Function at 0x410cd0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1a88
call fcn.00416c10
mov dword [esp + 0x1a74], 0
mov dword [esp + 0x1a70], 0
mov dword [esp + 0x1a6c], 0
mov dword [esp + 0x1a68], 0
mov dword [esp + 0x1a64], 0
mov dword [esp + 0x1a60], 0
mov dword [esp + 0x1a5c], 0
mov dword [esp + 0x1a58], 0
mov dword [esp + 0x1a54], 0
mov dword [esp + 0x1a50], 0
mov dword [esp + 0x1a4c], 0
mov dword [esp + 0x1a48], 0
mov dword [esp + 0x1a44], 0
mov dword [esp + 0x1a40], 0
mov dword [esp + 0x1a3c], 0
mov dword [esp + 0x1a38], 0
mov dword [esp + 0x19fc], 0
lea eax, [esp + 0x17f2]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x15e8]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x13de]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x11d4]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea ebx, [esp + 0xfca]
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0xdc0]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea esi, [esp + 0xbb6]
mov dword [esp], esi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x9ac]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x7a2]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x598]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0x38e]
mov dword [esp], eax
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00417480
lea eax, [esp + 0xbc]
mov dword [esp], eax
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0
call fcn.00417480
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov word [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0xffffffff
call fcn.00410400
mov dword [esp + 0x1a7c], eax
mov dword [esp + 0x48], 0x79d508e4
jmp 0x411020
mov dword [esp + 0x48], 0x73e6d9e8
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
cmp eax, 0x7becccac
jg 0x411150
cmp eax, 0x79d508e3
jg 0x411160
cmp eax, 0x73e6d9e7
jg 0x411188
cmp eax, 0x8878ed8c
jg 0x4111bc
cmp eax, 0x8765e931
jne 0x411020
lea edi, [esp + 0xdc0]
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], esi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.004056d0
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13de]
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0x104
call fcn.00404da0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x58]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xbb6]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404da0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x4c]
mov edx, 0x8083a6f0
sub edx, eax
sub edx, ecx
add edx, 0x7f7c5a14
lea eax, [esp + eax*2 + 0xbb6]
lea eax, [eax + ecx*2]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00404da0
mov dword [esp + 0x48], 0x8b863407
jmp 0x411020
cmp eax, 0x7becccad
jne 0x411020
jmp 0x41100f
cmp eax, 0x79d508e4
jne 0x411020
mov eax, 0xa8258986
cmp dword [esp + 0x1a7c], 0
js 0x41117f
mov eax, 0xb6f4a0dc
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0x73e6d9e8
jne 0x411020
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
call fcn.00410cb0
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1a78], eax
mov dword [esp + 0x48], 0x1ce9e083
jmp 0x411020
cmp eax, 0x8b863406
jg 0x4111db
cmp eax, 0x8878ed8d
jne 0x411020
mov dword [esp + 0x48], 0x7becccad
jmp 0x411020
cmp eax, 0x91605a0c
jg 0x411223
cmp eax, 0x8b863407
jne 0x411020
mov dword [esp + 4], esi
lea eax, [esp + 0x38e]
mov dword [esp], eax
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esp, 0xc
test eax, eax
mov eax, 0x8765e931
je 0x41121a
mov eax, 0xf726a6e3
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0x92e5d967
jg 0x411242
cmp eax, 0x91605a0d
jne 0x411020
mov dword [esp + 0x48], 0x7becccad
jmp 0x411020
cmp eax, 0x9a5f8ad3
jg 0x4112ac
cmp eax, 0x92e5d968
jne 0x411020
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
mov dword [esp + 0x50], 1
mov dword [esp + 0x48], 0x418a7297
jmp 0x411020
cmp eax, 0xa380cce3
jg 0x4112e6
cmp eax, 0x9a5f8ad4
jne 0x411020
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
lea eax, [esp + 0x38e]
mov dword [esp], eax
call fcn.0040f040
mov dword [esp + 0x48], 0x3f3459ad
jmp 0x411020
cmp eax, 0xa4daf787
jg 0x41136c
cmp eax, 0xa380cce4
jne 0x411020
lea eax, [esp + 0x38e]
mov dword [esp + 8], eax
lea eax, [esp + 0x598]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
sub esp, 0x10
lea eax, [esp + 0x13de]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00404950
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x58], eax
mov dword [esp], 0
call fcn.004126b0
mov dword [esp], eax
call fcn.00417612
mov dword [esp + 0x48], 0x8765e931
jmp 0x411020
cmp eax, 0xa7e3f180
jg 0x411414
cmp eax, 0xa4daf788
jne 0x411020
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
lea eax, [esp + 0x9ac]
mov dword [esp + 0x1a48], eax
mov dword [esp + 0x1a4c], 0
mov dword [esp + 0x1a54], 1
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
cmp eax, 1
mov eax, 0x1d6727d9
jne 0x41140b
mov eax, 0xcde8d947
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0x70856275
jg 0x41156b
cmp eax, 0x6ffca7cb
jg 0x411583
cmp eax, 0x67059064
jg 0x4115ab
cmp eax, 0x66a9505e
jg 0x4115bb
cmp eax, 0x64aafd85
jg 0x4115d3
cmp eax, 0x5be151ca
jg 0x4115eb
cmp eax, 0x4b815983
jg 0x411610
cmp eax, 0x498e2210
jg 0x4116dd
cmp eax, 0x423a06c6
jg 0x4116f5
cmp eax, 0x418a7296
jg 0x411718
cmp eax, 0x3f3459ac
jg 0x41177b
cmp eax, 0x2cc5723e
jg 0x4117ae
cmp eax, 0x2830b488
jg 0x4117c6
cmp eax, 0x20faecb0
jg 0x4117e9
cmp eax, 0x1d6727d8
jg 0x4117f9
cmp eax, 0x1ce9e082
jg 0x41182c
cmp eax, 0x174bc1bd
jg 0x411844
cmp eax, 0x102170ae
jg 0x41186d
cmp eax, 0xe843f71
jg 0x41247f
cmp eax, 0x6bf3ea
jg 0x4124ad
cmp eax, 0xfd9f8158
jg 0x4124d1
cmp eax, 0xf726a6e2
jg 0x412516
cmp eax, 0xed6af0b5
jg 0x41252e
cmp eax, 0xe1d3d005
jg 0x412557
cmp eax, 0xdd925015
jg 0x41256f
cmp eax, 0xcde8d946
jg 0x412587
cmp eax, 0xb920ce89
jg 0x412660
cmp eax, 0xa7e3f181
je 0x412694
cmp eax, 0xa8258986
je 0x411700
cmp eax, 0xb6f4a0dc
jne 0x411020
mov dword [esp + 0x48], 0xe843f72
jmp 0x411020
cmp eax, 0x70856276
jne 0x411020
mov dword [esp + 0x48], 0x7becccad
jmp 0x411020
cmp eax, 0x6ffca7cc
jne 0x411020
cmp dword [esp + 0x1a74], 0
sete byte [esp + 0x1a83]
mov dword [esp + 0x48], 0x174bc1be
jmp 0x411020
cmp eax, 0x67059065
jne 0x411020
jmp 0x411700
cmp eax, 0x66a9505f
jne 0x411020
mov dword [esp + 0x48], 0x2cc5723f
jmp 0x411020
cmp eax, 0x64aafd86
jne 0x411020
mov dword [esp + 0x48], 0x3f3459ad
jmp 0x411020
cmp eax, 0x5be151cb
jne 0x411020
mov eax, 0x67059065
cmp dword [esp + 0x54], 6
jb 0x411607
mov eax, 0xfd9f8159
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0x4b815984
jne 0x411020
lea eax, [esp + 0x11d4]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], ebx
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.004056d0
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x13de]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x104
call fcn.00404da0
mov dword [esp], edi
call fcn.004050d0
mov ecx, dword [esp + 0x58]
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0xfca]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404da0
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [0x4c9e60]
sub esp, 8
mov dword [esp + 0x1a74], eax
mov dword [esp + 0x48], 0xe1d3d006
jmp 0x411020
cmp eax, 0x498e2211
jne 0x411020
mov dword [esp + 0x48], 0x4b815984
jmp 0x411020
cmp eax, 0x423a06c7
jne 0x411020
mov dword [esp + 0x1a78], 0xffffffff
mov dword [esp + 0x48], 0x20faecb1
jmp 0x411020
cmp eax, 0x418a7297
jne 0x411020
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x4c9e64]
sub esp, 0x10
mov dword [esp + 0x50], 1
mov dword [esp + 0x48], 0x91605a0d
jmp 0x411020
cmp eax, 0x3f3459ad
jne 0x411020
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
lea eax, [esp + 0x38e]
mov dword [esp], eax
call fcn.0040f040
mov dword [esp + 0x48], 0x8878ed8d
jmp 0x411020
cmp eax, 0x2cc5723f
jne 0x411020
mov dword [esp + 0x48], 0x498e2211
jmp 0x411020
cmp eax, 0x2830b489
jne 0x411020
mov dword [esp + 0x1a78], 0
mov dword [esp + 0x48], 0x20faecb1
jmp 0x411020
cmp eax, 0x20faecb1
jne 0x411020
jmp 0x4126a1
cmp eax, 0x1d6727d9
jne 0x411020
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
lea eax, [esp + 0x38e]
mov dword [esp], eax
call fcn.0040f040
mov dword [esp + 0x48], 0x7becccad
jmp 0x411020
cmp eax, 0x1ce9e083
jne 0x411020
mov dword [esp + 0x48], 0x20faecb1
jmp 0x411020
cmp eax, 0x174bc1be
jne 0x411020
mov al, byte [esp + 0x1a83]
test al, al
mov eax, 0x4b815984
jne 0x411864
mov eax, 0x102170af
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0x102170af
jne 0x411020
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a34]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cbc]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a30]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cc0]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a2c]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9cd0]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a28]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9ca0]
mov ecx, dword [0x4c9ce0]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a24]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cac]
mov ecx, dword [0x4c9ce4]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a20]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cf0]
mov ecx, dword [0x4c9ce8]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a1c]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cec]
mov ecx, dword [0x4c9ce8]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a18]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [0x4c9cec]
mov ecx, dword [0x4c9cd4]
mov edx, dword [esp + 0x1a74]
lea edi, [esp + 0x1a14]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
call dword [0x4c9e54]
sub esp, 0x18
mov eax, dword [esp + 0x1a74]
mov dword [esp], eax
call dword [0x4c9e50]
sub esp, 4
call fcn.004175ef
mov ecx, eax
xor ecx, 0xfffffff0
and ecx, eax
lea edi, [esp + 0xbc]
mov dword [esp + 4], edi
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x64], eax
lea ecx, [eax + 1]
mov dword [esp + 0x64], ecx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea eax, [esp + eax*2 + 0xbc]
mov dword [esp + 0x44], eax
call fcn.004175ef
mov ecx, eax
xor ecx, 0xfffffffe
and ecx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x64], eax
lea ecx, [eax + 1]
mov dword [esp + 0x64], ecx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea eax, [esp + eax*2 + 0xbc]
mov dword [esp + 0x44], eax
call fcn.004175ef
mov ecx, eax
xor ecx, 0xfffffffa
and ecx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x64], eax
mov ecx, eax
neg ecx
mov edx, 1
sub edx, ecx
mov dword [esp + 0x64], edx
mov word [esp + eax*2 + 0xbc], 0x2e
mov eax, dword [esp + 0x64]
lea eax, [esp + eax*2 + 0xbc]
mov dword [esp + 0x44], eax
call fcn.004175ef
mov ecx, eax
xor ecx, 0xfffffff3
and ecx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.00417fa4
mov dword [esp], edi
call fcn.004050d0
mov dword [esp + 0x64], eax
mov eax, dword [0x4c7e8c]
movzx eax, byte [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7e8c]
movzx eax, byte [eax + ecx + 1]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7e8c]
mov edx, dword [esp + 0x60]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea edi, [esp + 0x84]
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.00402d50
mov eax, dword [0x4c9cc8]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a10], eax
mov eax, dword [0x4c9cf8]
mov ecx, dword [0x4c9ca8]
mov edx, dword [esp + 0x1a74]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0xc], 0
call dword [0x4c9e44]
sub esp, 0x10
mov eax, dword [0x4c9cc4]
mov ecx, dword [esp + 0x1a74]
lea edx, [esp + 0xbc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a74]
lea edx, [esp + 0x11d4]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9ca4]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 1
call dword [0x4c9e3c]
sub esp, 0xc
mov eax, dword [0x4c9cf4]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4c9e38]
sub esp, 0x10
mov eax, dword [0x4c9ccc]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a0c], eax
mov eax, dword [esp + 0x1a28]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a28]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a20]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a20]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a0c]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a30]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a30]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a2c]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a2c]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a34]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a14]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
call fcn.004175ef
mov ecx, eax
mov edx, 0xcccccccd
mul edx
shr edx, 2
lea eax, [edx + edx*4]
sub ecx, eax
mov eax, dword [ecx*4 + 0x4c7e90]
mov dword [esp + 0x19fc], eax
movzx eax, word [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x19fc]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x19fc]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
add ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x17f2]
mov edi, eax
mov dword [esp], edi
call fcn.00403290
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
lea edi, [esp + 0x9ac]
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00404da0
mov eax, dword [esp + 0x60]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0x9ac]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], str..exe
call fcn.00404da0
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x17f2]
mov dword [esp + 8], eax
lea edi, [esp + 0x7a2]
mov dword [esp], edi
mov dword [esp + 4], 0x104
call fcn.00404da0
mov eax, dword [esp + 0x60]
mov ecx, 0x104
sub ecx, eax
lea eax, [esp + eax*2 + 0x7a2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 6
mov dword [esp + 8], str.32.exe
call fcn.00404da0
mov eax, dword [0x4c7ea4]
movzx eax, byte [eax]
mov dword [esp + 0x60], eax
not eax
mov ecx, dword [0x4c7ea4]
neg eax
movzx eax, byte [ecx + eax]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7ea4]
mov edx, dword [esp + 0x60]
lea edx, [ecx + edx + 2]
inc ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea edi, [esp + 0x74]
mov dword [esp], edi
mov dword [esp + 4], 0x10
call fcn.00402d50
mov eax, dword [0x4c9cd4]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a08], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a74]
lea edx, [esp + 0x9ac]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb4]
mov ecx, dword [esp + 0x1a74]
lea edx, [esp + 0x7a2]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb0]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], str.Microsoft
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cec]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x10
call dword [0x4c9e38]
sub esp, 0x10
mov eax, dword [0x4c9cd8]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a04], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x421520
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [esp + 0x1a04]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [0x4c7ea8]
movzx eax, word [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [0x4c7ea8]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x4c7ea8]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
add ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x94]
mov edi, eax
mov dword [esp], edi
call fcn.00403290
mov eax, dword [0x4c9cdc]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e4c]
sub esp, 8
mov dword [esp + 0x1a00], eax
mov eax, dword [0x4c9cac]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [0x4c9cb8]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e40]
sub esp, 0xc
mov eax, dword [esp + 0x1a00]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a08]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a14]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a34]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a1c]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a18]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a18]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a1c]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a24]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e34]
sub esp, 8
mov eax, dword [esp + 0x1a24]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e30]
sub esp, 8
mov eax, dword [esp + 0x1a10]
mov ecx, dword [esp + 0x1a74]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [0x4c9e48]
sub esp, 8
mov eax, dword [esp + 0x1a74]
mov dword [esp], eax
call dword [0x4c9e58]
sub esp, 4
mov dword [esp + 0x1a38], 0x3c
mov dword [esp + 0x1a3c], 0x40
mov dword [esp + 0x1a40], 0
mov dword [esp + 0x1a44], 0x421524
mov dword [esp + 0x1a50], 0
mov dword [esp + 0x1a58], 0
lea edi, [esp + 0x184]
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x42152e
mov dword [esp + 4], 0x104
call fcn.00404da0
mov dword [esp], ebx
call fcn.004050d0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
lea eax, [esp + 0x18a]
mov dword [esp], eax
mov dword [esp + 4], 0x101
call fcn.00404da0
mov eax, dword [str._vAX8]
movzx eax, word [eax]
mov dword [esp + 0x60], eax
mov ecx, dword [str._vAX8]
movzx eax, word [ecx + eax*2 + 2]
mov dword [esp + 0x5c], eax
mov ecx, dword [str._vAX8]
mov edx, dword [esp + 0x60]
lea edi, [ecx + edx*2 + 4]
mov dword [esp + 0x44], edi
add ecx, 2
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea eax, [esp + 0x15e8]
mov edi, eax
mov dword [esp], edi
call fcn.00403290
mov dword [esp + 0x1a48], edi
lea eax, [esp + 0x184]
mov dword [esp + 0x1a4c], eax
mov dword [esp + 0x1a54], 0
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
cmp eax, 1
mov eax, 0x64aafd86
jne 0x412476
mov eax, 0xa4daf788
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0xe843f72
jne 0x411020
lea eax, [esp + 0x54]
mov dword [esp], eax
call fcn.0040f2d0
test eax, eax
setne byte [esp + 0x1a82]
mov dword [esp + 0x48], 0xed6af0b6
jmp 0x411020
cmp eax, 0x6bf3eb
jne 0x411020
lea eax, [esp + 0x54]
mov dword [esp], eax
call fcn.0040f2d0
mov dword [esp + 0x48], 0xe843f72
jmp 0x411020
cmp eax, 0xfd9f8159
jne 0x411020
lea eax, [esp + 0x598]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
mov eax, 0xa380cce4
jne 0x41250d
mov eax, 0x423a06c7
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0xf726a6e3
jne 0x411020
mov dword [esp + 0x48], 0x2cc5723f
jmp 0x411020
cmp eax, 0xed6af0b6
jne 0x411020
mov al, byte [esp + 0x1a82]
test al, al
mov eax, 0x2830b489
jne 0x41254e
mov eax, 0x5be151cb
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0xe1d3d006
jne 0x411020
mov dword [esp + 0x48], 0x6ffca7cc
jmp 0x411020
cmp eax, 0xdd925016
jne 0x411020
mov dword [esp + 0x48], 0x418a7297
jmp 0x411020
cmp eax, 0xcde8d947
jne 0x411020
mov eax, dword [esp + 0x1a70]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x184]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 8], 0x20a
mov dword [esp + 4], 0
call fcn.00404570
mov dword [esp], edi
mov dword [esp + 0xc], 6
mov dword [esp + 8], str._q__u
mov dword [esp + 4], 0x104
call fcn.00404da0
mov dword [esp], ebx
call fcn.004050d0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
lea eax, [esp + 0x190]
mov dword [esp], eax
mov dword [esp + 4], 0xfe
call fcn.00404da0
lea eax, [esp + 0x15e8]
mov dword [esp + 0x1a48], eax
mov dword [esp + 0x1a4c], edi
mov dword [esp + 0x1a54], 0
lea eax, [esp + 0x1a38]
mov dword [esp], eax
call dword [0x4c9e68]
sub esp, 4
cmp eax, 1
mov eax, 0x70856276
jne 0x412657
mov eax, 0xdd925016
mov dword [esp + 0x48], eax
jmp 0x411020
cmp eax, 0xb920ce8a
jne 0x411020
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
call fcn.00410cb0
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1a78], eax
mov dword [esp + 0x48], 0x73e6d9e8
jmp 0x411020
mov dword [esp + 0x48], 0x6ffca7cc
jmp 0x411020
mov eax, dword [esp + 0x1a78]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret