Function at 0x409840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42467b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x33c
push ebx
xor ebx, ebx
push ebp
push edi
mov dword [esp + 0xc], 0x425c28
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x38], 0x5c
mov ebp, dword [esp + 0x358]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
mov dword [esp + 0x354], ebx
call edi
cmp byte [eax + ebp - 1], 0x5c
push ebp
jne 0x4098bc
push str._s.
push 0x104
lea eax, [esp + 0x250]
push eax
jmp 0x4098ce
push 0x425c74
push 0x104
lea ecx, [esp + 0x250]
push ecx
call fcn.0040bb73
add esp, 0x10
push ebx
lea edx, [esp + 0x248]
push edx
lea ecx, [esp + 0x14]
call fcn.004095d0
test eax, eax
jne 0x40991a
lea ecx, [esp + 0xc]
mov dword [esp + 0x350], 0xffffffff
call fcn.00409210
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
add esp, 0x348
ret
push esi
mov esi, dword [esp + 0x360]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x409941
mov edi, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x409930
mov ax, word [0x425b48]
mov word [edi], ax
push ebx
push esi
call fcn.0040bb2d
add esp, 8
cmp eax, 0xffffffff
jne 0x40997a
push 1
push esi
call fcn.00408fc0
add esp, 8
test al, al
jne 0x40997a
lea ecx, [esp + 0x10]
mov dword [esp + 0x354], 0xffffffff
call fcn.00409210
xor eax, eax
jmp 0x409b54
mov eax, dword [esp + 0x14]
mov edi, edi
cmp dword [esp + 0x1c], ebx
jne 0x40998a
xor edi, edi
jmp 0x4099b9
cmp eax, ebx
jne 0x40999b
push 0x140
call fcn.0041c216
add esp, 4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4099f1
mov eax, dword [esp + 0x10]
push 0x10
lea ecx, [esp + 0x14]
call dword [eax + 0x28]
test eax, eax
je 0x4099f1
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x2c], 0x2e
jne 0x4099f1
mov cl, byte [eax + 0x2d]
cmp cl, bl
je 0x409b33
cmp cl, 0x2e
jne 0x4099f1
cmp byte [eax + 0x2e], bl
je 0x409b33
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + ebp - 1], 0x5c
mov eax, dword [esp + 0x14]
jne 0x409a24
cmp eax, ebx
je 0x409a0c
add eax, 0x2c
jmp 0x409a0e
xor eax, eax
push eax
push ebp
push 0x4258a0
push 0x104
lea ecx, [esp + 0x154]
push ecx
jmp 0x409a43
cmp eax, ebx
je 0x409a2d
add eax, 0x2c
jmp 0x409a2f
xor eax, eax
push eax
push ebp
push str._s_s
push 0x104
lea edx, [esp + 0x154]
push edx
call fcn.0040bb73
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
mov eax, dword [esp + 0x14]
jne 0x409a7b
cmp eax, ebx
je 0x409a66
add eax, 0x2c
jmp 0x409a68
xor eax, eax
push eax
push esi
push 0x4258a0
push 0x104
lea eax, [esp + 0x50]
push eax
jmp 0x409a97
cmp eax, ebx
je 0x409a84
add eax, 0x2c
jmp 0x409a86
xor eax, eax
push eax
push esi
push str._s_s
push 0x104
lea ecx, [esp + 0x50]
push ecx
call fcn.0040bb73
mov edx, dword [esp + 0x24]
add esp, 0x14
push 0x10
lea ecx, [esp + 0x14]
call dword [edx + 0x28]
test eax, eax
je 0x409ad7
mov eax, dword [esp + 0x368]
mov ecx, dword [esp + 0x364]
push eax
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x150]
push eax
call fcn.00409840
add esp, 0x10
jmp 0x409b2f
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.0040bb2d
add esp, 8
cmp eax, 0xffffffff
je 0x409b14
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409b09
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x368]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 0x14]
cmp edi, ebx
jne 0x409980
lea ecx, [esp + 0x10]
mov dword [esp + 0x354], 0xffffffff
call fcn.00409210
mov eax, 1
mov ecx, dword [esp + 0x34c]
pop esi
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x348
ret