Function at 0x413de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47d336
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
mov eax, dword [0x4a8ae4]
xor eax, esp
push ebx
push ebp
push esi
mov dword [esp + 0x464], eax
push edi
mov ebp, ecx
mov edi, 1
mov dword [esp + 0x474], edi
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x474], 2
call fcn.00476002
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
call fcn.00476002
mov ecx, dword [eax + 4]
call fcn.00461e2e
push 0xa0
mov byte [esp + 0x478], 3
call fcn.004620a8
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x474], 4
je 0x413e7f
mov ecx, eax
call fcn.0042ae60
mov esi, eax
jmp 0x413e81
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x474], 3
nop
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x4a0]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], eax
push edx
mov word [ecx + 4], ax
call fcn.00401f80
mov ecx, esi
call fcn.0042bf90
test eax, eax
je 0x413f17
mov dword [esp + 0x18], 0x80004005
call ebx
cmp eax, 0x20
jne 0x413efa
cmp edi, 0xa
jge 0x413eee
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jle 0x413e90
jmp 0x4142c6
push 0xf5
mov ecx, ebp
call fcn.0040e720
test esi, esi
je 0x4142c6
mov ecx, esi
call fcn.0042acf0
push esi
call fcn.004620d3
add esp, 4
jmp 0x4142c6
call fcn.00476002
mov ecx, dword [eax + 4]
call fcn.00461e2e
mov ecx, esi
mov byte [esp + 0x474], 5
call fcn.0042b8d0
xor ebx, ebx
cmp eax, ebx
jne 0x413f44
mov ecx, esi
call fcn.0042ac10
test al, al
je 0x413f6c
mov ecx, esi
call fcn.0042afa0
cmp esi, ebx
je 0x413f5f
mov ecx, esi
call fcn.0042acf0
push esi
call fcn.004620d3
add esp, 4
mov dword [esp + 0x18], 0x80004005
jmp 0x4142b1
lea eax, [esp + 0x24]
push eax
push esi
mov ecx, ebp
call fcn.00411da0
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x4142b1
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 0xd70], ebx
jne 0x413ffd
cmp dword [esp + 0x24], ebx
jne 0x413ffd
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x4bc]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], bx
call fcn.00401f80
push esi
mov ecx, ebp
call fcn.0040f900
cmp esi, ebx
mov dword [esp + 0x18], eax
je 0x4142b1
mov ecx, esi
call fcn.0042ac00
test al, al
je 0x4142b1
mov ecx, esi
call fcn.0042afa0
mov ecx, esi
call fcn.0042acf0
push esi
call fcn.004620d3
add esp, 4
jmp 0x4142b1
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x260], bx
mov ecx, 0x81
lea edi, [esp + 0x262]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x58], bx
mov ecx, 0x81
lea edi, [esp + 0x5a]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x1c]
stosw word es:[edi], ax
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov word [esp + 0x54], ax
mov eax, dword [esp + 0x4b0]
mov dword [esp + 0x38], ebx
mov edx, dword [ecx + 0x1c]
mov esi, 8
cmp eax, esi
mov eax, dword [esp + 0x49c]
mov byte [esp + 0x474], 6
mov dword [esp + 0x38], edx
mov word [esp + 0x48], 0x10
mov dword [esp + 0x3c], 2
jae 0x4140a0
lea eax, [esp + 0x49c]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0044a5c9
mov eax, dword [esp + 0x49c]
add esp, 8
cmp eax, esi
mov eax, dword [esp + 0x480]
jae 0x4140c7
lea eax, [esp + 0x480]
push eax
lea ecx, [esp + 0x264]
push ecx
call fcn.0044a5c9
lea eax, [esp + 0x268]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x49c]
add esp, 8
lea edx, [esp + 0x58]
cmp eax, esi
mov eax, dword [esp + 0x480]
mov dword [esp + 0x44], edx
jae 0x414104
lea eax, [esp + 0x480]
push eax
lea ecx, [esp + 0x20]
call fcn.00406210
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x478], 7
call fcn.00406210
mov byte [esp + 0x474], 8
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
push 0x5c
mov bl, 9
push eax
mov byte [esp + 0x47c], bl
call fcn.0044a56f
mov edx, dword [esp + 0x24]
add esp, 8
test eax, eax
jne 0x414164
or ecx, 0xffffffff
jmp 0x41416a
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [edx - 0xc]
sub eax, ecx
dec eax
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
call fcn.00408280
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x478], 0xa
call fcn.00403cc0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x474], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4141b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, dword [esp + 0x24]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004082f0
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
push esi
call fcn.00401570
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.0040ec10
cmp eax, 1
jne 0x4141fa
mov ecx, dword [esp + 0x30]
push 0x118
call fcn.0040e720
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x414220
mov eax, dword [ebp + 0xd7c]
lea ecx, [ebp + 0xd74]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.0045c091
mov byte [esp + 0x474], 8
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41423f
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x474], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414265
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x474], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41428b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x474], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4142b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0x474], 3
call fcn.00476002
mov ecx, dword [eax + 4]
call fcn.00461e43
mov byte [esp + 0x474], 2
call fcn.00476002
mov ecx, dword [eax + 4]
call fcn.00461e43
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x474], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414301
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x494]
mov esi, 8
cmp eax, esi
jb 0x414321
mov eax, dword [esp + 0x480]
push eax
call fcn.004620d3
add esp, 4
xor eax, eax
mov dword [esp + 0x490], eax
mov word [esp + 0x480], ax
cmp dword [esp + 0x4b0], esi
mov dword [esp + 0x494], 7
jb 0x414356
mov ecx, dword [esp + 0x49c]
push ecx
call fcn.004620d3
add esp, 4
mov ecx, dword [esp + 0x46c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x460]
pop ebp
pop ebx
xor ecx, esp
call fcn.0044a318
add esp, 0x468
ret 0x38