7f50
xor rbx, rbx
lea rcx, [rbp + 0x318]
call fcn.00410080
lea rcx, [rbp + 0x310]
call fcn.00410080
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2a0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2b0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1f0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1c0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1d0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1e0]
test al, al
jne 0x4e0630
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x320]
test al, al
je 0x4e0eec
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x358]
test al, al
je 0x4e0c22
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x270]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3f0]
lea rcx, [rbp + 0x318]
mov rdx, qword [rbp + 0x270]
call fcn.004a99d0
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e06a6
mov rcx, qword [rbp + 0x318]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4e06ea
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x4e07f5
lea rcx, [rbp + 0x268]
mov rdx, qword [rbp + 0x318]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x268]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4e07f5
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x260]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3f0]
lea rcx, [0x004e238c]
mov rdx, qword [rbp + 0x260]
mov r8d, 1
mov r9d, 0x7fffffff
mov rax, qword [0x00bb7940]
call qword [rax]
test eax, eax
jne 0x4e07f5
lea rcx, [rbp + 0x248]
xor rdx, rdx
call fcn.004a98b0
lea rcx, [rbp + 0x250]
mov rdx, qword [rbp + 0x248]
call fcn.00428260
lea rcx, [rbp + 0x258]
mov rdx, qword [rbp + 0x250]
call fcn.004a9980
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x240]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3f0]
lea rcx, [rbp + 0x318]
mov edx, 4
lea r8, [0x004e239c]
mov r9, qword [rbp + 0x258]
lea rax, [0x004e238c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x240]
mov qword [rsp + 0x28], rax
call fcn.00412390
xor rcx, rcx
lea rdx, [rbp + 0x318]
lea r8, [0x004e23c8]
lea r9, [0x004e23f0]
lea rax, [0x004e2414]
mov qword [rsp + 0x20], rax
lea rax, [0x004e2438]
mov qword [rsp + 0x28], rax
call fcn.004ad250
lea rcx, [rbp + 0x2a8]
call fcn.004a9c80
cmp qword [rbp + 0x2a8], 0
je 0x4e0c22
lea rcx, [rbp + 0x238]
mov rdx, qword [rbp + 0x318]
call fcn.00428260
lea rcx, [rbp + 0x2a8]
mov rdx, qword [rbp + 0x238]
call fcn.00412180
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x368]
test al, al
je 0x4e089a
lea rcx, [rbp + 0x2e0]
call fcn.00415f60
mov rcx, qword [rbp + 0x398]
lea rdx, [0x004e2456]
mov r8, rax
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax]
test eax, eax
jne 0x4e089a
mov rcx, qword [rbp + 0x2e0]
mov rax, qword [rbp + 0x2e0]
mov rax, qword [rax]
call qword [rax + 0x40]
test al, al
je 0x4e089a
xor rsi, rsi
jmp 0x4e089d
mov sil, 1
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x368]
test al, al
je 0x4e0977
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e08f6
mov rcx, qword [rbp + 0x318]
call fcn.00411e10
mov rdi, rax
mov rcx, qword [rbp + 0x2a8]
call fcn.00411e10
mov rcx, rdi
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4e095c
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x4e0977
lea rcx, [rbp + 0x230]
mov rdx, qword [rbp + 0x318]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x230]
call fcn.00411320
mov rdi, rax
lea rcx, [rbp + 0x228]
mov rdx, qword [rbp + 0x2a8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x228]
call fcn.00411320
mov rcx, rdi
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4e0977
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x378]
mov ebx, eax
jmp 0x4e09c7
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e099a
mov rcx, qword [rbp + 0x2a8]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x4e09c4
lea rcx, [rbp + 0x220]
mov rdx, qword [rbp + 0x2a8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x220]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
mov sil, 1
test sil, sil
je 0x4e0b46
lea rcx, [rbp + 0x2e0]
call fcn.00415f60
