Function at 0x40caa8
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes
Get file size
Get program files directory
Read file on windows

Disassembly:
call fcn.00418d6f
cmp dword [0x43b664], 0
jne 0x40cac0
mov eax, dword [0x43b684]
mov dword [0x43b6ac], eax
mov dword [0x43b66c], 0
mov dword [0x43b6d4], 0
mov dword [0x43b670], 0
mov eax, dword [0x43b6a0]
mov dword [0x43b6b8], eax
mov dword [0x43b668], 0
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x447cff
push 0x43bc04
call sub.KERNEL32.dll_FindFirstFileA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0xffffffff
je 0x40d674
mov dword [0x43b6a4], eax
mov edi, 0x447d2b
cmp byte [edi], 0x2e
je 0x40cf52
pushal
push 0x447d2b
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cb3a
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
mov edi, dword [0x44478b]
sub edi, 5
cmp dword [edi], 0x6b6e6c2e
jne 0x40cf52
mov eax, 0x447d2b
mov dword [0x43b6c4], eax
pushal
push dword [0x43b6bc]
push 0x43bd44
push 0x43bc04
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
mov edi, 0x43bd44
add edi, dword [0x43b6bc]
mov byte [edi], 0x5c
inc edi
pushal
push 0x447d2b
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cba7
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
inc dword [0x444787]
pushal
push dword [0x444787]
push edi
push 0x447d2b
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x258
push 0x43be84
push 0xffffffffffffffff
push 0x43bd44
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov ebx, 0x43be84
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov eax, dword [0x43a187]
mov edi, dword [eax]
push 0
push 0x43be84
push dword [0x43a187]
call dword [edi + 0x14]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov eax, dword [0x43a183]
mov edi, dword [eax]
push 2
push 0x447e65
push 0x104
push 0x43bd44
push dword [0x43a183]
call dword [edi + 0xc]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
test dword [0x447e65], 0x10
jne 0x40cf52
pushal
push 0x43bd44
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cc73
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
cmp dword [0x444787], 6
jb 0x40cf52
sub dword [0x44478b], 2
mov edi, dword [0x44478b]
cmp edi, 0x43bd44
je 0x40cf52
cmp byte [edi], 0x2e
je 0x40ccb7
dec edi
jmp 0x40cca3
cmp edi, dword [0x44478b]
je 0x40cf52
cmp edi, 0x43bd44
je 0x40cf52
cmp byte [edi], 0x5c
je 0x40ccd7
dec edi
jmp 0x40ccc3
mov eax, dword [0x43b684]
mov dword [0x43c35c], eax
add dword [0x43c35c], 0x10
mov eax, dword [0x43b664]
mov dword [0x43c360], eax
cmp dword [0x43b664], 0
je 0x40ceb6
pushal
push dword [0x43c35c]
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cd11
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
pushal
push dword [0x44478b]
push dword [0x444787]
push 0
push 0
push 0x43bd44
push dword [0x43c35c]
pop dword [0x43c334]
pop dword [0x43c338]
pop dword [0x43c33c]
pop dword [0x43c340]
pushal
push dword [0x43c334]
mov ebx, dword [0x43c33c]
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cd6e
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
dec dword [0x44478b]
mov eax, dword [0x44478b]
mov dword [0x43c344], eax
pushal
push dword [0x43c338]
mov ebx, dword [0x43c340]
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cda7
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
dec dword [0x44478b]
mov eax, dword [0x44478b]
mov dword [0x43c348], eax
mov edi, dword [0x43c344]
mov byte [edi], 0
mov edi, dword [0x43c348]
mov byte [edi], 0
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43c338]
push dword [0x43c334]
call sub.KERNEL32.dll_lstrcmpiA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0
jl 0x40ce05
