Function at 0x410eb7
Capabilities:
Enumerate files on windows
Get file size
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov dword [ebp - 0x20], 0xb4
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0xc], 0x42
mov dword [ebp - 4], 0xdb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x59
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xa6
ja case.0x410f02.1
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x411c3b]
jmp dword [eax*4 + 0x411c1b]
mov dword [ebp - 0x150], 0x89
mov dword [ebp - 0x154], 0xca
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x41a0c0], eax
mov ecx, dword [0x41a0ec]
push ecx
mov edx, dword [0x41a0d4]
push edx
call dword [sym.imp.USER32.dll_SetClipboardData]
mov dword [0x41a108], eax
mov eax, dword [0x41a0dc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x41a108]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x41a0dc], eax
jmp 0x4110de
mov ecx, dword [ebp + 8]
or ecx, dword [0x41a0e8]
mov dword [ebp - 0x24], ecx
mov edx, dword [0x41a0d0]
push edx
mov eax, dword [0x41a0c0]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x41a0bc], eax
mov eax, dword [0x41a0ec]
or eax, dword [0x41a0c4]
mov dword [0x41a0e8], eax
jmp 0x4110de
mov dword [ebp - 0x158], 0x98
mov ecx, dword [0x41a0dc]
push ecx
mov edx, dword [0x41a100]
push edx
call dword [sym.imp.GDI32.dll_SetArcDirection]
mov dword [0x41a108], eax
mov eax, dword [0x41a100]
or eax, dword [0x41a0f0]
mov dword [ebp - 0x14], eax
jmp 0x4110de
mov dword [ebp - 0x15c], 0x47
mov dword [ebp - 0x160], 0x32
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov dword [0x41a0fc], eax
jmp 0x4110de
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
or edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x41a0f8]
push edx
call fcn.0040ac57
add esp, 8
push str.FvVUCa.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
push str.IqUSSDl
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
jmp 0x4110de
mov dword [ebp - 0x164], 0x8e
mov dword [ebp - 0x118], 0x10
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x118]
mov dword [0x41a0d0], ecx
mov eax, dword [0x41a0c4]
xor edx, edx
div dword [ebp - 0xc]
mov dword [0x41a0fc], eax
jmp 0x4110de
mov edx, dword [0x41a0dc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov dword [0x41a108], eax
jmp 0x4110de
mov ecx, dword [0x41a0d4]
xor ecx, dword [0x41a0c8]
mov dword [ebp - 0xc], ecx
mov edx, dword [0x41a0e8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov dword [0x41a0f4], eax
mov eax, dword [0x41a0d8]
xor edx, edx
div dword [0x41a0d0]
mov dword [0x41a0ec], eax
mov ecx, dword [0x41a0c0]
add ecx, dword [0x41a0dc]
mov edx, dword [0x41a104]
xor edx, dword [ebp - 0xc]
cmp ecx, edx
jbe 0x411100
mov dword [ebp - 0x50], 1
jmp 0x411107
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0
jne 0x41113c
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 4]
cmp eax, ecx
jbe 0x411126
mov dword [ebp - 0x54], 1
jmp 0x41112d
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 0
jne 0x41113c
mov dword [ebp - 0x58], 0
jmp 0x411143
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0
jne 0x411183
mov edx, dword [0x41a100]
or edx, dword [0x41a0e8]
mov eax, dword [0x41a0f4]
add eax, dword [0x41a0f8]
cmp edx, eax
jae 0x41116d
mov dword [ebp - 0x5c], 1
jmp 0x411174
mov dword [ebp - 0x5c], 0
cmp dword [ebp - 0x5c], 0
jne 0x411183
mov dword [ebp - 0x60], 0
jmp 0x41118a
mov dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 0
jne 0x4111bb
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
imul edx, dword [ebp - 4]
cmp ecx, edx
je 0x4111aa
mov dword [ebp - 0x64], 1
jmp 0x4111b1
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0
je 0x4113c9
mov dword [ebp - 0x88], 0x14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x128], 0x37
mov eax, dword [0x41a0ec]
sub eax, dword [0x41a0c8]
mov ecx, dword [ebp - 0x18]
xor ecx, dword [0x41a0d4]
cmp eax, ecx
jae 0x41120b
mov dword [ebp - 0x68], 1
jmp 0x411212
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
je 0x41124f
mov edx, dword [ebp - 4]
and edx, dword [0x41a0f4]
mov eax, dword [0x41a0e0]
sub eax, dword [0x41a0f0]
cmp edx, eax
je 0x411239
mov dword [ebp - 0x6c], 1
jmp 0x411240
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x6c], 0
je 0x41124f
mov dword [ebp - 0x70], 1
jmp 0x411256
mov dword [ebp - 0x70], 0
cmp dword [ebp - 0x70], 0
je 0x411292
mov ecx, dword [0x41a0cc]
imul ecx, dword [0x41a0c0]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
cmp ecx, edx
jae 0x41127c
mov dword [ebp - 0x74], 1
jmp 0x411283
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0
je 0x411292
mov dword [ebp - 0x78], 1
jmp 0x411299
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
je 0x4112d6
mov eax, dword [0x41a108]
or eax, dword [ebp - 0x24]
jne 0x4112c0
mov ecx, dword [0x41a0dc]
sub ecx, dword [0x41a0c8]
jne 0x4112c0
mov dword [ebp - 0x7c], 0
jmp 0x4112c7
mov dword [ebp - 0x7c], 1
cmp dword [ebp - 0x7c], 0
je 0x4112d6
mov dword [ebp - 0x80], 1
jmp 0x4112dd
mov dword [ebp - 0x80], 0
cmp dword [ebp - 0x80], 0
je 0x41132b
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
je 0x411302
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x11c]
je 0x411302
mov dword [ebp - 0x84], 1
jmp 0x41130c
mov dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 0
je 0x41132b
mov eax, dword [ebp - 0x1c]
xor edx, edx
div dword [0x41a0c8]
mov dword [ebp - 0x16c], eax
jmp 0x4113b8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x170], 0
lea ecx, [ebp - 0x1c]
push ecx
push str.iRdlJxU
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x88], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x411388
mov dword [ebp - 0x120], 0x157e
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4113af
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x41138f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x128]
mov dword [ebp - 0x18], ecx
jmp 0x411569
mov dword [ebp - 0xa0], 0x99
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
test eax, eax
jne 0x4113f7
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4113f7
mov dword [ebp - 0x8c], 0
jmp 0x411401
mov dword [ebp - 0x8c], 1
cmp dword [ebp - 0x8c], 0
je 0x411466
mov eax, dword [0x41a108]
mov dword [0x41a0f0], eax
mov ecx, dword [0x41a0f0]
mov dword [0x41a0e0], ecx
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [0x41a0f0]
push eax
call dword [sym.imp.GDI32.dll_SetArcDirection]
cmp eax, dword [0x41a0e0]
jbe 0x411447
mov dword [ebp - 0x90], 1
jmp 0x411451
mov dword [ebp - 0x90], 0
cmp dword [ebp - 0x90], 0
je 0x411466
mov dword [ebp - 0x94], 1
jmp 0x411470
mov dword [ebp - 0x94], 0
mov ecx, dword [0x41a0f4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [0x41a0bc], edx
cmp dword [0x41a0bc], 0
je 0x4114a1
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4114a1
mov dword [ebp - 0x98], 1
jmp 0x4114ab
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x98]
jne 0x4114c5
mov dword [ebp - 0x9c], 1
jmp 0x4114cf
mov dword [ebp - 0x9c], 0
cmp dword [ebp - 0x9c], 0
je 0x411550
mov ecx, dword [ebp - 0xc]
xor ecx, dword [0x41a0f4]
jne 0x41150b
mov edx, dword [str.a6_b_]
push edx
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_PolylineTo]
test eax, eax
jne 0x41150b
mov dword [ebp - 0xa4], 0
jmp 0x411515
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xa4], 0
je 0x411550
mov dword [ebp - 0x12c], 0x75
mov edx, dword [0x41a0c4]
or edx, dword [0x41a0fc]
mov dword [0x41a0bc], edx
mov eax, dword [ebp - 0x20]
mov dword [str.a6_b_], eax
mov ecx, dword [str.a6_b_]
mov dword [ebp - 0x12c], ecx
jmp 0x411569
mov dword [ebp - 0x174], 0xfd
mov edx, dword [ebp - 0xc]
or edx, dword [0x41a0cc]
mov dword [0x41a108], edx
mov eax, dword [ebp - 0x20]
or eax, dword [0x41a0cc]
mov ecx, dword [0x41a0c8]
imul ecx, dword [0x41a108]
cmp eax, ecx
jbe 0x41158f
mov dword [ebp - 0xa8], 1
jmp 0x411599
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0
jne 0x4115e2
mov edx, dword [ebp - 4]
and edx, dword [0x41a0e0]
mov eax, dword [0x41a0d4]
xor eax, dword [ebp - 0x20]
cmp edx, eax
jbe 0x4115c3
mov dword [ebp - 0xac], 1
jmp 0x4115cd
mov dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0
jne 0x4115e2
mov dword [ebp - 0xb0], 0
jmp 0x4115ec
mov dword [ebp - 0xb0], 1
cmp dword [ebp - 0xb0], 0
jne 0x41163c
mov ecx, dword [0x41a0bc]
add ecx, dword [0x41a0d0]
jne 0x41161d
mov edx, dword [0x41a108]
xor edx, dword [0x41a0e8]
jne 0x41161d
mov dword [ebp - 0xb4], 0
jmp 0x411627
mov dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0
jne 0x41163c
mov dword [ebp - 0xb8], 0
jmp 0x411646
mov dword [ebp - 0xb8], 1
cmp dword [ebp - 0xb8], 0
jne 0x411691
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
mov ecx, dword [0x41a0ec]
sub ecx, dword [str.a6_b_]
cmp eax, ecx
je 0x411672
mov dword [ebp - 0xbc], 1
jmp 0x41167c
mov dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0
jne 0x411691
mov dword [ebp - 0xc0], 0
jmp 0x41169b
mov dword [ebp - 0xc0], 1
cmp dword [ebp - 0xc0], 0
jne 0x4116d7
mov edx, dword [ebp - 4]
and edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 4]
cmp edx, eax
jbe 0x4116c0
mov dword [ebp - 0xc4], 1
jmp 0x4116ca
mov dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0
je 0x41190c
mov dword [ebp - 0xe4], 0x1b
mov dword [ebp - 0x134], 0
mov dword [ebp - 0xdc], 0x4c
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov edx, dword [0x41a0dc]
or edx, dword [0x41a0bc]
cmp ecx, edx
jbe 0x411732
mov dword [ebp - 0xc8], 1
jmp 0x41173c
mov dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0
je 0x411789
mov eax, dword [0x41a108]
imul eax, dword [0x41a0f4]
mov ecx, dword [ebp - 0x24]
or ecx, dword [0x41a104]
cmp eax, ecx
je 0x41176a
mov dword [ebp - 0xcc], 1
jmp 0x411774
mov dword [ebp - 0xcc], 0
cmp dword [ebp - 0xcc], 0
je 0x411789
mov dword [ebp - 0xd0], 1
jmp 0x411793
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
je 0x4117dd
mov edx, dword [ebp - 0x2c]
or edx, dword [str.a6_b_]
mov eax, dword [0x41a0f8]
imul eax, dword [ebp - 0x40]
cmp edx, eax
jne 0x4117be
mov dword [ebp - 0xd4], 1
jmp 0x4117c8
mov dword [ebp - 0xd4], 0
cmp dword [ebp - 0xd4], 0
je 0x4117dd
mov dword [ebp - 0xd8], 1
jmp 0x4117e7
mov dword [ebp - 0xd8], 0
cmp dword [ebp - 0xd8], 0
je 0x41186a
mov ecx, dword [ebp - 0xdc]
xor ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xe8]
sub edx, dword [ebp - 0x130]
cmp ecx, edx
je 0x411818
mov dword [ebp - 0xe0], 1
jmp 0x411822
mov dword [ebp - 0xe0], 0
cmp dword [ebp - 0xe0], 0
je 0x41186a
mov eax, dword [0x41a104]
push eax
mov ecx, dword [0x41a104]
push ecx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [str.a6_b_], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x41a0d8]
push eax
call dword [sym.imp.GDI32.dll_SetArcDirection]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x40]
or ecx, dword [ebp - 0x134]
mov dword [0x41a0e8], ecx
jmp 0x4118ec
mov dword [ebp - 0x178], 0x92
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x38], 0xb3
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push str.DSQOztRQlwy.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x24]
push ecx
push str.HwQqydsPttmu
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x2c], 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4118ec
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x4118cc
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0xe8], edx
push str.KHEsBBTyf
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
jmp 0x41192f
mov dword [ebp - 0x180], 0x2e
mov dword [ebp - 0x184], 0x13
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
mov dword [str.a6_b_], eax
mov dword [ebp - 0x44], 0xba
jmp 0x411941
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0xd8
jae 0x411c0f
mov dword [ebp - 0x140], 0x49
mov dword [ebp - 0x34], 0xad
mov dword [ebp - 0x13c], 0xc8
mov dword [ebp - 0x48], 0x33
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov ecx, dword [0x41a0fc]
or ecx, dword [0x41a0ec]
mov edx, dword [0x41a0dc]
add edx, dword [0x41a0f4]
cmp ecx, edx
jbe 0x4119b2
mov dword [ebp - 0xec], 1
jmp 0x4119bc
mov dword [ebp - 0xec], 0
cmp dword [ebp - 0xec], 0
jne 0x411a0e
mov eax, dword [0x41a0d0]
xor eax, dword [0x41a0e8]
je 0x4119ef
mov ecx, dword [ebp - 0x13c]
imul ecx, dword [0x41a0fc]
test ecx, ecx
je 0x4119ef
mov dword [ebp - 0xf0], 1
jmp 0x4119f9
mov dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0
jne 0x411a0e
mov dword [ebp - 0xf4], 0
jmp 0x411a18
mov dword [ebp - 0xf4], 1
cmp dword [ebp - 0xf4], 0
jne 0x411a54
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x4c]
jne 0x411a3d
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
jne 0x411a3d
mov dword [ebp - 0xf8], 0
jmp 0x411a47
mov dword [ebp - 0xf8], 1
cmp dword [ebp - 0xf8], 0
je 0x411c01
mov dword [ebp - 0x18c], 0xe2
mov dword [ebp - 0x190], 0x34
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x140]
add ecx, dword [ebp - 0x1c]
je 0x411a9e
mov edx, dword [ebp + 8]
imul edx, dword [0x41a0fc]
test edx, edx
je 0x411a9e
mov dword [ebp - 0xfc], 1
jmp 0x411aa8
mov dword [ebp - 0xfc], 0
cmp dword [ebp - 0xfc], 0
je 0x411af6
mov eax, dword [0x41a100]
imul eax, dword [ebp - 0x30]
mov ecx, dword [0x41a104]
imul ecx, dword [0x41a0c8]
cmp eax, ecx
jbe 0x411ad7
mov dword [ebp - 0x100], 1
jmp 0x411ae1
mov dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0
je 0x411af6
mov dword [ebp - 0x104], 1
jmp 0x411b00
mov dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0
je 0x411b47
mov edx, dword [ebp - 0x1c]
xor edx, dword [0x41a0cc]
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x30]
cmp edx, eax
je 0x411b28
mov dword [ebp - 0x108], 1
jmp 0x411b32
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x108], 0
je 0x411b47
mov dword [ebp - 0x10c], 1
jmp 0x411b51
mov dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0
je 0x411ba2
mov ecx, dword [ebp - 0x110]
add ecx, dword [ebp - 0x30]
jne 0x411b7c
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x110]
jne 0x411b7c
mov dword [ebp - 0x114], 0
jmp 0x411b86
mov dword [ebp - 0x114], 1
cmp dword [ebp - 0x114], 0
je 0x411ba2
mov eax, dword [0x41a0ec]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x41a0bc], eax
jmp 0x411bfc
mov dword [ebp - 0x194], 0xe8
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x1a0], 0
mov ecx, dword [ebp - 0x144]
xor ecx, dword [ebp - 0x148]
mov dword [ebp - 0x14c], ecx
jmp 0x411c01
jmp 0x41198a
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], edx
jmp 0x411938
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret