Function at 0x437c29
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, 0x560cb2
call fcn.0053c1d0
sub esp, 0x208
mov eax, dword [0x5af710]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
push esi
push edi
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x7c], eax
je 0x4389ad
cmp byte [eax], 0
je 0x4389ad
and dword [ebp - 0x58], 0
push 1
push 0x1b6
push 0x21
push eax
lea ecx, [ebp - 0x214]
call fcn.0042b7c3
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x20c]
and dword [ebp - 4], 0
test al, 6
je 0x437caf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.0042b864
mov dword [ebp - 0x1b0], 0x572840
jmp 0x4389a2
test al, 1
mov esi, 0x572a3c
mov ebx, 0x572a38
mov edi, 0x572a34
jne 0x4385c5
push 1
push 0
push 0
call fcn.004338e1
add esp, 0xc
mov dword [ebp - 0x30], eax
test eax, eax
mov byte [ebp - 4], 1
jne 0x437ce7
mov byte [ebp - 4], al
jmp 0x4385c5
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00433d30
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp word [eax + 4], 0xffff
pop ecx
pop ecx
jne 0x437ead
cmp dword [0x5b21c0], 0x211
jne 0x437ea1
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push 0x5749dc
push 0x572a4c
push eax
push 0x572a48
push 0x211
push 0x572a40
push dword [ebp - 0x60]
mov byte [ebp - 4], 2
push esi
push dword [ebp - 0x62]
push esi
push dword [ebp - 0x64]
push ebx
push dword [ebp - 0x66]
push edi
push dword [ebp - 0x6a]
push edi
push dword [ebp - 0x6c]
push ebx
push 0x628
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x54]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 3
jb 0x437da1
mov eax, dword [eax + 4]
jmp 0x437da4
add eax, 4
push eax
lea eax, [ebp - 0xfc]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00402c50
lea eax, [ebp - 0xfc]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.004028d0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x572840
call fcn.0054dfcb
xor eax, eax
inc eax
mov dword [ebp - 0x58], eax
push eax
jmp 0x4385b9
mov ecx, dword [ebp - 0x5c]
push 1
add ecx, 0xc4
call fcn.004293f8
cmp eax, 9
jne 0x437ed5
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov word [eax + 4], 0x32
mov eax, dword [ecx]
mov word [eax + 6], 1
or dword [ebp - 0x28], 0xffffffff
mov word [ebp - 0x24], 2
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x2c], 0x572c04
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00408250
test eax, eax
jne 0x4385ab
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004bef40
pop ecx
pop ecx
push dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0040e73e
test eax, eax
jne 0x438077
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push dword [ebp - 0x38]
mov byte [ebp - 4], 6
push 0x572a4c
push eax
push 0x572a48
push 0x10000000
push 0x572a40
push dword [ebp - 0x60]
push esi
push dword [ebp - 0x62]
push esi
push dword [ebp - 0x64]
push ebx
push dword [ebp - 0x66]
push edi
push dword [ebp - 0x6a]
push edi
push dword [ebp - 0x6c]
push ebx
push 0x63a
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x54]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 7
jb 0x437fac
mov eax, dword [eax + 4]
jmp 0x437faf
add eax, 4
push eax
lea eax, [ebp - 0xfc]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x54]
jmp 0x438566
lea ecx, [ebp - 0x2c]
call fcn.00409890
test eax, eax
mov dword [ebp - 0x34], eax
jne 0x4383be
cmp dword [0x5b21c0], 0x212
jne 0x438224
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push 0x572d9c
push 0x572a4c
push eax
push 0x572a48
push 0x212
push 0x572a40
push dword [ebp - 0x3c]
mov byte [ebp - 4], 8
push esi
push dword [ebp - 0x3e]
push esi
push dword [ebp - 0x40]
push ebx
push dword [ebp - 0x42]
push edi
push dword [ebp - 0x46]
push edi
push dword [ebp - 0x48]
push ebx
push 0x641
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x78]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 9
jb 0x438124
mov eax, dword [eax + 4]
jmp 0x438127
add eax, 4
push eax
lea eax, [ebp - 0xfc]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.00402c50
lea eax, [ebp - 0xfc]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.004028d0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x572840
call fcn.0054dfcb
cmp dword [0x5b21c0], 0x211
jne 0x4383be
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push 0x572d9c
push 0x572a4c
push eax
push 0x572a48
push 0x211
push 0x572a40
push dword [ebp - 0x3c]
mov byte [ebp - 4], 0xa
push esi
push dword [ebp - 0x3e]
push esi
push dword [ebp - 0x40]
push ebx
push dword [ebp - 0x42]
push edi
push dword [ebp - 0x46]
push edi
push dword [ebp - 0x48]
push ebx
push 0x642
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x78]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0xb
jb 0x4382be
mov eax, dword [eax + 4]
jmp 0x4382c1
add eax, 4
push eax
lea eax, [ebp - 0xfc]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.00402c50
lea eax, [ebp - 0xfc]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.004028d0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x572840
call fcn.0054dfcb
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
call fcn.004293aa
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
push 0
push ecx
push eax
push dword [ebp - 0x28]
call fcn.00503ed7
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
push 0x14
push 0
push ecx
push eax
push dword [ebp - 0x28]
call fcn.00503f15
add esp, 0x24
test eax, eax
jle 0x438406
mov dword [ebp - 0x58], 1
jmp 0x4385a0
cmp dword [0x5b21c0], 0x212
jne 0x4385a0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push 0x572aa4
push 0x572a4c
push eax
push 0x572a48
push 0x212
push 0x572a40
push dword [ebp - 0x3c]
mov byte [ebp - 4], 0xc
push esi
push dword [ebp - 0x3e]
push esi
push dword [ebp - 0x40]
push ebx
push dword [ebp - 0x42]
push edi
push dword [ebp - 0x46]
push edi
push dword [ebp - 0x48]
push ebx
push 0x64c
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x78]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0xd
jb 0x4384a0
mov eax, dword [eax + 4]
jmp 0x4384a3
add eax, 4
push eax
lea eax, [ebp - 0xfc]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x78]
push 0
push 1
call fcn.00402c50
lea eax, [ebp - 0xfc]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.004028d0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x572840
call fcn.0054dfcb
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401250
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040b997
push 1
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00428dd5
lea ecx, [ebp - 0x214]
call fcn.0042b8aa
cmp dword [ebp - 0x58], 0
je 0x438988
push 1
push 2
lea ecx, [ebp - 0xfc]
call fcn.00404a20
mov eax, dword [0x5b096c]
add eax, 0x6c
push str.DistributeOnline
push eax
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0xe
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push str._Y__m__d__H__M__S
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.004189e9
mov ecx, eax
call fcn.0041916d
mov eax, dword [eax]
push 0x574940
push eax
lea eax, [ebp - 0xfc]
push str._sc_
push eax
mov byte [ebp - 4], 0xf
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.00401250
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00407320
cmp dword [eax + 0x18], 0x10
jb 0x438682
mov eax, dword [eax + 4]
jmp 0x438685
add eax, 4
push 0
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402c50
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0x17c]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push 0x5749c4
push 0x572a4c
push eax
push 0x572a48
push 0x40000000
push 0x572a40
push dword [ebp - 0x3c]
mov byte [ebp - 4], 0x10
push esi
push dword [ebp - 0x3e]
push esi
push dword [ebp - 0x40]
push ebx
push dword [ebp - 0x42]
push edi
push dword [ebp - 0x46]
push edi
push dword [ebp - 0x48]
push ebx
push 0x659
push esi
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x2c]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x11
jb 0x438727
mov eax, dword [eax + 4]
jmp 0x43872a
add eax, 4
push eax
lea eax, [ebp - 0x17c]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 0x10
push 0
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00402c50
lea eax, [ebp - 0x17c]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xe
call fcn.004028d0
mov edi, 0x572840
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], edi
call fcn.0054dfcb
mov esi, dword [ebp - 0x5c]
add esi, 0xc4
push ebx
mov ecx, esi
call fcn.004293f8
cmp eax, 9
jne 0x43895d
push eax
mov ecx, esi
call fcn.00429424
push eax
push 0x1000
call fcn.00417576
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405500
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x12
jae 0x438872
lea eax, [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.004071e0
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.SecurityCheckPrompt
mov byte [ebp - 4], 0x13
call fcn.004071e0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x5743b8
mov byte [ebp - 4], 0x14
call fcn.004071e0
mov byte [ebp - 4], 0x12
mov eax, dword [0x5b096c]
mov ecx, dword [eax + 0x48]
call fcn.0044fcc0
push ebx
push 2
lea ecx, [ebp - 0x17c]
call fcn.00404a20
mov eax, dword [0x5b096c]
add eax, 0x6c
push str.EdpSecurityCheck.exe
push eax
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0x15
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x17c]
call fcn.00407320
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x16
jb 0x43890b
mov eax, dword [eax + 4]
jmp 0x43890e
add eax, 4
push ebx
xor esi, esi
push esi
push 5
push eax
call fcn.00506e62
push esi
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x15
call fcn.00402c50
push 0x10000004
call fcn.00452300
pop ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x12
call fcn.004028d0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], edi
call fcn.0054dfcb
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00402c50
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.004028d0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], edi
call fcn.0054dfcb
jmp 0x43898d
mov edi, 0x572840
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.0042b864
mov dword [ebp - 0x1b0], edi
lea ecx, [ebp - 0x1b0]
call fcn.0054dfcb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret 4