je 0x40ce61
jg 0x40ce33
mov edi, dword [0x43c344]
mov eax, dword [0x43c33c]
mov byte [edi], al
mov edi, dword [0x43c348]
mov eax, dword [0x43c340]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 2
jmp 0x40ce8f
mov edi, dword [0x43c344]
mov eax, dword [0x43c33c]
mov byte [edi], al
mov edi, dword [0x43c348]
mov eax, dword [0x43c340]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 3
jmp 0x40ce8f
mov edi, dword [0x43c344]
mov eax, dword [0x43c33c]
mov byte [edi], al
mov edi, dword [0x43c348]
mov eax, dword [0x43c340]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 1
jmp 0x40ce8f
cmp eax, 1
je 0x40cfbe
mov eax, dword [0x444787]
add dword [0x43c35c], eax
add dword [0x43c35c], 0x14
dec dword [0x43c360]
jne 0x40ccff
inc dword [0x43b664]
mov edi, dword [0x43b6ac]
mov dword [edi], 0
add edi, 4
pushal
push 0x43bd44
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cedc
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
mov ecx, dword [0x444787]
add ecx, 0x14
add ecx, dword [0x43b6ac]
mov dword [edi], ecx
add edi, 4
mov esi, 0x447d13
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
add edi, 8
pushal
push dword [0x444787]
push edi
push 0x43bd44
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
add edi, dword [0x444787]
mov dword [edi], 0
add edi, 4
mov dword [0x43b6ac], edi
mov eax, 0x2710
cmp dword [0x43b664], eax
jae 0x40cffd
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x447cff
push dword [0x43b6a4]
call sub.KERNEL32.dll_FindNextFileA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0
je 0x40d019
mov edi, 0x447d2b
cmp byte [edi], 0x2e
je 0x40cf52
pushal
push 0x447d2b
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40cf92
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
mov edi, dword [0x44478b]
sub edi, 5
cmp dword [edi], 0x6b6e6c2e
jne 0x40cf52
jmp 0x40cb65
mov esi, 0x447d13
mov edi, dword [0x43c35c]
sub edi, 0x10
mov ebx, edi
add ebx, 8
push ebx
push ecx
push edx
push esi
push edi
push ebp
push esi
push ebx
call sub.KERNEL32.dll_CompareFileTime
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0xffffffff
jne 0x40cf52
mov eax, dword [esi]
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov dword [edi + 0xc], eax
jmp 0x40cf52
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43b6a4]
call sub.KERNEL32.dll_FindClose
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
jmp 0x40d475
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43b6a4]
call sub.KERNEL32.dll_FindClose
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 1
push 0x1a
push 0x446da8
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 1
jne 0x40d09f
push 0x445526
push 0x446da8
call fcn.004382bb
push 0x4475c5
push 0x446da8
call fcn.004382bb
pushal
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x446da8
call sub.KERNEL32.dll_CreateFileA
mov dword [0x43c354], eax
popal
cmp dword [0x43c354], 0xffffffff
jne 0x40d13e
pushal
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x4475c5
call sub.KERNEL32.dll_CreateFileA
mov dword [0x43c354], eax
popal
cmp dword [0x43c354], 0xffffffff
jne 0x40d13e
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 1
push 0x26
push 0x446ee8
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 1
jne 0x40d475
push 0x445535
push 0x446ee8
call fcn.004382bb
push 0x4475c5
push 0x446ee8
call fcn.004382bb
pushal
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x446ee8
call sub.KERNEL32.dll_CreateFileA
mov dword [0x43c354], eax
popal
cmp dword [0x43c354], 0xffffffff
je 0x40d475
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0
push dword [0x43c354]
call sub.KERNEL32.dll_GetFileSize
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov dword [0x43c350], eax
pushal
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 4
push 0x1000
push dword [0x43c350]
push 0
call sub.KERNEL32.dll_VirtualAlloc
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov dword [0x43f591], eax
popal
pushal
push 0
push 0x445197
push dword [0x43c350]
push dword [0x43f591]
push dword [0x43c354]
call sub.KERNEL32.dll_ReadFile
popal
push dword [0x43c354]
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [0x43f591]
add esi, 6
mov eax, esi
mov dword [0x43c34c], eax
mov esi, dword [0x43f591]
mov eax, dword [esi]
mov dword [0x43b668], eax
mov esi, dword [0x43c34c]
mov edi, dword [0x43b6ac]
mov eax, dword [0x43b684]
mov dword [0x43c35c], eax
add dword [0x43c35c], 0x10
mov eax, dword [0x43b664]
mov dword [0x43c360], eax
cmp dword [0x43b664], 0
je 0x40d3b7
pushal
push dword [0x43c35c]
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d211
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
pushal
push dword [0x44478b]
push dword [0x444787]
push 0
push 0
push dword [0x43c34c]
push dword [0x43c35c]
pop dword [0x43c364]
pop dword [0x43c368]
pop dword [0x43c36c]
pop dword [0x43c370]
pushal
push dword [0x43c364]
mov ebx, dword [0x43c36c]
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d26f
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
dec dword [0x44478b]
mov eax, dword [0x44478b]
mov dword [0x43c374], eax
pushal
push dword [0x43c368]
mov ebx, dword [0x43c370]
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d2a8
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
dec dword [0x44478b]
mov eax, dword [0x44478b]
mov dword [0x43c378], eax
mov edi, dword [0x43c374]
mov byte [edi], 0
mov edi, dword [0x43c378]
mov byte [edi], 0
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43c368]
push dword [0x43c364]
call sub.KERNEL32.dll_lstrcmpiA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0
jl 0x40d306
je 0x40d362
jg 0x40d334
mov edi, dword [0x43c374]
mov eax, dword [0x43c36c]
mov byte [edi], al
mov edi, dword [0x43c378]
mov eax, dword [0x43c370]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 2
jmp 0x40d390
mov edi, dword [0x43c374]
mov eax, dword [0x43c36c]
mov byte [edi], al
mov edi, dword [0x43c378]
mov eax, dword [0x43c370]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 3
jmp 0x40d390
mov edi, dword [0x43c374]
mov eax, dword [0x43c36c]
mov byte [edi], al
mov edi, dword [0x43c378]
mov eax, dword [0x43c370]
mov byte [edi], al
pop dword [0x444787]
pop dword [0x44478b]
popal
mov eax, 1
jmp 0x40d390
cmp eax, 1
je 0x40d457
mov eax, dword [0x444787]
add dword [0x43c35c], eax
add dword [0x43c35c], 0x14
dec dword [0x43c360]
jne 0x40d1ff
mov dword [edi], 0
add edi, 4
pushal
push esi
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d3cd
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
mov ecx, dword [0x444787]
add ecx, 0x14
add ecx, dword [0x43b6ac]
mov dword [edi], ecx
add esi, dword [0x444787]
add esi, 4
add edi, 4
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
sub esi, 4
sub esi, dword [0x444787]
add edi, 8
pushal
push dword [0x444787]
push edi
push esi
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
add edi, dword [0x444787]
mov dword [edi], 0
inc dword [0x43b664]
mov eax, 0x2710
cmp dword [0x43b664], eax
jae 0x40d475
mov eax, dword [0x444787]
add dword [0x43b6ac], eax
add dword [0x43b6ac], 0x14
mov eax, dword [0x444787]
add dword [0x43c34c], eax
add dword [0x43c34c], 0x3a
dec dword [0x43b668]
jne 0x40d1cb
cmp dword [0x43b664], 0
je 0x40d674
mov eax, dword [0x43b67c]
mov dword [0x43b6a8], eax
mov dword [0x43b668], 0
mov esi, dword [0x43b684]
mov edx, esi
inc dword [0x43b668]
mov eax, dword [0x43b664]
cmp dword [0x43b668], eax
je 0x40d50e
cmp dword [esi], 0
je 0x40d4bd
mov eax, dword [esi + 4]
mov esi, eax
jmp 0x40d49c
inc dword [0x43b668]
mov eax, dword [0x43b664]
cmp dword [0x43b668], eax
je 0x40d4de
ja 0x40d50e
mov eax, dword [esi + 4]
mov esi, eax
cmp dword [esi], 0
je 0x40d4e8
jmp 0x40d4bd
mov eax, dword [esi + 4]
mov esi, eax
cmp dword [esi], 1
je 0x40d50e
mov eax, esi
add eax, 8
mov ecx, edx
add ecx, 8
push ebx
push ecx
push edx
push esi
push edi
push ebp
push ecx
push eax
call sub.KERNEL32.dll_CompareFileTime
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0xffffffff
je 0x40d4bd
mov edx, esi
jmp 0x40d4bd
mov dword [edx], 1
mov dword [0x43b6c0], edx
add edx, 0x10
mov dword [0x43b6c4], edx
pushal
push dword [0x43b6c4]
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d535
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
pushal
push dword [0x44478b]
mov ebx, 0x5c
pop edi
cmp byte [edi], bl
je 0x40d55f
dec edi
jmp 0x40d558
mov dword [0x44478f], edi
popal
inc dword [0x44478f]
pushal
push dword [0x44478f]
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d57e
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
pushal
push dword [0x444787]
push dword [0x43b6a8]
push dword [0x44478f]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
mov eax, dword [0x444787]
mov dword [0x43b6c8], eax
mov edi, dword [0x43b6b8]
mov eax, dword [0x43b6a8]
mov dword [edi], eax
mov eax, dword [0x444787]
mov dword [edi + 4], eax
mov dword [edi + 0x28], 0
mov edx, dword [0x43b6c0]
mov ebx, 0x18
mov eax, dword [edx + 8]
mov dword [edi + ebx], eax
mov eax, dword [edx + 0xc]
mov dword [edi + ebx + 4], eax
pushal
push dword [0x43b6c4]
mov ebx, 0
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d5fe
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
inc dword [0x444787]
add edi, 0x2c
pushal
push dword [0x444787]
push edi
push dword [0x43b6c4]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
add dword [0x43b6b8], 0x158
mov edi, dword [0x43b6a8]
add edi, dword [0x43b6c8]
mov word [edi], 0xa0d
add edi, 2
mov dword [0x43b6a8], edi
inc dword [0x43b66c]
inc dword [0x43b670]
mov eax, dword [0x43b664]
cmp dword [0x43b670], eax
je 0x40d674
jmp 0x40d48c
mov esi, dword [0x43b684]
mov ecx, 0
mov eax, 0
mov dword [esi], eax
mov ebx, dword [esi + 4]
mov esi, ebx
inc ecx
cmp ecx, dword [0x43b664]
jb 0x40d684
mov eax, dword [0x43b664]
mov dword [0x43c388], eax
cmp dword [0x43c6b4], 1
jne 0x40d71c
push 0xa
push 0x43c694
push 0x43c690
push dword [0x43c688]
push dword [0x43c684]
push 0x43ca5c
call fcn.00433f12
cmp dword [0x43c690], 0
je 0x40d71c
push 0x43c694
push dword [0x43c690]
push dword [0x43c688]
push dword [0x43c684]
push dword [0x43b664]
push dword [0x43b6a0]
push dword [0x43b67c]
call dword [0x43a048]
cmp eax, 0x2710
jbe 0x40d717
mov eax, 0x2710
mov dword [0x43c388], eax
jmp 0x40d855
mov dword [0x43c388], eax
cmp dword [0x43c6b8], 1
jne 0x40d79a
push 0xa
push 0x43c694
push 0x43c690
push dword [0x43c688]
push dword [0x43c684]
push 0x43c804
call fcn.00433f12
cmp dword [0x43c690], 0
je 0x40d79a
push 0x43c694
push dword [0x43c690]
push dword [0x43c688]
push dword [0x43c684]
push dword [0x43c388]
push dword [0x43b6a0]
push dword [0x43b67c]
call dword [0x43a048]
cmp eax, 0x2710
jbe 0x40d795
mov eax, 0x2710
mov dword [0x43c388], eax
jmp 0x40d855
mov dword [0x43c388], eax
mov ecx, 0
mov esi, 0x43c624
cmp dword [esi + ecx*4], 1
jne 0x40d84b
mov edi, 0x43a1d2
mov ebx, 0x12c
push ebx
push ecx
push ebx
pop eax
pop ebx
imul eax, ebx
pop ebx
mov ebx, eax
add edi, ebx
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0xa
push 0x43c694
push 0x43c690
push dword [0x43c688]
push dword [0x43c684]
push edi
call fcn.00433f12
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp dword [0x43c690], 0
je 0x40d84b
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x43c694
push dword [0x43c690]
push dword [0x43c688]
push dword [0x43c684]
push dword [0x43c388]
push dword [0x43b6a0]
push dword [0x43b67c]
call dword [0x43a048]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0x2710
jbe 0x40d846
mov eax, 0x2710
mov dword [0x43c388], eax
jmp 0x40d855
mov dword [0x43c388], eax
inc ecx
cmp ecx, 5
jb 0x40d79f
push ebx
push ecx
push edx
push esi
push edi
push ebp
push dword [0x43c388]
push dword [0x43b6a0]
push dword [0x43b67c]
call dword [0x43a04c]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov eax, dword [0x43b177]
mov dword [0x43c37c], eax
mov eax, dword [0x43b17b]
mov dword [0x43c380], eax
mov eax, dword [0x43b67c]
mov dword [0x43c384], eax
mov eax, dword [0x43b6a0]
mov dword [0x43c496], eax
mov dword [0x43c38c], 0
mov eax, dword [0x43c388]
mov dword [0x43b668], eax
cmp dword [0x43b664], 0
je 0x40d9d0
pushal
push dword [0x43c384]
mov ebx, 0xd
pop edi
mov ecx, 0
mov al, byte [edi]
inc edi
inc ecx
cmp al, bl
jne 0x40d8d4
dec ecx
mov dword [0x444787], ecx
mov dword [0x44478b], edi
popal
add dword [0x444787], 2
mov edi, dword [0x43c496]
add edi, 0x2c
push ebx
push ecx
push edx
push esi
push edi
push ebp
push edi
call sub.KERNEL32.dll_GetFileAttributesA
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0xffffffff
je 0x40d9af
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0
push edi
call dword [0x43a060]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esi, edi
add esi, eax
sub esi, 1
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x2e
push eax
push esi
call dword [0x43a050]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
cmp eax, 0
je 0x40d9af
cmp dword [eax], 0x706d742e
je 0x40d9af
pushal
push dword [0x444787]
push dword [0x43c37c]
push dword [0x43c384]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
pushal
push 0x158
push dword [0x43c380]
push dword [0x43c496]
pop esi
pop edi
pop ecx
cld
rep movsb byte es:[edi], byte [esi]
popal
mov ebx, dword [0x43c380]
mov eax, dword [0x43c37c]
mov dword [ebx], eax
mov eax, dword [0x444787]
add dword [0x43c37c], eax
add dword [0x43c380], 0x158
inc dword [0x43c38c]
mov eax, dword [0x444787]
add dword [0x43c384], eax
add dword [0x43c496], 0x158
dec dword [0x43b668]
jne 0x40d8c2
cmp dword [0x441467], 0
je 0x40d9f0
mov eax, dword [0x441477]
cmp dword [0x43c38c], eax
jbe 0x40d9f0
mov eax, dword [0x441477]
mov dword [0x43c38c], eax
cmp dword [0x44146b], 0
je 0x40daaf
cmp dword [0x43c38c], 0
je 0x40daaf
cmp dword [0x44147b], 0
je 0x40daaf
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x444815
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
wait
fninit
wait
fnstcw word [0x44481d]
or word [0x44481d], 0xc00
fldcw word [0x44481d]
mov eax, dword [0x44147b]
mov dword [0x43c3a0], eax
dec dword [0x43c3a0]
mov esi, dword [0x43b17b]
mov dword [0x43c390], 0
fild qword [0x444815]
fild qword [esi + 0x18]
fsubp st(1)
fild qword [0x43c394]
fdivp st(1)
fistp dword [0x43c39c]
mov eax, dword [0x44147b]
cmp dword [0x43c39c], eax
ja 0x40daa5
add esi, 0x158
inc dword [0x43c390]
mov eax, dword [0x43c38c]
cmp dword [0x43c390], eax
jb 0x40da66
mov eax, dword [0x43c390]
mov dword [0x43c38c], eax
pushal
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x8000
push 0
push dword [0x43f591]
call sub.KERNEL32.dll_VirtualFree
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
popal
call fcn.00418d8b
ret