mov rcx, qword [rbp + 0x398]
lea rdx, [0x004e2456]
mov r8, rax
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax]
test eax, eax
jne 0x4e0a15
mov rcx, qword [rbp + 0x2e0]
mov rax, qword [rbp + 0x2e0]
mov rax, qword [rax]
call qword [rax + 0x40]
test al, al
je 0x4e0a1a
xor rsi, rsi
jmp 0x4e0a1d
mov sil, 1
mov rcx, qword [rbp + 0x2a8]
mov rdx, qword [rbp + 0xa8]
xor r8, r8
mov r9b, 1
mov rax, qword [rbp + 0x398]
mov qword [rsp + 0x20], rax
call fcn.004de970
test al, al
jne 0x4e0b2a
lea rcx, [rbp + 0x218]
call fcn.004a9c80
call sub.kernel32.dll_GetTickCount
lea rcx, [rbp + 0x210]
mov edx, eax
mov r8d, 1
mov r9w, 0x30
call fcn.00425c80
lea rcx, [rbp + 0x208]
mov rdx, qword [rbp + 0x318]
call fcn.00428260
lea rcx, [rbp + 0x2a8]
mov edx, 3
mov r8, qword [rbp + 0x218]
mov r9, qword [rbp + 0x210]
mov rax, qword [rbp + 0x208]
mov qword [rsp + 0x20], rax
call fcn.00412390
mov rcx, qword [rbp + 0x2a8]
mov rdx, qword [rbp + 0xa8]
xor r8, r8
mov r9b, 1
mov rax, qword [rbp + 0x398]
mov qword [rsp + 0x20], rax
call fcn.004de970
test al, al
jne 0x4e0b2a
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e0b00
mov rcx, qword [rbp + 0x2a8]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x4e0b2a
lea rcx, [rbp + 0x200]
mov rdx, qword [rbp + 0x2a8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x200]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
test sil, sil
je 0x4e0b46
mov rcx, qword [rbp + 0x2e0]
xor rdx, rdx
mov rax, qword [rbp + 0x2e0]
mov rsi, qword [rax]
call qword [rsi + 0x48]
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e0b6c
mov rcx, qword [rbp + 0x2a8]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4e0bac
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x4e0c1f
lea rcx, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x2a8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x1f8]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e0c1f
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1f0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x388]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1e8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x398]
mov rcx, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x2a8]
mov r8, qword [rbp + 0x1f0]
mov r9, qword [rbp + 0x1e8]
lea rax, [0x004e2474]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x2d8]
mov rsi, qword [rax]
call qword [rsi + 0x38]
jmp 0x4e0c22
xor rbx, rbx
mov rax, qword [rbp + 0xb0]
test rax, rax
je 0x4e0dab
lea rcx, [rbp + 0x310]
call fcn.004a9c80
cmp qword [rbp + 0x310], 0
je 0x4e0dab
lea rcx, [rbp + 0x310]
lea rdx, [0x004e2494]
call fcn.00412180
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x3a8]
cmp eax, 0x19000
jg 0x4e0c99
cmp eax, 0x19000
je 0x4e0cb9
sub eax, 4
test eax, eax
je 0x4e0caf
sub eax, 0xc7fc
test eax, eax
jne 0x4e0cc8
jmp 0x4e0cb4
sub eax, 0x32000
test eax, eax
je 0x4e0cbe
sub eax, 0x19000
test eax, eax
jne 0x4e0cc8
jmp 0x4e0cc3
mov sil, 1
jmp 0x4e0ccb
mov sil, 2
jmp 0x4e0ccb
mov sil, 3
jmp 0x4e0ccb
mov sil, 4
jmp 0x4e0ccb
mov sil, 5
jmp 0x4e0ccb
xor rsi, rsi
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e0cee
mov rcx, qword [rbp + 0x310]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x4e0d18
lea rcx, [rbp + 0x1e0]
mov rdx, qword [rbp + 0x310]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x1e0]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0x310]
mov r8d, esi
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax]
call qword [rax + 0x48]
test al, al
je 0x4e0dab
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1d8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3c8]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1d0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3d8]
mov rcx, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x310]
mov r8, qword [rbp + 0x1d8]
mov r9, qword [rbp + 0x1d0]
lea rax, [0x004e24c0]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x2d8]
mov rsi, qword [rax]
call qword [rsi + 0x38]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1c8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x3e8]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1c8]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rsi, rsi
mov edi, eax
sub edi, 1
cmp esi, edi
jg 0x4e0e8c
add edi, 1
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1c0]
mov rax, qword [rbp + 0x398]
mov r13, qword [rax]
call qword [r13 + 0x3e8]
mov rcx, qword [rbp + 0x1c0]
mov edx, esi
lea r8, [rbp + 0x338]
lea r9, [rbp + 0x330]
lea rax, [rbp + 0x328]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1c0]
mov rax, qword [rax]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x338]
mov r8, qword [rbp + 0x330]
mov r9, qword [rbp + 0x328]
mov rax, qword [rbp + 0x320]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x2d8]
mov r13, qword [rax]
call qword [r13 + 0x38]
add esi, 1
cmp esi, edi
jne 0x4e0df0
nop
lea rcx, [rbp + 0x2b8]
mov rdx, qword [rbp + 0x398]
mov r8, qword [rbp + 0x2d8]
lea r9, [rbp + 0x2d0]
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x30], rax
movzx rax, byte [rbp + 0xa7]
mov byte [rsp + 0x38], al
movzx rax, byte [rbp + 0x3a0]
mov byte [rsp + 0x40], al
call fcn.004c8350
jmp 0x4e0ef8
lea rcx, [rbp + 0x2b8]
call fcn.00415f60
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1b8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x350]
mov rcx, qword [rbp + 0x1b8]
lea rdx, [rbp + 0x2e8]
mov rax, qword [rbp + 0x1b8]
mov rsi, qword [rax]
call qword [rsi + 0x78]
cmp qword [rbp + 0x2f8], 0
je 0x4e0f5d
mov rcx, qword [rbp + 0x2e8]
lea rdx, [0x004e24e4]
mov r8, qword [rbp + 0x2f8]
mov rax, qword [rbp + 0x2e8]
mov rsi, qword [rax]
call qword [rsi + 0x50]
cmp qword [rbp + 0x308], 0
je 0x4e0f89
mov rcx, qword [rbp + 0x2e8]
lea rdx, [0x004e2504]
mov r8, qword [rbp + 0x308]
mov rax, qword [rbp + 0x2e8]
mov rsi, qword [rax]
call qword [rsi + 0x50]
cmp qword [rbp + 0x300], 0
je 0x4e0fb5
mov rcx, qword [rbp + 0x2e8]
lea rdx, [0x004e2528]
mov r8, qword [rbp + 0x300]
mov rax, qword [rbp + 0x2e8]
mov rsi, qword [rax]
call qword [rsi + 0x50]
cmp qword [rbp + 0x2f0], 0
je 0x4e0fe1
mov rcx, qword [rbp + 0x2e8]
lea rdx, [0x004e2548]
mov r8, qword [rbp + 0x2f0]
mov rax, qword [rbp + 0x2e8]
mov rsi, qword [rax]
call qword [rsi + 0x50]
xor rax, rax
mov byte [rbp + 0xbf], al
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1c0]
test al, al
jne 0x4e105a
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1d0]
test al, al
jne 0x4e105a
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1e0]
test al, al
jne 0x4e105a
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1f0]
test al, al
je 0x4e1784
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x200]
cmp qword [rbp + 0x1b0], 0
je 0x4e1784
movzx rax, byte [rbp + 0xa7]
test al, al
sete cl
call fcn.004c91a0
test al, al
je 0x4e1784
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x2a0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x200]
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1f0]
test al, al
jne 0x4e1121
cmp qword [rbp + 0x2a0], 0
je 0x4e1121
mov rcx, qword [rbp + 0x2a0]
call fcn.004108b0
mov rcx, qword [rbp + 0x2a0]
movsxd rax, eax
cmp byte [rcx + rax - 1], 0x2f
jne 0x4e1121
mov rcx, qword [rbp + 0x2a0]
call fcn.004108b0
lea rcx, [rbp + 0x2a0]
mov edx, eax
mov r8d, 1
call fcn.004113d0
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x210]
mov esi, eax
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x220]
mov edi, eax
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1a8]
mov rax, qword [rbp + 0x398]
mov r13, qword [rax]
call qword [r13 + 0x230]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x398]
mov r13, qword [rax]
call qword [r13 + 0x240]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x198]
mov rax, qword [rbp + 0x398]
mov r13, qword [rax]
call qword [r13 + 0x250]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x190]
mov rax, qword [rbp + 0x398]
mov r13, qword [rax]
call qword [r13 + 0x260]
mov rcx, qword [0x004d10c8]
mov dl, 1
mov r8, qword [rbp + 0x2a0]
mov r9d, esi
mov word [rsp + 0x20], di
mov byte [rsp + 0x28], 0
mov rax, qword [rbp + 0x1a8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x48], rax
mov rax, qword [0x00b2db40]
mov qword [rsp + 0x50], rax
mov rax, qword [0x00b2db48]
mov qword [rsp + 0x58], rax
mov rax, qword [0x00b2db50]
mov qword [rsp + 0x60], rax
mov rax, qword [0x00b2db58]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x398]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rsp + 0x78], rax
call fcn.004d2ff0
mov rsi, rax
lea rcx, [rbp + 0x338]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e2568]
call fcn.004de240
lea rcx, [rbp + 0x330]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e2590]
call fcn.004de240
lea rcx, [rbp + 0x328]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e25c0]
call fcn.004de240
lea rcx, [rbp + 0x320]
mov rdx, qword [rbp + 0xa8]
lea r8, [0x004e25dc]
call fcn.004de240
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1c0]
test al, al
je 0x4e142a
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x188]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x600]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x180]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x610]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x178]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x270]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x170]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x280]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x168]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x290]
mov rcx, rsi
mov rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x180]
mov r9, qword [rbp + 0x178]
mov rax, qword [rbp + 0x170]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x338]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x2f8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x320]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x68], rax
call fcn.004d7820
mov byte [rbp + 0xbf], al
jmp 0x4e177c
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1d0]
test al, al
je 0x4e1607
lea rcx, [rbp + 0x320]
lea rdx, [0x004e25f8]
mov rax, qword [0x00bb7788]
call qword [rax]
lea rcx, [rbp + 0x320]
mov dl, 0x2c
mov rdi, qword [0x00bb63b8]
call qword [rdi]
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x320]
mov r8d, 2
mov r9b, 0x2c
mov rdi, qword [0x00bb8a78]
call qword [rdi]
lea rcx, [rbp + 0x320]
mov rdx, qword [rbp + 0x160]
call fcn.00410750
lea rcx, [rbp + 0x320]
mov edx, 1
mov r8d, 1
call fcn.004124e0
mov rcx, qword [rbp + 0x320]
lea rdx, [0x004e2624]
call fcn.00412470
test eax, eax
jne 0x4e14e9
lea rcx, [rbp + 0x320]
mov rdx, qword [rbp + 0x338]
call fcn.00410750
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x158]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x600]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x610]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x148]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x270]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x140]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x280]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x138]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x290]
mov rcx, rsi
mov rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x150]
mov r9, qword [rbp + 0x148]
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x330]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x58], rax
call fcn.004d9f30
mov byte [rbp + 0xbf], al
jmp 0x4e177c
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x1e0]
test al, al
je 0x4e1741
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x130]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x600]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x128]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x610]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x120]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x270]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x118]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x280]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x110]
mov rax, qword [rbp + 0x398]
mov rdi, qword [rax]
call qword [rdi + 0x290]
mov rcx, rsi
mov rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x128]
mov r9, qword [rbp + 0x120]
mov rax, qword [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x330]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x58], rax
call fcn.004dcf40
mov byte [rbp + 0xbf], al
jmp 0x4e177c
mov rcx, rsi
mov rdx, qword [rbp + 0x2f8]
mov r8, qword [rbp + 0x2e8]
mov r9, qword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x28], rax
call fcn.004d6550
mov byte [rbp + 0xbf], al
mov rcx, rsi
call fcn.0040ccc0
movzx rax, byte [rbp + 0xbf]
test al, al
jne 0x4e1a63
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2a0]
test al, al
je 0x4e1895
cmp qword [rbp + 0x2f0], 0
je 0x4e1883
movzx rax, byte [rbp + 0xa7]
test al, al
sete cl
call fcn.004c91a0
test al, al
je 0x4e1883
mov rcx, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x2f0]
mov r8, qword [rbp + 0x2f8]
mov r9, qword [rbp + 0x308]
mov rax, qword [rbp + 0x300]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov eax, dword [0x00b2db8c]
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rax, qword [rbp + 0x2b8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x398]
mov qword [rsp + 0x80], rax
call fcn.004d0a40
test al, al
jne 0x4e1888
xor rax, rax
jmp 0x4e188a
mov al, 1
mov byte [rbp + 0xbf], al
jmp 0x4e1a63
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2b0]
test al, al
je 0x4e1a63
cmp qword [rbp + 0x2f0], 0
je 0x4e1a56
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x108]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x2c0]
cmp qword [rbp + 0x108], 0
je 0x4e1a56
movzx rax, byte [rbp + 0xa7]
test al, al
sete cl
call fcn.004c91a0
test al, al
je 0x4e1a56
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0x100]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x2c0]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0xf8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x300]
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0xf0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x310]
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2f0]
mov esi, eax
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2d0]
mov edi, eax
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x2e0]
mov rcx, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x2f0]
mov r8, qword [rbp + 0x2f8]
mov r9, qword [rbp + 0x308]
mov r10, qword [rbp + 0x300]
mov qword [rsp + 0x20], r10
mov r10, qword [rbp + 0x2d0]
mov qword [rsp + 0x28], r10
mov r10, qword [rbp + 0x2c8]
mov qword [rsp + 0x30], r10
mov r10, qword [rbp + 0x2c0]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], 0
mov r10, qword [rbp + 0x100]
mov qword [rsp + 0x48], r10
mov r10, qword [rbp + 0xf8]
mov qword [rsp + 0x50], r10
mov r10, qword [rbp + 0xf0]
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x60], esi
mov byte [rsp + 0x68], dil
mov byte [rsp + 0x70], al
mov rax, qword [rbp + 0x2b8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x398]
mov qword [rsp + 0x80], rax
call fcn.004d0a40
test al, al
jne 0x4e1a5b
xor rax, rax
jmp 0x4e1a5d
mov al, 1
mov byte [rbp + 0xbf], al
cmp qword [rbp + 0x2b8], 0
je 0x4e1a81
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rbp + 0x2b8]
mov rsi, qword [rax]
call qword [rsi + 0x70]
cmp qword [rbp + 0x310], 0
je 0x4e1aff
movzx rax, byte [rbp + 0xbf]
test al, al
jne 0x4e1ab2
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x320]
test al, al
jne 0x4e1aff
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e1ad5
mov rcx, qword [rbp + 0x310]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x4e1aff
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x310]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xe8]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
movzx rax, byte [rbp + 0xbf]
test al, al
jne 0x4e1cd7
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x320]
test al, al
je 0x4e1b75
mov rcx, qword [rbp + 0x2f0]
mov rdx, qword [rbp + 0x308]
mov r8, qword [rbp + 0x300]
mov r9, qword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x28], rax
movzx rax, byte [rbp + 0xa7]
mov byte [rsp + 0x30], al
call fcn.004c9500
mov byte [rbp + 0xbf], al
movzx rax, byte [rbp + 0xbf]
test al, al
jne 0x4e1c0c
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x330]
test al, al
je 0x4e1c0c
movzx rax, byte [rbp + 0xa7]
test al, al
jne 0x4e1c0c
xor rbx, rbx
mov rax, qword [rbp + 0x98]
test rax, rax
je 0x4e1bec
mov rcx, qword [rbp + 0x98]
mov rdx, 0xfffffffffffffffe
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 3
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbp + 0x2f0]
mov rdx, qword [rbp + 0x308]
mov r8, qword [rbp + 0xa8]
call fcn.004c9da0
mov byte [rbp + 0xbf], al
movzx rax, byte [rbp + 0xbf]
test al, al
jne 0x4e1cd7
movzx rax, byte [rbp + 0xa7]
test al, al
jne 0x4e1cd7
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e1c7e
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x6c0]
mov rcx, qword [rbp + 0xe0]
call fcn.00411e10
mov rcx, qword [rbp + 0x98]
mov rdx, rax
xor r8, r8
mov r9d, 0x10
call sub.user32.dll_MessageBoxW
jmp 0x4e1cd7
mov rcx, qword [rbp + 0x398]
lea rdx, [rbp + 0xd8]
mov rax, qword [rbp + 0x398]
mov rsi, qword [rax]
call qword [rsi + 0x6c0]
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xd0]
call fcn.00411320
mov rcx, qword [rbp + 0x98]
mov rdx, rax
xor r8, r8
mov r9d, 0x10
call sub.user32.dll_MessageBoxA
movzx rax, byte [rbp + 0xbf]
cmp al, 1
jne 0x4e1df1
lea rcx, [rbp + 0x2e0]
call fcn.00415f60
mov rcx, qword [rbp + 0x398]
lea rdx, [0x004e2456]
mov r8, rax
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax]
test eax, eax
jne 0x4e1d2b
mov rcx, qword [rbp + 0x2e0]
mov dl, 1
mov rax, qword [rbp + 0x2e0]
mov rsi, qword [rax]
call qword [rsi + 0x38]
test bl, bl
je 0x4e1df1
cmp qword [rbp + 0x318], 0
je 0x4e1df1
mov rcx, qword [rbp + 0x398]
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
call qword [rax + 0x378]
test al, al
je 0x4e1df1
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e1d9a
mov rcx, qword [rbp + 0x318]
call fcn.00411e10
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_SetFileAttributesW
mov rcx, qword [rbp + 0x318]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x4e1df1
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0x318]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xc8]
call fcn.00411320
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_SetFileAttributesA
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x318]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xc0]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
nop
lea rcx, [rbp + 0xc0]
mov edx, 3
call fcn.00410190
lea rcx, [rbp + 0xd8]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0xe8]
call fcn.004100d0
lea rcx, [rbp + 0xf0]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x100]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0x110]
mov edx, 0x14
call fcn.00410160
lea rcx, [rbp + 0x1b0]
call fcn.004100d0
lea rcx, [rbp + 0x1b8]
call fcn.00415f60
lea rcx, [rbp + 0x1c0]
mov rdx, qword [0x004a8190]
mov r8d, 2
call fcn.00412e00
lea rcx, [rbp + 0x1d0]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x1e0]
call fcn.004100d0
lea rcx, [rbp + 0x1e8]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x1f8]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0x208]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x220]
mov edx, 3
call fcn.00410190
lea rcx, [rbp + 0x238]
mov edx, 6
call fcn.00410160
lea rcx, [rbp + 0x268]
call fcn.004100d0
lea rcx, [rbp + 0x270]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x280]
call fcn.004100d0
lea rcx, [rbp + 0x288]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x2a0]
call fcn.004100d0
lea rcx, [rbp + 0x2a8]
call fcn.00410080
lea rcx, [rbp + 0x2b8]
call fcn.00415f60
lea rcx, [rbp + 0x2c0]
mov rdx, qword [0x00422240]
mov r8d, 3
call fcn.00412e00
lea rcx, [rbp + 0x2d8]
call fcn.00415f60
lea rcx, [rbp + 0x2e0]
call fcn.00415f60
lea rcx, [rbp + 0x2e8]
call fcn.00415f60
lea rcx, [rbp + 0x2f0]
mov edx, 0xa
call fcn.00410160
movzx rax, byte [rbp + 0xbf]
lea rsp, [rbp + 0x340]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret