Function at 0x40b2d0
Capabilities:
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x44bbf5
mov eax, dword fs:[0]
push eax
sub esp, 0x7d0
mov eax, dword [0x45e520]
xor eax, esp
mov dword [esp + 0x7c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e520]
xor eax, esp
push eax
lea eax, [esp + 0x7e4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x7f4]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, ecx
mov ebp, 0xf
push eax
lea ecx, [esp + 0x150]
mov dword [esp + 0x34], eax
mov dword [esp + 0x168], ebp
mov dword [esp + 0x164], ebx
mov byte [esp + 0x154], bl
call fcn.00402280
push 0xffffffffffffffff
mov dword [esp + 0x7f0], ebx
push ebx
push esi
lea ecx, [esp + 0xe0]
mov dword [esp + 0xf8], ebp
mov dword [esp + 0xf4], ebx
mov byte [esp + 0xe4], bl
call fcn.00402280
push 0x103
lea eax, [esp + 0x6d9]
push ebx
mov byte [esp + 0x7f4], 1
push eax
mov byte [esp + 0x6e0], bl
call fcn.00436440
add esp, 0xc
push 0x104
lea ecx, [esp + 0x6d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [0x462410]
mov eax, dword [edx + 0xc]
mov ecx, 0x462410
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x7f4], 3
call fcn.00409ed0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x7f0], 4
call fcn.00411230
mov byte [esp + 0x7ec], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b428
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xb4], 0x10
mov edx, dword [esp + 0xa0]
jae 0x40b440
lea edx, [esp + 0xa0]
xor eax, eax
mov ecx, 0x4526a4
call fcn.004016d0
cmp eax, ebx
jne 0x40b473
xor eax, eax
cmp dword [esp + 0xb0], ebx
setne al
cmp eax, ebx
jne 0x40b473
push 0x18
push str.iKeeperSimpleConsole.exe
lea ecx, [esp + 0xa4]
call fcn.004024f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xc0]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402280
sub esp, 0x1c
mov byte [esp + 0x824], 5
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x16
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.GetControlPath_strExe_
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 3
call fcn.004041e0
push 0x103
lea eax, [esp + 0x4c9]
push ebx
push eax
mov byte [esp + 0x4d0], bl
call fcn.00436440
mov esi, dword [esp + 0x48]
lea eax, [esp + 0x4d0]
mov ecx, eax
add esp, 0xc
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
mov cl, byte [eax + esi]
cmp cl, bl
je 0x40b513
mov byte [eax], cl
add eax, 1
sub edx, 1
jne 0x40b500
jmp 0x40b517
cmp edx, ebx
jne 0x40b51a
sub eax, 1
mov byte [eax], bl
sub esp, 0x1c
mov esi, esp
lea eax, [esp + 0x4e0]
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov dword [esp + 0x30], esp
mov byte [esi + 4], bl
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40b538
sub eax, edi
push eax
lea edx, [esp + 0x4e4]
push edx
mov ecx, esi
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 6
mov ecx, esp
mov dword [esp + 0x50], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4529b8
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 3
call fcn.004041e0
lea eax, [esp + 0x4c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40b641
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.fail
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 7
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x11
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.PathIsDirectory__
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 3
call fcn.004041e0
mov esi, 0x10
cmp dword [esp + 0xb4], esi
jb 0x40b60b
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ec], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40c4f4
mov dword [esp + 0x140], ebp
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
mov dword [esp + 0x108], ebp
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
mov dword [esp + 0x124], ebp
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x4cc]
push edx
lea ecx, [esp + 0x118]
mov byte [esp + 0x7f8], 0xa
call fcn.0040a2f0
mov dword [esp + 0x24], 1
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x60], vtable.CParseConfig.0
mov byte [esp + 0x7ec], 0xc
mov ecx, dword [esp + 0xd8]
mov esi, 0x10
cmp dword [esp + 0xec], esi
jae 0x40b6ec
lea ecx, [esp + 0xd8]
lea eax, [esp + 0x40]
push eax
call fcn.00401a10
test al, al
je 0x40c3c8
call fcn.0040b130
test eax, eax
jne 0x40b74c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x453144
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0xd
mov ecx, esp
mov dword [esp + 0x50], esp
push str.KillControlBySendMsg___fail
call fcn.004020b0
mov byte [esp + 0x824], 0xc
call fcn.004041e0
mov ecx, str.iKeeperSimpleConsole.exe
call fcn.00402fd0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x7ec], 0xe
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
cmp ebp, esi
jbe 0x40b775
call fcn.00432c1e
mov esi, dword [esp + 0x48]
lea edi, [esp + 0x40]
mov dword [esp + 0x50], edi
lea ecx, [ecx]
cmp dword [esp + 0x44], esi
jbe 0x40b78b
call fcn.00432c1e
cmp edi, ebx
je 0x40b797
lea ecx, [esp + 0x40]
cmp edi, ecx
je 0x40b79c
call fcn.00432c1e
cmp ebp, esi
je 0x40bb36
push 0x103
lea edx, [esp + 0x181]
push ebx
push edx
mov byte [esp + 0x188], bl
call fcn.00436440
add esp, 0xc
push 0x104
lea eax, [esp + 0x284]
push ebx
push eax
call fcn.00436440
add esp, 0xc
cmp edi, ebx
jne 0x40b7e0
call fcn.00432c1e
cmp ebp, dword [edi + 8]
jb 0x40b7ea
call fcn.00432c1e
push ebp
lea edx, [esp + 0x4c8]
lea esi, [esp + 0x180]
call fcn.004034c0
test eax, eax
je 0x40bacd
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40bacd
cmp ebp, dword [edi + 8]
jb 0x40b821
call fcn.00432c1e
push ebp
lea edx, [esp + 0x180]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x384]
push eax
lea ecx, [esp + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40b96c
push ebx
call fcn.00433fb9
mov dword [esp + 0x60], edx
add esp, 4
lea edx, [esp + 0x58]
push edx
mov ecx, str.._Y_m_d_H_M_S
lea edi, [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.00402e40
mov byte [esp + 0x7ec], 0xf
mov eax, dword [eax]
push eax
lea ecx, [esp + 0xbc]
call fcn.004020b0
mov byte [esp + 0x7ec], 0x11
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b8b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, 0x104
lea eax, [esp + 0x280]
mov edi, edi
mov cl, byte [eax - 0x104]
cmp cl, bl
je 0x40b8d6
mov byte [eax], cl
add eax, 1
sub edx, 1
jne 0x40b8c0
jmp 0x40b8da
cmp edx, ebx
jne 0x40b8dd
sub eax, 1
cmp dword [esp + 0xd0], 0x10
mov byte [eax], bl
mov eax, dword [esp + 0xbc]
jae 0x40b8f7
lea eax, [esp + 0xbc]
push eax
lea edi, [esp + 0x284]
call fcn.00402f30
mov ecx, edi
push ecx
lea edx, [esp + 0x180]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x40ba4a
lea eax, [esp + 0x17c]
lea esi, [esp + 0x2c]
call fcn.00410c70
mov eax, dword [esp + 0x50]
cmp ebp, dword [eax + 8]
jb 0x40b93b
call fcn.00432c1e
mov ecx, dword [ebp + 0x104]
push ecx
lea ecx, [esp + 0x180]
call fcn.00403670
test eax, eax
je 0x40b9f0
lea ecx, [esp + 0xb8]
mov byte [esp + 0x7ec], 0xe
call fcn.00402120
jmp 0x40b9cf
sub esp, 0x1c
lea edx, [esp + 0x198]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0x14
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x452a84
call fcn.004020b0
mov byte [esp + 0x824], 0xe
call fcn.004041e0
cmp ebp, dword [edi + 8]
jb 0x40b9b4
call fcn.00432c1e
mov eax, dword [ebp + 0x104]
push eax
lea ecx, [esp + 0x180]
call fcn.00403670
test eax, eax
je 0x40ba7f
mov ecx, dword [esp + 0x50]
cmp ebp, dword [ecx + 8]
jb 0x40b9dd
call fcn.00432c1e
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x50]
add ebp, 0x214
jmp 0x40b780
lea edx, [esp + 0x2c]
push edx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x452a44
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0x12
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x452a54
call fcn.004020b0
mov byte [esp + 0x824], 0x11
call fcn.004041e0
lea ecx, [esp + 0xb8]
mov dword [esp + 0x24], ebx
call fcn.00402120
jmp 0x40bf3b
lea eax, [esp + 0x2c]
push eax
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x452b3c
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0x13
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.return_FALSE
jmp 0x40ba23
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x452a44
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0x15
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x452a54
call fcn.004020b0
mov byte [esp + 0x824], 0xe
call fcn.004041e0
mov dword [esp + 0x24], ebx
jmp 0x40bf3b
lea edx, [esp + 0x2c]
push edx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 5
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.fail_
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 0x16
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x24
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.BuildPath
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 0xe
call fcn.004041e0
mov dword [esp + 0x24], ebx
jmp 0x40bf3b
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp esi, eax
jbe 0x40bb4b
call fcn.00432c1e
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
mov ebp, ecx
mov edi, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edi
jmp 0x40bb60
cmp dword [esp + 0x30], eax
mov esi, eax
jbe 0x40bb6d
call fcn.00432c1e
cmp ebp, ebx
je 0x40bb79
lea eax, [esp + 0x2c]
cmp ebp, eax
je 0x40bb7e
call fcn.00432c1e
cmp edi, esi
je 0x40bf3b
cmp ebp, ebx
jne 0x40bb8f
call fcn.00432c1e
cmp edi, dword [ebp + 8]
jb 0x40bb99
call fcn.00432c1e
mov eax, edi
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40bbb7
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x88]
call fcn.004024f0
mov byte [esp + 0x7ec], 0x17
mov ecx, dword [esp + 0x98]
cmp ecx, 0x10
mov edx, dword [esp + 0x84]
jb 0x40bd60
cmp edx, ebx
mov esi, edx
mov dword [esp + 0x18], esi
je 0x40bc26
cmp ecx, 0x10
mov eax, edx
jae 0x40bc07
lea eax, [esp + 0x84]
cmp eax, esi
ja 0x40bc26
cmp ecx, 0x10
mov eax, edx
jae 0x40bc19
lea eax, [esp + 0x84]
mov ebp, dword [esp + 0x94]
add eax, ebp
cmp esi, eax
jbe 0x40bc40
call fcn.00432c1e
mov ecx, dword [esp + 0x98]
mov ebp, dword [esp + 0x94]
mov edx, dword [esp + 0x84]
cmp ecx, 0x10
mov eax, edx
jae 0x40bc4e
lea eax, [esp + 0x84]
lea edi, [eax + ebp]
cmp edi, ebx
je 0x40bc7b
cmp ecx, 0x10
mov eax, edx
jae 0x40bc63
lea eax, [esp + 0x84]
cmp eax, edi
ja 0x40bc7b
cmp ecx, 0x10
mov eax, edx
jae 0x40bc75
lea eax, [esp + 0x84]
add eax, ebp
cmp edi, eax
jbe 0x40bc95
call fcn.00432c1e
mov ecx, dword [esp + 0x98]
mov ebp, dword [esp + 0x94]
mov edx, dword [esp + 0x84]
cmp ecx, 0x10
jb 0x40bd70
cmp edx, ebx
mov esi, edx
je 0x40bcca
cmp ecx, 0x10
mov eax, edx
jae 0x40bcb2
lea eax, [esp + 0x84]
cmp eax, esi
ja 0x40bcca
cmp ecx, 0x10
mov eax, edx
jae 0x40bcc4
lea eax, [esp + 0x84]
add ebp, eax
cmp esi, ebp
jbe 0x40bccf
call fcn.00432c1e
mov ecx, dword [esp + 0x18]
push ecx
lea eax, [esp + 0x84]
push eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1c], bl
mov edx, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x68]
push edi
push ecx
mov eax, esi
call fcn.00412f70
add esp, 0x18
push 0xb
push str.wndtool.dll
lea edx, [esp + 0x88]
push edx
call fcn.00402360
cmp eax, 0xffffffff
jne 0x40bd7c
mov byte [esp + 0x7ec], 0xe
cmp dword [esp + 0x98], 0x10
jb 0x40bd35
mov eax, dword [esp + 0x84]
push eax
call fcn.00416c01
add esp, 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
cmp edx, dword [ecx + 8]
jb 0x40bd47
call fcn.00432c1e
add dword [esp + 0x20], 0x208
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
jmp 0x40bb60
lea esi, [esp + 0x84]
mov dword [esp + 0x18], esi
jmp 0x40bbf9
lea esi, [esp + 0x84]
jmp 0x40bca4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa4]
mov ebp, 0xf
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402280
sub esp, 0x1c
mov byte [esp + 0x824], 0x18
mov ecx, esp
mov dword [esp + 0x4c], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x453190
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 0x17
call fcn.004041e0
push 0x103
lea ecx, [esp + 0x181]
push ebx
push ecx
mov byte [esp + 0x188], bl
call fcn.00436440
add esp, 0xc
push 0x104
lea edx, [esp + 0x180]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xc4]
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xd8], ebx
mov byte [esp + 0xc8], bl
call fcn.00402280
push 1
lea edi, [esp + 0xbc]
mov byte [esp + 0x7f0], 0x19
call fcn.004110a0
cmp eax, 0xffffffff
je 0x40be88
push eax
xor ecx, ecx
lea esi, [esp + 0x68]
mov edx, edi
call fcn.00402180
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x7f8], 0x1a
call fcn.00402280
mov edi, 0x10
cmp dword [esp + 0x7c], edi
jb 0x40be8d
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00416c01
add esp, 4
jmp 0x40be8d
mov edi, 0x10
cmp dword [esp + 0xd0], edi
mov eax, dword [esp + 0xbc]
jae 0x40bea4
lea eax, [esp + 0xbc]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push eax
push str._s__u_wndtool.dll
push str.Regsvr32.exe
push str.open
push ebx
call esi
push ebx
lea edx, [esp + 0x180]
push edx
push str._s__u_wndtool.dll
push str.Regsvr32.exe
push str.open
push ebx
call esi
push ebx
lea eax, [esp + 0x180]
push eax
push str._s_wndtool.dll
push str.Regsvr32.exe
push str.open
push ebx
call esi
cmp dword [esp + 0xd0], edi
jb 0x40bf0d
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x98], edi
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], bl
jb 0x40bf3b
mov edx, dword [esp + 0x84]
push edx
call fcn.00416c01
add esp, 4
mov ebp, 0xf
mov dword [esp + 0x178], ebp
mov dword [esp + 0x174], ebx
mov byte [esp + 0x164], bl
mov edi, dword [esp + 0x24]
cmp edi, ebx
mov byte [esp + 0x7ec], 0x1b
je 0x40bff6
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x128]
push eax
push ecx
lea edx, [esp + 0x4cc]
push edx
lea edx, [esp + 0x118]
lea ecx, [esp + 0xfc]
call fcn.0040a8b0
test eax, eax
jne 0x40bff6
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 5
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.fail_
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x10
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.SetCtrlCfgInfo__
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 0x1b
call fcn.004041e0
lea eax, [esp + 0x2c]
push eax
call fcn.00403840
xor edi, edi
mov dword [esp + 0x24], edi
push 0x103
lea ecx, [esp + 0x5d1]
push ebx
push ecx
mov byte [esp + 0x5d8], bl
call fcn.00436440
lea eax, [esp + 0x5d8]
lea edx, [esp + 0x4d0]
mov ecx, eax
add esp, 0xc
mov esi, 0x104
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [edx + eax]
cmp cl, bl
je 0x40c043
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x40c030
jmp 0x40c047
cmp esi, ebx
jne 0x40c04a
sub eax, 1
cmp dword [esp + 0xb4], 0x10
mov byte [eax], bl
mov eax, dword [esp + 0xa0]
jae 0x40c064
lea eax, [esp + 0xa0]
push eax
lea edx, [esp + 0x5d0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp edi, ebx
push 1
push ebx
push ebx
je 0x40c21e
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esp + 0x5d8]
push eax
push str.open
push ebx
call esi
cmp eax, 0x20
jl 0x40c19e
je 0x40c19e
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp ebp, eax
jbe 0x40c0b9
call fcn.00432c1e
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
mov esi, ecx
mov dword [esp + 0x50], esi
cmp dword [esp + 0x30], eax
mov edi, eax
jbe 0x40c0d0
call fcn.00432c1e
cmp esi, ebx
je 0x40c0dc
lea ecx, [esp + 0x2c]
cmp esi, ecx
je 0x40c0e1
call fcn.00432c1e
cmp ebp, edi
je 0x40c232
mov esi, dword [esp + 0x50]
cmp esi, ebx
jne 0x40c0f6
call fcn.00432c1e
cmp ebp, dword [esi + 8]
jb 0x40c100
call fcn.00432c1e
lea edi, [ebp + 0x104]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp ebp, dword [esi + 8]
jb 0x40c117
call fcn.00432c1e
sub esp, 0x1c
mov esi, esp
mov eax, edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x38], esp
mov byte [esi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x40c132
sub eax, ecx
push eax
push edi
mov ecx, esi
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 0x1e
mov ecx, esp
mov dword [esp + 0x60], esp
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4527c8
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 0x1b
call fcn.004041e0
mov edx, dword [esp + 0x50]
cmp ebp, dword [edx + 8]
jb 0x40c18b
call fcn.00432c1e
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x50]
add ebp, 0x208
jmp 0x40c0c3
lea eax, [esp + 0x2c]
push eax
call fcn.00403840
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebx
lea ecx, [esp + 0x5d8]
push ecx
push str.open
push ebx
call esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x24
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4531e0
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x824], 0x1d
mov ecx, esp
mov dword [esp + 0x60], esp
push 7
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x453208
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x824], 0x1b
call fcn.004041e0
mov dword [esp + 0x24], ebx
jmp 0x40c232
lea edx, [esp + 0x5d8]
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 0x10
cmp dword [esp + 0x178], edi
jb 0x40c250
mov eax, dword [esp + 0x164]
push eax
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov esi, 0xf
mov dword [esp + 0x178], esi
mov dword [esp + 0x174], ebx
mov byte [esp + 0x164], bl
je 0x40c27b
push eax
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x40c28c
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x124], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
jb 0x40c2b1
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x108], edi
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
jb 0x40c2df
mov edx, dword [esp + 0xf4]
push edx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x140], edi
mov dword [esp + 0x108], esi
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
jb 0x40c30d
mov eax, dword [esp + 0x12c]
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0xb4], edi
mov dword [esp + 0x140], esi
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
jb 0x40c33b
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ec], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c378
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xec], edi
jb 0x40c391
mov ecx, dword [esp + 0xd8]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x15c], edi
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
jb 0x40c3bf
mov edx, dword [esp + 0x148]
push edx
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x24]
jmp 0x40c549
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x452ae4
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x824], 0x1f
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x452af8
call fcn.004020b0
mov byte [esp + 0x824], 0xc
call fcn.004041e0
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x40c414
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x124], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
jb 0x40c439
mov eax, dword [esp + 0x110]
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x108], esi
mov dword [esp + 0x124], ebp
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
jb 0x40c467
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x140], esi
mov dword [esp + 0x108], ebp
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
jb 0x40c495
mov edx, dword [esp + 0x12c]
push edx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0xb4], esi
mov dword [esp + 0x140], ebp
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
jb 0x40c4c3
mov eax, dword [esp + 0xa0]
push eax
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ec], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c500
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xec], esi
jb 0x40c519
mov ecx, dword [esp + 0xd8]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x15c], esi
mov byte [esp + 0xd8], bl
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebp
jb 0x40c547
mov edx, dword [esp + 0x148]
push edx
call fcn.00416c01
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x7e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c8]
xor ecx, esp
call fcn.004322f2
add esp, 0x7dc
ret 4